# Flog Txt Version 1 # Analyzer Version: 3.2.1 # Analyzer Build Date: Jan 31 2020 07:36:36 # Log Creation Date: 05.02.2020 05:14:44.251 Process: id = "1" image_name = "happythree.exe.exe" filename = "c:\\users\\fd1hvy\\desktop\\happythree.exe.exe" page_root = "0x6c57000" os_pid = "0x13dc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x7d0" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001086c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x13e0 [0046.741] GetProcessHeap () returned 0x630000 [0046.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x641470 [0046.741] GetProcessHeap () returned 0x630000 [0046.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x636718 [0046.807] GetProcessHeap () returned 0x630000 [0046.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x641470 | out: hHeap=0x630000) returned 1 [0046.807] GetProcessHeap () returned 0x630000 [0046.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x636718 | out: hHeap=0x630000) returned 1 [0046.807] GetProcessHeap () returned 0x630000 [0046.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x20) returned 0x63b068 [0046.808] GetProcessHeap () returned 0x630000 [0046.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1000) returned 0x64df18 [0046.849] GetProcessHeap () returned 0x630000 [0046.849] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9b4) returned 0x64ef20 [0046.849] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x64df18, nSize=0x800 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\happythree.exe.exe")) returned 0x2a [0046.849] GetProcessHeap () returned 0x630000 [0046.849] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x641470 [0046.849] GetProcessHeap () returned 0x630000 [0046.849] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x636718 [0046.858] GetProcessHeap () returned 0x630000 [0046.858] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x641470 | out: hHeap=0x630000) returned 1 [0046.858] GetProcessHeap () returned 0x630000 [0046.858] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x636718 | out: hHeap=0x630000) returned 1 [0046.858] GetProcessHeap () returned 0x630000 [0046.858] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x641470 [0046.858] GetProcessHeap () returned 0x630000 [0046.858] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x636718 [0046.889] GetProcessHeap () returned 0x630000 [0046.889] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x641470 | out: hHeap=0x630000) returned 1 [0046.889] GetProcessHeap () returned 0x630000 [0046.889] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x636718 | out: hHeap=0x630000) returned 1 [0046.889] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0x4017b8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 18 [0046.889] GetProcessHeap () returned 0x630000 [0046.889] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x24) returned 0x644ae0 [0046.889] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0x4017b8, cbMultiByte=-1, lpWideCharStr=0x644ae0, cchWideChar=18 | out: lpWideCharStr=".happythreechoose") returned 18 [0046.889] GetProcessHeap () returned 0x630000 [0046.889] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x641470 [0046.889] GetProcessHeap () returned 0x630000 [0046.889] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x636718 [0046.947] GetProcessHeap () returned 0x630000 [0046.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x641470 | out: hHeap=0x630000) returned 1 [0046.947] GetProcessHeap () returned 0x630000 [0046.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x636718 | out: hHeap=0x630000) returned 1 [0046.947] lstrlenA (lpString="Windows,Microsoft,Microsoft Help,Windows App Certification Kit,Windows Defender,ESET,COMODO,Windows NT,Windows Kits,Windows Mail,Windows Media Player,Windows Multimedia Platform,Windows Phone Kits,Windows Phone Silverlight Kits,Windows Photo Viewer,Windows Portable Devices,Windows Sidebar,WindowsPowerShell,NVIDIA Corporation,Microsoft.NET,Internet Explorer,Kaspersky Lab,McAfee,Avira,spytech software,sysconfig,Avast,Dr.Web,Symantec,Symantec_Client_Security,system volume information,AVG,Microsoft Shared,Common Files,Outlook Express,Movie Maker,Chrome,Mozilla Firefox,Opera,YandexBrowser,ntldr,Wsus,ProgramData") returned 613 [0046.947] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x620000 [0046.947] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x0, Size=0xac) returned 0x6205a8 [0046.950] GetProcessHeap () returned 0x630000 [0046.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x641470 [0046.950] GetProcessHeap () returned 0x630000 [0046.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x636718 [0046.974] GetProcessHeap () returned 0x630000 [0046.974] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x641470 | out: hHeap=0x630000) returned 1 [0046.974] GetProcessHeap () returned 0x630000 [0046.974] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x636718 | out: hHeap=0x630000) returned 1 [0046.974] lstrlenA (lpString=".happythreechoose") returned 17 [0046.974] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x1ff0000 [0046.974] RtlAllocateHeap (HeapHandle=0x1ff0000, Flags=0x0, Size=0x4) returned 0x1ff05a8 [0046.975] GetProcessHeap () returned 0x630000 [0046.975] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1000) returned 0x64f8e0 [0046.975] GetEnvironmentVariableW (in: lpName="LOCALAPPDATA", lpBuffer=0x64f8e0, nSize=0x800 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local") returned 0x1d [0046.975] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Local" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Local\\") returned="" [0046.975] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0046.975] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Local\\", lpString2="HAPPYTHREE.EXE.exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Local\\HAPPYTHREE.EXE.exe") returned="C:\\Users\\FD1HVy\\AppData\\Local\\HAPPYTHREE.EXE.exe" [0046.975] lstrcmpiW (lpString1="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe", lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\HAPPYTHREE.EXE.exe") returned 1 [0046.977] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\HAPPYTHREE.EXE.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\happythree.exe.exe")) returned 0xffffffff [0046.977] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\happythree.exe.exe"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\HAPPYTHREE.EXE.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\happythree.exe.exe"), bFailIfExists=0) returned 1 [0047.253] _alloca_probe () returned 0x40962e [0047.253] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ef60 | out: phkResult=0x19ef60*=0x1d8) returned 0x0 [0047.253] RegQueryValueExW (in: hKey=0x1d8, lpValueName="BrowserUpdateCheck", lpReserved=0x0, lpType=0x0, lpData=0x19ef68, lpcbData=0x19ef64*=0x800 | out: lpType=0x0, lpData=0x19ef68*=0x0, lpcbData=0x19ef64*=0x800) returned 0x2 [0047.253] lstrcmpiW (lpString1="", lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\HAPPYTHREE.EXE.exe") returned -1 [0047.253] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x1, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x19ef60, lpdwDisposition=0x0 | out: phkResult=0x19ef60*=0x1fc, lpdwDisposition=0x0) returned 0x0 [0047.253] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Local\\HAPPYTHREE.EXE.exe") returned 48 [0047.253] RegSetValueExW (in: hKey=0x1fc, lpValueName="BrowserUpdateCheck", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Local\\HAPPYTHREE.EXE.exe", cbData=0x60 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Local\\HAPPYTHREE.EXE.exe") returned 0x0 [0047.254] RegCloseKey (hKey=0x1fc) returned 0x0 [0047.254] GetProcessHeap () returned 0x630000 [0047.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1000) returned 0x6508e8 [0047.254] GetEnvironmentVariableW (in: lpName="public", lpBuffer=0x6508e8, nSize=0x800 | out: lpBuffer="C:\\Users\\Public") returned 0xf [0047.254] GetProcessHeap () returned 0x630000 [0047.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x98) returned 0x641a50 [0047.254] GetProcessHeap () returned 0x630000 [0047.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x40) returned 0x642280 [0047.254] GetProcessHeap () returned 0x630000 [0047.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x42) returned 0x642868 [0047.254] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0x642868, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0047.254] GetProcessHeap () returned 0x630000 [0047.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x82) returned 0x63ea90 [0047.254] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0x642868, cbMultiByte=-1, lpWideCharStr=0x63ea90, cchWideChar=65 | out: lpWideCharStr="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 65 [0047.254] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0x4017e8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0047.254] GetProcessHeap () returned 0x630000 [0047.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2a) returned 0x652278 [0047.254] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0x4017e8, cbMultiByte=-1, lpWideCharStr=0x652278, cchWideChar=21 | out: lpWideCharStr="Decryption INFO.html") returned 21 [0047.254] lstrcpyW (in: lpString1=0x641a50, lpString2="Decryption INFO.html" | out: lpString1="Decryption INFO.html") returned="Decryption INFO.html" [0047.254] GetProcessHeap () returned 0x630000 [0047.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1000) returned 0x652900 [0047.254] lstrcpyW (in: lpString1=0x652900, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0047.254] PathAddBackslashW (in: pszPath="C:\\Users\\Public" | out: pszPath="C:\\Users\\Public\\") returned="" [0047.254] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF" | out: lpString1="C:\\Users\\Public\\5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned="C:\\Users\\Public\\5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF" [0047.254] CreateFileW (lpFileName="C:\\Users\\Public\\5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF" (normalized: "c:\\users\\public\\5d64cc94fbaa1e0f7d767179eacf76de6051563629f05d7c3b1fabe9ef4413ff"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1fc [0047.257] GetLastError () returned 0x0 [0047.257] GetProcessHeap () returned 0x630000 [0047.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x400) returned 0x64ca68 [0047.257] lstrlenA (lpString="rsa_genkey") returned 10 [0047.257] CryptAcquireContextW (in: phProv=0x19f848, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x19f848*=0x64ce70) returned 1 [0048.043] CryptGenRandom (in: hProv=0x64ce70, dwLen=0x80, pbBuffer=0x19f860 | out: pbBuffer=0x19f860) returned 1 [0048.043] CryptReleaseContext (hProv=0x64ce70, dwFlags=0x0) returned 1 [0048.043] GetProcessHeap () returned 0x630000 [0048.043] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x645410 [0048.043] GetProcessHeap () returned 0x630000 [0048.043] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x40) returned 0x642310 [0048.043] GetProcessHeap () returned 0x630000 [0048.043] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x40) returned 0x642358 [0048.043] GetProcessHeap () returned 0x630000 [0048.043] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x40) returned 0x642088 [0048.043] GetProcessHeap () returned 0x630000 [0048.043] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x40) returned 0x642238 [0048.043] GetProcessHeap () returned 0x630000 [0048.044] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x63e3c8 [0048.044] GetProcessHeap () returned 0x630000 [0048.044] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x642238 | out: hHeap=0x630000) returned 1 [0048.044] GetProcessHeap () returned 0x630000 [0048.044] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x641470 [0048.044] GetProcessHeap () returned 0x630000 [0048.044] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x64ce70 [0048.044] GetProcessHeap () returned 0x630000 [0048.044] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x645380 [0048.044] GetProcessHeap () returned 0x630000 [0048.044] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x640fb0 [0048.044] GetProcessHeap () returned 0x630000 [0048.044] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.044] GetProcessHeap () returned 0x630000 [0048.044] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x640c90 [0048.044] GetProcessHeap () returned 0x630000 [0048.044] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x40) returned 0x642238 [0048.044] GetProcessHeap () returned 0x630000 [0048.044] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8c) returned 0x641530 [0048.044] GetProcessHeap () returned 0x630000 [0048.044] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.044] GetProcessHeap () returned 0x630000 [0048.044] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0048.044] GetProcessHeap () returned 0x630000 [0048.044] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x63e830 [0048.044] GetProcessHeap () returned 0x630000 [0048.044] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x642238 | out: hHeap=0x630000) returned 1 [0048.044] GetProcessHeap () returned 0x630000 [0048.044] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x64c178 [0048.044] GetProcessHeap () returned 0x630000 [0048.044] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0048.044] GetProcessHeap () returned 0x630000 [0048.044] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645450 [0048.044] GetProcessHeap () returned 0x630000 [0048.044] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0048.044] GetProcessHeap () returned 0x630000 [0048.044] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.044] GetProcessHeap () returned 0x630000 [0048.044] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645450 | out: hHeap=0x630000) returned 1 [0048.044] GetProcessHeap () returned 0x630000 [0048.044] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x48) returned 0x654060 [0048.045] GetProcessHeap () returned 0x630000 [0048.045] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0048.045] GetProcessHeap () returned 0x630000 [0048.045] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x641ca8 [0048.045] GetProcessHeap () returned 0x630000 [0048.045] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x654060 | out: hHeap=0x630000) returned 1 [0048.045] GetProcessHeap () returned 0x630000 [0048.045] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.045] GetProcessHeap () returned 0x630000 [0048.045] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.045] GetProcessHeap () returned 0x630000 [0048.045] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.045] GetProcessHeap () returned 0x630000 [0048.045] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.045] GetProcessHeap () returned 0x630000 [0048.045] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.045] GetProcessHeap () returned 0x630000 [0048.045] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.045] GetProcessHeap () returned 0x630000 [0048.045] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645450 [0048.045] GetProcessHeap () returned 0x630000 [0048.045] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645450 | out: hHeap=0x630000) returned 1 [0048.045] GetProcessHeap () returned 0x630000 [0048.045] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.045] GetProcessHeap () returned 0x630000 [0048.045] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.045] GetProcessHeap () returned 0x630000 [0048.045] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.045] GetProcessHeap () returned 0x630000 [0048.045] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.045] GetProcessHeap () returned 0x630000 [0048.045] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.045] GetProcessHeap () returned 0x630000 [0048.045] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.045] GetProcessHeap () returned 0x630000 [0048.045] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.045] GetProcessHeap () returned 0x630000 [0048.045] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.046] GetProcessHeap () returned 0x630000 [0048.046] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.046] GetProcessHeap () returned 0x630000 [0048.046] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.046] GetProcessHeap () returned 0x630000 [0048.046] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.046] GetProcessHeap () returned 0x630000 [0048.046] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.046] GetProcessHeap () returned 0x630000 [0048.046] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.046] GetProcessHeap () returned 0x630000 [0048.046] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.046] GetProcessHeap () returned 0x630000 [0048.046] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645450 [0048.046] GetProcessHeap () returned 0x630000 [0048.046] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645450 | out: hHeap=0x630000) returned 1 [0048.046] GetProcessHeap () returned 0x630000 [0048.046] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.046] GetProcessHeap () returned 0x630000 [0048.046] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.046] GetProcessHeap () returned 0x630000 [0048.046] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.046] GetProcessHeap () returned 0x630000 [0048.046] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.046] GetProcessHeap () returned 0x630000 [0048.046] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645420 [0048.046] GetProcessHeap () returned 0x630000 [0048.046] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645420 | out: hHeap=0x630000) returned 1 [0048.046] GetProcessHeap () returned 0x630000 [0048.046] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.046] GetProcessHeap () returned 0x630000 [0048.046] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.046] GetProcessHeap () returned 0x630000 [0048.046] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.046] GetProcessHeap () returned 0x630000 [0048.046] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.046] GetProcessHeap () returned 0x630000 [0048.047] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.047] GetProcessHeap () returned 0x630000 [0048.047] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.047] GetProcessHeap () returned 0x630000 [0048.047] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.047] GetProcessHeap () returned 0x630000 [0048.047] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.047] GetProcessHeap () returned 0x630000 [0048.047] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0048.047] GetProcessHeap () returned 0x630000 [0048.047] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c178 | out: hHeap=0x630000) returned 1 [0048.047] GetProcessHeap () returned 0x630000 [0048.047] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x641530 | out: hHeap=0x630000) returned 1 [0048.047] GetProcessHeap () returned 0x630000 [0048.047] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x641ca8 | out: hHeap=0x630000) returned 1 [0048.047] GetProcessHeap () returned 0x630000 [0048.047] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0048.047] GetProcessHeap () returned 0x630000 [0048.047] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653930 [0048.047] GetProcessHeap () returned 0x630000 [0048.047] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653a20 [0048.047] GetProcessHeap () returned 0x630000 [0048.047] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653e80 [0048.047] GetProcessHeap () returned 0x630000 [0048.047] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x6540b0 [0048.047] GetProcessHeap () returned 0x630000 [0048.047] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653c00 [0048.047] GetProcessHeap () returned 0x630000 [0048.047] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653980 [0048.047] GetProcessHeap () returned 0x630000 [0048.047] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653a70 [0048.047] GetProcessHeap () returned 0x630000 [0048.047] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653c50 [0048.047] GetProcessHeap () returned 0x630000 [0048.047] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653ca0 [0048.047] GetProcessHeap () returned 0x630000 [0048.047] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x6539d0 [0048.047] GetProcessHeap () returned 0x630000 [0048.047] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653ac0 [0048.047] GetProcessHeap () returned 0x630000 [0048.047] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653f70 [0048.048] GetProcessHeap () returned 0x630000 [0048.048] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653d40 [0048.048] GetProcessHeap () returned 0x630000 [0048.048] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653d90 [0048.048] GetProcessHeap () returned 0x630000 [0048.048] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653fc0 [0048.048] GetProcessHeap () returned 0x630000 [0048.048] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653de0 [0048.048] GetProcessHeap () returned 0x630000 [0048.048] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653930 | out: hHeap=0x630000) returned 1 [0048.048] GetProcessHeap () returned 0x630000 [0048.048] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653a20 | out: hHeap=0x630000) returned 1 [0048.048] GetProcessHeap () returned 0x630000 [0048.048] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653e80 | out: hHeap=0x630000) returned 1 [0048.048] GetProcessHeap () returned 0x630000 [0048.048] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6540b0 | out: hHeap=0x630000) returned 1 [0048.048] GetProcessHeap () returned 0x630000 [0048.048] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653c00 | out: hHeap=0x630000) returned 1 [0048.048] GetProcessHeap () returned 0x630000 [0048.048] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653980 | out: hHeap=0x630000) returned 1 [0048.048] GetProcessHeap () returned 0x630000 [0048.048] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653a70 | out: hHeap=0x630000) returned 1 [0048.048] GetProcessHeap () returned 0x630000 [0048.049] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653c50 | out: hHeap=0x630000) returned 1 [0048.049] GetProcessHeap () returned 0x630000 [0048.049] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653ca0 | out: hHeap=0x630000) returned 1 [0048.049] GetProcessHeap () returned 0x630000 [0048.049] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6539d0 | out: hHeap=0x630000) returned 1 [0048.049] GetProcessHeap () returned 0x630000 [0048.049] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653ac0 | out: hHeap=0x630000) returned 1 [0048.049] GetProcessHeap () returned 0x630000 [0048.049] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653f70 | out: hHeap=0x630000) returned 1 [0048.049] GetProcessHeap () returned 0x630000 [0048.049] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653d40 | out: hHeap=0x630000) returned 1 [0048.049] GetProcessHeap () returned 0x630000 [0048.049] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653d90 | out: hHeap=0x630000) returned 1 [0048.049] GetProcessHeap () returned 0x630000 [0048.049] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653fc0 | out: hHeap=0x630000) returned 1 [0048.049] GetProcessHeap () returned 0x630000 [0048.049] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653de0 | out: hHeap=0x630000) returned 1 [0048.049] GetProcessHeap () returned 0x630000 [0048.049] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x641470 | out: hHeap=0x630000) returned 1 [0048.049] GetProcessHeap () returned 0x630000 [0048.049] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce70 | out: hHeap=0x630000) returned 1 [0048.049] GetProcessHeap () returned 0x630000 [0048.049] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x642358 | out: hHeap=0x630000) returned 1 [0048.049] GetProcessHeap () returned 0x630000 [0048.049] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x642088 | out: hHeap=0x630000) returned 1 [0048.049] GetProcessHeap () returned 0x630000 [0048.049] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e3c8 | out: hHeap=0x630000) returned 1 [0048.049] GetProcessHeap () returned 0x630000 [0048.049] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0048.049] GetProcessHeap () returned 0x630000 [0048.049] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x40) returned 0x6424c0 [0048.049] GetProcessHeap () returned 0x630000 [0048.049] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x40) returned 0x641e90 [0048.049] GetProcessHeap () returned 0x630000 [0048.049] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x40) returned 0x642358 [0048.049] GetProcessHeap () returned 0x630000 [0048.049] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653f20 [0048.049] GetProcessHeap () returned 0x630000 [0048.049] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x642358 | out: hHeap=0x630000) returned 1 [0048.049] GetProcessHeap () returned 0x630000 [0048.049] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653ac0 [0048.050] GetProcessHeap () returned 0x630000 [0048.050] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x64ce70 [0048.050] GetProcessHeap () returned 0x630000 [0048.050] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x645380 [0048.050] GetProcessHeap () returned 0x630000 [0048.050] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x640fb0 [0048.050] GetProcessHeap () returned 0x630000 [0048.050] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.050] GetProcessHeap () returned 0x630000 [0048.050] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x640c90 [0048.050] GetProcessHeap () returned 0x630000 [0048.050] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x40) returned 0x642508 [0048.050] GetProcessHeap () returned 0x630000 [0048.050] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8c) returned 0x641530 [0048.050] GetProcessHeap () returned 0x630000 [0048.050] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.050] GetProcessHeap () returned 0x630000 [0048.050] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9d8 [0048.050] GetProcessHeap () returned 0x630000 [0048.050] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653ed0 [0048.050] GetProcessHeap () returned 0x630000 [0048.050] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x642508 | out: hHeap=0x630000) returned 1 [0048.050] GetProcessHeap () returned 0x630000 [0048.050] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x64c178 [0048.050] GetProcessHeap () returned 0x630000 [0048.050] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653ed0 | out: hHeap=0x630000) returned 1 [0048.050] GetProcessHeap () returned 0x630000 [0048.050] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.050] GetProcessHeap () returned 0x630000 [0048.050] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0048.050] GetProcessHeap () returned 0x630000 [0048.050] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.050] GetProcessHeap () returned 0x630000 [0048.050] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.050] GetProcessHeap () returned 0x630000 [0048.050] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x48) returned 0x653cf0 [0048.050] GetProcessHeap () returned 0x630000 [0048.050] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0048.050] GetProcessHeap () returned 0x630000 [0048.050] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x641ca8 [0048.050] GetProcessHeap () returned 0x630000 [0048.051] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653cf0 | out: hHeap=0x630000) returned 1 [0048.051] GetProcessHeap () returned 0x630000 [0048.051] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.051] GetProcessHeap () returned 0x630000 [0048.051] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.051] GetProcessHeap () returned 0x630000 [0048.051] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645450 [0048.051] GetProcessHeap () returned 0x630000 [0048.051] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645450 | out: hHeap=0x630000) returned 1 [0048.051] GetProcessHeap () returned 0x630000 [0048.051] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645450 [0048.051] GetProcessHeap () returned 0x630000 [0048.051] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645450 | out: hHeap=0x630000) returned 1 [0048.051] GetProcessHeap () returned 0x630000 [0048.051] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.051] GetProcessHeap () returned 0x630000 [0048.051] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.051] GetProcessHeap () returned 0x630000 [0048.051] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.051] GetProcessHeap () returned 0x630000 [0048.051] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.051] GetProcessHeap () returned 0x630000 [0048.051] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.051] GetProcessHeap () returned 0x630000 [0048.051] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.051] GetProcessHeap () returned 0x630000 [0048.051] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645420 [0048.051] GetProcessHeap () returned 0x630000 [0048.051] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645420 | out: hHeap=0x630000) returned 1 [0048.051] GetProcessHeap () returned 0x630000 [0048.051] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.051] GetProcessHeap () returned 0x630000 [0048.051] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.051] GetProcessHeap () returned 0x630000 [0048.051] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.051] GetProcessHeap () returned 0x630000 [0048.051] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.051] GetProcessHeap () returned 0x630000 [0048.051] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.052] GetProcessHeap () returned 0x630000 [0048.052] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.052] GetProcessHeap () returned 0x630000 [0048.052] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.052] GetProcessHeap () returned 0x630000 [0048.052] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.052] GetProcessHeap () returned 0x630000 [0048.052] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645420 [0048.052] GetProcessHeap () returned 0x630000 [0048.052] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645420 | out: hHeap=0x630000) returned 1 [0048.052] GetProcessHeap () returned 0x630000 [0048.052] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.052] GetProcessHeap () returned 0x630000 [0048.052] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.052] GetProcessHeap () returned 0x630000 [0048.052] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.052] GetProcessHeap () returned 0x630000 [0048.052] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.052] GetProcessHeap () returned 0x630000 [0048.052] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.052] GetProcessHeap () returned 0x630000 [0048.052] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.053] GetProcessHeap () returned 0x630000 [0048.053] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.053] GetProcessHeap () returned 0x630000 [0048.053] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.053] GetProcessHeap () returned 0x630000 [0048.053] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.053] GetProcessHeap () returned 0x630000 [0048.053] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.053] GetProcessHeap () returned 0x630000 [0048.053] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.053] GetProcessHeap () returned 0x630000 [0048.053] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.053] GetProcessHeap () returned 0x630000 [0048.053] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645420 [0048.053] GetProcessHeap () returned 0x630000 [0048.053] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645420 | out: hHeap=0x630000) returned 1 [0048.053] GetProcessHeap () returned 0x630000 [0048.053] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.053] GetProcessHeap () returned 0x630000 [0048.053] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.053] GetProcessHeap () returned 0x630000 [0048.053] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0048.053] GetProcessHeap () returned 0x630000 [0048.053] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c178 | out: hHeap=0x630000) returned 1 [0048.053] GetProcessHeap () returned 0x630000 [0048.053] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x641530 | out: hHeap=0x630000) returned 1 [0048.053] GetProcessHeap () returned 0x630000 [0048.053] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x641ca8 | out: hHeap=0x630000) returned 1 [0048.053] GetProcessHeap () returned 0x630000 [0048.053] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9d8 | out: hHeap=0x630000) returned 1 [0048.053] GetProcessHeap () returned 0x630000 [0048.053] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x6540b0 [0048.053] GetProcessHeap () returned 0x630000 [0048.053] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653b10 [0048.053] GetProcessHeap () returned 0x630000 [0048.053] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653930 [0048.053] GetProcessHeap () returned 0x630000 [0048.053] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653f70 [0048.053] GetProcessHeap () returned 0x630000 [0048.053] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653980 [0048.054] GetProcessHeap () returned 0x630000 [0048.054] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x6539d0 [0048.054] GetProcessHeap () returned 0x630000 [0048.054] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x654010 [0048.054] GetProcessHeap () returned 0x630000 [0048.054] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653c50 [0048.054] GetProcessHeap () returned 0x630000 [0048.054] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653d40 [0048.054] GetProcessHeap () returned 0x630000 [0048.054] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653ca0 [0048.054] GetProcessHeap () returned 0x630000 [0048.054] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653a20 [0048.054] GetProcessHeap () returned 0x630000 [0048.054] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653b60 [0048.054] GetProcessHeap () returned 0x630000 [0048.054] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653e80 [0048.054] GetProcessHeap () returned 0x630000 [0048.054] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653cf0 [0048.054] GetProcessHeap () returned 0x630000 [0048.054] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653a70 [0048.054] GetProcessHeap () returned 0x630000 [0048.054] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653c00 [0048.055] GetProcessHeap () returned 0x630000 [0048.055] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6540b0 | out: hHeap=0x630000) returned 1 [0048.055] GetProcessHeap () returned 0x630000 [0048.055] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653b10 | out: hHeap=0x630000) returned 1 [0048.055] GetProcessHeap () returned 0x630000 [0048.055] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653930 | out: hHeap=0x630000) returned 1 [0048.055] GetProcessHeap () returned 0x630000 [0048.055] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653f70 | out: hHeap=0x630000) returned 1 [0048.055] GetProcessHeap () returned 0x630000 [0048.055] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653980 | out: hHeap=0x630000) returned 1 [0048.055] GetProcessHeap () returned 0x630000 [0048.055] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6539d0 | out: hHeap=0x630000) returned 1 [0048.055] GetProcessHeap () returned 0x630000 [0048.055] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x654010 | out: hHeap=0x630000) returned 1 [0048.055] GetProcessHeap () returned 0x630000 [0048.055] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653c50 | out: hHeap=0x630000) returned 1 [0048.055] GetProcessHeap () returned 0x630000 [0048.055] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653d40 | out: hHeap=0x630000) returned 1 [0048.055] GetProcessHeap () returned 0x630000 [0048.055] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653ca0 | out: hHeap=0x630000) returned 1 [0048.055] GetProcessHeap () returned 0x630000 [0048.055] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653a20 | out: hHeap=0x630000) returned 1 [0048.055] GetProcessHeap () returned 0x630000 [0048.055] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653b60 | out: hHeap=0x630000) returned 1 [0048.055] GetProcessHeap () returned 0x630000 [0048.055] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653e80 | out: hHeap=0x630000) returned 1 [0048.055] GetProcessHeap () returned 0x630000 [0048.055] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653cf0 | out: hHeap=0x630000) returned 1 [0048.055] GetProcessHeap () returned 0x630000 [0048.055] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653a70 | out: hHeap=0x630000) returned 1 [0048.055] GetProcessHeap () returned 0x630000 [0048.055] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653c00 | out: hHeap=0x630000) returned 1 [0048.055] GetProcessHeap () returned 0x630000 [0048.055] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653ac0 | out: hHeap=0x630000) returned 1 [0048.055] GetProcessHeap () returned 0x630000 [0048.055] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce70 | out: hHeap=0x630000) returned 1 [0048.055] GetProcessHeap () returned 0x630000 [0048.055] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6424c0 | out: hHeap=0x630000) returned 1 [0048.055] GetProcessHeap () returned 0x630000 [0048.055] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x641e90 | out: hHeap=0x630000) returned 1 [0048.055] GetProcessHeap () returned 0x630000 [0048.055] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653f20 | out: hHeap=0x630000) returned 1 [0048.055] GetProcessHeap () returned 0x630000 [0048.056] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0048.056] GetProcessHeap () returned 0x630000 [0048.056] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x40) returned 0x642550 [0048.056] GetProcessHeap () returned 0x630000 [0048.056] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x40) returned 0x642238 [0048.056] GetProcessHeap () returned 0x630000 [0048.056] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x40) returned 0x642358 [0048.056] GetProcessHeap () returned 0x630000 [0048.056] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653c00 [0048.056] GetProcessHeap () returned 0x630000 [0048.056] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x642358 | out: hHeap=0x630000) returned 1 [0048.056] GetProcessHeap () returned 0x630000 [0048.056] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653ac0 [0048.056] GetProcessHeap () returned 0x630000 [0048.056] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x64ce70 [0048.056] GetProcessHeap () returned 0x630000 [0048.056] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x645380 [0048.056] GetProcessHeap () returned 0x630000 [0048.056] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x640fb0 [0048.056] GetProcessHeap () returned 0x630000 [0048.056] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.056] GetProcessHeap () returned 0x630000 [0048.056] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x640c90 [0048.056] GetProcessHeap () returned 0x630000 [0048.056] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x40) returned 0x641f68 [0048.056] GetProcessHeap () returned 0x630000 [0048.056] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8c) returned 0x641530 [0048.056] GetProcessHeap () returned 0x630000 [0048.056] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.056] GetProcessHeap () returned 0x630000 [0048.056] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca50 [0048.056] GetProcessHeap () returned 0x630000 [0048.056] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653d40 [0048.056] GetProcessHeap () returned 0x630000 [0048.056] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x641f68 | out: hHeap=0x630000) returned 1 [0048.056] GetProcessHeap () returned 0x630000 [0048.056] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x64c178 [0048.056] GetProcessHeap () returned 0x630000 [0048.056] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653d40 | out: hHeap=0x630000) returned 1 [0048.056] GetProcessHeap () returned 0x630000 [0048.057] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.057] GetProcessHeap () returned 0x630000 [0048.057] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9a8 [0048.057] GetProcessHeap () returned 0x630000 [0048.057] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.057] GetProcessHeap () returned 0x630000 [0048.057] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.057] GetProcessHeap () returned 0x630000 [0048.057] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x48) returned 0x6539d0 [0048.057] GetProcessHeap () returned 0x630000 [0048.057] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9a8 | out: hHeap=0x630000) returned 1 [0048.057] GetProcessHeap () returned 0x630000 [0048.057] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x641ca8 [0048.057] GetProcessHeap () returned 0x630000 [0048.057] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6539d0 | out: hHeap=0x630000) returned 1 [0048.057] GetProcessHeap () returned 0x630000 [0048.057] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.057] GetProcessHeap () returned 0x630000 [0048.057] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.057] GetProcessHeap () returned 0x630000 [0048.057] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645420 [0048.057] GetProcessHeap () returned 0x630000 [0048.057] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645420 | out: hHeap=0x630000) returned 1 [0048.057] GetProcessHeap () returned 0x630000 [0048.057] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.057] GetProcessHeap () returned 0x630000 [0048.057] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.057] GetProcessHeap () returned 0x630000 [0048.057] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.057] GetProcessHeap () returned 0x630000 [0048.057] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.057] GetProcessHeap () returned 0x630000 [0048.057] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.057] GetProcessHeap () returned 0x630000 [0048.057] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.057] GetProcessHeap () returned 0x630000 [0048.057] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645420 [0048.057] GetProcessHeap () returned 0x630000 [0048.057] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645420 | out: hHeap=0x630000) returned 1 [0048.058] GetProcessHeap () returned 0x630000 [0048.058] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.058] GetProcessHeap () returned 0x630000 [0048.058] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.058] GetProcessHeap () returned 0x630000 [0048.058] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.058] GetProcessHeap () returned 0x630000 [0048.058] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.058] GetProcessHeap () returned 0x630000 [0048.058] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.058] GetProcessHeap () returned 0x630000 [0048.058] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.058] GetProcessHeap () returned 0x630000 [0048.058] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.058] GetProcessHeap () returned 0x630000 [0048.058] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.058] GetProcessHeap () returned 0x630000 [0048.058] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.058] GetProcessHeap () returned 0x630000 [0048.058] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.058] GetProcessHeap () returned 0x630000 [0048.058] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.058] GetProcessHeap () returned 0x630000 [0048.058] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.058] GetProcessHeap () returned 0x630000 [0048.058] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.058] GetProcessHeap () returned 0x630000 [0048.058] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.058] GetProcessHeap () returned 0x630000 [0048.058] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.058] GetProcessHeap () returned 0x630000 [0048.058] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.058] GetProcessHeap () returned 0x630000 [0048.058] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645450 [0048.058] GetProcessHeap () returned 0x630000 [0048.058] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645450 | out: hHeap=0x630000) returned 1 [0048.058] GetProcessHeap () returned 0x630000 [0048.059] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.059] GetProcessHeap () returned 0x630000 [0048.059] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.059] GetProcessHeap () returned 0x630000 [0048.059] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645420 [0048.059] GetProcessHeap () returned 0x630000 [0048.059] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645420 | out: hHeap=0x630000) returned 1 [0048.059] GetProcessHeap () returned 0x630000 [0048.059] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.059] GetProcessHeap () returned 0x630000 [0048.059] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.059] GetProcessHeap () returned 0x630000 [0048.059] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.059] GetProcessHeap () returned 0x630000 [0048.059] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.059] GetProcessHeap () returned 0x630000 [0048.059] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645450 [0048.059] GetProcessHeap () returned 0x630000 [0048.059] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645450 | out: hHeap=0x630000) returned 1 [0048.059] GetProcessHeap () returned 0x630000 [0048.059] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0048.059] GetProcessHeap () returned 0x630000 [0048.059] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c178 | out: hHeap=0x630000) returned 1 [0048.059] GetProcessHeap () returned 0x630000 [0048.059] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x641530 | out: hHeap=0x630000) returned 1 [0048.059] GetProcessHeap () returned 0x630000 [0048.059] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x641ca8 | out: hHeap=0x630000) returned 1 [0048.059] GetProcessHeap () returned 0x630000 [0048.059] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca50 | out: hHeap=0x630000) returned 1 [0048.059] GetProcessHeap () returned 0x630000 [0048.059] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653e80 [0048.059] GetProcessHeap () returned 0x630000 [0048.059] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653c50 [0048.059] GetProcessHeap () returned 0x630000 [0048.059] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x654060 [0048.059] GetProcessHeap () returned 0x630000 [0048.059] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653cf0 [0048.059] GetProcessHeap () returned 0x630000 [0048.059] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653b60 [0048.059] GetProcessHeap () returned 0x630000 [0048.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653ed0 [0048.060] GetProcessHeap () returned 0x630000 [0048.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653b10 [0048.060] GetProcessHeap () returned 0x630000 [0048.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653980 [0048.060] GetProcessHeap () returned 0x630000 [0048.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653de0 [0048.060] GetProcessHeap () returned 0x630000 [0048.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653ca0 [0048.060] GetProcessHeap () returned 0x630000 [0048.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653a20 [0048.060] GetProcessHeap () returned 0x630000 [0048.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653f20 [0048.060] GetProcessHeap () returned 0x630000 [0048.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x6539d0 [0048.060] GetProcessHeap () returned 0x630000 [0048.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653d40 [0048.060] GetProcessHeap () returned 0x630000 [0048.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653e30 [0048.060] GetProcessHeap () returned 0x630000 [0048.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653bb0 [0048.060] GetProcessHeap () returned 0x630000 [0048.060] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653e80 | out: hHeap=0x630000) returned 1 [0048.061] GetProcessHeap () returned 0x630000 [0048.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653c50 | out: hHeap=0x630000) returned 1 [0048.061] GetProcessHeap () returned 0x630000 [0048.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x654060 | out: hHeap=0x630000) returned 1 [0048.061] GetProcessHeap () returned 0x630000 [0048.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653cf0 | out: hHeap=0x630000) returned 1 [0048.061] GetProcessHeap () returned 0x630000 [0048.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653b60 | out: hHeap=0x630000) returned 1 [0048.061] GetProcessHeap () returned 0x630000 [0048.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653ed0 | out: hHeap=0x630000) returned 1 [0048.061] GetProcessHeap () returned 0x630000 [0048.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653b10 | out: hHeap=0x630000) returned 1 [0048.061] GetProcessHeap () returned 0x630000 [0048.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653980 | out: hHeap=0x630000) returned 1 [0048.061] GetProcessHeap () returned 0x630000 [0048.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653de0 | out: hHeap=0x630000) returned 1 [0048.061] GetProcessHeap () returned 0x630000 [0048.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653ca0 | out: hHeap=0x630000) returned 1 [0048.061] GetProcessHeap () returned 0x630000 [0048.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653a20 | out: hHeap=0x630000) returned 1 [0048.061] GetProcessHeap () returned 0x630000 [0048.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653f20 | out: hHeap=0x630000) returned 1 [0048.061] GetProcessHeap () returned 0x630000 [0048.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6539d0 | out: hHeap=0x630000) returned 1 [0048.061] GetProcessHeap () returned 0x630000 [0048.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653d40 | out: hHeap=0x630000) returned 1 [0048.061] GetProcessHeap () returned 0x630000 [0048.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653e30 | out: hHeap=0x630000) returned 1 [0048.061] GetProcessHeap () returned 0x630000 [0048.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653bb0 | out: hHeap=0x630000) returned 1 [0048.061] GetProcessHeap () returned 0x630000 [0048.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653ac0 | out: hHeap=0x630000) returned 1 [0048.061] GetProcessHeap () returned 0x630000 [0048.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce70 | out: hHeap=0x630000) returned 1 [0048.061] GetProcessHeap () returned 0x630000 [0048.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x642550 | out: hHeap=0x630000) returned 1 [0048.061] GetProcessHeap () returned 0x630000 [0048.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x642238 | out: hHeap=0x630000) returned 1 [0048.061] GetProcessHeap () returned 0x630000 [0048.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653c00 | out: hHeap=0x630000) returned 1 [0048.061] GetProcessHeap () returned 0x630000 [0048.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0048.062] GetProcessHeap () returned 0x630000 [0048.062] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x40) returned 0x642358 [0048.062] GetProcessHeap () returned 0x630000 [0048.062] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x40) returned 0x6424c0 [0048.062] GetProcessHeap () returned 0x630000 [0048.062] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x40) returned 0x641f20 [0048.062] GetProcessHeap () returned 0x630000 [0048.062] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653c00 [0048.062] GetProcessHeap () returned 0x630000 [0048.062] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x641f20 | out: hHeap=0x630000) returned 1 [0048.062] GetProcessHeap () returned 0x630000 [0048.062] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653a70 [0048.062] GetProcessHeap () returned 0x630000 [0048.062] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x64ce70 [0048.062] GetProcessHeap () returned 0x630000 [0048.062] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x645450 [0048.062] GetProcessHeap () returned 0x630000 [0048.062] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x640fb0 [0048.062] GetProcessHeap () returned 0x630000 [0048.062] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645450 | out: hHeap=0x630000) returned 1 [0048.062] GetProcessHeap () returned 0x630000 [0048.062] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x640c90 [0048.062] GetProcessHeap () returned 0x630000 [0048.062] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x40) returned 0x642508 [0048.062] GetProcessHeap () returned 0x630000 [0048.062] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8c) returned 0x654690 [0048.062] GetProcessHeap () returned 0x630000 [0048.062] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645450 [0048.062] GetProcessHeap () returned 0x630000 [0048.062] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9a8 [0048.062] GetProcessHeap () returned 0x630000 [0048.062] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653b60 [0048.062] GetProcessHeap () returned 0x630000 [0048.062] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x642508 | out: hHeap=0x630000) returned 1 [0048.062] GetProcessHeap () returned 0x630000 [0048.062] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x641530 [0048.062] GetProcessHeap () returned 0x630000 [0048.062] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653b60 | out: hHeap=0x630000) returned 1 [0048.063] GetProcessHeap () returned 0x630000 [0048.063] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.063] GetProcessHeap () returned 0x630000 [0048.063] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0048.063] GetProcessHeap () returned 0x630000 [0048.063] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645450 | out: hHeap=0x630000) returned 1 [0048.063] GetProcessHeap () returned 0x630000 [0048.063] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.063] GetProcessHeap () returned 0x630000 [0048.063] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x48) returned 0x653fc0 [0048.063] GetProcessHeap () returned 0x630000 [0048.063] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0048.063] GetProcessHeap () returned 0x630000 [0048.063] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x64c178 [0048.063] GetProcessHeap () returned 0x630000 [0048.063] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653fc0 | out: hHeap=0x630000) returned 1 [0048.063] GetProcessHeap () returned 0x630000 [0048.063] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.063] GetProcessHeap () returned 0x630000 [0048.063] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.063] GetProcessHeap () returned 0x630000 [0048.063] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.063] GetProcessHeap () returned 0x630000 [0048.063] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.063] GetProcessHeap () returned 0x630000 [0048.063] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.063] GetProcessHeap () returned 0x630000 [0048.063] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.063] GetProcessHeap () returned 0x630000 [0048.063] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.063] GetProcessHeap () returned 0x630000 [0048.063] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.063] GetProcessHeap () returned 0x630000 [0048.063] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.063] GetProcessHeap () returned 0x630000 [0048.063] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.063] GetProcessHeap () returned 0x630000 [0048.063] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.063] GetProcessHeap () returned 0x630000 [0048.063] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.064] GetProcessHeap () returned 0x630000 [0048.064] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.064] GetProcessHeap () returned 0x630000 [0048.064] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.064] GetProcessHeap () returned 0x630000 [0048.064] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645450 [0048.064] GetProcessHeap () returned 0x630000 [0048.064] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645450 | out: hHeap=0x630000) returned 1 [0048.064] GetProcessHeap () returned 0x630000 [0048.064] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.064] GetProcessHeap () returned 0x630000 [0048.064] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.064] GetProcessHeap () returned 0x630000 [0048.064] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.064] GetProcessHeap () returned 0x630000 [0048.064] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.064] GetProcessHeap () returned 0x630000 [0048.064] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645450 [0048.064] GetProcessHeap () returned 0x630000 [0048.064] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645450 | out: hHeap=0x630000) returned 1 [0048.064] GetProcessHeap () returned 0x630000 [0048.064] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.064] GetProcessHeap () returned 0x630000 [0048.064] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.064] GetProcessHeap () returned 0x630000 [0048.064] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.064] GetProcessHeap () returned 0x630000 [0048.064] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.064] GetProcessHeap () returned 0x630000 [0048.064] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.064] GetProcessHeap () returned 0x630000 [0048.064] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.064] GetProcessHeap () returned 0x630000 [0048.064] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.064] GetProcessHeap () returned 0x630000 [0048.064] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.064] GetProcessHeap () returned 0x630000 [0048.065] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.065] GetProcessHeap () returned 0x630000 [0048.065] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.065] GetProcessHeap () returned 0x630000 [0048.065] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.065] GetProcessHeap () returned 0x630000 [0048.065] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.065] GetProcessHeap () returned 0x630000 [0048.065] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.065] GetProcessHeap () returned 0x630000 [0048.065] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.065] GetProcessHeap () returned 0x630000 [0048.065] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.065] GetProcessHeap () returned 0x630000 [0048.065] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.065] GetProcessHeap () returned 0x630000 [0048.065] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.065] GetProcessHeap () returned 0x630000 [0048.065] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.065] GetProcessHeap () returned 0x630000 [0048.065] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0048.065] GetProcessHeap () returned 0x630000 [0048.065] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x641530 | out: hHeap=0x630000) returned 1 [0048.065] GetProcessHeap () returned 0x630000 [0048.065] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x654690 | out: hHeap=0x630000) returned 1 [0048.065] GetProcessHeap () returned 0x630000 [0048.065] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c178 | out: hHeap=0x630000) returned 1 [0048.065] GetProcessHeap () returned 0x630000 [0048.065] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9a8 | out: hHeap=0x630000) returned 1 [0048.065] GetProcessHeap () returned 0x630000 [0048.065] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653f20 [0048.065] GetProcessHeap () returned 0x630000 [0048.065] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653c50 [0048.065] GetProcessHeap () returned 0x630000 [0048.065] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653980 [0048.065] GetProcessHeap () returned 0x630000 [0048.065] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653e80 [0048.065] GetProcessHeap () returned 0x630000 [0048.065] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653b10 [0048.065] GetProcessHeap () returned 0x630000 [0048.066] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653e30 [0048.066] GetProcessHeap () returned 0x630000 [0048.066] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653930 [0048.066] GetProcessHeap () returned 0x630000 [0048.066] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653d40 [0048.066] GetProcessHeap () returned 0x630000 [0048.066] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653bb0 [0048.066] GetProcessHeap () returned 0x630000 [0048.066] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x6540b0 [0048.066] GetProcessHeap () returned 0x630000 [0048.066] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653cf0 [0048.066] GetProcessHeap () returned 0x630000 [0048.066] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x6539d0 [0048.066] GetProcessHeap () returned 0x630000 [0048.066] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653ca0 [0048.066] GetProcessHeap () returned 0x630000 [0048.066] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653b60 [0048.066] GetProcessHeap () returned 0x630000 [0048.066] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653a20 [0048.066] GetProcessHeap () returned 0x630000 [0048.066] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653ac0 [0048.066] GetProcessHeap () returned 0x630000 [0048.067] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653f20 | out: hHeap=0x630000) returned 1 [0048.067] GetProcessHeap () returned 0x630000 [0048.067] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653c50 | out: hHeap=0x630000) returned 1 [0048.067] GetProcessHeap () returned 0x630000 [0048.067] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653980 | out: hHeap=0x630000) returned 1 [0048.067] GetProcessHeap () returned 0x630000 [0048.067] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653e80 | out: hHeap=0x630000) returned 1 [0048.067] GetProcessHeap () returned 0x630000 [0048.067] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653b10 | out: hHeap=0x630000) returned 1 [0048.067] GetProcessHeap () returned 0x630000 [0048.067] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653e30 | out: hHeap=0x630000) returned 1 [0048.067] GetProcessHeap () returned 0x630000 [0048.067] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653930 | out: hHeap=0x630000) returned 1 [0048.067] GetProcessHeap () returned 0x630000 [0048.067] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653d40 | out: hHeap=0x630000) returned 1 [0048.067] GetProcessHeap () returned 0x630000 [0048.067] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653bb0 | out: hHeap=0x630000) returned 1 [0048.067] GetProcessHeap () returned 0x630000 [0048.067] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6540b0 | out: hHeap=0x630000) returned 1 [0048.067] GetProcessHeap () returned 0x630000 [0048.067] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653cf0 | out: hHeap=0x630000) returned 1 [0048.067] GetProcessHeap () returned 0x630000 [0048.067] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6539d0 | out: hHeap=0x630000) returned 1 [0048.067] GetProcessHeap () returned 0x630000 [0048.067] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653ca0 | out: hHeap=0x630000) returned 1 [0048.067] GetProcessHeap () returned 0x630000 [0048.067] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653b60 | out: hHeap=0x630000) returned 1 [0048.067] GetProcessHeap () returned 0x630000 [0048.067] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653a20 | out: hHeap=0x630000) returned 1 [0048.067] GetProcessHeap () returned 0x630000 [0048.067] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653ac0 | out: hHeap=0x630000) returned 1 [0048.067] GetProcessHeap () returned 0x630000 [0048.067] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653a70 | out: hHeap=0x630000) returned 1 [0048.067] GetProcessHeap () returned 0x630000 [0048.067] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce70 | out: hHeap=0x630000) returned 1 [0048.067] GetProcessHeap () returned 0x630000 [0048.067] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x642358 | out: hHeap=0x630000) returned 1 [0048.067] GetProcessHeap () returned 0x630000 [0048.067] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6424c0 | out: hHeap=0x630000) returned 1 [0048.067] GetProcessHeap () returned 0x630000 [0048.067] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653c00 | out: hHeap=0x630000) returned 1 [0048.067] GetProcessHeap () returned 0x630000 [0048.068] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0048.068] GetProcessHeap () returned 0x630000 [0048.068] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x40) returned 0x642238 [0048.068] GetProcessHeap () returned 0x630000 [0048.068] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x40) returned 0x642358 [0048.068] GetProcessHeap () returned 0x630000 [0048.068] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x40) returned 0x6424c0 [0048.068] GetProcessHeap () returned 0x630000 [0048.068] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653fc0 [0048.068] GetProcessHeap () returned 0x630000 [0048.068] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6424c0 | out: hHeap=0x630000) returned 1 [0048.068] GetProcessHeap () returned 0x630000 [0048.068] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653c50 [0048.068] GetProcessHeap () returned 0x630000 [0048.068] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x64ce70 [0048.068] GetProcessHeap () returned 0x630000 [0048.068] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x645450 [0048.068] GetProcessHeap () returned 0x630000 [0048.068] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x640fb0 [0048.068] GetProcessHeap () returned 0x630000 [0048.068] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645450 | out: hHeap=0x630000) returned 1 [0048.068] GetProcessHeap () returned 0x630000 [0048.068] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x640c90 [0048.068] GetProcessHeap () returned 0x630000 [0048.068] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x40) returned 0x641e90 [0048.068] GetProcessHeap () returned 0x630000 [0048.068] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8c) returned 0x6545f8 [0048.069] GetProcessHeap () returned 0x630000 [0048.069] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.069] GetProcessHeap () returned 0x630000 [0048.069] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9d8 [0048.069] GetProcessHeap () returned 0x630000 [0048.069] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x44) returned 0x653cf0 [0048.069] GetProcessHeap () returned 0x630000 [0048.069] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x641e90 | out: hHeap=0x630000) returned 1 [0048.069] GetProcessHeap () returned 0x630000 [0048.069] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x641530 [0048.069] GetProcessHeap () returned 0x630000 [0048.069] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653cf0 | out: hHeap=0x630000) returned 1 [0048.069] GetProcessHeap () returned 0x630000 [0048.069] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.069] GetProcessHeap () returned 0x630000 [0048.069] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9c0 [0048.069] GetProcessHeap () returned 0x630000 [0048.069] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.069] GetProcessHeap () returned 0x630000 [0048.069] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.069] GetProcessHeap () returned 0x630000 [0048.069] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x48) returned 0x653e30 [0048.069] GetProcessHeap () returned 0x630000 [0048.069] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9c0 | out: hHeap=0x630000) returned 1 [0048.069] GetProcessHeap () returned 0x630000 [0048.069] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x64c178 [0048.069] GetProcessHeap () returned 0x630000 [0048.069] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653e30 | out: hHeap=0x630000) returned 1 [0048.069] GetProcessHeap () returned 0x630000 [0048.069] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.069] GetProcessHeap () returned 0x630000 [0048.069] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.069] GetProcessHeap () returned 0x630000 [0048.069] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.069] GetProcessHeap () returned 0x630000 [0048.069] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.069] GetProcessHeap () returned 0x630000 [0048.069] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.070] GetProcessHeap () returned 0x630000 [0048.070] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.070] GetProcessHeap () returned 0x630000 [0048.070] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.070] GetProcessHeap () returned 0x630000 [0048.070] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.070] GetProcessHeap () returned 0x630000 [0048.071] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.071] GetProcessHeap () returned 0x630000 [0048.071] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.071] GetProcessHeap () returned 0x630000 [0048.072] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.072] GetProcessHeap () returned 0x630000 [0048.072] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.072] GetProcessHeap () returned 0x630000 [0048.072] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.072] GetProcessHeap () returned 0x630000 [0048.072] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.072] GetProcessHeap () returned 0x630000 [0048.072] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.072] GetProcessHeap () returned 0x630000 [0048.072] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.072] GetProcessHeap () returned 0x630000 [0048.084] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.084] GetProcessHeap () returned 0x630000 [0048.084] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.125] GetProcessHeap () returned 0x630000 [0048.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653e80 | out: hHeap=0x630000) returned 1 [0048.125] GetProcessHeap () returned 0x630000 [0048.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653f70 | out: hHeap=0x630000) returned 1 [0048.125] GetProcessHeap () returned 0x630000 [0048.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653d40 | out: hHeap=0x630000) returned 1 [0048.125] GetProcessHeap () returned 0x630000 [0048.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653e30 | out: hHeap=0x630000) returned 1 [0048.126] GetProcessHeap () returned 0x630000 [0048.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653c50 | out: hHeap=0x630000) returned 1 [0048.126] GetProcessHeap () returned 0x630000 [0048.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653a70 | out: hHeap=0x630000) returned 1 [0048.126] GetProcessHeap () returned 0x630000 [0048.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6539d0 | out: hHeap=0x630000) returned 1 [0048.126] GetProcessHeap () returned 0x630000 [0048.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653bb0 | out: hHeap=0x630000) returned 1 [0048.126] GetProcessHeap () returned 0x630000 [0048.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653980 | out: hHeap=0x630000) returned 1 [0048.126] GetProcessHeap () returned 0x630000 [0048.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6540b0 | out: hHeap=0x630000) returned 1 [0048.126] GetProcessHeap () returned 0x630000 [0048.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653cf0 | out: hHeap=0x630000) returned 1 [0048.126] GetProcessHeap () returned 0x630000 [0048.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653f20 | out: hHeap=0x630000) returned 1 [0048.126] GetProcessHeap () returned 0x630000 [0048.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653930 | out: hHeap=0x630000) returned 1 [0048.186] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0048.186] WriteFile (in: hFile=0x1fc, lpBuffer=0x64ef20*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x19faf4, lpOverlapped=0x0 | out: lpBuffer=0x64ef20*, lpNumberOfBytesWritten=0x19faf4*=0x102, lpOverlapped=0x0) returned 1 [0048.187] GetProcessHeap () returned 0x630000 [0048.187] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x40) returned 0x642358 [0048.187] GetProcessHeap () returned 0x630000 [0048.187] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x40) returned 0x642508 [0048.187] GetProcessHeap () returned 0x630000 [0048.187] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc0) returned 0x641530 [0048.188] lstrlenA (lpString="rsa_encrypt") returned 11 [0048.188] CryptAcquireContextW (in: phProv=0x19f038, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x19f038*=0x640fb0) returned 1 [0048.188] CryptGenRandom (in: hProv=0x640fb0, dwLen=0x80, pbBuffer=0x19f050 | out: pbBuffer=0x19f050) returned 1 [0048.188] CryptReleaseContext (hProv=0x640fb0, dwFlags=0x0) returned 1 [0048.188] lstrlenA (lpString="EB743D0B5B16A0734087597EBC3A6874D7311413B20B854D7223B879D30975995F5C53F6348CB1990ECD05B5E5CE0797942C56E511F2D77462AB3E41E37AF879B7AEF3CC8705006AF099017D092C57508654BAE724717E7ADA644F4EEE08D3B845BCD7C1F2FF47D8379D771252D1AA4D1B0CBF1770BB86FC0EB9380AA8EE5B97474ADD3293CE81AB882FAC17DDF9A95CB2625B925B43DC66830EC89618E1FBC1492D3DFFE05150930E258133C8A2B8D5D3BD2F23BAB48764E66721BE77B11F6A574F7914FDDBB479FE704B00DF23B28C2CD57CBB6D32CBAB8A21B0167BFB2CADF67390ECCACAFA0828AE15A17FFA618787A787A299FD4AAE0C6CF4AF9FEB930D") returned 512 [0048.188] GetProcessHeap () returned 0x630000 [0048.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x100) returned 0x6418f0 [0048.188] lstrlenA (lpString="010001") returned 6 [0048.188] GetProcessHeap () returned 0x630000 [0048.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x645420 [0048.190] GetProcessHeap () returned 0x630000 [0048.190] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x100) returned 0x641658 [0048.190] GetProcessHeap () returned 0x630000 [0048.190] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x63f900 [0048.190] GetProcessHeap () returned 0x630000 [0048.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x641658 | out: hHeap=0x630000) returned 1 [0048.190] GetProcessHeap () returned 0x630000 [0048.190] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x641658 [0048.190] GetProcessHeap () returned 0x630000 [0048.190] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x208) returned 0x657930 [0048.190] GetProcessHeap () returned 0x630000 [0048.190] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x645380 [0048.190] GetProcessHeap () returned 0x630000 [0048.190] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x204) returned 0x657b40 [0048.190] GetProcessHeap () returned 0x630000 [0048.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.190] GetProcessHeap () returned 0x630000 [0048.190] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x204) returned 0x657d50 [0048.190] GetProcessHeap () returned 0x630000 [0048.190] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x100) returned 0x63f6e0 [0048.190] GetProcessHeap () returned 0x630000 [0048.190] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20c) returned 0x657f60 [0048.197] GetProcessHeap () returned 0x630000 [0048.197] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.197] GetProcessHeap () returned 0x630000 [0048.197] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0048.197] GetProcessHeap () returned 0x630000 [0048.197] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x63f408 [0048.197] GetProcessHeap () returned 0x630000 [0048.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63f6e0 | out: hHeap=0x630000) returned 1 [0048.197] GetProcessHeap () returned 0x630000 [0048.197] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x204) returned 0x658178 [0048.197] GetProcessHeap () returned 0x630000 [0048.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63f408 | out: hHeap=0x630000) returned 1 [0048.197] GetProcessHeap () returned 0x630000 [0048.197] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.197] GetProcessHeap () returned 0x630000 [0048.197] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0048.197] GetProcessHeap () returned 0x630000 [0048.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.197] GetProcessHeap () returned 0x630000 [0048.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.197] GetProcessHeap () returned 0x630000 [0048.197] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x63f6e0 [0048.197] GetProcessHeap () returned 0x630000 [0048.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0048.197] GetProcessHeap () returned 0x630000 [0048.197] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x204) returned 0x658388 [0048.197] GetProcessHeap () returned 0x630000 [0048.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63f6e0 | out: hHeap=0x630000) returned 1 [0048.197] GetProcessHeap () returned 0x630000 [0048.197] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.197] GetProcessHeap () returned 0x630000 [0048.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.197] GetProcessHeap () returned 0x630000 [0048.198] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.198] GetProcessHeap () returned 0x630000 [0048.198] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.198] GetProcessHeap () returned 0x630000 [0048.198] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645400 [0048.198] GetProcessHeap () returned 0x630000 [0048.198] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645400 | out: hHeap=0x630000) returned 1 [0048.198] GetProcessHeap () returned 0x630000 [0048.198] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.198] GetProcessHeap () returned 0x630000 [0048.198] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.198] GetProcessHeap () returned 0x630000 [0048.198] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.198] GetProcessHeap () returned 0x630000 [0048.198] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.198] GetProcessHeap () returned 0x630000 [0048.198] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.198] GetProcessHeap () returned 0x630000 [0048.198] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.198] GetProcessHeap () returned 0x630000 [0048.198] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.198] GetProcessHeap () returned 0x630000 [0048.198] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.198] GetProcessHeap () returned 0x630000 [0048.198] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645450 [0048.198] GetProcessHeap () returned 0x630000 [0048.198] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645450 | out: hHeap=0x630000) returned 1 [0048.198] GetProcessHeap () returned 0x630000 [0048.198] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.198] GetProcessHeap () returned 0x630000 [0048.198] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.198] GetProcessHeap () returned 0x630000 [0048.198] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.198] GetProcessHeap () returned 0x630000 [0048.198] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.198] GetProcessHeap () returned 0x630000 [0048.198] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.198] GetProcessHeap () returned 0x630000 [0048.198] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.199] GetProcessHeap () returned 0x630000 [0048.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645450 [0048.199] GetProcessHeap () returned 0x630000 [0048.199] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645450 | out: hHeap=0x630000) returned 1 [0048.199] GetProcessHeap () returned 0x630000 [0048.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.199] GetProcessHeap () returned 0x630000 [0048.199] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.199] GetProcessHeap () returned 0x630000 [0048.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645450 [0048.199] GetProcessHeap () returned 0x630000 [0048.199] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645450 | out: hHeap=0x630000) returned 1 [0048.199] GetProcessHeap () returned 0x630000 [0048.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.199] GetProcessHeap () returned 0x630000 [0048.199] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.199] GetProcessHeap () returned 0x630000 [0048.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.199] GetProcessHeap () returned 0x630000 [0048.199] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.199] GetProcessHeap () returned 0x630000 [0048.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.199] GetProcessHeap () returned 0x630000 [0048.199] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.199] GetProcessHeap () returned 0x630000 [0048.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645450 [0048.199] GetProcessHeap () returned 0x630000 [0048.199] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645450 | out: hHeap=0x630000) returned 1 [0048.199] GetProcessHeap () returned 0x630000 [0048.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.199] GetProcessHeap () returned 0x630000 [0048.199] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.199] GetProcessHeap () returned 0x630000 [0048.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645450 [0048.199] GetProcessHeap () returned 0x630000 [0048.199] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645450 | out: hHeap=0x630000) returned 1 [0048.199] GetProcessHeap () returned 0x630000 [0048.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.199] GetProcessHeap () returned 0x630000 [0048.199] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.200] GetProcessHeap () returned 0x630000 [0048.200] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.202] GetProcessHeap () returned 0x630000 [0048.204] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.204] GetProcessHeap () returned 0x630000 [0048.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.204] GetProcessHeap () returned 0x630000 [0048.204] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.204] GetProcessHeap () returned 0x630000 [0048.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645450 [0048.204] GetProcessHeap () returned 0x630000 [0048.204] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645450 | out: hHeap=0x630000) returned 1 [0048.204] GetProcessHeap () returned 0x630000 [0048.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645450 [0048.204] GetProcessHeap () returned 0x630000 [0048.204] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645450 | out: hHeap=0x630000) returned 1 [0048.204] GetProcessHeap () returned 0x630000 [0048.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.204] GetProcessHeap () returned 0x630000 [0048.204] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.204] GetProcessHeap () returned 0x630000 [0048.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645400 [0048.204] GetProcessHeap () returned 0x630000 [0048.204] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645400 | out: hHeap=0x630000) returned 1 [0048.204] GetProcessHeap () returned 0x630000 [0048.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.204] GetProcessHeap () returned 0x630000 [0048.204] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.204] GetProcessHeap () returned 0x630000 [0048.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645450 [0048.204] GetProcessHeap () returned 0x630000 [0048.204] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645450 | out: hHeap=0x630000) returned 1 [0048.204] GetProcessHeap () returned 0x630000 [0048.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.204] GetProcessHeap () returned 0x630000 [0048.204] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.205] GetProcessHeap () returned 0x630000 [0048.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.205] GetProcessHeap () returned 0x630000 [0048.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.205] GetProcessHeap () returned 0x630000 [0048.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.205] GetProcessHeap () returned 0x630000 [0048.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.205] GetProcessHeap () returned 0x630000 [0048.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.205] GetProcessHeap () returned 0x630000 [0048.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.205] GetProcessHeap () returned 0x630000 [0048.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.205] GetProcessHeap () returned 0x630000 [0048.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.205] GetProcessHeap () returned 0x630000 [0048.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.205] GetProcessHeap () returned 0x630000 [0048.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.205] GetProcessHeap () returned 0x630000 [0048.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.205] GetProcessHeap () returned 0x630000 [0048.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.205] GetProcessHeap () returned 0x630000 [0048.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.205] GetProcessHeap () returned 0x630000 [0048.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.205] GetProcessHeap () returned 0x630000 [0048.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645450 [0048.205] GetProcessHeap () returned 0x630000 [0048.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645450 | out: hHeap=0x630000) returned 1 [0048.205] GetProcessHeap () returned 0x630000 [0048.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.205] GetProcessHeap () returned 0x630000 [0048.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.205] GetProcessHeap () returned 0x630000 [0048.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.205] GetProcessHeap () returned 0x630000 [0048.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.206] GetProcessHeap () returned 0x630000 [0048.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645450 [0048.206] GetProcessHeap () returned 0x630000 [0048.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645450 | out: hHeap=0x630000) returned 1 [0048.206] GetProcessHeap () returned 0x630000 [0048.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.206] GetProcessHeap () returned 0x630000 [0048.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.206] GetProcessHeap () returned 0x630000 [0048.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.206] GetProcessHeap () returned 0x630000 [0048.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.206] GetProcessHeap () returned 0x630000 [0048.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.206] GetProcessHeap () returned 0x630000 [0048.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.206] GetProcessHeap () returned 0x630000 [0048.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.206] GetProcessHeap () returned 0x630000 [0048.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.206] GetProcessHeap () returned 0x630000 [0048.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.206] GetProcessHeap () returned 0x630000 [0048.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.206] GetProcessHeap () returned 0x630000 [0048.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.206] GetProcessHeap () returned 0x630000 [0048.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.206] GetProcessHeap () returned 0x630000 [0048.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.206] GetProcessHeap () returned 0x630000 [0048.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.206] GetProcessHeap () returned 0x630000 [0048.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.206] GetProcessHeap () returned 0x630000 [0048.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.206] GetProcessHeap () returned 0x630000 [0048.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.206] GetProcessHeap () returned 0x630000 [0048.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.207] GetProcessHeap () returned 0x630000 [0048.207] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.207] GetProcessHeap () returned 0x630000 [0048.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.207] GetProcessHeap () returned 0x630000 [0048.207] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645450 [0048.207] GetProcessHeap () returned 0x630000 [0048.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645450 | out: hHeap=0x630000) returned 1 [0048.207] GetProcessHeap () returned 0x630000 [0048.207] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.207] GetProcessHeap () returned 0x630000 [0048.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.207] GetProcessHeap () returned 0x630000 [0048.207] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.207] GetProcessHeap () returned 0x630000 [0048.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.207] GetProcessHeap () returned 0x630000 [0048.207] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.207] GetProcessHeap () returned 0x630000 [0048.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.207] GetProcessHeap () returned 0x630000 [0048.207] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.207] GetProcessHeap () returned 0x630000 [0048.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.207] GetProcessHeap () returned 0x630000 [0048.207] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.207] GetProcessHeap () returned 0x630000 [0048.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.207] GetProcessHeap () returned 0x630000 [0048.207] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.207] GetProcessHeap () returned 0x630000 [0048.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.207] GetProcessHeap () returned 0x630000 [0048.207] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.207] GetProcessHeap () returned 0x630000 [0048.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.207] GetProcessHeap () returned 0x630000 [0048.207] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.207] GetProcessHeap () returned 0x630000 [0048.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.207] GetProcessHeap () returned 0x630000 [0048.208] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645450 [0048.208] GetProcessHeap () returned 0x630000 [0048.208] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645450 | out: hHeap=0x630000) returned 1 [0048.208] GetProcessHeap () returned 0x630000 [0048.208] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.208] GetProcessHeap () returned 0x630000 [0048.208] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.208] GetProcessHeap () returned 0x630000 [0048.208] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.208] GetProcessHeap () returned 0x630000 [0048.208] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.208] GetProcessHeap () returned 0x630000 [0048.208] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.208] GetProcessHeap () returned 0x630000 [0048.208] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.208] GetProcessHeap () returned 0x630000 [0048.208] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.208] GetProcessHeap () returned 0x630000 [0048.208] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.208] GetProcessHeap () returned 0x630000 [0048.208] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.208] GetProcessHeap () returned 0x630000 [0048.208] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.208] GetProcessHeap () returned 0x630000 [0048.208] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645450 [0048.208] GetProcessHeap () returned 0x630000 [0048.208] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645450 | out: hHeap=0x630000) returned 1 [0048.208] GetProcessHeap () returned 0x630000 [0048.208] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.208] GetProcessHeap () returned 0x630000 [0048.208] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.211] GetProcessHeap () returned 0x630000 [0048.211] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.211] GetProcessHeap () returned 0x630000 [0048.211] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.211] GetProcessHeap () returned 0x630000 [0048.211] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.211] GetProcessHeap () returned 0x630000 [0048.211] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.211] GetProcessHeap () returned 0x630000 [0048.211] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645450 [0048.211] GetProcessHeap () returned 0x630000 [0048.211] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645450 | out: hHeap=0x630000) returned 1 [0048.212] GetProcessHeap () returned 0x630000 [0048.212] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645450 [0048.212] GetProcessHeap () returned 0x630000 [0048.212] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645450 | out: hHeap=0x630000) returned 1 [0048.212] GetProcessHeap () returned 0x630000 [0048.212] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.212] GetProcessHeap () returned 0x630000 [0048.212] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.212] GetProcessHeap () returned 0x630000 [0048.212] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645450 [0048.212] GetProcessHeap () returned 0x630000 [0048.212] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645450 | out: hHeap=0x630000) returned 1 [0048.212] GetProcessHeap () returned 0x630000 [0048.212] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.212] GetProcessHeap () returned 0x630000 [0048.212] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.212] GetProcessHeap () returned 0x630000 [0048.212] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645450 [0048.212] GetProcessHeap () returned 0x630000 [0048.212] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645450 | out: hHeap=0x630000) returned 1 [0048.212] GetProcessHeap () returned 0x630000 [0048.212] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.212] GetProcessHeap () returned 0x630000 [0048.212] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.212] GetProcessHeap () returned 0x630000 [0048.212] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.212] GetProcessHeap () returned 0x630000 [0048.212] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.212] GetProcessHeap () returned 0x630000 [0048.212] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.212] GetProcessHeap () returned 0x630000 [0048.212] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.212] GetProcessHeap () returned 0x630000 [0048.212] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.212] GetProcessHeap () returned 0x630000 [0048.212] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.212] GetProcessHeap () returned 0x630000 [0048.212] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.212] GetProcessHeap () returned 0x630000 [0048.213] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.213] GetProcessHeap () returned 0x630000 [0048.213] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.213] GetProcessHeap () returned 0x630000 [0048.213] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.213] GetProcessHeap () returned 0x630000 [0048.213] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.213] GetProcessHeap () returned 0x630000 [0048.213] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.213] GetProcessHeap () returned 0x630000 [0048.213] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.213] GetProcessHeap () returned 0x630000 [0048.213] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.213] GetProcessHeap () returned 0x630000 [0048.213] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.213] GetProcessHeap () returned 0x630000 [0048.213] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.213] GetProcessHeap () returned 0x630000 [0048.213] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.213] GetProcessHeap () returned 0x630000 [0048.213] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.213] GetProcessHeap () returned 0x630000 [0048.213] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.213] GetProcessHeap () returned 0x630000 [0048.213] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.213] GetProcessHeap () returned 0x630000 [0048.213] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.213] GetProcessHeap () returned 0x630000 [0048.213] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.213] GetProcessHeap () returned 0x630000 [0048.213] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.213] GetProcessHeap () returned 0x630000 [0048.213] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.213] GetProcessHeap () returned 0x630000 [0048.213] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.213] GetProcessHeap () returned 0x630000 [0048.213] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.213] GetProcessHeap () returned 0x630000 [0048.213] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.214] GetProcessHeap () returned 0x630000 [0048.214] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.214] GetProcessHeap () returned 0x630000 [0048.214] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.214] GetProcessHeap () returned 0x630000 [0048.214] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.214] GetProcessHeap () returned 0x630000 [0048.214] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645450 [0048.214] GetProcessHeap () returned 0x630000 [0048.214] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645450 | out: hHeap=0x630000) returned 1 [0048.214] GetProcessHeap () returned 0x630000 [0048.214] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.214] GetProcessHeap () returned 0x630000 [0048.214] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.214] GetProcessHeap () returned 0x630000 [0048.214] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.214] GetProcessHeap () returned 0x630000 [0048.214] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.214] GetProcessHeap () returned 0x630000 [0048.214] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.214] GetProcessHeap () returned 0x630000 [0048.214] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.214] GetProcessHeap () returned 0x630000 [0048.214] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.214] GetProcessHeap () returned 0x630000 [0048.214] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.214] GetProcessHeap () returned 0x630000 [0048.214] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645450 [0048.214] GetProcessHeap () returned 0x630000 [0048.214] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645450 | out: hHeap=0x630000) returned 1 [0048.214] GetProcessHeap () returned 0x630000 [0048.214] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.214] GetProcessHeap () returned 0x630000 [0048.214] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.214] GetProcessHeap () returned 0x630000 [0048.214] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.214] GetProcessHeap () returned 0x630000 [0048.214] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.214] GetProcessHeap () returned 0x630000 [0048.214] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.214] GetProcessHeap () returned 0x630000 [0048.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.215] GetProcessHeap () returned 0x630000 [0048.215] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645450 [0048.215] GetProcessHeap () returned 0x630000 [0048.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645450 | out: hHeap=0x630000) returned 1 [0048.215] GetProcessHeap () returned 0x630000 [0048.215] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.215] GetProcessHeap () returned 0x630000 [0048.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.215] GetProcessHeap () returned 0x630000 [0048.215] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.215] GetProcessHeap () returned 0x630000 [0048.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.215] GetProcessHeap () returned 0x630000 [0048.215] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.215] GetProcessHeap () returned 0x630000 [0048.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.215] GetProcessHeap () returned 0x630000 [0048.215] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.215] GetProcessHeap () returned 0x630000 [0048.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.215] GetProcessHeap () returned 0x630000 [0048.215] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645450 [0048.215] GetProcessHeap () returned 0x630000 [0048.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645450 | out: hHeap=0x630000) returned 1 [0048.215] GetProcessHeap () returned 0x630000 [0048.215] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645450 [0048.215] GetProcessHeap () returned 0x630000 [0048.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645450 | out: hHeap=0x630000) returned 1 [0048.215] GetProcessHeap () returned 0x630000 [0048.215] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x645380 [0048.215] GetProcessHeap () returned 0x630000 [0048.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645380 | out: hHeap=0x630000) returned 1 [0048.215] GetProcessHeap () returned 0x630000 [0048.215] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x6453f0 [0048.215] GetProcessHeap () returned 0x630000 [0048.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6453f0 | out: hHeap=0x630000) returned 1 [0048.215] GetProcessHeap () returned 0x630000 [0048.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657d50 | out: hHeap=0x630000) returned 1 [0048.216] GetProcessHeap () returned 0x630000 [0048.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x658178 | out: hHeap=0x630000) returned 1 [0048.216] GetProcessHeap () returned 0x630000 [0048.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657f60 | out: hHeap=0x630000) returned 1 [0048.216] GetProcessHeap () returned 0x630000 [0048.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x658388 | out: hHeap=0x630000) returned 1 [0048.216] GetProcessHeap () returned 0x630000 [0048.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0048.216] GetProcessHeap () returned 0x630000 [0048.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x641658 | out: hHeap=0x630000) returned 1 [0048.216] GetProcessHeap () returned 0x630000 [0048.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657930 | out: hHeap=0x630000) returned 1 [0048.216] GetProcessHeap () returned 0x630000 [0048.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63f900 | out: hHeap=0x630000) returned 1 [0048.216] GetProcessHeap () returned 0x630000 [0048.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657b40 | out: hHeap=0x630000) returned 1 [0048.216] GetProcessHeap () returned 0x630000 [0048.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645420 | out: hHeap=0x630000) returned 1 [0048.216] GetProcessHeap () returned 0x630000 [0048.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6418f0 | out: hHeap=0x630000) returned 1 [0048.216] GetProcessHeap () returned 0x630000 [0048.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x641530 | out: hHeap=0x630000) returned 1 [0048.216] GetProcessHeap () returned 0x630000 [0048.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x642358 | out: hHeap=0x630000) returned 1 [0048.216] GetProcessHeap () returned 0x630000 [0048.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x642508 | out: hHeap=0x630000) returned 1 [0048.216] GetProcessHeap () returned 0x630000 [0048.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x642550 | out: hHeap=0x630000) returned 1 [0048.216] GetProcessHeap () returned 0x630000 [0048.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x641e90 | out: hHeap=0x630000) returned 1 [0048.216] GetProcessHeap () returned 0x630000 [0048.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6424c0 | out: hHeap=0x630000) returned 1 [0048.217] GetProcessHeap () returned 0x630000 [0048.217] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x642310 | out: hHeap=0x630000) returned 1 [0048.217] GetProcessHeap () returned 0x630000 [0048.217] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x642238 | out: hHeap=0x630000) returned 1 [0048.217] GetProcessHeap () returned 0x630000 [0048.217] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x641ca8 | out: hHeap=0x630000) returned 1 [0048.217] GetProcessHeap () returned 0x630000 [0048.217] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645410 | out: hHeap=0x630000) returned 1 [0048.217] GetProcessHeap () returned 0x630000 [0048.217] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce70 | out: hHeap=0x630000) returned 1 [0048.217] GetProcessHeap () returned 0x630000 [0048.217] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca68 | out: hHeap=0x630000) returned 1 [0048.217] SetFilePointer (in: hFile=0x1fc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x102 [0048.217] WriteFile (in: hFile=0x1fc, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x19ff64, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x19ff64*=0x300, lpOverlapped=0x0) returned 1 [0048.218] CloseHandle (hObject=0x1fc) returned 1 [0048.219] GetProcessHeap () returned 0x630000 [0048.219] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x840) returned 0x657930 [0048.219] GetProcessHeap () returned 0x630000 [0048.219] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7c0) returned 0x658178 [0048.219] GetProcessHeap () returned 0x630000 [0048.219] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x70) returned 0x641470 [0048.219] GetLogicalDrives () returned 0x4 [0048.219] GetDriveTypeA (lpRootPathName="C:\\") returned 0x3 [0048.219] GetProcessHeap () returned 0x630000 [0048.220] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3) returned 0x645380 [0048.220] lstrcpyA (in: lpString1=0x645380, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0048.220] GetProcessHeap () returned 0x630000 [0048.220] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9a8 [0048.220] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4096eb, lpParameter=0x64c9a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fc [0048.220] WaitForMultipleObjects (nCount=0x1, lpHandles=0x19f6f4*=0x1fc, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0x10ec Thread: id = 3 os_tid = 0x1180 [0048.223] _alloca_probe () returned 0x4096f5 [0048.223] CryptAcquireContextW (in: phProv=0x243d700, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243d700*=0x640fb0) returned 1 [0048.224] CryptGenRandom (in: hProv=0x640fb0, dwLen=0x80, pbBuffer=0x243d718 | out: pbBuffer=0x243d718) returned 1 [0048.224] CryptReleaseContext (hProv=0x640fb0, dwFlags=0x0) returned 1 [0048.224] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0x645380, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0048.224] GetProcessHeap () returned 0x630000 [0048.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x6453f0 [0048.239] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0x645380, cbMultiByte=-1, lpWideCharStr=0x6453f0, cchWideChar=4 | out: lpWideCharStr="C:\\") returned 4 [0048.239] GetProcessHeap () returned 0x630000 [0048.239] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x645400 [0048.239] lstrlenW (lpString="C:\\") returned 3 [0048.239] GetProcessHeap () returned 0x630000 [0048.239] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x645410 [0048.239] lstrcpyW (in: lpString1=0x645410, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0048.239] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0048.239] GetProcessHeap () returned 0x630000 [0048.239] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645410 | out: hHeap=0x630000) returned 1 [0048.239] GetProcessHeap () returned 0x630000 [0048.239] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645400 | out: hHeap=0x630000) returned 1 [0048.239] lstrlenW (lpString="C:\\") returned 3 [0048.239] lstrcatW (in: lpString1="C:\\", lpString2="*" | out: lpString1="C:\\*") returned="C:\\*" [0048.239] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x648a10 [0048.240] lstrcmpiW (lpString1="$GetCurrent", lpString2=".") returned -1 [0048.240] lstrcmpiW (lpString1="$GetCurrent", lpString2="..") returned -1 [0048.240] lstrcatW (in: lpString1="C:\\", lpString2="$GetCurrent" | out: lpString1="C:\\$GetCurrent") returned="C:\\$GetCurrent" [0048.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="$GetCurrent", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0048.240] GetProcessHeap () returned 0x630000 [0048.240] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9d8 [0048.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="$GetCurrent", cchWideChar=-1, lpMultiByteStr=0x64c9d8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="$GetCurrent", lpUsedDefaultChar=0x0) returned 12 [0048.240] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0048.240] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0048.240] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0048.240] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0048.240] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0048.240] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0048.240] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0048.240] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0048.240] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0048.241] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0048.241] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0048.241] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0048.241] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0048.241] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0048.241] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0048.241] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0048.241] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0048.241] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0048.241] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0048.241] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0048.241] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0048.241] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0048.241] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0048.241] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 1 [0048.241] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0048.241] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0048.241] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 1 [0048.241] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0048.241] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0048.241] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0048.241] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0048.241] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 1 [0048.241] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0048.241] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0048.241] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0048.241] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0048.241] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0048.241] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0048.241] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0048.241] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0048.241] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0048.241] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0048.241] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0048.242] lstrcatW (in: lpString1="C:\\$GetCurrent", lpString2="\\" | out: lpString1="C:\\$GetCurrent\\") returned="C:\\$GetCurrent\\" [0048.242] GetProcessHeap () returned 0x630000 [0048.242] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x645400 [0048.242] lstrlenW (lpString="C:\\$GetCurrent\\") returned 15 [0048.242] GetProcessHeap () returned 0x630000 [0048.242] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x20) returned 0x651e70 [0048.242] lstrcpyW (in: lpString1=0x651e70, lpString2="C:\\$GetCurrent\\" | out: lpString1="C:\\$GetCurrent\\") returned="C:\\$GetCurrent\\" [0048.242] GetProcessHeap () returned 0x630000 [0048.242] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9d8 | out: hHeap=0x630000) returned 1 [0048.242] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0048.242] lstrcmpiW (lpString1="$Recycle.Bin", lpString2=".") returned -1 [0048.242] lstrcmpiW (lpString1="$Recycle.Bin", lpString2="..") returned -1 [0048.242] lstrcatW (in: lpString1="C:\\", lpString2="$Recycle.Bin" | out: lpString1="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0048.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="$Recycle.Bin", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.242] GetProcessHeap () returned 0x630000 [0048.242] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd) returned 0x64c9d8 [0048.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="$Recycle.Bin", cchWideChar=-1, lpMultiByteStr=0x64c9d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="$Recycle.Bin", lpUsedDefaultChar=0x0) returned 13 [0048.242] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0048.242] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0048.242] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0048.242] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0048.242] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0048.242] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0048.242] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0048.242] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0048.242] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0048.242] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0048.242] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0048.242] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0048.242] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0048.242] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0048.242] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0048.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0048.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0048.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0048.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0048.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0048.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0048.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0048.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0048.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 1 [0048.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0048.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0048.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 1 [0048.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0048.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0048.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0048.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0048.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 1 [0048.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0048.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0048.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0048.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0048.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0048.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0048.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0048.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0048.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0048.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0048.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0048.243] lstrcatW (in: lpString1="C:\\$Recycle.Bin", lpString2="\\" | out: lpString1="C:\\$Recycle.Bin\\") returned="C:\\$Recycle.Bin\\" [0048.243] GetProcessHeap () returned 0x630000 [0048.243] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x645410 [0048.243] lstrlenW (lpString="C:\\$Recycle.Bin\\") returned 16 [0048.243] GetProcessHeap () returned 0x630000 [0048.243] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x22) returned 0x644960 [0048.243] lstrcpyW (in: lpString1=0x644960, lpString2="C:\\$Recycle.Bin\\" | out: lpString1="C:\\$Recycle.Bin\\") returned="C:\\$Recycle.Bin\\" [0048.244] GetProcessHeap () returned 0x630000 [0048.244] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9d8 | out: hHeap=0x630000) returned 1 [0048.244] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0048.244] lstrcmpiW (lpString1="$WINRE_BACKUP_PARTITION.MARKER", lpString2=".") returned -1 [0048.244] lstrcmpiW (lpString1="$WINRE_BACKUP_PARTITION.MARKER", lpString2="..") returned -1 [0048.244] lstrcatW (in: lpString1="C:\\", lpString2="$WINRE_BACKUP_PARTITION.MARKER" | out: lpString1="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned="C:\\$WINRE_BACKUP_PARTITION.MARKER" [0048.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="$WINRE_BACKUP_PARTITION.MARKER", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0048.244] GetProcessHeap () returned 0x630000 [0048.244] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1f) returned 0x6520c8 [0048.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="$WINRE_BACKUP_PARTITION.MARKER", cchWideChar=-1, lpMultiByteStr=0x6520c8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="$WINRE_BACKUP_PARTITION.MARKER", lpUsedDefaultChar=0x0) returned 31 [0048.244] lstrlenA (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30 [0048.244] lstrlenA (lpString=".happythreechoose") returned 17 [0048.244] lstrlenA (lpString=".happythreechoose") returned 17 [0048.244] lstrlenA (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30 [0048.244] lstrcmpiA (lpString1="_PARTITION.MARKER", lpString2=".happythreechoose") returned 1 [0048.244] lstrcmpiW (lpString1="$WINRE_BACKUP_PARTITION.MARKER", lpString2="Decryption INFO.html") returned -1 [0048.244] lstrcmpiW (lpString1="$WINRE_BACKUP_PARTITION.MARKER", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned -1 [0048.244] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0048.244] lstrcmpiW (lpString1="$WINRE_BACKUP_PARTITION.MARKER", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0048.244] GetProcessHeap () returned 0x630000 [0048.244] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0048.244] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0048.800] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=0) returned 1 [0048.801] CloseHandle (hObject=0x230) returned 1 [0048.801] GetProcessHeap () returned 0x630000 [0048.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0048.801] GetProcessHeap () returned 0x630000 [0048.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6520c8 | out: hHeap=0x630000) returned 1 [0048.801] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0048.801] lstrcmpiW (lpString1="588bce7c90097ed212", lpString2=".") returned 1 [0048.801] lstrcmpiW (lpString1="588bce7c90097ed212", lpString2="..") returned 1 [0048.801] lstrcatW (in: lpString1="C:\\", lpString2="588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0048.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="588bce7c90097ed212", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0048.801] GetProcessHeap () returned 0x630000 [0048.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x13) returned 0x645eb8 [0048.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="588bce7c90097ed212", cchWideChar=-1, lpMultiByteStr=0x645eb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="588bce7c90097ed212", lpUsedDefaultChar=0x0) returned 19 [0048.801] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0048.801] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0048.801] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0048.801] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0048.801] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0048.801] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0048.801] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0048.801] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0048.801] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0048.801] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0048.801] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0048.801] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0048.801] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0048.801] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0048.801] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0048.801] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0048.801] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0048.801] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0048.802] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0048.802] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0048.802] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0048.802] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0048.802] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0048.802] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 1 [0048.802] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0048.802] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0048.802] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 1 [0048.802] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0048.802] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0048.802] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0048.802] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0048.802] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 1 [0048.802] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0048.802] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0048.802] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0048.806] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0048.806] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0048.806] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0048.806] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0048.806] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0048.806] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0048.806] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0048.806] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0048.806] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0048.806] GetProcessHeap () returned 0x630000 [0048.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x645420 [0048.807] lstrlenW (lpString="C:\\588bce7c90097ed212\\") returned 22 [0048.807] GetProcessHeap () returned 0x630000 [0048.807] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2e) returned 0x6524e0 [0048.807] lstrcpyW (in: lpString1=0x6524e0, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0048.807] GetProcessHeap () returned 0x630000 [0048.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645eb8 | out: hHeap=0x630000) returned 1 [0048.807] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0048.807] lstrcmpiW (lpString1="Boot", lpString2=".") returned 1 [0048.807] lstrcmpiW (lpString1="Boot", lpString2="..") returned 1 [0048.807] lstrcatW (in: lpString1="C:\\", lpString2="Boot" | out: lpString1="C:\\Boot") returned="C:\\Boot" [0048.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Boot", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0048.807] GetProcessHeap () returned 0x630000 [0048.807] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5) returned 0x645450 [0048.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Boot", cchWideChar=-1, lpMultiByteStr=0x645450, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Boot", lpUsedDefaultChar=0x0) returned 5 [0048.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0048.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0048.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0048.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0048.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0048.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0048.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0048.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0048.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0048.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0048.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0048.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0048.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0048.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0048.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0048.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0048.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0048.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0048.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0048.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0048.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0048.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0048.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0048.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0048.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0048.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0048.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0048.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0048.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0048.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0048.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0048.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0048.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0048.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0048.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0048.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0048.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0048.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0048.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0048.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0048.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0048.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0048.808] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0048.808] lstrcatW (in: lpString1="C:\\Boot", lpString2="\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0048.808] GetProcessHeap () returned 0x630000 [0048.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a2d8 [0048.808] lstrlenW (lpString="C:\\Boot\\") returned 8 [0048.808] GetProcessHeap () returned 0x630000 [0048.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x645db8 [0048.808] lstrcpyW (in: lpString1=0x645db8, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0048.808] GetProcessHeap () returned 0x630000 [0048.808] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645450 | out: hHeap=0x630000) returned 1 [0048.808] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0048.809] lstrcmpiW (lpString1="bootmgr", lpString2=".") returned 1 [0048.809] lstrcmpiW (lpString1="bootmgr", lpString2="..") returned 1 [0048.809] lstrcatW (in: lpString1="C:\\", lpString2="bootmgr" | out: lpString1="C:\\bootmgr") returned="C:\\bootmgr" [0048.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bootmgr", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0048.809] GetProcessHeap () returned 0x630000 [0048.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a3f8 [0048.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bootmgr", cchWideChar=-1, lpMultiByteStr=0x65a3f8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr", lpUsedDefaultChar=0x0) returned 8 [0048.809] lstrlenA (lpString="bootmgr") returned 7 [0048.809] lstrlenA (lpString=".happythreechoose") returned 17 [0048.809] lstrcmpiW (lpString1="bootmgr", lpString2="Decryption INFO.html") returned -1 [0048.809] lstrcmpiW (lpString1="bootmgr", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0048.809] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0048.809] lstrcmpiW (lpString1="bootmgr", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0048.809] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0048.810] GetProcessHeap () returned 0x630000 [0048.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x6520c8 [0048.810] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0048.810] CloseHandle (hObject=0xffffffff) returned 1 [0048.810] GetProcessHeap () returned 0x630000 [0048.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6520c8 | out: hHeap=0x630000) returned 1 [0048.810] GetProcessHeap () returned 0x630000 [0048.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0048.810] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe5533ee0, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef9d0a0c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTNXT", cAlternateFileName="")) returned 1 [0048.810] lstrcmpiW (lpString1="BOOTNXT", lpString2=".") returned 1 [0048.810] lstrcmpiW (lpString1="BOOTNXT", lpString2="..") returned 1 [0048.810] lstrcatW (in: lpString1="C:\\", lpString2="BOOTNXT" | out: lpString1="C:\\BOOTNXT") returned="C:\\BOOTNXT" [0048.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BOOTNXT", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0048.810] GetProcessHeap () returned 0x630000 [0048.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a318 [0048.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BOOTNXT", cchWideChar=-1, lpMultiByteStr=0x65a318, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BOOTNXT", lpUsedDefaultChar=0x0) returned 8 [0048.811] lstrlenA (lpString="BOOTNXT") returned 7 [0048.811] lstrlenA (lpString=".happythreechoose") returned 17 [0048.811] lstrcmpiW (lpString1="BOOTNXT", lpString2="Decryption INFO.html") returned -1 [0048.811] lstrcmpiW (lpString1="BOOTNXT", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0048.811] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0048.811] lstrcmpiW (lpString1="BOOTNXT", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0048.811] GetProcessHeap () returned 0x630000 [0048.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0048.811] CreateFileW (lpFileName="C:\\BOOTNXT" (normalized: "c:\\bootnxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0048.812] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=1) returned 1 [0048.812] GetProcessHeap () returned 0x630000 [0048.812] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x63e830 [0048.812] GetProcessHeap () returned 0x630000 [0048.812] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0048.812] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0048.812] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0048.812] GetProcessHeap () returned 0x630000 [0048.812] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0048.812] GetProcessHeap () returned 0x630000 [0048.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38f) returned 0x65a420 [0048.813] lstrlenA (lpString="rsa_encrypt") returned 11 [0048.813] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0048.813] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0048.813] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0048.813] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0048.813] GetProcessHeap () returned 0x630000 [0048.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0048.813] lstrlenA (lpString="010001") returned 6 [0048.813] GetProcessHeap () returned 0x630000 [0048.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3d8 [0048.813] GetProcessHeap () returned 0x630000 [0048.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0048.813] GetProcessHeap () returned 0x630000 [0048.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655800 [0048.813] GetProcessHeap () returned 0x630000 [0048.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0048.814] GetProcessHeap () returned 0x630000 [0048.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655fe0 [0048.814] GetProcessHeap () returned 0x630000 [0048.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x6418f0 [0048.814] GetProcessHeap () returned 0x630000 [0048.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2a8 [0048.814] GetProcessHeap () returned 0x630000 [0048.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x63f900 [0048.814] GetProcessHeap () returned 0x630000 [0048.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0048.814] GetProcessHeap () returned 0x630000 [0048.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x641658 [0048.814] GetProcessHeap () returned 0x630000 [0048.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0048.814] GetProcessHeap () returned 0x630000 [0048.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x63f6e0 [0048.814] GetProcessHeap () returned 0x630000 [0048.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0048.814] GetProcessHeap () returned 0x630000 [0048.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9d8 [0048.814] GetProcessHeap () returned 0x630000 [0048.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x6551d0 [0048.814] GetProcessHeap () returned 0x630000 [0048.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0048.814] GetProcessHeap () returned 0x630000 [0048.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x63f408 [0048.814] GetProcessHeap () returned 0x630000 [0048.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6551d0 | out: hHeap=0x630000) returned 1 [0048.814] GetProcessHeap () returned 0x630000 [0048.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0048.814] GetProcessHeap () returned 0x630000 [0048.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0048.814] GetProcessHeap () returned 0x630000 [0048.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0048.814] GetProcessHeap () returned 0x630000 [0048.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0048.814] GetProcessHeap () returned 0x630000 [0048.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0048.815] GetProcessHeap () returned 0x630000 [0048.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0048.815] GetProcessHeap () returned 0x630000 [0048.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x655ec0 [0048.815] GetProcessHeap () returned 0x630000 [0048.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0048.815] GetProcessHeap () returned 0x630000 [0048.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x65a7b8 [0048.815] GetProcessHeap () returned 0x630000 [0048.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655ec0 | out: hHeap=0x630000) returned 1 [0048.815] GetProcessHeap () returned 0x630000 [0048.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0048.815] GetProcessHeap () returned 0x630000 [0048.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0048.815] GetProcessHeap () returned 0x630000 [0048.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0048.815] GetProcessHeap () returned 0x630000 [0048.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0048.815] GetProcessHeap () returned 0x630000 [0048.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a248 [0048.815] GetProcessHeap () returned 0x630000 [0048.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a248 | out: hHeap=0x630000) returned 1 [0048.815] GetProcessHeap () returned 0x630000 [0048.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2e8 [0048.815] GetProcessHeap () returned 0x630000 [0048.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2e8 | out: hHeap=0x630000) returned 1 [0048.815] GetProcessHeap () returned 0x630000 [0048.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0048.815] GetProcessHeap () returned 0x630000 [0048.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0048.815] GetProcessHeap () returned 0x630000 [0048.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2c8 [0048.815] GetProcessHeap () returned 0x630000 [0048.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2c8 | out: hHeap=0x630000) returned 1 [0048.815] GetProcessHeap () returned 0x630000 [0048.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0048.815] GetProcessHeap () returned 0x630000 [0048.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0048.816] GetProcessHeap () returned 0x630000 [0048.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0048.816] GetProcessHeap () returned 0x630000 [0048.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0048.816] GetProcessHeap () returned 0x630000 [0048.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a288 [0048.816] GetProcessHeap () returned 0x630000 [0048.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a288 | out: hHeap=0x630000) returned 1 [0048.816] GetProcessHeap () returned 0x630000 [0048.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0048.816] GetProcessHeap () returned 0x630000 [0048.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0048.816] GetProcessHeap () returned 0x630000 [0048.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0048.816] GetProcessHeap () returned 0x630000 [0048.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0048.816] GetProcessHeap () returned 0x630000 [0048.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0048.816] GetProcessHeap () returned 0x630000 [0048.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0048.816] GetProcessHeap () returned 0x630000 [0048.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0048.816] GetProcessHeap () returned 0x630000 [0048.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0048.816] GetProcessHeap () returned 0x630000 [0048.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3e8 [0048.816] GetProcessHeap () returned 0x630000 [0048.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3e8 | out: hHeap=0x630000) returned 1 [0048.816] GetProcessHeap () returned 0x630000 [0048.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0048.816] GetProcessHeap () returned 0x630000 [0048.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0048.816] GetProcessHeap () returned 0x630000 [0048.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0048.816] GetProcessHeap () returned 0x630000 [0048.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0048.817] GetProcessHeap () returned 0x630000 [0048.817] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0048.817] GetProcessHeap () returned 0x630000 [0048.817] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0048.817] GetProcessHeap () returned 0x630000 [0048.817] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0048.817] GetProcessHeap () returned 0x630000 [0048.817] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0048.817] GetProcessHeap () returned 0x630000 [0048.817] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0048.817] GetProcessHeap () returned 0x630000 [0048.817] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0048.817] GetProcessHeap () returned 0x630000 [0048.817] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0048.817] GetProcessHeap () returned 0x630000 [0048.817] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0048.817] GetProcessHeap () returned 0x630000 [0048.817] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0048.817] GetProcessHeap () returned 0x630000 [0048.817] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0048.817] GetProcessHeap () returned 0x630000 [0048.817] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0048.817] GetProcessHeap () returned 0x630000 [0048.817] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0048.817] GetProcessHeap () returned 0x630000 [0048.817] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0048.817] GetProcessHeap () returned 0x630000 [0048.817] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0048.817] GetProcessHeap () returned 0x630000 [0048.817] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0048.817] GetProcessHeap () returned 0x630000 [0048.817] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0048.817] GetProcessHeap () returned 0x630000 [0048.817] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0048.817] GetProcessHeap () returned 0x630000 [0048.817] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0048.817] GetProcessHeap () returned 0x630000 [0048.818] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a358 [0048.818] GetProcessHeap () returned 0x630000 [0048.818] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a358 | out: hHeap=0x630000) returned 1 [0048.818] GetProcessHeap () returned 0x630000 [0048.818] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0048.818] GetProcessHeap () returned 0x630000 [0048.818] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0048.818] GetProcessHeap () returned 0x630000 [0048.818] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2e8 [0048.818] GetProcessHeap () returned 0x630000 [0048.818] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2e8 | out: hHeap=0x630000) returned 1 [0048.818] GetProcessHeap () returned 0x630000 [0048.818] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0048.818] GetProcessHeap () returned 0x630000 [0048.818] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0048.818] GetProcessHeap () returned 0x630000 [0048.818] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0048.819] GetProcessHeap () returned 0x630000 [0048.819] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0048.819] GetProcessHeap () returned 0x630000 [0048.819] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3e8 [0048.819] GetProcessHeap () returned 0x630000 [0048.819] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3e8 | out: hHeap=0x630000) returned 1 [0048.819] GetProcessHeap () returned 0x630000 [0048.819] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2e8 [0048.819] GetProcessHeap () returned 0x630000 [0048.819] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2e8 | out: hHeap=0x630000) returned 1 [0048.819] GetProcessHeap () returned 0x630000 [0048.819] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0048.819] GetProcessHeap () returned 0x630000 [0048.819] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0048.819] GetProcessHeap () returned 0x630000 [0048.819] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3e8 [0048.819] GetProcessHeap () returned 0x630000 [0048.819] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3e8 | out: hHeap=0x630000) returned 1 [0048.819] GetProcessHeap () returned 0x630000 [0048.819] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0048.819] GetProcessHeap () returned 0x630000 [0048.819] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0048.819] GetProcessHeap () returned 0x630000 [0048.819] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0048.819] GetProcessHeap () returned 0x630000 [0048.819] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0048.819] GetProcessHeap () returned 0x630000 [0048.819] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0048.819] GetProcessHeap () returned 0x630000 [0048.819] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0048.819] GetProcessHeap () returned 0x630000 [0048.819] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0048.819] GetProcessHeap () returned 0x630000 [0048.819] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0048.819] GetProcessHeap () returned 0x630000 [0048.819] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3e8 [0048.819] GetProcessHeap () returned 0x630000 [0048.819] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3e8 | out: hHeap=0x630000) returned 1 [0048.820] GetProcessHeap () returned 0x630000 [0048.820] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0048.820] GetProcessHeap () returned 0x630000 [0048.820] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0048.820] GetProcessHeap () returned 0x630000 [0048.820] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0048.820] GetProcessHeap () returned 0x630000 [0048.820] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0048.820] GetProcessHeap () returned 0x630000 [0048.820] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x641658 | out: hHeap=0x630000) returned 1 [0048.820] GetProcessHeap () returned 0x630000 [0048.820] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63f408 | out: hHeap=0x630000) returned 1 [0048.820] GetProcessHeap () returned 0x630000 [0048.820] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63f6e0 | out: hHeap=0x630000) returned 1 [0048.820] GetProcessHeap () returned 0x630000 [0048.820] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a7b8 | out: hHeap=0x630000) returned 1 [0048.820] GetProcessHeap () returned 0x630000 [0048.820] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9d8 | out: hHeap=0x630000) returned 1 [0048.820] GetProcessHeap () returned 0x630000 [0048.820] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655fe0 | out: hHeap=0x630000) returned 1 [0048.820] GetProcessHeap () returned 0x630000 [0048.820] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6418f0 | out: hHeap=0x630000) returned 1 [0048.820] GetProcessHeap () returned 0x630000 [0048.820] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655800 | out: hHeap=0x630000) returned 1 [0048.820] GetProcessHeap () returned 0x630000 [0048.820] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63f900 | out: hHeap=0x630000) returned 1 [0048.820] GetProcessHeap () returned 0x630000 [0048.820] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3d8 | out: hHeap=0x630000) returned 1 [0048.820] GetProcessHeap () returned 0x630000 [0048.820] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0048.820] WriteFile (in: hFile=0x230, lpBuffer=0x65a420*, nNumberOfBytesToWrite=0x38f, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65a420*, lpNumberOfBytesWritten=0x243d864*=0x38f, lpOverlapped=0x0) returned 1 [0048.825] GetProcessHeap () returned 0x630000 [0048.825] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65a420, Size=0x30) returned 0x65a420 [0048.825] GetProcessHeap () returned 0x630000 [0048.826] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0048.826] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.826] GetProcessHeap () returned 0x630000 [0048.826] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x64c9d8 [0048.826] ReadFile (in: hFile=0x230, lpBuffer=0x64c9d8, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x64c9d8*, lpNumberOfBytesRead=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.826] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.826] WriteFile (in: hFile=0x230, lpBuffer=0x64c9d8*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x64c9d8*, lpNumberOfBytesWritten=0x243d7e4*=0x10, lpOverlapped=0x0) returned 1 [0048.827] GetProcessHeap () returned 0x630000 [0048.827] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9d8 | out: hHeap=0x630000) returned 1 [0048.827] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0048.827] WriteFile (in: hFile=0x230, lpBuffer=0x65a420*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65a420*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0048.828] CloseHandle (hObject=0x230) returned 1 [0048.829] GetProcessHeap () returned 0x630000 [0048.829] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0048.829] GetProcessHeap () returned 0x630000 [0048.829] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0048.829] GetProcessHeap () returned 0x630000 [0048.829] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0048.829] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\BOOTNXT" | out: lpString1="C:\\BOOTNXT") returned="C:\\BOOTNXT" [0048.829] lstrcatW (in: lpString1="C:\\BOOTNXT", lpString2=".happythreechoose" | out: lpString1="C:\\BOOTNXT.happythreechoose") returned="C:\\BOOTNXT.happythreechoose" [0048.829] MoveFileExW (lpExistingFileName="C:\\BOOTNXT" (normalized: "c:\\bootnxt"), lpNewFileName="C:\\BOOTNXT.happythreechoose" (normalized: "c:\\bootnxt.happythreechoose"), dwFlags=0x1) returned 1 [0048.830] PathRemoveFileSpecW (in: pszPath="C:\\BOOTNXT" | out: pszPath="C:\\") returned 1 [0048.830] PathAddBackslashW (in: pszPath="C:\\" | out: pszPath="C:\\") returned="" [0048.830] lstrcatW (in: lpString1="C:\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Decryption INFO.html") returned="C:\\Decryption INFO.html" [0048.830] GetFileAttributesW (lpFileName="C:\\Decryption INFO.html" (normalized: "c:\\decryption info.html")) returned 0xffffffff [0048.830] CreateFileW (lpFileName="C:\\Decryption INFO.html" (normalized: "c:\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0048.832] GetProcessHeap () returned 0x630000 [0048.832] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x63e830 [0048.832] GetProcessHeap () returned 0x630000 [0048.832] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0048.843] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.844] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.844] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.844] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.844] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.844] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.844] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.845] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.845] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.845] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.845] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.845] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.845] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.845] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.845] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.845] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.845] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.845] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.845] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.845] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.847] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.847] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.847] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.875] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.876] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.876] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.876] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.876] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.876] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.876] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.876] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.876] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.876] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.876] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.876] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.876] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.876] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.876] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.876] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.881] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.881] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.882] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.882] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.882] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.882] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.882] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.882] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.882] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.882] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.882] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.882] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.882] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.882] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.882] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.882] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.882] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.883] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.883] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.883] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.883] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.883] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.883] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.883] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.883] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.883] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.883] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.883] GetProcessHeap () returned 0x630000 [0048.883] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0048.883] GetProcessHeap () returned 0x630000 [0048.883] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0048.883] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0048.883] GetProcessHeap () returned 0x630000 [0048.883] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x63e830 [0048.883] GetProcessHeap () returned 0x630000 [0048.883] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0048.890] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.890] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.891] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.891] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.891] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.891] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.891] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.891] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.891] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.891] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.891] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.891] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.891] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.891] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.891] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.891] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.891] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.892] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.892] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.892] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.892] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.892] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.892] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.892] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.892] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.892] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.892] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.892] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.892] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.892] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.892] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.892] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.893] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.893] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.893] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.893] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.893] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.893] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.893] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.893] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.893] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.893] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.893] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.893] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.893] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.893] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.893] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.894] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.894] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.931] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.931] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.931] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.931] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.931] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.931] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.931] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.932] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.932] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.932] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.932] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.932] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.932] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.932] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.932] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.932] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.932] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.932] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.932] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.932] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.932] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.932] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.933] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.933] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.933] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.933] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.933] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.933] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.933] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.933] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.933] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.933] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.933] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.933] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.934] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.934] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.934] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.934] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.934] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.934] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.934] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.934] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.934] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.934] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.934] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.934] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.934] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.934] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.934] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0048.937] GetProcessHeap () returned 0x630000 [0048.937] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0048.937] GetProcessHeap () returned 0x630000 [0048.937] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0048.937] CloseHandle (hObject=0x230) returned 1 [0048.938] GetProcessHeap () returned 0x630000 [0048.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0048.938] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xc4ee267e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4ee267e, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf1c63cdd, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0048.938] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2=".") returned 1 [0048.938] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="..") returned 1 [0048.938] lstrcatW (in: lpString1="C:\\", lpString2="BOOTSECT.BAK" | out: lpString1="C:\\BOOTSECT.BAK") returned="C:\\BOOTSECT.BAK" [0048.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BOOTSECT.BAK", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0048.938] GetProcessHeap () returned 0x630000 [0048.938] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd) returned 0x64c9d8 [0048.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BOOTSECT.BAK", cchWideChar=-1, lpMultiByteStr=0x64c9d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BOOTSECT.BAK", lpUsedDefaultChar=0x0) returned 13 [0048.938] lstrlenA (lpString="BOOTSECT.BAK") returned 12 [0048.938] lstrlenA (lpString=".happythreechoose") returned 17 [0048.938] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="Decryption INFO.html") returned -1 [0048.938] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0048.938] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0048.938] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0048.938] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0048.939] GetProcessHeap () returned 0x630000 [0048.939] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0048.939] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0048.939] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=8192) returned 1 [0048.939] GetProcessHeap () returned 0x630000 [0048.939] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x63e830 [0048.939] GetProcessHeap () returned 0x630000 [0048.939] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0048.939] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0048.939] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0048.939] GetProcessHeap () returned 0x630000 [0048.939] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0048.939] GetProcessHeap () returned 0x630000 [0048.939] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x65a458 [0048.940] lstrlenA (lpString="rsa_encrypt") returned 11 [0048.940] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0048.940] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0048.940] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0048.940] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0048.940] GetProcessHeap () returned 0x630000 [0048.940] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0048.940] lstrlenA (lpString="010001") returned 6 [0048.941] GetProcessHeap () returned 0x630000 [0048.941] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0048.941] GetProcessHeap () returned 0x630000 [0048.941] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0048.941] GetProcessHeap () returned 0x630000 [0048.941] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655890 [0048.941] GetProcessHeap () returned 0x630000 [0048.941] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0048.941] GetProcessHeap () returned 0x630000 [0048.941] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655c80 [0048.941] GetProcessHeap () returned 0x630000 [0048.941] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x63f900 [0048.941] GetProcessHeap () returned 0x630000 [0048.941] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a248 [0048.941] GetProcessHeap () returned 0x630000 [0048.941] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6418f0 [0048.941] GetProcessHeap () returned 0x630000 [0048.941] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a248 | out: hHeap=0x630000) returned 1 [0048.941] GetProcessHeap () returned 0x630000 [0048.941] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x641658 [0048.941] GetProcessHeap () returned 0x630000 [0048.941] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0048.941] GetProcessHeap () returned 0x630000 [0048.941] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656c98 [0048.941] GetProcessHeap () returned 0x630000 [0048.941] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0048.941] GetProcessHeap () returned 0x630000 [0048.941] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0048.941] GetProcessHeap () returned 0x630000 [0048.941] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x6559b0 [0048.941] GetProcessHeap () returned 0x630000 [0048.941] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0048.941] GetProcessHeap () returned 0x630000 [0048.941] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x63f6e0 [0048.941] GetProcessHeap () returned 0x630000 [0048.941] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6559b0 | out: hHeap=0x630000) returned 1 [0048.941] GetProcessHeap () returned 0x630000 [0048.941] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a288 [0048.941] GetProcessHeap () returned 0x630000 [0048.941] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0048.941] GetProcessHeap () returned 0x630000 [0048.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0048.942] GetProcessHeap () returned 0x630000 [0048.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a288 | out: hHeap=0x630000) returned 1 [0048.942] GetProcessHeap () returned 0x630000 [0048.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a248 [0048.942] GetProcessHeap () returned 0x630000 [0048.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a248 | out: hHeap=0x630000) returned 1 [0048.942] GetProcessHeap () returned 0x630000 [0048.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x655140 [0048.942] GetProcessHeap () returned 0x630000 [0048.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0048.942] GetProcessHeap () returned 0x630000 [0048.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x63f408 [0048.942] GetProcessHeap () returned 0x630000 [0048.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655140 | out: hHeap=0x630000) returned 1 [0048.942] GetProcessHeap () returned 0x630000 [0048.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a358 [0048.942] GetProcessHeap () returned 0x630000 [0048.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a358 | out: hHeap=0x630000) returned 1 [0048.942] GetProcessHeap () returned 0x630000 [0048.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2c8 [0048.942] GetProcessHeap () returned 0x630000 [0048.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2c8 | out: hHeap=0x630000) returned 1 [0048.942] GetProcessHeap () returned 0x630000 [0048.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2e8 [0048.942] GetProcessHeap () returned 0x630000 [0048.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2e8 | out: hHeap=0x630000) returned 1 [0048.942] GetProcessHeap () returned 0x630000 [0048.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a358 [0048.942] GetProcessHeap () returned 0x630000 [0048.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a358 | out: hHeap=0x630000) returned 1 [0048.942] GetProcessHeap () returned 0x630000 [0048.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2c8 [0048.942] GetProcessHeap () returned 0x630000 [0048.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2c8 | out: hHeap=0x630000) returned 1 [0048.942] GetProcessHeap () returned 0x630000 [0048.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0048.942] GetProcessHeap () returned 0x630000 [0048.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0048.943] GetProcessHeap () returned 0x630000 [0048.943] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3e8 [0048.943] GetProcessHeap () returned 0x630000 [0048.943] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3e8 | out: hHeap=0x630000) returned 1 [0048.943] GetProcessHeap () returned 0x630000 [0048.943] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0048.943] GetProcessHeap () returned 0x630000 [0048.943] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0048.943] GetProcessHeap () returned 0x630000 [0048.943] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0048.943] GetProcessHeap () returned 0x630000 [0048.943] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0048.943] GetProcessHeap () returned 0x630000 [0048.943] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0048.943] GetProcessHeap () returned 0x630000 [0048.944] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0048.944] GetProcessHeap () returned 0x630000 [0048.944] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0048.944] GetProcessHeap () returned 0x630000 [0048.944] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0048.944] GetProcessHeap () returned 0x630000 [0048.944] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a358 [0048.944] GetProcessHeap () returned 0x630000 [0048.944] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a358 | out: hHeap=0x630000) returned 1 [0048.944] GetProcessHeap () returned 0x630000 [0048.944] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a248 [0048.944] GetProcessHeap () returned 0x630000 [0048.944] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a248 | out: hHeap=0x630000) returned 1 [0048.944] GetProcessHeap () returned 0x630000 [0048.944] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0048.944] GetProcessHeap () returned 0x630000 [0048.944] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0048.944] GetProcessHeap () returned 0x630000 [0048.944] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0048.944] GetProcessHeap () returned 0x630000 [0048.944] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0048.944] GetProcessHeap () returned 0x630000 [0048.944] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2e8 [0048.944] GetProcessHeap () returned 0x630000 [0048.944] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2e8 | out: hHeap=0x630000) returned 1 [0048.944] GetProcessHeap () returned 0x630000 [0048.944] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2c8 [0048.944] GetProcessHeap () returned 0x630000 [0048.944] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2c8 | out: hHeap=0x630000) returned 1 [0048.944] GetProcessHeap () returned 0x630000 [0048.944] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0048.944] GetProcessHeap () returned 0x630000 [0048.944] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0048.944] GetProcessHeap () returned 0x630000 [0048.944] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a248 [0048.944] GetProcessHeap () returned 0x630000 [0048.944] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a248 | out: hHeap=0x630000) returned 1 [0048.945] GetProcessHeap () returned 0x630000 [0048.945] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0048.945] GetProcessHeap () returned 0x630000 [0048.945] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0048.945] GetProcessHeap () returned 0x630000 [0048.945] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0048.945] GetProcessHeap () returned 0x630000 [0048.945] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0048.945] GetProcessHeap () returned 0x630000 [0048.945] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0048.945] GetProcessHeap () returned 0x630000 [0048.945] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0048.945] GetProcessHeap () returned 0x630000 [0048.945] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0048.945] GetProcessHeap () returned 0x630000 [0048.945] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0048.945] GetProcessHeap () returned 0x630000 [0048.945] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a358 [0048.945] GetProcessHeap () returned 0x630000 [0048.945] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a358 | out: hHeap=0x630000) returned 1 [0048.945] GetProcessHeap () returned 0x630000 [0048.945] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2c8 [0048.945] GetProcessHeap () returned 0x630000 [0048.945] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2c8 | out: hHeap=0x630000) returned 1 [0048.945] GetProcessHeap () returned 0x630000 [0048.945] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3e8 [0048.945] GetProcessHeap () returned 0x630000 [0048.945] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3e8 | out: hHeap=0x630000) returned 1 [0048.945] GetProcessHeap () returned 0x630000 [0048.945] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a248 [0048.945] GetProcessHeap () returned 0x630000 [0048.945] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a248 | out: hHeap=0x630000) returned 1 [0048.945] GetProcessHeap () returned 0x630000 [0048.945] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3d8 [0048.945] GetProcessHeap () returned 0x630000 [0048.945] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3d8 | out: hHeap=0x630000) returned 1 [0048.945] GetProcessHeap () returned 0x630000 [0048.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0048.946] GetProcessHeap () returned 0x630000 [0048.946] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0048.946] GetProcessHeap () returned 0x630000 [0048.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2e8 [0048.946] GetProcessHeap () returned 0x630000 [0048.946] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2e8 | out: hHeap=0x630000) returned 1 [0048.946] GetProcessHeap () returned 0x630000 [0048.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a248 [0048.946] GetProcessHeap () returned 0x630000 [0048.946] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a248 | out: hHeap=0x630000) returned 1 [0048.946] GetProcessHeap () returned 0x630000 [0048.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3e8 [0048.946] GetProcessHeap () returned 0x630000 [0048.946] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3e8 | out: hHeap=0x630000) returned 1 [0048.946] GetProcessHeap () returned 0x630000 [0048.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0048.946] GetProcessHeap () returned 0x630000 [0048.946] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0048.946] GetProcessHeap () returned 0x630000 [0048.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0048.946] GetProcessHeap () returned 0x630000 [0048.946] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0048.946] GetProcessHeap () returned 0x630000 [0048.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3e8 [0048.946] GetProcessHeap () returned 0x630000 [0048.946] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3e8 | out: hHeap=0x630000) returned 1 [0048.946] GetProcessHeap () returned 0x630000 [0048.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3e8 [0048.946] GetProcessHeap () returned 0x630000 [0048.946] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3e8 | out: hHeap=0x630000) returned 1 [0048.946] GetProcessHeap () returned 0x630000 [0048.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2e8 [0048.946] GetProcessHeap () returned 0x630000 [0048.946] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2e8 | out: hHeap=0x630000) returned 1 [0048.946] GetProcessHeap () returned 0x630000 [0048.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a388 [0048.946] GetProcessHeap () returned 0x630000 [0048.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a388 | out: hHeap=0x630000) returned 1 [0048.947] GetProcessHeap () returned 0x630000 [0048.947] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0048.947] GetProcessHeap () returned 0x630000 [0048.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0048.947] GetProcessHeap () returned 0x630000 [0048.947] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0048.947] GetProcessHeap () returned 0x630000 [0048.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0048.947] GetProcessHeap () returned 0x630000 [0048.947] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0048.947] GetProcessHeap () returned 0x630000 [0048.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0048.947] GetProcessHeap () returned 0x630000 [0048.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x641658 | out: hHeap=0x630000) returned 1 [0048.947] GetProcessHeap () returned 0x630000 [0048.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63f6e0 | out: hHeap=0x630000) returned 1 [0048.947] GetProcessHeap () returned 0x630000 [0048.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0048.947] GetProcessHeap () returned 0x630000 [0048.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63f408 | out: hHeap=0x630000) returned 1 [0048.947] GetProcessHeap () returned 0x630000 [0048.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0048.947] GetProcessHeap () returned 0x630000 [0048.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655c80 | out: hHeap=0x630000) returned 1 [0048.947] GetProcessHeap () returned 0x630000 [0048.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63f900 | out: hHeap=0x630000) returned 1 [0048.947] GetProcessHeap () returned 0x630000 [0048.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655890 | out: hHeap=0x630000) returned 1 [0048.947] GetProcessHeap () returned 0x630000 [0048.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6418f0 | out: hHeap=0x630000) returned 1 [0048.947] GetProcessHeap () returned 0x630000 [0048.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0048.947] GetProcessHeap () returned 0x630000 [0048.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0048.947] WriteFile (in: hFile=0x230, lpBuffer=0x65a458*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65a458*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0048.951] GetProcessHeap () returned 0x630000 [0048.951] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65a458, Size=0x30) returned 0x65a458 [0048.951] GetProcessHeap () returned 0x630000 [0048.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0048.951] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.951] GetProcessHeap () returned 0x630000 [0048.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2000) returned 0x65a490 [0048.951] ReadFile (in: hFile=0x230, lpBuffer=0x65a490, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65a490*, lpNumberOfBytesRead=0x243d7e8*=0x2000, lpOverlapped=0x0) returned 1 [0048.952] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0048.952] WriteFile (in: hFile=0x230, lpBuffer=0x65a490*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65a490*, lpNumberOfBytesWritten=0x243d7e4*=0x2000, lpOverlapped=0x0) returned 1 [0049.043] GetProcessHeap () returned 0x630000 [0049.043] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a490 | out: hHeap=0x630000) returned 1 [0049.044] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0049.044] WriteFile (in: hFile=0x230, lpBuffer=0x65a458*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65a458*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0049.045] CloseHandle (hObject=0x230) returned 1 [0049.046] GetProcessHeap () returned 0x630000 [0049.046] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0049.046] GetProcessHeap () returned 0x630000 [0049.047] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0049.047] GetProcessHeap () returned 0x630000 [0049.047] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0049.047] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\BOOTSECT.BAK" | out: lpString1="C:\\BOOTSECT.BAK") returned="C:\\BOOTSECT.BAK" [0049.047] lstrcatW (in: lpString1="C:\\BOOTSECT.BAK", lpString2=".happythreechoose" | out: lpString1="C:\\BOOTSECT.BAK.happythreechoose") returned="C:\\BOOTSECT.BAK.happythreechoose" [0049.047] MoveFileExW (lpExistingFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), lpNewFileName="C:\\BOOTSECT.BAK.happythreechoose" (normalized: "c:\\bootsect.bak.happythreechoose"), dwFlags=0x1) returned 1 [0049.047] PathRemoveFileSpecW (in: pszPath="C:\\BOOTSECT.BAK" | out: pszPath="C:\\") returned 1 [0049.047] PathAddBackslashW (in: pszPath="C:\\" | out: pszPath="C:\\") returned="" [0049.047] lstrcatW (in: lpString1="C:\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Decryption INFO.html") returned="C:\\Decryption INFO.html" [0049.047] GetFileAttributesW (lpFileName="C:\\Decryption INFO.html" (normalized: "c:\\decryption info.html")) returned 0x20 [0049.047] GetProcessHeap () returned 0x630000 [0049.047] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9d8 | out: hHeap=0x630000) returned 1 [0049.047] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0049.048] lstrcmpiW (lpString1="Documents and Settings", lpString2=".") returned 1 [0049.048] lstrcmpiW (lpString1="Documents and Settings", lpString2="..") returned 1 [0049.048] lstrcatW (in: lpString1="C:\\", lpString2="Documents and Settings" | out: lpString1="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0049.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Documents and Settings", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0049.048] GetProcessHeap () returned 0x630000 [0049.048] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x17) returned 0x645f58 [0049.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Documents and Settings", cchWideChar=-1, lpMultiByteStr=0x645f58, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Documents and Settings", lpUsedDefaultChar=0x0) returned 23 [0049.048] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0049.048] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0049.048] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0049.048] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0049.048] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0049.048] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0049.048] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0049.048] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0049.048] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0049.048] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0049.048] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0049.048] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0049.048] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0049.048] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0049.048] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0049.048] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0049.048] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0049.048] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0049.048] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0049.048] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0049.048] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0049.048] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0049.048] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0049.048] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0049.048] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0049.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0049.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0049.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0049.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0049.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0049.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0049.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0049.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0049.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0049.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0049.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0049.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0049.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0049.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0049.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0049.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0049.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0049.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0049.049] lstrcatW (in: lpString1="C:\\Documents and Settings", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\") returned="C:\\Documents and Settings\\" [0049.049] GetProcessHeap () returned 0x630000 [0049.049] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a2c8 [0049.049] lstrlenW (lpString="C:\\Documents and Settings\\") returned 26 [0049.049] GetProcessHeap () returned 0x630000 [0049.049] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x36) returned 0x648a50 [0049.049] lstrcpyW (in: lpString1=0x648a50, lpString2="C:\\Documents and Settings\\" | out: lpString1="C:\\Documents and Settings\\") returned="C:\\Documents and Settings\\" [0049.049] GetProcessHeap () returned 0x630000 [0049.049] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645f58 | out: hHeap=0x630000) returned 1 [0049.049] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1 [0049.049] lstrcmpiW (lpString1="ESD", lpString2=".") returned 1 [0049.049] lstrcmpiW (lpString1="ESD", lpString2="..") returned 1 [0049.049] lstrcatW (in: lpString1="C:\\", lpString2="ESD" | out: lpString1="C:\\ESD") returned="C:\\ESD" [0049.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ESD", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0049.049] GetProcessHeap () returned 0x630000 [0049.049] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4) returned 0x65a2e8 [0049.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ESD", cchWideChar=-1, lpMultiByteStr=0x65a2e8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ESD", lpUsedDefaultChar=0x0) returned 4 [0049.049] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0049.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0049.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0049.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0049.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0049.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0049.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0049.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0049.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0049.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0049.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0049.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0049.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0049.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0049.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0049.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0049.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0049.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0049.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0049.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0049.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0049.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0049.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0049.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0049.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0049.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0049.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0049.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0049.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0049.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0049.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0049.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0049.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0049.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0049.050] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0049.051] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0049.051] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0049.051] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0049.051] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0049.051] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0049.051] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0049.051] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0049.051] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0049.051] lstrcatW (in: lpString1="C:\\ESD", lpString2="\\" | out: lpString1="C:\\ESD\\") returned="C:\\ESD\\" [0049.051] GetProcessHeap () returned 0x630000 [0049.051] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a248 [0049.051] lstrlenW (lpString="C:\\ESD\\") returned 7 [0049.051] GetProcessHeap () returned 0x630000 [0049.051] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x64c9d8 [0049.051] lstrcpyW (in: lpString1=0x64c9d8, lpString2="C:\\ESD\\" | out: lpString1="C:\\ESD\\") returned="C:\\ESD\\" [0049.051] GetProcessHeap () returned 0x630000 [0049.051] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2e8 | out: hHeap=0x630000) returned 1 [0049.051] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x174ff10, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0049.051] lstrcmpiW (lpString1="hiberfil.sys", lpString2=".") returned 1 [0049.051] lstrcmpiW (lpString1="hiberfil.sys", lpString2="..") returned 1 [0049.051] lstrcatW (in: lpString1="C:\\", lpString2="hiberfil.sys" | out: lpString1="C:\\hiberfil.sys") returned="C:\\hiberfil.sys" [0049.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hiberfil.sys", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0049.051] GetProcessHeap () returned 0x630000 [0049.051] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd) returned 0x64c9f0 [0049.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hiberfil.sys", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hiberfil.sys", lpUsedDefaultChar=0x0) returned 13 [0049.051] lstrlenA (lpString="hiberfil.sys") returned 12 [0049.051] lstrlenA (lpString=".happythreechoose") returned 17 [0049.051] lstrcmpiW (lpString1="hiberfil.sys", lpString2="Decryption INFO.html") returned 1 [0049.051] lstrcmpiW (lpString1="hiberfil.sys", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0049.051] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0049.051] lstrcmpiW (lpString1="hiberfil.sys", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0049.051] GetProcessHeap () returned 0x630000 [0049.051] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f10 [0049.051] CreateFileW (lpFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0049.052] CloseHandle (hObject=0xffffffff) returned 1 [0049.052] GetProcessHeap () returned 0x630000 [0049.052] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f10 | out: hHeap=0x630000) returned 1 [0049.052] GetProcessHeap () returned 0x630000 [0049.052] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0049.052] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0049.052] lstrcmpiW (lpString1="Logs", lpString2=".") returned 1 [0049.052] lstrcmpiW (lpString1="Logs", lpString2="..") returned 1 [0049.052] lstrcatW (in: lpString1="C:\\", lpString2="Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs" [0049.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Logs", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0049.052] GetProcessHeap () returned 0x630000 [0049.052] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5) returned 0x65a268 [0049.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Logs", cchWideChar=-1, lpMultiByteStr=0x65a268, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Logs", lpUsedDefaultChar=0x0) returned 5 [0049.052] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0049.052] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0049.052] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0049.052] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0049.052] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0049.052] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0049.052] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0049.052] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0049.052] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0049.052] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0049.052] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0049.052] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0049.052] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0049.052] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0049.052] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0049.052] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0049.053] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0049.053] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0049.053] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0049.053] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0049.053] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0049.053] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0049.053] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0049.053] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0049.053] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0049.053] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0049.053] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0049.053] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0049.053] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0049.053] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0049.053] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0049.053] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0049.053] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0049.053] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0049.053] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0049.053] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0049.053] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0049.053] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0049.053] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0049.053] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0049.053] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0049.053] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0049.053] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0049.053] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0049.053] GetProcessHeap () returned 0x630000 [0049.053] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a3e8 [0049.053] lstrlenW (lpString="C:\\Logs\\") returned 8 [0049.053] GetProcessHeap () returned 0x630000 [0049.053] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x645e38 [0049.053] lstrcpyW (in: lpString1=0x645e38, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0049.053] GetProcessHeap () returned 0x630000 [0049.054] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0049.054] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x21ffac8, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0049.054] lstrcmpiW (lpString1="pagefile.sys", lpString2=".") returned 1 [0049.054] lstrcmpiW (lpString1="pagefile.sys", lpString2="..") returned 1 [0049.054] lstrcatW (in: lpString1="C:\\", lpString2="pagefile.sys" | out: lpString1="C:\\pagefile.sys") returned="C:\\pagefile.sys" [0049.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pagefile.sys", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0049.054] GetProcessHeap () returned 0x630000 [0049.054] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd) returned 0x64c9f0 [0049.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pagefile.sys", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pagefile.sys", lpUsedDefaultChar=0x0) returned 13 [0049.054] lstrlenA (lpString="pagefile.sys") returned 12 [0049.054] lstrlenA (lpString=".happythreechoose") returned 17 [0049.054] lstrcmpiW (lpString1="pagefile.sys", lpString2="Decryption INFO.html") returned 1 [0049.054] lstrcmpiW (lpString1="pagefile.sys", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0049.054] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0049.054] lstrcmpiW (lpString1="pagefile.sys", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0049.054] GetProcessHeap () returned 0x630000 [0049.054] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0049.054] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0049.054] CloseHandle (hObject=0xffffffff) returned 1 [0049.054] GetProcessHeap () returned 0x630000 [0049.054] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0049.054] GetProcessHeap () returned 0x630000 [0049.054] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0049.054] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0049.054] lstrcmpiW (lpString1="PerfLogs", lpString2=".") returned 1 [0049.054] lstrcmpiW (lpString1="PerfLogs", lpString2="..") returned 1 [0049.054] lstrcatW (in: lpString1="C:\\", lpString2="PerfLogs" | out: lpString1="C:\\PerfLogs") returned="C:\\PerfLogs" [0049.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PerfLogs", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0049.054] GetProcessHeap () returned 0x630000 [0049.054] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9) returned 0x64c9f0 [0049.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PerfLogs", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PerfLogs", lpUsedDefaultChar=0x0) returned 9 [0049.055] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0049.055] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0049.055] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0049.055] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0049.055] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0049.055] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0049.055] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0049.055] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0049.055] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0049.055] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0049.055] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0049.055] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0049.055] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0049.055] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0049.055] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0049.055] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0049.055] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0049.055] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0049.055] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0049.055] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0049.055] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0049.055] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0049.055] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0049.055] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0049.055] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0049.055] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0049.055] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0049.055] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0049.055] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0049.055] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0049.055] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0049.055] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0049.055] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0049.055] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0049.056] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0049.056] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0049.056] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0049.056] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0049.056] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0049.056] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0049.056] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0049.056] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0049.056] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0049.056] lstrcatW (in: lpString1="C:\\PerfLogs", lpString2="\\" | out: lpString1="C:\\PerfLogs\\") returned="C:\\PerfLogs\\" [0049.056] GetProcessHeap () returned 0x630000 [0049.056] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a288 [0049.056] lstrlenW (lpString="C:\\PerfLogs\\") returned 12 [0049.056] GetProcessHeap () returned 0x630000 [0049.056] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a) returned 0x651fb0 [0049.056] lstrcpyW (in: lpString1=0x651fb0, lpString2="C:\\PerfLogs\\" | out: lpString1="C:\\PerfLogs\\") returned="C:\\PerfLogs\\" [0049.056] GetProcessHeap () returned 0x630000 [0049.056] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0049.056] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x421bfbaf, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x421bfbaf, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0049.056] lstrcmpiW (lpString1="Program Files", lpString2=".") returned 1 [0049.056] lstrcmpiW (lpString1="Program Files", lpString2="..") returned 1 [0049.056] lstrcatW (in: lpString1="C:\\", lpString2="Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files" [0049.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Program Files", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0049.056] GetProcessHeap () returned 0x630000 [0049.056] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x64c9f0 [0049.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Program Files", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Program Files", lpUsedDefaultChar=0x0) returned 14 [0049.056] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0049.056] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0049.056] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0049.056] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0049.056] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0049.056] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0049.056] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0049.056] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0049.056] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0049.057] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0049.057] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0049.057] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0049.057] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0049.057] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0049.057] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0049.057] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0049.057] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0049.057] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0049.057] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0049.057] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0049.057] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0049.057] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0049.057] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0049.057] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0049.057] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0049.057] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0049.057] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0049.057] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0049.057] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0049.057] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0049.057] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0049.057] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0049.057] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0049.057] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0049.057] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0049.057] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0049.057] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0049.057] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0049.057] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0049.057] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0049.057] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0049.057] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0049.057] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0049.058] lstrcatW (in: lpString1="C:\\Program Files", lpString2="\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0049.058] GetProcessHeap () returned 0x630000 [0049.058] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a3d8 [0049.058] lstrlenW (lpString="C:\\Program Files\\") returned 17 [0049.058] GetProcessHeap () returned 0x630000 [0049.058] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x24) returned 0x644a50 [0049.058] lstrcpyW (in: lpString1=0x644a50, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0049.058] GetProcessHeap () returned 0x630000 [0049.058] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0049.058] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe7a165b3, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xe7a165b3, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0049.058] lstrcmpiW (lpString1="Program Files (x86)", lpString2=".") returned 1 [0049.058] lstrcmpiW (lpString1="Program Files (x86)", lpString2="..") returned 1 [0049.058] lstrcatW (in: lpString1="C:\\", lpString2="Program Files (x86)" | out: lpString1="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0049.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Program Files (x86)", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0049.058] GetProcessHeap () returned 0x630000 [0049.058] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x645ef8 [0049.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Program Files (x86)", cchWideChar=-1, lpMultiByteStr=0x645ef8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Program Files (x86)", lpUsedDefaultChar=0x0) returned 20 [0049.058] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0049.058] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0049.058] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0049.058] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0049.058] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0049.058] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0049.058] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0049.058] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0049.058] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0049.058] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0049.058] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0049.058] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0049.058] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0049.058] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0049.058] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0049.058] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0049.058] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0049.058] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0049.059] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0049.059] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0049.059] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0049.059] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0049.059] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0049.059] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0049.059] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0049.059] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0049.059] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0049.059] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0049.059] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0049.059] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0049.059] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0049.059] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0049.059] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0049.059] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0049.059] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0049.059] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0049.059] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0049.059] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0049.059] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0049.059] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0049.059] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0049.059] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0049.059] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0049.059] lstrcatW (in: lpString1="C:\\Program Files (x86)", lpString2="\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0049.059] GetProcessHeap () returned 0x630000 [0049.059] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a358 [0049.059] lstrlenW (lpString="C:\\Program Files (x86)\\") returned 23 [0049.059] GetProcessHeap () returned 0x630000 [0049.059] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x30) returned 0x652630 [0049.059] lstrcpyW (in: lpString1=0x652630, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0049.059] GetProcessHeap () returned 0x630000 [0049.059] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645ef8 | out: hHeap=0x630000) returned 1 [0049.059] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x450f4738, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0049.060] lstrcmpiW (lpString1="ProgramData", lpString2=".") returned 1 [0049.060] lstrcmpiW (lpString1="ProgramData", lpString2="..") returned 1 [0049.060] lstrcatW (in: lpString1="C:\\", lpString2="ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0049.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramData", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0049.060] GetProcessHeap () returned 0x630000 [0049.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0049.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramData", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProgramData", lpUsedDefaultChar=0x0) returned 12 [0049.060] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0049.060] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0049.060] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0049.060] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0049.060] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0049.060] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0049.060] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0049.060] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0049.060] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0049.060] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0049.060] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0049.060] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0049.060] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0049.060] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0049.060] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0049.060] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0049.060] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0049.060] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0049.060] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0049.060] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0049.060] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0049.060] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0049.060] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0049.060] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0049.060] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0049.060] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0049.060] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0049.060] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0049.061] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0049.061] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0049.061] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0049.061] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0049.061] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0049.061] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0049.061] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0049.061] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0049.061] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0049.061] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0049.061] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0049.061] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0049.061] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0049.061] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0049.061] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 2 [0049.061] GetProcessHeap () returned 0x630000 [0049.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0049.061] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0049.061] lstrcmpiW (lpString1="Recovery", lpString2=".") returned 1 [0049.061] lstrcmpiW (lpString1="Recovery", lpString2="..") returned 1 [0049.061] lstrcatW (in: lpString1="C:\\", lpString2="Recovery" | out: lpString1="C:\\Recovery") returned="C:\\Recovery" [0049.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Recovery", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0049.061] GetProcessHeap () returned 0x630000 [0049.061] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9) returned 0x64c9f0 [0049.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Recovery", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Recovery", lpUsedDefaultChar=0x0) returned 9 [0049.061] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0049.061] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0049.061] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0049.061] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0049.061] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0049.061] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0049.061] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0049.061] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0049.061] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0049.061] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0049.062] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0049.062] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0049.062] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0049.062] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0049.062] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0049.062] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0049.062] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0049.062] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0049.062] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0049.062] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0049.062] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0049.062] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0049.062] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0049.062] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0049.062] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0049.062] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0049.062] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0049.062] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0049.062] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0049.062] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0049.062] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0049.062] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0049.062] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0049.062] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0049.062] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0049.062] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0049.062] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0049.062] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0049.062] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0049.062] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0049.062] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0049.062] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0049.062] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0049.062] lstrcatW (in: lpString1="C:\\Recovery", lpString2="\\" | out: lpString1="C:\\Recovery\\") returned="C:\\Recovery\\" [0049.063] GetProcessHeap () returned 0x630000 [0049.063] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a388 [0049.063] lstrlenW (lpString="C:\\Recovery\\") returned 12 [0049.063] GetProcessHeap () returned 0x630000 [0049.063] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a) returned 0x6520c8 [0049.063] lstrcpyW (in: lpString1=0x6520c8, lpString2="C:\\Recovery\\" | out: lpString1="C:\\Recovery\\") returned="C:\\Recovery\\" [0049.063] GetProcessHeap () returned 0x630000 [0049.063] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0049.063] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6ead2556, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6ead2556, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x21ffac8, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x10000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="swapfile.sys", cAlternateFileName="")) returned 1 [0049.063] lstrcmpiW (lpString1="swapfile.sys", lpString2=".") returned 1 [0049.063] lstrcmpiW (lpString1="swapfile.sys", lpString2="..") returned 1 [0049.063] lstrcatW (in: lpString1="C:\\", lpString2="swapfile.sys" | out: lpString1="C:\\swapfile.sys") returned="C:\\swapfile.sys" [0049.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="swapfile.sys", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0049.063] GetProcessHeap () returned 0x630000 [0049.063] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd) returned 0x64c9f0 [0049.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="swapfile.sys", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="swapfile.sys", lpUsedDefaultChar=0x0) returned 13 [0049.063] lstrlenA (lpString="swapfile.sys") returned 12 [0049.063] lstrlenA (lpString=".happythreechoose") returned 17 [0049.063] lstrcmpiW (lpString1="swapfile.sys", lpString2="Decryption INFO.html") returned 1 [0049.063] lstrcmpiW (lpString1="swapfile.sys", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0049.063] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0049.063] lstrcmpiW (lpString1="swapfile.sys", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0049.063] GetProcessHeap () returned 0x630000 [0049.063] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0049.063] CreateFileW (lpFileName="C:\\swapfile.sys" (normalized: "c:\\swapfile.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0049.063] CloseHandle (hObject=0xffffffff) returned 1 [0049.063] GetProcessHeap () returned 0x630000 [0049.063] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0049.063] GetProcessHeap () returned 0x630000 [0049.063] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0049.063] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x6e16f135, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0xb1ff7ba5, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xb1ff7ba5, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0049.063] lstrcmpiW (lpString1="System Volume Information", lpString2=".") returned 1 [0049.063] lstrcmpiW (lpString1="System Volume Information", lpString2="..") returned 1 [0049.063] lstrcatW (in: lpString1="C:\\", lpString2="System Volume Information" | out: lpString1="C:\\System Volume Information") returned="C:\\System Volume Information" [0049.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="System Volume Information", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0049.064] GetProcessHeap () returned 0x630000 [0049.064] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a) returned 0x651f10 [0049.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="System Volume Information", cchWideChar=-1, lpMultiByteStr=0x651f10, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="System Volume Information", lpUsedDefaultChar=0x0) returned 26 [0049.064] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0049.064] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0049.064] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0049.064] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0049.064] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0049.064] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0049.064] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0049.064] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0049.064] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0049.064] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0049.064] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0049.064] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0049.064] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0049.064] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0049.064] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0049.064] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0049.064] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0049.064] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0049.064] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0049.064] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0049.064] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0049.064] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0049.064] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0049.064] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0049.064] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 3 [0049.064] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 3 [0049.064] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0049.064] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0049.064] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 3 [0049.064] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 3 [0049.065] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 2 [0049.065] GetProcessHeap () returned 0x630000 [0049.065] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f10 | out: hHeap=0x630000) returned 1 [0049.065] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0049.065] lstrcmpiW (lpString1="Users", lpString2=".") returned 1 [0049.065] lstrcmpiW (lpString1="Users", lpString2="..") returned 1 [0049.065] lstrcatW (in: lpString1="C:\\", lpString2="Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0049.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Users", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0049.065] GetProcessHeap () returned 0x630000 [0049.065] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6) returned 0x65a258 [0049.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Users", cchWideChar=-1, lpMultiByteStr=0x65a258, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Users", lpUsedDefaultChar=0x0) returned 6 [0049.065] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0049.065] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0049.065] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0049.065] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0049.065] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0049.065] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0049.065] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0049.065] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0049.065] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0049.065] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0049.065] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0049.065] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0049.065] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0049.065] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0049.065] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0049.065] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0049.065] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0049.065] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0049.065] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0049.065] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0049.065] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0049.065] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0049.065] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0049.066] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0049.066] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 3 [0049.066] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 3 [0049.066] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0049.066] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0049.066] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 3 [0049.066] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 3 [0049.066] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 3 [0049.066] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0049.066] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0049.066] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0049.066] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0049.066] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0049.066] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0049.066] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0049.066] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0049.066] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0049.066] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0049.066] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0049.066] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0049.066] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0049.066] GetProcessHeap () returned 0x630000 [0049.066] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a2f8 [0049.066] lstrlenW (lpString="C:\\Users\\") returned 9 [0049.066] GetProcessHeap () returned 0x630000 [0049.066] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x645e58 [0049.066] lstrcpyW (in: lpString1=0x645e58, lpString2="C:\\Users\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0049.066] GetProcessHeap () returned 0x630000 [0049.066] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0049.066] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0049.066] lstrcmpiW (lpString1="Windows", lpString2=".") returned 1 [0049.066] lstrcmpiW (lpString1="Windows", lpString2="..") returned 1 [0049.067] lstrcatW (in: lpString1="C:\\", lpString2="Windows" | out: lpString1="C:\\Windows") returned="C:\\Windows" [0049.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Windows", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0049.067] GetProcessHeap () returned 0x630000 [0049.067] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a2e8 [0049.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Windows", cchWideChar=-1, lpMultiByteStr=0x65a2e8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows", lpUsedDefaultChar=0x0) returned 8 [0049.067] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 2 [0049.067] GetProcessHeap () returned 0x630000 [0049.067] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2e8 | out: hHeap=0x630000) returned 1 [0049.067] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows10Upgrade", cAlternateFileName="WINDOW~1")) returned 1 [0049.067] lstrcmpiW (lpString1="Windows10Upgrade", lpString2=".") returned 1 [0049.067] lstrcmpiW (lpString1="Windows10Upgrade", lpString2="..") returned 1 [0049.067] lstrcatW (in: lpString1="C:\\", lpString2="Windows10Upgrade" | out: lpString1="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0049.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Windows10Upgrade", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0049.067] GetProcessHeap () returned 0x630000 [0049.067] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11) returned 0x645e78 [0049.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Windows10Upgrade", cchWideChar=-1, lpMultiByteStr=0x645e78, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows10Upgrade", lpUsedDefaultChar=0x0) returned 17 [0049.067] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 3 [0049.067] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0049.067] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0049.067] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 3 [0049.067] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 3 [0049.067] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0049.067] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0049.067] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 3 [0049.067] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 3 [0049.067] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 3 [0049.067] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 3 [0049.067] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 3 [0049.067] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 3 [0049.067] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 3 [0049.067] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 3 [0049.067] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 3 [0049.068] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 3 [0049.068] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0049.068] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0049.068] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0049.068] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0049.068] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0049.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0049.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0049.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 3 [0049.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 3 [0049.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0049.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0049.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 3 [0049.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 3 [0049.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 3 [0049.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0049.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0049.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0049.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0049.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0049.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0049.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0049.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0049.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0049.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0049.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0049.070] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0049.070] lstrcatW (in: lpString1="C:\\Windows10Upgrade", lpString2="\\" | out: lpString1="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0049.070] GetProcessHeap () returned 0x630000 [0049.070] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a378 [0049.070] lstrlenW (lpString="C:\\Windows10Upgrade\\") returned 20 [0049.070] GetProcessHeap () returned 0x630000 [0049.070] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2a) returned 0x652400 [0049.070] lstrcpyW (in: lpString1=0x652400, lpString2="C:\\Windows10Upgrade\\" | out: lpString1="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0049.070] GetProcessHeap () returned 0x630000 [0049.070] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645e78 | out: hHeap=0x630000) returned 1 [0049.070] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows10Upgrade", cAlternateFileName="WINDOW~1")) returned 0 [0049.071] FindClose (in: hFindFile=0x648a10 | out: hFindFile=0x648a10) returned 1 [0049.071] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Windows10Upgrade\\" | out: lpString1="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0049.071] GetProcessHeap () returned 0x630000 [0049.071] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x652400 | out: hHeap=0x630000) returned 1 [0049.071] GetProcessHeap () returned 0x630000 [0049.071] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0049.071] lstrlenW (lpString="C:\\Windows10Upgrade\\") returned 20 [0049.071] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="*" | out: lpString1="C:\\Windows10Upgrade\\*") returned="C:\\Windows10Upgrade\\*" [0049.071] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648b10 [0049.073] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0049.073] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.073] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0049.074] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0049.074] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea35483d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea355be9, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="2052", cAlternateFileName="")) returned 1 [0049.074] lstrcmpiW (lpString1="2052", lpString2=".") returned 1 [0049.074] lstrcmpiW (lpString1="2052", lpString2="..") returned 1 [0049.074] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="2052" | out: lpString1="C:\\Windows10Upgrade\\2052") returned="C:\\Windows10Upgrade\\2052" [0049.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="2052", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0049.074] GetProcessHeap () returned 0x630000 [0049.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5) returned 0x65a338 [0049.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="2052", cchWideChar=-1, lpMultiByteStr=0x65a338, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2052", lpUsedDefaultChar=0x0) returned 5 [0049.074] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0049.074] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0049.074] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0049.074] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0049.074] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0049.074] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0049.074] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0049.074] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0049.074] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0049.074] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0049.074] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0049.074] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0049.074] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0049.074] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0049.074] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0049.074] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0049.074] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0049.074] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0049.074] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0049.074] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0049.074] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0049.074] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0049.074] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0049.074] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 1 [0049.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0049.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0049.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 1 [0049.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0049.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0049.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0049.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0049.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 1 [0049.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0049.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0049.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0049.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0049.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0049.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0049.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0049.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0049.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0049.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0049.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0049.075] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\2052", lpString2="\\" | out: lpString1="C:\\Windows10Upgrade\\2052\\") returned="C:\\Windows10Upgrade\\2052\\" [0049.075] GetProcessHeap () returned 0x630000 [0049.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a318 [0049.075] lstrlenW (lpString="C:\\Windows10Upgrade\\2052\\") returned 25 [0049.075] GetProcessHeap () returned 0x630000 [0049.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x34) returned 0x648c90 [0049.075] lstrcpyW (in: lpString1=0x648c90, lpString2="C:\\Windows10Upgrade\\2052\\" | out: lpString1="C:\\Windows10Upgrade\\2052\\") returned="C:\\Windows10Upgrade\\2052\\" [0049.075] GetProcessHeap () returned 0x630000 [0049.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0049.075] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3659ec, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3659ec, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x704c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="appraiserxp.dll", cAlternateFileName="APPRAI~1.DLL")) returned 1 [0049.075] lstrcmpiW (lpString1="appraiserxp.dll", lpString2=".") returned 1 [0049.075] lstrcmpiW (lpString1="appraiserxp.dll", lpString2="..") returned 1 [0049.075] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="appraiserxp.dll" | out: lpString1="C:\\Windows10Upgrade\\appraiserxp.dll") returned="C:\\Windows10Upgrade\\appraiserxp.dll" [0049.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appraiserxp.dll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0049.075] GetProcessHeap () returned 0x630000 [0049.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x64c9f0 [0049.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appraiserxp.dll", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appraiserxp.dll", lpUsedDefaultChar=0x0) returned 16 [0049.076] lstrlenA (lpString="appraiserxp.dll") returned 15 [0049.076] lstrlenA (lpString=".happythreechoose") returned 17 [0049.076] lstrcmpiW (lpString1="appraiserxp.dll", lpString2="Decryption INFO.html") returned -1 [0049.076] lstrcmpiW (lpString1="appraiserxp.dll", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0049.076] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0049.076] lstrcmpiW (lpString1="appraiserxp.dll", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0049.076] GetProcessHeap () returned 0x630000 [0049.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0049.076] CreateFileW (lpFileName="C:\\Windows10Upgrade\\appraiserxp.dll" (normalized: "c:\\windows10upgrade\\appraiserxp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0049.077] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=459976) returned 1 [0049.077] GetProcessHeap () returned 0x630000 [0049.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x63e830 [0049.077] GetProcessHeap () returned 0x630000 [0049.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0049.077] lstrlenW (lpString="C:\\Windows10Upgrade\\appraiserxp.dll") returned 35 [0049.077] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0049.077] GetProcessHeap () returned 0x630000 [0049.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0049.077] GetProcessHeap () returned 0x630000 [0049.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x388) returned 0x65a490 [0049.077] lstrlenA (lpString="rsa_encrypt") returned 11 [0049.078] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0049.078] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0049.078] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0049.078] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0049.078] GetProcessHeap () returned 0x630000 [0049.078] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0049.078] lstrlenA (lpString="010001") returned 6 [0049.078] GetProcessHeap () returned 0x630000 [0049.078] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a368 [0049.078] GetProcessHeap () returned 0x630000 [0049.078] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0049.078] GetProcessHeap () returned 0x630000 [0049.078] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655b60 [0049.078] GetProcessHeap () returned 0x630000 [0049.078] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0049.078] GetProcessHeap () returned 0x630000 [0049.078] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x6559b0 [0049.079] GetProcessHeap () returned 0x630000 [0049.079] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x6418f0 [0049.079] GetProcessHeap () returned 0x630000 [0049.079] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a328 [0049.079] GetProcessHeap () returned 0x630000 [0049.079] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x63f900 [0049.079] GetProcessHeap () returned 0x630000 [0049.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0049.079] GetProcessHeap () returned 0x630000 [0049.079] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x641658 [0049.079] GetProcessHeap () returned 0x630000 [0049.079] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0049.079] GetProcessHeap () returned 0x630000 [0049.079] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657328 [0049.079] GetProcessHeap () returned 0x630000 [0049.079] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0049.079] GetProcessHeap () returned 0x630000 [0049.079] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0049.079] GetProcessHeap () returned 0x630000 [0049.079] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655e30 [0049.079] GetProcessHeap () returned 0x630000 [0049.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0049.079] GetProcessHeap () returned 0x630000 [0049.079] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x63f6e0 [0049.079] GetProcessHeap () returned 0x630000 [0049.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655e30 | out: hHeap=0x630000) returned 1 [0049.079] GetProcessHeap () returned 0x630000 [0049.079] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0049.079] GetProcessHeap () returned 0x630000 [0049.079] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65aa90 [0049.079] GetProcessHeap () returned 0x630000 [0049.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0049.079] GetProcessHeap () returned 0x630000 [0049.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0049.079] GetProcessHeap () returned 0x630000 [0049.079] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0049.079] GetProcessHeap () returned 0x630000 [0049.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0049.079] GetProcessHeap () returned 0x630000 [0049.079] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x655ec0 [0049.079] GetProcessHeap () returned 0x630000 [0049.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65aa90 | out: hHeap=0x630000) returned 1 [0049.080] GetProcessHeap () returned 0x630000 [0049.080] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x63f408 [0049.080] GetProcessHeap () returned 0x630000 [0049.080] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655ec0 | out: hHeap=0x630000) returned 1 [0049.080] GetProcessHeap () returned 0x630000 [0049.080] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0049.080] GetProcessHeap () returned 0x630000 [0049.080] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0049.080] GetProcessHeap () returned 0x630000 [0049.080] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0049.080] GetProcessHeap () returned 0x630000 [0049.080] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0049.080] GetProcessHeap () returned 0x630000 [0049.080] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0049.080] GetProcessHeap () returned 0x630000 [0049.080] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0049.080] GetProcessHeap () returned 0x630000 [0049.080] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0049.080] GetProcessHeap () returned 0x630000 [0049.080] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0049.080] GetProcessHeap () returned 0x630000 [0049.080] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0049.080] GetProcessHeap () returned 0x630000 [0049.080] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0049.080] GetProcessHeap () returned 0x630000 [0049.080] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0049.080] GetProcessHeap () returned 0x630000 [0049.080] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0049.080] GetProcessHeap () returned 0x630000 [0049.080] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2e8 [0049.080] GetProcessHeap () returned 0x630000 [0049.080] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2e8 | out: hHeap=0x630000) returned 1 [0049.080] GetProcessHeap () returned 0x630000 [0049.080] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0049.080] GetProcessHeap () returned 0x630000 [0049.080] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0049.080] GetProcessHeap () returned 0x630000 [0049.080] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0049.081] GetProcessHeap () returned 0x630000 [0049.081] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0049.081] GetProcessHeap () returned 0x630000 [0049.081] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0049.081] GetProcessHeap () returned 0x630000 [0049.081] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0049.081] GetProcessHeap () returned 0x630000 [0049.081] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2e8 [0049.081] GetProcessHeap () returned 0x630000 [0049.081] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2e8 | out: hHeap=0x630000) returned 1 [0049.081] GetProcessHeap () returned 0x630000 [0049.081] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0049.081] GetProcessHeap () returned 0x630000 [0049.081] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0049.081] GetProcessHeap () returned 0x630000 [0049.081] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0049.081] GetProcessHeap () returned 0x630000 [0049.081] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0049.081] GetProcessHeap () returned 0x630000 [0049.081] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0049.081] GetProcessHeap () returned 0x630000 [0049.081] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0049.081] GetProcessHeap () returned 0x630000 [0049.081] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0049.081] GetProcessHeap () returned 0x630000 [0049.081] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0049.081] GetProcessHeap () returned 0x630000 [0049.081] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0049.081] GetProcessHeap () returned 0x630000 [0049.081] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0049.081] GetProcessHeap () returned 0x630000 [0049.081] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0049.081] GetProcessHeap () returned 0x630000 [0049.081] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0049.081] GetProcessHeap () returned 0x630000 [0049.081] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0049.081] GetProcessHeap () returned 0x630000 [0049.082] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0049.082] GetProcessHeap () returned 0x630000 [0049.082] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0049.082] GetProcessHeap () returned 0x630000 [0049.082] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0049.082] GetProcessHeap () returned 0x630000 [0049.082] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0049.082] GetProcessHeap () returned 0x630000 [0049.082] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0049.082] GetProcessHeap () returned 0x630000 [0049.082] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0049.082] GetProcessHeap () returned 0x630000 [0049.082] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0049.082] GetProcessHeap () returned 0x630000 [0049.082] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0049.082] GetProcessHeap () returned 0x630000 [0049.082] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0049.082] GetProcessHeap () returned 0x630000 [0049.082] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0049.082] GetProcessHeap () returned 0x630000 [0049.082] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0049.082] GetProcessHeap () returned 0x630000 [0049.082] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0049.082] GetProcessHeap () returned 0x630000 [0049.082] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0049.082] GetProcessHeap () returned 0x630000 [0049.082] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0049.082] GetProcessHeap () returned 0x630000 [0049.082] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0049.082] GetProcessHeap () returned 0x630000 [0049.082] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2e8 [0049.082] GetProcessHeap () returned 0x630000 [0049.082] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2e8 | out: hHeap=0x630000) returned 1 [0049.082] GetProcessHeap () returned 0x630000 [0049.082] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0049.082] GetProcessHeap () returned 0x630000 [0049.082] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0049.083] GetProcessHeap () returned 0x630000 [0049.083] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2e8 [0049.083] GetProcessHeap () returned 0x630000 [0049.083] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2e8 | out: hHeap=0x630000) returned 1 [0049.083] GetProcessHeap () returned 0x630000 [0049.083] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0049.083] GetProcessHeap () returned 0x630000 [0049.083] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0049.083] GetProcessHeap () returned 0x630000 [0049.083] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0049.083] GetProcessHeap () returned 0x630000 [0049.083] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0049.083] GetProcessHeap () returned 0x630000 [0049.083] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0049.083] GetProcessHeap () returned 0x630000 [0049.083] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0049.083] GetProcessHeap () returned 0x630000 [0049.083] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0049.083] GetProcessHeap () returned 0x630000 [0049.083] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0049.083] GetProcessHeap () returned 0x630000 [0049.083] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0049.083] GetProcessHeap () returned 0x630000 [0049.083] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0049.083] GetProcessHeap () returned 0x630000 [0049.083] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0049.083] GetProcessHeap () returned 0x630000 [0049.083] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0049.194] GetProcessHeap () returned 0x630000 [0049.194] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0049.194] GetProcessHeap () returned 0x630000 [0049.194] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0049.194] GetProcessHeap () returned 0x630000 [0049.194] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0049.195] GetProcessHeap () returned 0x630000 [0049.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0049.195] GetProcessHeap () returned 0x630000 [0049.195] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0049.195] GetProcessHeap () returned 0x630000 [0049.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0049.195] GetProcessHeap () returned 0x630000 [0049.195] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0049.195] GetProcessHeap () returned 0x630000 [0049.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0049.195] GetProcessHeap () returned 0x630000 [0049.195] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0049.195] GetProcessHeap () returned 0x630000 [0049.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0049.195] GetProcessHeap () returned 0x630000 [0049.195] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0049.195] GetProcessHeap () returned 0x630000 [0049.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0049.195] GetProcessHeap () returned 0x630000 [0049.195] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0049.195] GetProcessHeap () returned 0x630000 [0049.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0049.195] GetProcessHeap () returned 0x630000 [0049.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x641658 | out: hHeap=0x630000) returned 1 [0049.195] GetProcessHeap () returned 0x630000 [0049.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63f6e0 | out: hHeap=0x630000) returned 1 [0049.195] GetProcessHeap () returned 0x630000 [0049.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0049.195] GetProcessHeap () returned 0x630000 [0049.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63f408 | out: hHeap=0x630000) returned 1 [0049.195] GetProcessHeap () returned 0x630000 [0049.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0049.195] GetProcessHeap () returned 0x630000 [0049.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6559b0 | out: hHeap=0x630000) returned 1 [0049.195] GetProcessHeap () returned 0x630000 [0049.196] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6418f0 | out: hHeap=0x630000) returned 1 [0049.196] GetProcessHeap () returned 0x630000 [0049.196] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655b60 | out: hHeap=0x630000) returned 1 [0049.196] GetProcessHeap () returned 0x630000 [0049.196] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63f900 | out: hHeap=0x630000) returned 1 [0049.196] GetProcessHeap () returned 0x630000 [0049.196] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0049.196] GetProcessHeap () returned 0x630000 [0049.196] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0049.196] WriteFile (in: hFile=0x230, lpBuffer=0x65a490*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65a490*, lpNumberOfBytesWritten=0x243d864*=0x388, lpOverlapped=0x0) returned 1 [0049.220] GetProcessHeap () returned 0x630000 [0049.220] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65a490, Size=0x30) returned 0x65a490 [0049.220] GetProcessHeap () returned 0x630000 [0049.220] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0049.220] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0049.220] GetProcessHeap () returned 0x630000 [0049.220] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x704d0) returned 0x65ac28 [0049.231] ReadFile (in: hFile=0x230, lpBuffer=0x65ac28, nNumberOfBytesToRead=0x704d0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ac28*, lpNumberOfBytesRead=0x243d7e8*=0x704d0, lpOverlapped=0x0) returned 1 [0049.239] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0049.239] WriteFile (in: hFile=0x230, lpBuffer=0x65ac28*, nNumberOfBytesToWrite=0x704d0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ac28*, lpNumberOfBytesWritten=0x243d7e4*=0x704d0, lpOverlapped=0x0) returned 1 [0049.285] GetProcessHeap () returned 0x630000 [0049.285] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ac28 | out: hHeap=0x630000) returned 1 [0049.288] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0049.288] WriteFile (in: hFile=0x230, lpBuffer=0x65a490*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65a490*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0049.289] CloseHandle (hObject=0x230) returned 1 [0049.298] GetProcessHeap () returned 0x630000 [0049.298] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0049.298] GetProcessHeap () returned 0x630000 [0049.298] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0049.298] GetProcessHeap () returned 0x630000 [0049.298] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0049.298] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\appraiserxp.dll" | out: lpString1="C:\\Windows10Upgrade\\appraiserxp.dll") returned="C:\\Windows10Upgrade\\appraiserxp.dll" [0049.299] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\appraiserxp.dll", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\appraiserxp.dll.happythreechoose") returned="C:\\Windows10Upgrade\\appraiserxp.dll.happythreechoose" [0049.299] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\appraiserxp.dll" (normalized: "c:\\windows10upgrade\\appraiserxp.dll"), lpNewFileName="C:\\Windows10Upgrade\\appraiserxp.dll.happythreechoose" (normalized: "c:\\windows10upgrade\\appraiserxp.dll.happythreechoose"), dwFlags=0x1) returned 1 [0049.299] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\appraiserxp.dll" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0049.299] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0049.299] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\Decryption INFO.html" [0049.299] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\decryption info.html")) returned 0xffffffff [0049.299] CreateFileW (lpFileName="C:\\Windows10Upgrade\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0049.300] GetProcessHeap () returned 0x630000 [0049.300] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x63e830 [0049.300] GetProcessHeap () returned 0x630000 [0049.300] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0049.310] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.311] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.311] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.312] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.312] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.312] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.312] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.312] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.312] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.312] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.312] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.312] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.312] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.312] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.312] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.312] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.312] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.313] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.313] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.313] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.313] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.313] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.313] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.313] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.313] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.313] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.313] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.313] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.313] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.313] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.313] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.314] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.314] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.314] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.314] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.314] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.314] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.315] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.315] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.315] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.315] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.315] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.315] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.316] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.316] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.316] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.316] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.316] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.316] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.316] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.316] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.316] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.316] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.316] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.316] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.316] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.316] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.316] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.317] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.317] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.317] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.317] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.317] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.317] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.317] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.317] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.317] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.317] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.317] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.317] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.317] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.317] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.318] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.318] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.318] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.318] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.318] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.318] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.318] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.318] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.318] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.318] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.318] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.319] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.319] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.319] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.319] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.319] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.319] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.319] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.319] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.319] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.319] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.319] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.319] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.319] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.319] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.319] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.320] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.320] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.320] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.320] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.320] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.320] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.320] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.320] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.320] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.320] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.320] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.320] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.320] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.320] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.321] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.321] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.321] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.321] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.321] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.321] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.321] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.321] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.321] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.321] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.321] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.321] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.321] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.321] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.321] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.322] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.322] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.322] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.322] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.322] GetProcessHeap () returned 0x630000 [0049.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0049.322] GetProcessHeap () returned 0x630000 [0049.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0049.322] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0049.322] GetProcessHeap () returned 0x630000 [0049.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x63e830 [0049.322] GetProcessHeap () returned 0x630000 [0049.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0049.329] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.329] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.329] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.329] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.329] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.329] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.330] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.330] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.330] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.330] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.330] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.330] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.330] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.330] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.330] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.330] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.330] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.330] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.330] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.330] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.331] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.331] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.331] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.331] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.331] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.331] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.331] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.331] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.331] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.331] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.331] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.331] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.331] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.332] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.332] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.332] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.332] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.332] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.332] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.332] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.332] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.332] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.332] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.332] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.333] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.333] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.333] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.333] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.333] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.333] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.333] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.333] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.333] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.333] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.357] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.357] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.357] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.357] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.357] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.357] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.357] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.357] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.358] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.358] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.358] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.358] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.358] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.358] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.358] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.358] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.358] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.358] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.358] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.358] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.358] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.358] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.359] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.359] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.359] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.359] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.359] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.359] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.359] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.359] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.359] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.359] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.359] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.359] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.359] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.360] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.360] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.360] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.360] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.360] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.360] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.360] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.360] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.360] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.360] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.360] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.360] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.361] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.361] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.361] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.361] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.361] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.361] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.361] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.361] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.361] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.361] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.361] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.361] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.361] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.361] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.361] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.361] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.362] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0049.362] GetProcessHeap () returned 0x630000 [0049.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0049.362] GetProcessHeap () returned 0x630000 [0049.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0049.363] CloseHandle (hObject=0x230) returned 1 [0049.363] GetProcessHeap () returned 0x630000 [0049.363] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0049.363] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea36cf08, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea36cf08, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x1cec8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootsect.exe", cAlternateFileName="")) returned 1 [0049.363] lstrcmpiW (lpString1="bootsect.exe", lpString2=".") returned 1 [0049.363] lstrcmpiW (lpString1="bootsect.exe", lpString2="..") returned 1 [0049.363] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="bootsect.exe" | out: lpString1="C:\\Windows10Upgrade\\bootsect.exe") returned="C:\\Windows10Upgrade\\bootsect.exe" [0049.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bootsect.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0049.363] GetProcessHeap () returned 0x630000 [0049.363] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd) returned 0x64c9f0 [0049.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bootsect.exe", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootsect.exe", lpUsedDefaultChar=0x0) returned 13 [0049.363] lstrlenA (lpString="bootsect.exe") returned 12 [0049.363] lstrlenA (lpString=".happythreechoose") returned 17 [0049.363] lstrcmpiW (lpString1="bootsect.exe", lpString2="Decryption INFO.html") returned -1 [0049.363] lstrcmpiW (lpString1="bootsect.exe", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0049.363] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0049.363] lstrcmpiW (lpString1="bootsect.exe", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0049.363] GetProcessHeap () returned 0x630000 [0049.363] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0049.363] CreateFileW (lpFileName="C:\\Windows10Upgrade\\bootsect.exe" (normalized: "c:\\windows10upgrade\\bootsect.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0049.364] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=118472) returned 1 [0049.364] GetProcessHeap () returned 0x630000 [0049.364] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x63e830 [0049.364] GetProcessHeap () returned 0x630000 [0049.364] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0049.364] lstrlenW (lpString="C:\\Windows10Upgrade\\bootsect.exe") returned 32 [0049.364] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0049.364] GetProcessHeap () returned 0x630000 [0049.364] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0049.364] GetProcessHeap () returned 0x630000 [0049.364] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x388) returned 0x65ac28 [0049.390] lstrlenA (lpString="rsa_encrypt") returned 11 [0049.390] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0049.391] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0049.391] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0049.391] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0049.391] GetProcessHeap () returned 0x630000 [0049.391] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0049.391] lstrlenA (lpString="010001") returned 6 [0049.391] GetProcessHeap () returned 0x630000 [0049.391] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a368 [0049.391] GetProcessHeap () returned 0x630000 [0049.391] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0049.391] GetProcessHeap () returned 0x630000 [0049.391] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x6554a0 [0049.391] GetProcessHeap () returned 0x630000 [0049.391] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0049.391] GetProcessHeap () returned 0x630000 [0049.391] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x6556e0 [0049.391] GetProcessHeap () returned 0x630000 [0049.391] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x63f900 [0049.391] GetProcessHeap () returned 0x630000 [0049.391] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a328 [0049.391] GetProcessHeap () returned 0x630000 [0049.391] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6418f0 [0049.391] GetProcessHeap () returned 0x630000 [0049.391] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0049.391] GetProcessHeap () returned 0x630000 [0049.391] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x641658 [0049.391] GetProcessHeap () returned 0x630000 [0049.391] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0049.391] GetProcessHeap () returned 0x630000 [0049.391] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656b80 [0049.391] GetProcessHeap () returned 0x630000 [0049.391] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0049.391] GetProcessHeap () returned 0x630000 [0049.391] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0049.391] GetProcessHeap () returned 0x630000 [0049.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x6559b0 [0049.392] GetProcessHeap () returned 0x630000 [0049.392] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0049.392] GetProcessHeap () returned 0x630000 [0049.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x63f6e0 [0049.392] GetProcessHeap () returned 0x630000 [0049.392] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6559b0 | out: hHeap=0x630000) returned 1 [0049.392] GetProcessHeap () returned 0x630000 [0049.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0049.392] GetProcessHeap () returned 0x630000 [0049.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65aa48 [0049.392] GetProcessHeap () returned 0x630000 [0049.392] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0049.392] GetProcessHeap () returned 0x630000 [0049.392] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0049.392] GetProcessHeap () returned 0x630000 [0049.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0049.392] GetProcessHeap () returned 0x630000 [0049.392] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0049.392] GetProcessHeap () returned 0x630000 [0049.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x655a40 [0049.392] GetProcessHeap () returned 0x630000 [0049.392] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65aa48 | out: hHeap=0x630000) returned 1 [0049.392] GetProcessHeap () returned 0x630000 [0049.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x63f408 [0049.392] GetProcessHeap () returned 0x630000 [0049.392] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655a40 | out: hHeap=0x630000) returned 1 [0049.392] GetProcessHeap () returned 0x630000 [0049.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0049.392] GetProcessHeap () returned 0x630000 [0049.392] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0049.392] GetProcessHeap () returned 0x630000 [0049.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0049.392] GetProcessHeap () returned 0x630000 [0049.392] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0049.392] GetProcessHeap () returned 0x630000 [0049.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0049.392] GetProcessHeap () returned 0x630000 [0049.392] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0049.392] GetProcessHeap () returned 0x630000 [0049.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0049.393] GetProcessHeap () returned 0x630000 [0049.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0049.393] GetProcessHeap () returned 0x630000 [0049.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0049.393] GetProcessHeap () returned 0x630000 [0049.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0049.393] GetProcessHeap () returned 0x630000 [0049.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0049.393] GetProcessHeap () returned 0x630000 [0049.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0049.393] GetProcessHeap () returned 0x630000 [0049.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0049.393] GetProcessHeap () returned 0x630000 [0049.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0049.393] GetProcessHeap () returned 0x630000 [0049.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0049.393] GetProcessHeap () returned 0x630000 [0049.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0049.393] GetProcessHeap () returned 0x630000 [0049.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0049.393] GetProcessHeap () returned 0x630000 [0049.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0049.393] GetProcessHeap () returned 0x630000 [0049.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0049.393] GetProcessHeap () returned 0x630000 [0049.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0049.393] GetProcessHeap () returned 0x630000 [0049.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0049.393] GetProcessHeap () returned 0x630000 [0049.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0049.393] GetProcessHeap () returned 0x630000 [0049.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0049.393] GetProcessHeap () returned 0x630000 [0049.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0049.393] GetProcessHeap () returned 0x630000 [0049.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2e8 [0049.393] GetProcessHeap () returned 0x630000 [0049.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2e8 | out: hHeap=0x630000) returned 1 [0049.394] GetProcessHeap () returned 0x630000 [0049.394] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0049.394] GetProcessHeap () returned 0x630000 [0049.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0049.394] GetProcessHeap () returned 0x630000 [0049.394] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0049.394] GetProcessHeap () returned 0x630000 [0049.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0049.394] GetProcessHeap () returned 0x630000 [0049.394] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0049.394] GetProcessHeap () returned 0x630000 [0049.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0049.394] GetProcessHeap () returned 0x630000 [0049.394] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0049.394] GetProcessHeap () returned 0x630000 [0049.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0049.394] GetProcessHeap () returned 0x630000 [0049.394] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0049.394] GetProcessHeap () returned 0x630000 [0049.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0049.394] GetProcessHeap () returned 0x630000 [0049.394] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0049.394] GetProcessHeap () returned 0x630000 [0049.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0049.394] GetProcessHeap () returned 0x630000 [0049.394] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0049.394] GetProcessHeap () returned 0x630000 [0049.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0049.394] GetProcessHeap () returned 0x630000 [0049.394] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0049.394] GetProcessHeap () returned 0x630000 [0049.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0049.394] GetProcessHeap () returned 0x630000 [0049.394] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0049.394] GetProcessHeap () returned 0x630000 [0049.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0049.395] GetProcessHeap () returned 0x630000 [0049.395] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0049.395] GetProcessHeap () returned 0x630000 [0049.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0049.395] GetProcessHeap () returned 0x630000 [0049.395] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0049.395] GetProcessHeap () returned 0x630000 [0049.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0049.395] GetProcessHeap () returned 0x630000 [0049.395] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0049.395] GetProcessHeap () returned 0x630000 [0049.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0049.395] GetProcessHeap () returned 0x630000 [0049.395] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0049.395] GetProcessHeap () returned 0x630000 [0049.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0049.395] GetProcessHeap () returned 0x630000 [0049.395] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0049.395] GetProcessHeap () returned 0x630000 [0049.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0049.395] GetProcessHeap () returned 0x630000 [0049.395] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0049.395] GetProcessHeap () returned 0x630000 [0049.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0049.395] GetProcessHeap () returned 0x630000 [0049.395] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0049.395] GetProcessHeap () returned 0x630000 [0049.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0049.395] GetProcessHeap () returned 0x630000 [0049.395] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2e8 [0049.395] GetProcessHeap () returned 0x630000 [0049.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2e8 | out: hHeap=0x630000) returned 1 [0049.395] GetProcessHeap () returned 0x630000 [0049.395] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2e8 [0049.395] GetProcessHeap () returned 0x630000 [0049.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2e8 | out: hHeap=0x630000) returned 1 [0049.395] GetProcessHeap () returned 0x630000 [0049.395] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0049.396] GetProcessHeap () returned 0x630000 [0049.396] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0049.396] GetProcessHeap () returned 0x630000 [0049.396] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2e8 [0049.396] GetProcessHeap () returned 0x630000 [0049.396] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2e8 | out: hHeap=0x630000) returned 1 [0049.396] GetProcessHeap () returned 0x630000 [0049.396] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0049.396] GetProcessHeap () returned 0x630000 [0049.396] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0049.396] GetProcessHeap () returned 0x630000 [0049.396] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0049.396] GetProcessHeap () returned 0x630000 [0049.396] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0049.396] GetProcessHeap () returned 0x630000 [0049.396] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0049.396] GetProcessHeap () returned 0x630000 [0049.396] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0049.396] GetProcessHeap () returned 0x630000 [0049.396] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0049.396] GetProcessHeap () returned 0x630000 [0049.396] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0049.396] GetProcessHeap () returned 0x630000 [0049.396] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0049.396] GetProcessHeap () returned 0x630000 [0049.396] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0049.396] GetProcessHeap () returned 0x630000 [0049.396] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0049.396] GetProcessHeap () returned 0x630000 [0049.396] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0049.396] GetProcessHeap () returned 0x630000 [0049.396] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0049.396] GetProcessHeap () returned 0x630000 [0049.396] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0049.396] GetProcessHeap () returned 0x630000 [0049.397] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0049.397] GetProcessHeap () returned 0x630000 [0049.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0049.397] GetProcessHeap () returned 0x630000 [0049.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x641658 | out: hHeap=0x630000) returned 1 [0049.397] GetProcessHeap () returned 0x630000 [0049.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63f6e0 | out: hHeap=0x630000) returned 1 [0049.397] GetProcessHeap () returned 0x630000 [0049.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0049.397] GetProcessHeap () returned 0x630000 [0049.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63f408 | out: hHeap=0x630000) returned 1 [0049.397] GetProcessHeap () returned 0x630000 [0049.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0049.397] GetProcessHeap () returned 0x630000 [0049.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6556e0 | out: hHeap=0x630000) returned 1 [0049.397] GetProcessHeap () returned 0x630000 [0049.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63f900 | out: hHeap=0x630000) returned 1 [0049.397] GetProcessHeap () returned 0x630000 [0049.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6554a0 | out: hHeap=0x630000) returned 1 [0049.397] GetProcessHeap () returned 0x630000 [0049.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6418f0 | out: hHeap=0x630000) returned 1 [0049.397] GetProcessHeap () returned 0x630000 [0049.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0049.397] GetProcessHeap () returned 0x630000 [0049.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0049.397] WriteFile (in: hFile=0x230, lpBuffer=0x65ac28*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65ac28*, lpNumberOfBytesWritten=0x243d864*=0x388, lpOverlapped=0x0) returned 1 [0049.425] GetProcessHeap () returned 0x630000 [0049.425] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65ac28, Size=0x30) returned 0x65ac28 [0049.425] GetProcessHeap () returned 0x630000 [0049.425] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0049.425] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0049.425] GetProcessHeap () returned 0x630000 [0049.425] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1ced0) returned 0x65ac60 [0049.428] ReadFile (in: hFile=0x230, lpBuffer=0x65ac60, nNumberOfBytesToRead=0x1ced0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ac60*, lpNumberOfBytesRead=0x243d7e8*=0x1ced0, lpOverlapped=0x0) returned 1 [0049.430] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0049.430] WriteFile (in: hFile=0x230, lpBuffer=0x65ac60*, nNumberOfBytesToWrite=0x1ced0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ac60*, lpNumberOfBytesWritten=0x243d7e4*=0x1ced0, lpOverlapped=0x0) returned 1 [0049.440] GetProcessHeap () returned 0x630000 [0049.440] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ac60 | out: hHeap=0x630000) returned 1 [0049.440] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0049.440] WriteFile (in: hFile=0x230, lpBuffer=0x65ac28*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65ac28*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0049.441] CloseHandle (hObject=0x230) returned 1 [0049.446] GetProcessHeap () returned 0x630000 [0049.446] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0049.446] GetProcessHeap () returned 0x630000 [0049.446] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0049.446] GetProcessHeap () returned 0x630000 [0049.446] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0049.446] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\bootsect.exe" | out: lpString1="C:\\Windows10Upgrade\\bootsect.exe") returned="C:\\Windows10Upgrade\\bootsect.exe" [0049.446] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\bootsect.exe", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\bootsect.exe.happythreechoose") returned="C:\\Windows10Upgrade\\bootsect.exe.happythreechoose" [0049.446] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\bootsect.exe" (normalized: "c:\\windows10upgrade\\bootsect.exe"), lpNewFileName="C:\\Windows10Upgrade\\bootsect.exe.happythreechoose" (normalized: "c:\\windows10upgrade\\bootsect.exe.happythreechoose"), dwFlags=0x1) returned 1 [0049.447] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\bootsect.exe" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0049.447] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0049.447] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\Decryption INFO.html" [0049.447] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\decryption info.html")) returned 0x20 [0049.447] GetProcessHeap () returned 0x630000 [0049.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0049.447] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea350dad, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea350dad, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xb08c3ee, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Configuration.ini", cAlternateFileName="CONFIG~1.INI")) returned 1 [0049.447] lstrcmpiW (lpString1="Configuration.ini", lpString2=".") returned 1 [0049.447] lstrcmpiW (lpString1="Configuration.ini", lpString2="..") returned 1 [0049.447] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="Configuration.ini" | out: lpString1="C:\\Windows10Upgrade\\Configuration.ini") returned="C:\\Windows10Upgrade\\Configuration.ini" [0049.447] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Configuration.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0049.447] GetProcessHeap () returned 0x630000 [0049.447] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x645f58 [0049.447] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Configuration.ini", cchWideChar=-1, lpMultiByteStr=0x645f58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Configuration.ini", lpUsedDefaultChar=0x0) returned 18 [0049.447] lstrlenA (lpString="Configuration.ini") returned 17 [0049.447] lstrlenA (lpString=".happythreechoose") returned 17 [0049.447] lstrlenA (lpString=".happythreechoose") returned 17 [0049.447] lstrlenA (lpString="Configuration.ini") returned 17 [0049.447] lstrcmpiA (lpString1="Configuration.ini", lpString2=".happythreechoose") returned 1 [0049.447] lstrcmpiW (lpString1="Configuration.ini", lpString2="Decryption INFO.html") returned -1 [0049.447] lstrcmpiW (lpString1="Configuration.ini", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0049.447] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0049.447] lstrcmpiW (lpString1="Configuration.ini", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0049.447] GetProcessHeap () returned 0x630000 [0049.447] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0049.448] CreateFileW (lpFileName="C:\\Windows10Upgrade\\Configuration.ini" (normalized: "c:\\windows10upgrade\\configuration.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0049.448] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=212) returned 1 [0049.448] GetProcessHeap () returned 0x630000 [0049.448] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x63e830 [0049.448] GetProcessHeap () returned 0x630000 [0049.448] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0049.448] lstrlenW (lpString="C:\\Windows10Upgrade\\Configuration.ini") returned 37 [0049.448] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0049.448] GetProcessHeap () returned 0x630000 [0049.448] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0049.448] GetProcessHeap () returned 0x630000 [0049.448] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38c) returned 0x65ac60 [0049.448] lstrlenA (lpString="rsa_encrypt") returned 11 [0049.448] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0049.449] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0049.449] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0049.449] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0049.449] GetProcessHeap () returned 0x630000 [0049.449] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0049.449] lstrlenA (lpString="010001") returned 6 [0049.449] GetProcessHeap () returned 0x630000 [0049.449] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2e8 [0049.449] GetProcessHeap () returned 0x630000 [0049.449] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0049.449] GetProcessHeap () returned 0x630000 [0049.449] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655140 [0049.449] GetProcessHeap () returned 0x630000 [0049.449] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0049.449] GetProcessHeap () returned 0x630000 [0049.449] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655260 [0049.449] GetProcessHeap () returned 0x630000 [0049.449] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x6418f0 [0049.449] GetProcessHeap () returned 0x630000 [0049.449] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3f8 [0049.449] GetProcessHeap () returned 0x630000 [0049.449] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x63f900 [0049.449] GetProcessHeap () returned 0x630000 [0049.449] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0049.449] GetProcessHeap () returned 0x630000 [0049.449] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x641658 [0049.450] GetProcessHeap () returned 0x630000 [0049.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0049.450] GetProcessHeap () returned 0x630000 [0049.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656fe0 [0049.450] GetProcessHeap () returned 0x630000 [0049.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0049.450] GetProcessHeap () returned 0x630000 [0049.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0049.450] GetProcessHeap () returned 0x630000 [0049.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655530 [0049.450] GetProcessHeap () returned 0x630000 [0049.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0049.450] GetProcessHeap () returned 0x630000 [0049.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0049.450] GetProcessHeap () returned 0x630000 [0049.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655530 | out: hHeap=0x630000) returned 1 [0049.450] GetProcessHeap () returned 0x630000 [0049.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0049.450] GetProcessHeap () returned 0x630000 [0049.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0049.450] GetProcessHeap () returned 0x630000 [0049.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0049.450] GetProcessHeap () returned 0x630000 [0049.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0049.450] GetProcessHeap () returned 0x630000 [0049.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0049.450] GetProcessHeap () returned 0x630000 [0049.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0049.450] GetProcessHeap () returned 0x630000 [0049.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x655f50 [0049.450] GetProcessHeap () returned 0x630000 [0049.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0049.450] GetProcessHeap () returned 0x630000 [0049.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0049.450] GetProcessHeap () returned 0x630000 [0049.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655f50 | out: hHeap=0x630000) returned 1 [0049.450] GetProcessHeap () returned 0x630000 [0049.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0049.450] GetProcessHeap () returned 0x630000 [0049.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0049.451] GetProcessHeap () returned 0x630000 [0049.451] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0049.451] GetProcessHeap () returned 0x630000 [0049.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0049.451] GetProcessHeap () returned 0x630000 [0049.451] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0049.451] GetProcessHeap () returned 0x630000 [0049.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0049.451] GetProcessHeap () returned 0x630000 [0049.451] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0049.451] GetProcessHeap () returned 0x630000 [0049.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0049.451] GetProcessHeap () returned 0x630000 [0049.451] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0049.451] GetProcessHeap () returned 0x630000 [0049.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0049.451] GetProcessHeap () returned 0x630000 [0049.451] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0049.451] GetProcessHeap () returned 0x630000 [0049.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0049.451] GetProcessHeap () returned 0x630000 [0049.451] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0049.451] GetProcessHeap () returned 0x630000 [0049.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0049.451] GetProcessHeap () returned 0x630000 [0049.451] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0049.451] GetProcessHeap () returned 0x630000 [0049.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0049.451] GetProcessHeap () returned 0x630000 [0049.451] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0049.451] GetProcessHeap () returned 0x630000 [0049.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0049.451] GetProcessHeap () returned 0x630000 [0049.451] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0049.451] GetProcessHeap () returned 0x630000 [0049.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0049.452] GetProcessHeap () returned 0x630000 [0049.452] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0049.452] GetProcessHeap () returned 0x630000 [0049.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0049.452] GetProcessHeap () returned 0x630000 [0049.452] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0049.452] GetProcessHeap () returned 0x630000 [0049.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0049.452] GetProcessHeap () returned 0x630000 [0049.452] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0049.452] GetProcessHeap () returned 0x630000 [0049.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0049.452] GetProcessHeap () returned 0x630000 [0049.452] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0049.452] GetProcessHeap () returned 0x630000 [0049.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0049.452] GetProcessHeap () returned 0x630000 [0049.452] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0049.452] GetProcessHeap () returned 0x630000 [0049.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0049.452] GetProcessHeap () returned 0x630000 [0049.452] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0049.452] GetProcessHeap () returned 0x630000 [0049.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0049.452] GetProcessHeap () returned 0x630000 [0049.452] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0049.452] GetProcessHeap () returned 0x630000 [0049.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0049.452] GetProcessHeap () returned 0x630000 [0049.452] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0049.452] GetProcessHeap () returned 0x630000 [0049.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0049.452] GetProcessHeap () returned 0x630000 [0049.452] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0049.452] GetProcessHeap () returned 0x630000 [0049.453] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0049.453] GetProcessHeap () returned 0x630000 [0049.453] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0049.453] GetProcessHeap () returned 0x630000 [0049.453] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0049.453] GetProcessHeap () returned 0x630000 [0049.453] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0049.453] GetProcessHeap () returned 0x630000 [0049.453] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0049.453] GetProcessHeap () returned 0x630000 [0049.453] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0049.453] GetProcessHeap () returned 0x630000 [0049.453] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0049.453] GetProcessHeap () returned 0x630000 [0049.453] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0049.453] GetProcessHeap () returned 0x630000 [0049.453] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0049.453] GetProcessHeap () returned 0x630000 [0049.453] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0049.453] GetProcessHeap () returned 0x630000 [0049.453] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0049.453] GetProcessHeap () returned 0x630000 [0049.453] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0049.453] GetProcessHeap () returned 0x630000 [0049.453] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0049.453] GetProcessHeap () returned 0x630000 [0049.453] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0049.453] GetProcessHeap () returned 0x630000 [0049.453] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0049.453] GetProcessHeap () returned 0x630000 [0049.453] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0049.453] GetProcessHeap () returned 0x630000 [0049.453] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0049.453] GetProcessHeap () returned 0x630000 [0049.453] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0049.453] GetProcessHeap () returned 0x630000 [0049.453] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0049.453] GetProcessHeap () returned 0x630000 [0049.454] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0049.454] GetProcessHeap () returned 0x630000 [0049.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0049.454] GetProcessHeap () returned 0x630000 [0049.454] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0049.454] GetProcessHeap () returned 0x630000 [0049.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0049.454] GetProcessHeap () returned 0x630000 [0049.454] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0049.454] GetProcessHeap () returned 0x630000 [0049.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0049.454] GetProcessHeap () returned 0x630000 [0049.454] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0049.454] GetProcessHeap () returned 0x630000 [0049.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0049.454] GetProcessHeap () returned 0x630000 [0049.454] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0049.454] GetProcessHeap () returned 0x630000 [0049.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0049.454] GetProcessHeap () returned 0x630000 [0049.454] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0049.454] GetProcessHeap () returned 0x630000 [0049.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0049.454] GetProcessHeap () returned 0x630000 [0049.454] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0049.454] GetProcessHeap () returned 0x630000 [0049.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0049.454] GetProcessHeap () returned 0x630000 [0049.454] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0049.454] GetProcessHeap () returned 0x630000 [0049.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0049.454] GetProcessHeap () returned 0x630000 [0049.454] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0049.454] GetProcessHeap () returned 0x630000 [0049.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0049.454] GetProcessHeap () returned 0x630000 [0049.454] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0049.454] GetProcessHeap () returned 0x630000 [0049.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0049.455] GetProcessHeap () returned 0x630000 [0049.455] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0049.455] GetProcessHeap () returned 0x630000 [0049.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0049.455] GetProcessHeap () returned 0x630000 [0049.455] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0049.455] GetProcessHeap () returned 0x630000 [0049.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0049.455] GetProcessHeap () returned 0x630000 [0049.455] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0049.455] GetProcessHeap () returned 0x630000 [0049.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0049.455] GetProcessHeap () returned 0x630000 [0049.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x641658 | out: hHeap=0x630000) returned 1 [0049.455] GetProcessHeap () returned 0x630000 [0049.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0049.455] GetProcessHeap () returned 0x630000 [0049.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0049.455] GetProcessHeap () returned 0x630000 [0049.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0049.455] GetProcessHeap () returned 0x630000 [0049.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0049.455] GetProcessHeap () returned 0x630000 [0049.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655260 | out: hHeap=0x630000) returned 1 [0049.455] GetProcessHeap () returned 0x630000 [0049.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6418f0 | out: hHeap=0x630000) returned 1 [0049.455] GetProcessHeap () returned 0x630000 [0049.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655140 | out: hHeap=0x630000) returned 1 [0049.455] GetProcessHeap () returned 0x630000 [0049.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63f900 | out: hHeap=0x630000) returned 1 [0049.455] GetProcessHeap () returned 0x630000 [0049.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2e8 | out: hHeap=0x630000) returned 1 [0049.455] GetProcessHeap () returned 0x630000 [0049.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0049.455] WriteFile (in: hFile=0x230, lpBuffer=0x65ac60*, nNumberOfBytesToWrite=0x38c, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65ac60*, lpNumberOfBytesWritten=0x243d864*=0x38c, lpOverlapped=0x0) returned 1 [0049.459] GetProcessHeap () returned 0x630000 [0049.459] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65ac60, Size=0x30) returned 0x65ac60 [0049.459] GetProcessHeap () returned 0x630000 [0049.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0049.459] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0049.459] GetProcessHeap () returned 0x630000 [0049.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe0) returned 0x641ca8 [0049.459] ReadFile (in: hFile=0x230, lpBuffer=0x641ca8, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x641ca8*, lpNumberOfBytesRead=0x243d7e8*=0xe0, lpOverlapped=0x0) returned 1 [0049.460] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0049.460] WriteFile (in: hFile=0x230, lpBuffer=0x641ca8*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x641ca8*, lpNumberOfBytesWritten=0x243d7e4*=0xe0, lpOverlapped=0x0) returned 1 [0049.460] GetProcessHeap () returned 0x630000 [0049.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x641ca8 | out: hHeap=0x630000) returned 1 [0049.460] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0049.461] WriteFile (in: hFile=0x230, lpBuffer=0x65ac60*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65ac60*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0049.461] CloseHandle (hObject=0x230) returned 1 [0049.463] GetProcessHeap () returned 0x630000 [0049.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0049.463] GetProcessHeap () returned 0x630000 [0049.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0049.463] GetProcessHeap () returned 0x630000 [0049.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0049.463] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\Configuration.ini" | out: lpString1="C:\\Windows10Upgrade\\Configuration.ini") returned="C:\\Windows10Upgrade\\Configuration.ini" [0049.463] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\Configuration.ini", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\Configuration.ini.happythreechoose") returned="C:\\Windows10Upgrade\\Configuration.ini.happythreechoose" [0049.463] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\Configuration.ini" (normalized: "c:\\windows10upgrade\\configuration.ini"), lpNewFileName="C:\\Windows10Upgrade\\Configuration.ini.happythreechoose" (normalized: "c:\\windows10upgrade\\configuration.ini.happythreechoose"), dwFlags=0x1) returned 1 [0049.463] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\Configuration.ini" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0049.463] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0049.463] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\Decryption INFO.html" [0049.464] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\decryption info.html")) returned 0x20 [0049.464] GetProcessHeap () returned 0x630000 [0049.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645f58 | out: hHeap=0x630000) returned 1 [0049.464] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea36e29e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea36e29e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xf0c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cosquery.dll", cAlternateFileName="")) returned 1 [0049.464] lstrcmpiW (lpString1="cosquery.dll", lpString2=".") returned 1 [0049.464] lstrcmpiW (lpString1="cosquery.dll", lpString2="..") returned 1 [0049.464] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="cosquery.dll" | out: lpString1="C:\\Windows10Upgrade\\cosquery.dll") returned="C:\\Windows10Upgrade\\cosquery.dll" [0049.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cosquery.dll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0049.464] GetProcessHeap () returned 0x630000 [0049.464] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd) returned 0x64c9f0 [0049.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cosquery.dll", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cosquery.dll", lpUsedDefaultChar=0x0) returned 13 [0049.464] lstrlenA (lpString="cosquery.dll") returned 12 [0049.464] lstrlenA (lpString=".happythreechoose") returned 17 [0049.464] lstrcmpiW (lpString1="cosquery.dll", lpString2="Decryption INFO.html") returned -1 [0049.464] lstrcmpiW (lpString1="cosquery.dll", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0049.464] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0049.464] lstrcmpiW (lpString1="cosquery.dll", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0049.464] GetProcessHeap () returned 0x630000 [0049.464] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0049.464] CreateFileW (lpFileName="C:\\Windows10Upgrade\\cosquery.dll" (normalized: "c:\\windows10upgrade\\cosquery.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0049.464] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=61640) returned 1 [0049.464] GetProcessHeap () returned 0x630000 [0049.464] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x63e830 [0049.464] GetProcessHeap () returned 0x630000 [0049.465] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0049.465] lstrlenW (lpString="C:\\Windows10Upgrade\\cosquery.dll") returned 32 [0049.465] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0049.465] GetProcessHeap () returned 0x630000 [0049.465] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0049.465] GetProcessHeap () returned 0x630000 [0049.465] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x65ac98 [0049.465] lstrlenA (lpString="rsa_encrypt") returned 11 [0049.465] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0049.465] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0049.465] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0049.465] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0049.465] GetProcessHeap () returned 0x630000 [0049.465] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0049.466] lstrlenA (lpString="010001") returned 6 [0049.466] GetProcessHeap () returned 0x630000 [0049.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2e8 [0049.466] GetProcessHeap () returned 0x630000 [0049.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0049.466] GetProcessHeap () returned 0x630000 [0049.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655b60 [0049.466] GetProcessHeap () returned 0x630000 [0049.466] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0049.466] GetProcessHeap () returned 0x630000 [0049.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x6551d0 [0049.466] GetProcessHeap () returned 0x630000 [0049.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656fe0 [0049.466] GetProcessHeap () returned 0x630000 [0049.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a308 [0049.466] GetProcessHeap () returned 0x630000 [0049.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0049.466] GetProcessHeap () returned 0x630000 [0049.466] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0049.466] GetProcessHeap () returned 0x630000 [0049.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0049.466] GetProcessHeap () returned 0x630000 [0049.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0049.466] GetProcessHeap () returned 0x630000 [0049.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657788 [0049.466] GetProcessHeap () returned 0x630000 [0049.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0049.466] GetProcessHeap () returned 0x630000 [0049.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0049.466] GetProcessHeap () returned 0x630000 [0049.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655f50 [0049.466] GetProcessHeap () returned 0x630000 [0049.466] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0049.466] GetProcessHeap () returned 0x630000 [0049.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0049.466] GetProcessHeap () returned 0x630000 [0049.466] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655f50 | out: hHeap=0x630000) returned 1 [0049.466] GetProcessHeap () returned 0x630000 [0049.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0049.467] GetProcessHeap () returned 0x630000 [0049.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65b3c8 [0049.467] GetProcessHeap () returned 0x630000 [0049.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0049.467] GetProcessHeap () returned 0x630000 [0049.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0049.467] GetProcessHeap () returned 0x630000 [0049.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0049.467] GetProcessHeap () returned 0x630000 [0049.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0049.467] GetProcessHeap () returned 0x630000 [0049.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x655260 [0049.467] GetProcessHeap () returned 0x630000 [0049.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b3c8 | out: hHeap=0x630000) returned 1 [0049.467] GetProcessHeap () returned 0x630000 [0049.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0049.467] GetProcessHeap () returned 0x630000 [0049.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655260 | out: hHeap=0x630000) returned 1 [0049.467] GetProcessHeap () returned 0x630000 [0049.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0049.467] GetProcessHeap () returned 0x630000 [0049.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0049.467] GetProcessHeap () returned 0x630000 [0049.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0049.467] GetProcessHeap () returned 0x630000 [0049.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0049.467] GetProcessHeap () returned 0x630000 [0049.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0049.467] GetProcessHeap () returned 0x630000 [0049.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0049.467] GetProcessHeap () returned 0x630000 [0049.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0049.467] GetProcessHeap () returned 0x630000 [0049.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0049.467] GetProcessHeap () returned 0x630000 [0049.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0049.467] GetProcessHeap () returned 0x630000 [0049.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0049.468] GetProcessHeap () returned 0x630000 [0049.468] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0049.468] GetProcessHeap () returned 0x630000 [0049.468] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0049.468] GetProcessHeap () returned 0x630000 [0049.468] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0049.468] GetProcessHeap () returned 0x630000 [0049.468] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0049.468] GetProcessHeap () returned 0x630000 [0049.468] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0049.468] GetProcessHeap () returned 0x630000 [0049.468] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0049.468] GetProcessHeap () returned 0x630000 [0049.468] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0049.468] GetProcessHeap () returned 0x630000 [0049.468] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0049.468] GetProcessHeap () returned 0x630000 [0049.468] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0049.468] GetProcessHeap () returned 0x630000 [0049.468] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0049.468] GetProcessHeap () returned 0x630000 [0049.468] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0049.468] GetProcessHeap () returned 0x630000 [0049.468] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0049.468] GetProcessHeap () returned 0x630000 [0049.468] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0049.468] GetProcessHeap () returned 0x630000 [0049.468] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0049.468] GetProcessHeap () returned 0x630000 [0049.468] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0049.468] GetProcessHeap () returned 0x630000 [0049.468] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0049.468] GetProcessHeap () returned 0x630000 [0049.468] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0049.468] GetProcessHeap () returned 0x630000 [0049.468] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0049.469] GetProcessHeap () returned 0x630000 [0049.469] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0049.469] GetProcessHeap () returned 0x630000 [0049.469] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0049.469] GetProcessHeap () returned 0x630000 [0049.469] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0049.469] GetProcessHeap () returned 0x630000 [0049.469] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0049.469] GetProcessHeap () returned 0x630000 [0049.469] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0049.469] GetProcessHeap () returned 0x630000 [0049.469] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0049.469] GetProcessHeap () returned 0x630000 [0049.469] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0049.469] GetProcessHeap () returned 0x630000 [0049.469] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0049.469] GetProcessHeap () returned 0x630000 [0049.469] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0049.469] GetProcessHeap () returned 0x630000 [0049.469] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0049.469] GetProcessHeap () returned 0x630000 [0049.469] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0049.469] GetProcessHeap () returned 0x630000 [0049.469] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0049.469] GetProcessHeap () returned 0x630000 [0049.469] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0049.469] GetProcessHeap () returned 0x630000 [0049.469] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0049.469] GetProcessHeap () returned 0x630000 [0049.469] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0049.469] GetProcessHeap () returned 0x630000 [0049.469] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0049.469] GetProcessHeap () returned 0x630000 [0049.469] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0049.469] GetProcessHeap () returned 0x630000 [0049.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0049.470] GetProcessHeap () returned 0x630000 [0049.470] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0049.470] GetProcessHeap () returned 0x630000 [0049.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0049.470] GetProcessHeap () returned 0x630000 [0049.470] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0049.470] GetProcessHeap () returned 0x630000 [0049.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0049.470] GetProcessHeap () returned 0x630000 [0049.470] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0049.470] GetProcessHeap () returned 0x630000 [0049.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0049.470] GetProcessHeap () returned 0x630000 [0049.470] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0049.470] GetProcessHeap () returned 0x630000 [0049.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0049.470] GetProcessHeap () returned 0x630000 [0049.470] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0049.470] GetProcessHeap () returned 0x630000 [0049.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0049.470] GetProcessHeap () returned 0x630000 [0049.470] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0049.470] GetProcessHeap () returned 0x630000 [0049.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0049.470] GetProcessHeap () returned 0x630000 [0049.470] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0049.470] GetProcessHeap () returned 0x630000 [0049.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0049.470] GetProcessHeap () returned 0x630000 [0049.470] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0049.470] GetProcessHeap () returned 0x630000 [0049.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0049.470] GetProcessHeap () returned 0x630000 [0049.470] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0049.470] GetProcessHeap () returned 0x630000 [0049.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0049.471] GetProcessHeap () returned 0x630000 [0049.471] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0049.471] GetProcessHeap () returned 0x630000 [0049.471] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0049.471] GetProcessHeap () returned 0x630000 [0049.471] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0049.471] GetProcessHeap () returned 0x630000 [0049.471] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0049.471] GetProcessHeap () returned 0x630000 [0049.471] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0049.471] GetProcessHeap () returned 0x630000 [0049.471] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0049.471] GetProcessHeap () returned 0x630000 [0049.471] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0049.471] GetProcessHeap () returned 0x630000 [0049.471] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0049.471] GetProcessHeap () returned 0x630000 [0049.471] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0049.471] GetProcessHeap () returned 0x630000 [0049.471] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0049.471] GetProcessHeap () returned 0x630000 [0049.471] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0049.471] GetProcessHeap () returned 0x630000 [0049.471] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0049.471] GetProcessHeap () returned 0x630000 [0049.471] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0049.471] GetProcessHeap () returned 0x630000 [0049.471] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0049.471] GetProcessHeap () returned 0x630000 [0049.471] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0049.471] GetProcessHeap () returned 0x630000 [0049.471] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0049.471] GetProcessHeap () returned 0x630000 [0049.471] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0049.471] GetProcessHeap () returned 0x630000 [0049.471] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0049.472] GetProcessHeap () returned 0x630000 [0049.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0049.472] GetProcessHeap () returned 0x630000 [0049.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0049.472] GetProcessHeap () returned 0x630000 [0049.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0049.472] GetProcessHeap () returned 0x630000 [0049.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0049.472] GetProcessHeap () returned 0x630000 [0049.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0049.472] GetProcessHeap () returned 0x630000 [0049.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6551d0 | out: hHeap=0x630000) returned 1 [0049.472] GetProcessHeap () returned 0x630000 [0049.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0049.472] GetProcessHeap () returned 0x630000 [0049.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655b60 | out: hHeap=0x630000) returned 1 [0049.472] GetProcessHeap () returned 0x630000 [0049.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0049.472] GetProcessHeap () returned 0x630000 [0049.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2e8 | out: hHeap=0x630000) returned 1 [0049.472] GetProcessHeap () returned 0x630000 [0049.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0049.472] WriteFile (in: hFile=0x230, lpBuffer=0x65ac98*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65ac98*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0049.924] GetProcessHeap () returned 0x630000 [0049.924] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65ac98, Size=0x30) returned 0x65ac98 [0049.924] GetProcessHeap () returned 0x630000 [0049.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0049.924] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0049.925] GetProcessHeap () returned 0x630000 [0049.925] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf0c8) returned 0x65b428 [0049.925] ReadFile (in: hFile=0x230, lpBuffer=0x65b428, nNumberOfBytesToRead=0xf0c8, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65b428*, lpNumberOfBytesRead=0x243d7e8*=0xf0c8, lpOverlapped=0x0) returned 1 [0049.926] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0049.926] WriteFile (in: hFile=0x230, lpBuffer=0x65b428*, nNumberOfBytesToWrite=0xf0c8, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65b428*, lpNumberOfBytesWritten=0x243d7e4*=0xf0c8, lpOverlapped=0x0) returned 1 [0049.935] GetProcessHeap () returned 0x630000 [0049.935] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b428 | out: hHeap=0x630000) returned 1 [0049.935] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0049.935] WriteFile (in: hFile=0x230, lpBuffer=0x65ac98*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65ac98*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0049.936] CloseHandle (hObject=0x230) returned 1 [0049.938] GetProcessHeap () returned 0x630000 [0049.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0049.938] GetProcessHeap () returned 0x630000 [0049.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0049.938] GetProcessHeap () returned 0x630000 [0049.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0049.938] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\cosquery.dll" | out: lpString1="C:\\Windows10Upgrade\\cosquery.dll") returned="C:\\Windows10Upgrade\\cosquery.dll" [0049.938] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\cosquery.dll", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\cosquery.dll.happythreechoose") returned="C:\\Windows10Upgrade\\cosquery.dll.happythreechoose" [0049.938] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\cosquery.dll" (normalized: "c:\\windows10upgrade\\cosquery.dll"), lpNewFileName="C:\\Windows10Upgrade\\cosquery.dll.happythreechoose" (normalized: "c:\\windows10upgrade\\cosquery.dll.happythreechoose"), dwFlags=0x1) returned 1 [0049.939] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\cosquery.dll" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0049.939] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0049.939] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\Decryption INFO.html" [0049.940] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\decryption info.html")) returned 0x20 [0049.940] GetProcessHeap () returned 0x630000 [0049.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0049.940] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea370998, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea370998, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x508c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DevInv.dll", cAlternateFileName="")) returned 1 [0049.940] lstrcmpiW (lpString1="DevInv.dll", lpString2=".") returned 1 [0049.940] lstrcmpiW (lpString1="DevInv.dll", lpString2="..") returned 1 [0049.940] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="DevInv.dll" | out: lpString1="C:\\Windows10Upgrade\\DevInv.dll") returned="C:\\Windows10Upgrade\\DevInv.dll" [0049.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DevInv.dll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0049.940] GetProcessHeap () returned 0x630000 [0049.940] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb) returned 0x64c9f0 [0049.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DevInv.dll", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DevInv.dll", lpUsedDefaultChar=0x0) returned 11 [0049.940] lstrlenA (lpString="DevInv.dll") returned 10 [0049.940] lstrlenA (lpString=".happythreechoose") returned 17 [0049.940] lstrcmpiW (lpString1="DevInv.dll", lpString2="Decryption INFO.html") returned 1 [0049.940] lstrcmpiW (lpString1="DevInv.dll", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0049.940] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0049.940] lstrcmpiW (lpString1="DevInv.dll", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0049.940] GetProcessHeap () returned 0x630000 [0049.940] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0049.940] CreateFileW (lpFileName="C:\\Windows10Upgrade\\DevInv.dll" (normalized: "c:\\windows10upgrade\\devinv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0049.940] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=329928) returned 1 [0049.941] GetProcessHeap () returned 0x630000 [0049.941] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x63e830 [0049.941] GetProcessHeap () returned 0x630000 [0049.941] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0049.941] lstrlenW (lpString="C:\\Windows10Upgrade\\DevInv.dll") returned 30 [0049.941] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0049.941] GetProcessHeap () returned 0x630000 [0049.941] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0049.941] GetProcessHeap () returned 0x630000 [0049.941] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x388) returned 0x65b428 [0049.941] lstrlenA (lpString="rsa_encrypt") returned 11 [0049.941] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0049.941] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0049.941] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0049.942] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0049.942] GetProcessHeap () returned 0x630000 [0049.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0049.942] lstrlenA (lpString="010001") returned 6 [0049.942] GetProcessHeap () returned 0x630000 [0049.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a298 [0049.942] GetProcessHeap () returned 0x630000 [0049.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0049.942] GetProcessHeap () returned 0x630000 [0049.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655650 [0049.942] GetProcessHeap () returned 0x630000 [0049.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0049.942] GetProcessHeap () returned 0x630000 [0049.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655260 [0049.942] GetProcessHeap () returned 0x630000 [0049.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657788 [0049.942] GetProcessHeap () returned 0x630000 [0049.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0049.942] GetProcessHeap () returned 0x630000 [0049.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0049.942] GetProcessHeap () returned 0x630000 [0049.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0049.942] GetProcessHeap () returned 0x630000 [0049.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0049.942] GetProcessHeap () returned 0x630000 [0049.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0049.942] GetProcessHeap () returned 0x630000 [0049.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656950 [0049.942] GetProcessHeap () returned 0x630000 [0049.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0049.942] GetProcessHeap () returned 0x630000 [0049.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0049.942] GetProcessHeap () returned 0x630000 [0049.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655410 [0049.942] GetProcessHeap () returned 0x630000 [0049.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0049.942] GetProcessHeap () returned 0x630000 [0049.943] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0049.943] GetProcessHeap () returned 0x630000 [0049.943] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655410 | out: hHeap=0x630000) returned 1 [0049.943] GetProcessHeap () returned 0x630000 [0049.943] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0049.943] GetProcessHeap () returned 0x630000 [0049.943] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65b320 [0049.943] GetProcessHeap () returned 0x630000 [0049.943] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0049.943] GetProcessHeap () returned 0x630000 [0049.943] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0049.943] GetProcessHeap () returned 0x630000 [0049.943] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2e8 [0049.943] GetProcessHeap () returned 0x630000 [0049.943] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2e8 | out: hHeap=0x630000) returned 1 [0049.943] GetProcessHeap () returned 0x630000 [0049.943] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x655d10 [0049.943] GetProcessHeap () returned 0x630000 [0049.943] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b320 | out: hHeap=0x630000) returned 1 [0049.943] GetProcessHeap () returned 0x630000 [0049.943] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0049.943] GetProcessHeap () returned 0x630000 [0049.943] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655d10 | out: hHeap=0x630000) returned 1 [0049.943] GetProcessHeap () returned 0x630000 [0049.943] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0049.943] GetProcessHeap () returned 0x630000 [0049.943] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0049.943] GetProcessHeap () returned 0x630000 [0049.943] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0049.943] GetProcessHeap () returned 0x630000 [0049.943] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0049.943] GetProcessHeap () returned 0x630000 [0049.943] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0049.943] GetProcessHeap () returned 0x630000 [0049.943] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0049.943] GetProcessHeap () returned 0x630000 [0049.943] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0049.943] GetProcessHeap () returned 0x630000 [0049.944] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0049.944] GetProcessHeap () returned 0x630000 [0049.944] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0049.944] GetProcessHeap () returned 0x630000 [0049.944] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0049.944] GetProcessHeap () returned 0x630000 [0049.947] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0049.947] GetProcessHeap () returned 0x630000 [0049.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0049.947] GetProcessHeap () returned 0x630000 [0049.947] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0049.947] GetProcessHeap () returned 0x630000 [0049.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0049.947] GetProcessHeap () returned 0x630000 [0049.947] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0049.947] GetProcessHeap () returned 0x630000 [0049.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0049.947] GetProcessHeap () returned 0x630000 [0049.947] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0049.947] GetProcessHeap () returned 0x630000 [0049.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0049.947] GetProcessHeap () returned 0x630000 [0049.947] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0049.947] GetProcessHeap () returned 0x630000 [0049.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0049.947] GetProcessHeap () returned 0x630000 [0049.947] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0049.947] GetProcessHeap () returned 0x630000 [0049.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0049.947] GetProcessHeap () returned 0x630000 [0049.947] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0049.947] GetProcessHeap () returned 0x630000 [0049.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0049.947] GetProcessHeap () returned 0x630000 [0049.947] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0049.947] GetProcessHeap () returned 0x630000 [0049.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0049.947] GetProcessHeap () returned 0x630000 [0049.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0049.948] GetProcessHeap () returned 0x630000 [0049.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0049.948] GetProcessHeap () returned 0x630000 [0049.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0049.948] GetProcessHeap () returned 0x630000 [0049.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0049.948] GetProcessHeap () returned 0x630000 [0049.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0049.948] GetProcessHeap () returned 0x630000 [0049.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0049.948] GetProcessHeap () returned 0x630000 [0049.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0049.948] GetProcessHeap () returned 0x630000 [0049.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0049.948] GetProcessHeap () returned 0x630000 [0049.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2e8 [0049.948] GetProcessHeap () returned 0x630000 [0049.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2e8 | out: hHeap=0x630000) returned 1 [0049.948] GetProcessHeap () returned 0x630000 [0049.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0049.948] GetProcessHeap () returned 0x630000 [0049.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0049.948] GetProcessHeap () returned 0x630000 [0049.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0049.948] GetProcessHeap () returned 0x630000 [0049.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0049.948] GetProcessHeap () returned 0x630000 [0049.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0049.948] GetProcessHeap () returned 0x630000 [0049.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0049.948] GetProcessHeap () returned 0x630000 [0049.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0049.948] GetProcessHeap () returned 0x630000 [0049.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0049.949] GetProcessHeap () returned 0x630000 [0049.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2e8 [0049.949] GetProcessHeap () returned 0x630000 [0049.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2e8 | out: hHeap=0x630000) returned 1 [0049.949] GetProcessHeap () returned 0x630000 [0049.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0049.949] GetProcessHeap () returned 0x630000 [0049.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0049.949] GetProcessHeap () returned 0x630000 [0049.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0049.949] GetProcessHeap () returned 0x630000 [0049.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0049.949] GetProcessHeap () returned 0x630000 [0049.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0049.949] GetProcessHeap () returned 0x630000 [0049.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0049.949] GetProcessHeap () returned 0x630000 [0049.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0049.949] GetProcessHeap () returned 0x630000 [0049.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0049.949] GetProcessHeap () returned 0x630000 [0049.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0049.949] GetProcessHeap () returned 0x630000 [0049.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0049.949] GetProcessHeap () returned 0x630000 [0049.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0049.949] GetProcessHeap () returned 0x630000 [0049.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0049.949] GetProcessHeap () returned 0x630000 [0049.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0049.949] GetProcessHeap () returned 0x630000 [0049.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0049.949] GetProcessHeap () returned 0x630000 [0049.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0049.949] GetProcessHeap () returned 0x630000 [0049.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0049.950] GetProcessHeap () returned 0x630000 [0049.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0049.950] GetProcessHeap () returned 0x630000 [0049.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0049.950] GetProcessHeap () returned 0x630000 [0049.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0049.950] GetProcessHeap () returned 0x630000 [0049.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0049.950] GetProcessHeap () returned 0x630000 [0049.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0049.950] GetProcessHeap () returned 0x630000 [0049.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0049.950] GetProcessHeap () returned 0x630000 [0049.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2e8 [0049.950] GetProcessHeap () returned 0x630000 [0049.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2e8 | out: hHeap=0x630000) returned 1 [0049.950] GetProcessHeap () returned 0x630000 [0049.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0049.950] GetProcessHeap () returned 0x630000 [0049.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0049.950] GetProcessHeap () returned 0x630000 [0049.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0049.950] GetProcessHeap () returned 0x630000 [0049.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0049.950] GetProcessHeap () returned 0x630000 [0049.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0049.950] GetProcessHeap () returned 0x630000 [0049.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0049.950] GetProcessHeap () returned 0x630000 [0049.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0049.950] GetProcessHeap () returned 0x630000 [0049.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0049.950] GetProcessHeap () returned 0x630000 [0049.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0049.951] GetProcessHeap () returned 0x630000 [0049.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0049.951] GetProcessHeap () returned 0x630000 [0049.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0049.951] GetProcessHeap () returned 0x630000 [0049.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0049.951] GetProcessHeap () returned 0x630000 [0049.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0049.951] GetProcessHeap () returned 0x630000 [0049.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0049.951] GetProcessHeap () returned 0x630000 [0049.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0049.951] GetProcessHeap () returned 0x630000 [0049.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0049.951] GetProcessHeap () returned 0x630000 [0049.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0049.951] GetProcessHeap () returned 0x630000 [0049.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655260 | out: hHeap=0x630000) returned 1 [0049.951] GetProcessHeap () returned 0x630000 [0049.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0049.951] GetProcessHeap () returned 0x630000 [0049.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655650 | out: hHeap=0x630000) returned 1 [0049.951] GetProcessHeap () returned 0x630000 [0049.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0049.951] GetProcessHeap () returned 0x630000 [0049.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0049.951] GetProcessHeap () returned 0x630000 [0049.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0049.951] WriteFile (in: hFile=0x230, lpBuffer=0x65b428*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65b428*, lpNumberOfBytesWritten=0x243d864*=0x388, lpOverlapped=0x0) returned 1 [0049.964] GetProcessHeap () returned 0x630000 [0049.964] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65b428, Size=0x30) returned 0x65b428 [0049.964] GetProcessHeap () returned 0x630000 [0049.964] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0049.964] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0049.964] GetProcessHeap () returned 0x630000 [0049.964] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x508d0) returned 0x65b460 [0049.967] ReadFile (in: hFile=0x230, lpBuffer=0x65b460, nNumberOfBytesToRead=0x508d0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65b460*, lpNumberOfBytesRead=0x243d7e8*=0x508d0, lpOverlapped=0x0) returned 1 [0049.972] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0049.972] WriteFile (in: hFile=0x230, lpBuffer=0x65b460*, nNumberOfBytesToWrite=0x508d0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65b460*, lpNumberOfBytesWritten=0x243d7e4*=0x508d0, lpOverlapped=0x0) returned 1 [0050.002] GetProcessHeap () returned 0x630000 [0050.002] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b460 | out: hHeap=0x630000) returned 1 [0050.004] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0050.004] WriteFile (in: hFile=0x230, lpBuffer=0x65b428*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65b428*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0050.006] CloseHandle (hObject=0x230) returned 1 [0050.012] GetProcessHeap () returned 0x630000 [0050.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0050.012] GetProcessHeap () returned 0x630000 [0050.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0050.012] GetProcessHeap () returned 0x630000 [0050.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0050.012] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\DevInv.dll" | out: lpString1="C:\\Windows10Upgrade\\DevInv.dll") returned="C:\\Windows10Upgrade\\DevInv.dll" [0050.012] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\DevInv.dll", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\DevInv.dll.happythreechoose") returned="C:\\Windows10Upgrade\\DevInv.dll.happythreechoose" [0050.012] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\DevInv.dll" (normalized: "c:\\windows10upgrade\\devinv.dll"), lpNewFileName="C:\\Windows10Upgrade\\DevInv.dll.happythreechoose" (normalized: "c:\\windows10upgrade\\devinv.dll.happythreechoose"), dwFlags=0x1) returned 1 [0050.012] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\DevInv.dll" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0050.013] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0050.013] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\Decryption INFO.html" [0050.013] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\decryption info.html")) returned 0x20 [0050.013] GetProcessHeap () returned 0x630000 [0050.013] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0050.013] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3757e9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea377ed3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea377ed3, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dll1", cAlternateFileName="")) returned 1 [0050.013] lstrcmpiW (lpString1="dll1", lpString2=".") returned 1 [0050.013] lstrcmpiW (lpString1="dll1", lpString2="..") returned 1 [0050.013] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="dll1" | out: lpString1="C:\\Windows10Upgrade\\dll1") returned="C:\\Windows10Upgrade\\dll1" [0050.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dll1", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0050.013] GetProcessHeap () returned 0x630000 [0050.013] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5) returned 0x65a3b8 [0050.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dll1", cchWideChar=-1, lpMultiByteStr=0x65a3b8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dll1", lpUsedDefaultChar=0x0) returned 5 [0050.013] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0050.013] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0050.013] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0050.013] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0050.013] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0050.013] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0050.013] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0050.013] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0050.013] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0050.013] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0050.013] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0050.013] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0050.013] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0050.013] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0050.013] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0050.013] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0050.013] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0050.013] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0050.014] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0050.014] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0050.014] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0050.014] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0050.014] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0050.014] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0050.014] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0050.014] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0050.014] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0050.014] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0050.014] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0050.014] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0050.014] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0050.014] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0050.014] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0050.014] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0050.014] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0050.014] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0050.014] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0050.014] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0050.014] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0050.014] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0050.014] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0050.014] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0050.014] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0050.014] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\dll1", lpString2="\\" | out: lpString1="C:\\Windows10Upgrade\\dll1\\") returned="C:\\Windows10Upgrade\\dll1\\" [0050.014] GetProcessHeap () returned 0x630000 [0050.014] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a2e8 [0050.014] lstrlenW (lpString="C:\\Windows10Upgrade\\dll1\\") returned 25 [0050.014] GetProcessHeap () returned 0x630000 [0050.014] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x34) returned 0x648a10 [0050.014] lstrcpyW (in: lpString1=0x648a10, lpString2="C:\\Windows10Upgrade\\dll1\\" | out: lpString1="C:\\Windows10Upgrade\\dll1\\") returned="C:\\Windows10Upgrade\\dll1\\" [0050.014] GetProcessHeap () returned 0x630000 [0050.014] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0050.014] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea37cd05, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37cd05, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea37cd05, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dll2", cAlternateFileName="")) returned 1 [0050.015] lstrcmpiW (lpString1="dll2", lpString2=".") returned 1 [0050.015] lstrcmpiW (lpString1="dll2", lpString2="..") returned 1 [0050.015] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="dll2" | out: lpString1="C:\\Windows10Upgrade\\dll2") returned="C:\\Windows10Upgrade\\dll2" [0050.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dll2", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0050.015] GetProcessHeap () returned 0x630000 [0050.015] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5) returned 0x65a308 [0050.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dll2", cchWideChar=-1, lpMultiByteStr=0x65a308, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dll2", lpUsedDefaultChar=0x0) returned 5 [0050.015] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0050.015] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0050.015] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0050.015] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0050.015] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0050.015] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0050.015] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0050.015] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0050.015] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0050.015] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0050.015] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0050.015] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0050.015] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0050.015] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0050.015] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0050.015] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0050.015] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0050.015] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0050.015] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0050.015] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0050.015] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0050.015] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0050.015] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0050.015] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0050.015] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0050.015] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0050.015] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0050.016] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0050.016] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0050.016] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0050.016] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0050.016] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0050.016] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0050.016] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0050.016] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0050.016] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0050.016] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0050.016] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0050.016] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0050.016] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0050.016] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0050.016] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0050.016] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0050.016] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\dll2", lpString2="\\" | out: lpString1="C:\\Windows10Upgrade\\dll2\\") returned="C:\\Windows10Upgrade\\dll2\\" [0050.016] GetProcessHeap () returned 0x630000 [0050.016] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a258 [0050.016] lstrlenW (lpString="C:\\Windows10Upgrade\\dll2\\") returned 25 [0050.016] GetProcessHeap () returned 0x630000 [0050.016] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x34) returned 0x6487d0 [0050.016] lstrcpyW (in: lpString1=0x6487d0, lpString2="C:\\Windows10Upgrade\\dll2\\" | out: lpString1="C:\\Windows10Upgrade\\dll2\\") returned="C:\\Windows10Upgrade\\dll2\\" [0050.016] GetProcessHeap () returned 0x630000 [0050.016] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.016] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea380798, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea380798, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x326c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="downloader.dll", cAlternateFileName="DOWNLO~1.DLL")) returned 1 [0050.016] lstrcmpiW (lpString1="downloader.dll", lpString2=".") returned 1 [0050.016] lstrcmpiW (lpString1="downloader.dll", lpString2="..") returned 1 [0050.016] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="downloader.dll" | out: lpString1="C:\\Windows10Upgrade\\downloader.dll") returned="C:\\Windows10Upgrade\\downloader.dll" [0050.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="downloader.dll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0050.016] GetProcessHeap () returned 0x630000 [0050.016] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0050.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="downloader.dll", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="downloader.dll", lpUsedDefaultChar=0x0) returned 15 [0050.016] lstrlenA (lpString="downloader.dll") returned 14 [0050.016] lstrlenA (lpString=".happythreechoose") returned 17 [0050.016] lstrcmpiW (lpString1="downloader.dll", lpString2="Decryption INFO.html") returned 1 [0050.017] lstrcmpiW (lpString1="downloader.dll", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0050.017] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0050.017] lstrcmpiW (lpString1="downloader.dll", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0050.017] GetProcessHeap () returned 0x630000 [0050.017] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f10 [0050.017] CreateFileW (lpFileName="C:\\Windows10Upgrade\\downloader.dll" (normalized: "c:\\windows10upgrade\\downloader.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0050.018] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=206536) returned 1 [0050.018] GetProcessHeap () returned 0x630000 [0050.018] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x63e830 [0050.018] GetProcessHeap () returned 0x630000 [0050.018] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0050.018] lstrlenW (lpString="C:\\Windows10Upgrade\\downloader.dll") returned 34 [0050.018] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0050.018] GetProcessHeap () returned 0x630000 [0050.018] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0050.018] GetProcessHeap () returned 0x630000 [0050.018] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x65b460 [0050.019] lstrlenA (lpString="rsa_encrypt") returned 11 [0050.019] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0050.020] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0050.020] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0050.020] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0050.020] GetProcessHeap () returned 0x630000 [0050.020] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0050.020] lstrlenA (lpString="010001") returned 6 [0050.020] GetProcessHeap () returned 0x630000 [0050.020] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a348 [0050.020] GetProcessHeap () returned 0x630000 [0050.020] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0050.020] GetProcessHeap () returned 0x630000 [0050.020] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655800 [0050.020] GetProcessHeap () returned 0x630000 [0050.020] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0050.020] GetProcessHeap () returned 0x630000 [0050.020] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655c80 [0050.020] GetProcessHeap () returned 0x630000 [0050.020] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656ec8 [0050.020] GetProcessHeap () returned 0x630000 [0050.020] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0050.020] GetProcessHeap () returned 0x630000 [0050.020] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0050.020] GetProcessHeap () returned 0x630000 [0050.020] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0050.020] GetProcessHeap () returned 0x630000 [0050.020] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0050.020] GetProcessHeap () returned 0x630000 [0050.020] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0050.020] GetProcessHeap () returned 0x630000 [0050.020] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657440 [0050.020] GetProcessHeap () returned 0x630000 [0050.021] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.021] GetProcessHeap () returned 0x630000 [0050.021] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0050.021] GetProcessHeap () returned 0x630000 [0050.021] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655ad0 [0050.021] GetProcessHeap () returned 0x630000 [0050.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0050.021] GetProcessHeap () returned 0x630000 [0050.021] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0050.021] GetProcessHeap () returned 0x630000 [0050.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655ad0 | out: hHeap=0x630000) returned 1 [0050.021] GetProcessHeap () returned 0x630000 [0050.021] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0050.021] GetProcessHeap () returned 0x630000 [0050.021] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65b248 [0050.021] GetProcessHeap () returned 0x630000 [0050.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.021] GetProcessHeap () returned 0x630000 [0050.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0050.021] GetProcessHeap () returned 0x630000 [0050.021] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.021] GetProcessHeap () returned 0x630000 [0050.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.021] GetProcessHeap () returned 0x630000 [0050.021] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x6556e0 [0050.021] GetProcessHeap () returned 0x630000 [0050.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b248 | out: hHeap=0x630000) returned 1 [0050.021] GetProcessHeap () returned 0x630000 [0050.021] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0050.021] GetProcessHeap () returned 0x630000 [0050.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6556e0 | out: hHeap=0x630000) returned 1 [0050.021] GetProcessHeap () returned 0x630000 [0050.021] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.021] GetProcessHeap () returned 0x630000 [0050.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.021] GetProcessHeap () returned 0x630000 [0050.021] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0050.021] GetProcessHeap () returned 0x630000 [0050.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0050.022] GetProcessHeap () returned 0x630000 [0050.022] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0050.022] GetProcessHeap () returned 0x630000 [0050.022] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0050.022] GetProcessHeap () returned 0x630000 [0050.022] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.022] GetProcessHeap () returned 0x630000 [0050.022] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.022] GetProcessHeap () returned 0x630000 [0050.022] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.022] GetProcessHeap () returned 0x630000 [0050.022] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.022] GetProcessHeap () returned 0x630000 [0050.022] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0050.022] GetProcessHeap () returned 0x630000 [0050.022] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0050.022] GetProcessHeap () returned 0x630000 [0050.022] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0050.022] GetProcessHeap () returned 0x630000 [0050.022] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0050.022] GetProcessHeap () returned 0x630000 [0050.022] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0050.022] GetProcessHeap () returned 0x630000 [0050.022] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0050.022] GetProcessHeap () returned 0x630000 [0050.022] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.022] GetProcessHeap () returned 0x630000 [0050.023] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.023] GetProcessHeap () returned 0x630000 [0050.023] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0050.023] GetProcessHeap () returned 0x630000 [0050.023] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0050.023] GetProcessHeap () returned 0x630000 [0050.023] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0050.023] GetProcessHeap () returned 0x630000 [0050.023] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0050.023] GetProcessHeap () returned 0x630000 [0050.023] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.023] GetProcessHeap () returned 0x630000 [0050.023] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.023] GetProcessHeap () returned 0x630000 [0050.023] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0050.023] GetProcessHeap () returned 0x630000 [0050.023] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0050.023] GetProcessHeap () returned 0x630000 [0050.023] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.023] GetProcessHeap () returned 0x630000 [0050.023] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.023] GetProcessHeap () returned 0x630000 [0050.023] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0050.023] GetProcessHeap () returned 0x630000 [0050.023] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0050.023] GetProcessHeap () returned 0x630000 [0050.023] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0050.023] GetProcessHeap () returned 0x630000 [0050.023] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0050.023] GetProcessHeap () returned 0x630000 [0050.023] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0050.023] GetProcessHeap () returned 0x630000 [0050.023] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0050.023] GetProcessHeap () returned 0x630000 [0050.023] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0050.023] GetProcessHeap () returned 0x630000 [0050.024] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0050.024] GetProcessHeap () returned 0x630000 [0050.024] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0050.024] GetProcessHeap () returned 0x630000 [0050.024] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0050.024] GetProcessHeap () returned 0x630000 [0050.024] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0050.024] GetProcessHeap () returned 0x630000 [0050.024] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0050.024] GetProcessHeap () returned 0x630000 [0050.024] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0050.024] GetProcessHeap () returned 0x630000 [0050.024] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0050.024] GetProcessHeap () returned 0x630000 [0050.024] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0050.024] GetProcessHeap () returned 0x630000 [0050.024] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0050.024] GetProcessHeap () returned 0x630000 [0050.024] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.024] GetProcessHeap () returned 0x630000 [0050.024] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.024] GetProcessHeap () returned 0x630000 [0050.024] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0050.024] GetProcessHeap () returned 0x630000 [0050.024] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0050.024] GetProcessHeap () returned 0x630000 [0050.024] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0050.024] GetProcessHeap () returned 0x630000 [0050.024] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0050.024] GetProcessHeap () returned 0x630000 [0050.024] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.024] GetProcessHeap () returned 0x630000 [0050.024] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.024] GetProcessHeap () returned 0x630000 [0050.024] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0050.024] GetProcessHeap () returned 0x630000 [0050.024] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0050.025] GetProcessHeap () returned 0x630000 [0050.025] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0050.025] GetProcessHeap () returned 0x630000 [0050.025] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0050.025] GetProcessHeap () returned 0x630000 [0050.025] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0050.025] GetProcessHeap () returned 0x630000 [0050.025] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0050.025] GetProcessHeap () returned 0x630000 [0050.025] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.025] GetProcessHeap () returned 0x630000 [0050.025] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.025] GetProcessHeap () returned 0x630000 [0050.025] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0050.025] GetProcessHeap () returned 0x630000 [0050.025] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0050.025] GetProcessHeap () returned 0x630000 [0050.025] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0050.025] GetProcessHeap () returned 0x630000 [0050.025] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0050.025] GetProcessHeap () returned 0x630000 [0050.025] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0050.025] GetProcessHeap () returned 0x630000 [0050.025] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0050.025] GetProcessHeap () returned 0x630000 [0050.025] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.025] GetProcessHeap () returned 0x630000 [0050.025] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.025] GetProcessHeap () returned 0x630000 [0050.025] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0050.025] GetProcessHeap () returned 0x630000 [0050.025] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0050.025] GetProcessHeap () returned 0x630000 [0050.025] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.025] GetProcessHeap () returned 0x630000 [0050.025] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.026] GetProcessHeap () returned 0x630000 [0050.026] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0050.026] GetProcessHeap () returned 0x630000 [0050.026] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0050.026] GetProcessHeap () returned 0x630000 [0050.026] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0050.026] GetProcessHeap () returned 0x630000 [0050.026] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0050.026] GetProcessHeap () returned 0x630000 [0050.026] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0050.026] GetProcessHeap () returned 0x630000 [0050.026] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0050.026] GetProcessHeap () returned 0x630000 [0050.026] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.026] GetProcessHeap () returned 0x630000 [0050.026] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.026] GetProcessHeap () returned 0x630000 [0050.026] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0050.026] GetProcessHeap () returned 0x630000 [0050.026] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0050.026] GetProcessHeap () returned 0x630000 [0050.026] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0050.026] GetProcessHeap () returned 0x630000 [0050.026] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0050.026] GetProcessHeap () returned 0x630000 [0050.026] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0050.026] GetProcessHeap () returned 0x630000 [0050.026] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0050.026] GetProcessHeap () returned 0x630000 [0050.026] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0050.026] GetProcessHeap () returned 0x630000 [0050.026] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655c80 | out: hHeap=0x630000) returned 1 [0050.026] GetProcessHeap () returned 0x630000 [0050.026] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0050.026] GetProcessHeap () returned 0x630000 [0050.026] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655800 | out: hHeap=0x630000) returned 1 [0050.026] GetProcessHeap () returned 0x630000 [0050.026] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0050.027] GetProcessHeap () returned 0x630000 [0050.027] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0050.027] GetProcessHeap () returned 0x630000 [0050.027] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0050.027] WriteFile (in: hFile=0x230, lpBuffer=0x65b460*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65b460*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0050.067] GetProcessHeap () returned 0x630000 [0050.067] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65b460, Size=0x30) returned 0x65b460 [0050.067] GetProcessHeap () returned 0x630000 [0050.067] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0050.067] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.067] GetProcessHeap () returned 0x630000 [0050.067] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x326c8) returned 0x65b498 [0050.070] ReadFile (in: hFile=0x230, lpBuffer=0x65b498, nNumberOfBytesToRead=0x326c8, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65b498*, lpNumberOfBytesRead=0x243d7e8*=0x326c8, lpOverlapped=0x0) returned 1 [0050.073] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.073] WriteFile (in: hFile=0x230, lpBuffer=0x65b498*, nNumberOfBytesToWrite=0x326c8, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65b498*, lpNumberOfBytesWritten=0x243d7e4*=0x326c8, lpOverlapped=0x0) returned 1 [0050.087] GetProcessHeap () returned 0x630000 [0050.087] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b498 | out: hHeap=0x630000) returned 1 [0050.087] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0050.087] WriteFile (in: hFile=0x230, lpBuffer=0x65b460*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65b460*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0050.088] CloseHandle (hObject=0x230) returned 1 [0050.093] GetProcessHeap () returned 0x630000 [0050.093] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f10 | out: hHeap=0x630000) returned 1 [0050.093] GetProcessHeap () returned 0x630000 [0050.093] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0050.093] GetProcessHeap () returned 0x630000 [0050.093] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0050.093] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\downloader.dll" | out: lpString1="C:\\Windows10Upgrade\\downloader.dll") returned="C:\\Windows10Upgrade\\downloader.dll" [0050.093] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\downloader.dll", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\downloader.dll.happythreechoose") returned="C:\\Windows10Upgrade\\downloader.dll.happythreechoose" [0050.093] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\downloader.dll" (normalized: "c:\\windows10upgrade\\downloader.dll"), lpNewFileName="C:\\Windows10Upgrade\\downloader.dll.happythreechoose" (normalized: "c:\\windows10upgrade\\downloader.dll.happythreechoose"), dwFlags=0x1) returned 1 [0050.093] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\downloader.dll" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0050.094] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0050.094] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\Decryption INFO.html" [0050.094] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\decryption info.html")) returned 0x20 [0050.094] GetProcessHeap () returned 0x630000 [0050.094] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0050.094] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea381b2a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea381b2a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x9d2c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0050.094] lstrcmpiW (lpString1="DW20.EXE", lpString2=".") returned 1 [0050.094] lstrcmpiW (lpString1="DW20.EXE", lpString2="..") returned 1 [0050.094] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="DW20.EXE" | out: lpString1="C:\\Windows10Upgrade\\DW20.EXE") returned="C:\\Windows10Upgrade\\DW20.EXE" [0050.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DW20.EXE", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0050.094] GetProcessHeap () returned 0x630000 [0050.094] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9) returned 0x64c9f0 [0050.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DW20.EXE", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DW20.EXE", lpUsedDefaultChar=0x0) returned 9 [0050.094] lstrlenA (lpString="DW20.EXE") returned 8 [0050.094] lstrlenA (lpString=".happythreechoose") returned 17 [0050.094] lstrcmpiW (lpString1="DW20.EXE", lpString2="Decryption INFO.html") returned 1 [0050.094] lstrcmpiW (lpString1="DW20.EXE", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0050.094] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0050.094] lstrcmpiW (lpString1="DW20.EXE", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0050.094] GetProcessHeap () returned 0x630000 [0050.094] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f10 [0050.094] CreateFileW (lpFileName="C:\\Windows10Upgrade\\DW20.EXE" (normalized: "c:\\windows10upgrade\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0050.095] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=643784) returned 1 [0050.095] GetProcessHeap () returned 0x630000 [0050.095] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x63e830 [0050.095] GetProcessHeap () returned 0x630000 [0050.095] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0050.095] lstrlenW (lpString="C:\\Windows10Upgrade\\DW20.EXE") returned 28 [0050.095] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0050.095] GetProcessHeap () returned 0x630000 [0050.095] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0050.095] GetProcessHeap () returned 0x630000 [0050.095] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x388) returned 0x65b498 [0050.095] lstrlenA (lpString="rsa_encrypt") returned 11 [0050.095] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0050.095] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0050.096] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0050.096] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0050.096] GetProcessHeap () returned 0x630000 [0050.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0050.096] lstrlenA (lpString="010001") returned 6 [0050.096] GetProcessHeap () returned 0x630000 [0050.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0050.096] GetProcessHeap () returned 0x630000 [0050.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0050.096] GetProcessHeap () returned 0x630000 [0050.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655260 [0050.096] GetProcessHeap () returned 0x630000 [0050.096] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0050.096] GetProcessHeap () returned 0x630000 [0050.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655da0 [0050.096] GetProcessHeap () returned 0x630000 [0050.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657210 [0050.096] GetProcessHeap () returned 0x630000 [0050.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2b8 [0050.096] GetProcessHeap () returned 0x630000 [0050.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0050.096] GetProcessHeap () returned 0x630000 [0050.096] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0050.096] GetProcessHeap () returned 0x630000 [0050.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0050.096] GetProcessHeap () returned 0x630000 [0050.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0050.096] GetProcessHeap () returned 0x630000 [0050.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657440 [0050.096] GetProcessHeap () returned 0x630000 [0050.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0050.096] GetProcessHeap () returned 0x630000 [0050.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0050.096] GetProcessHeap () returned 0x630000 [0050.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655e30 [0050.096] GetProcessHeap () returned 0x630000 [0050.096] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0050.097] GetProcessHeap () returned 0x630000 [0050.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0050.097] GetProcessHeap () returned 0x630000 [0050.097] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655e30 | out: hHeap=0x630000) returned 1 [0050.097] GetProcessHeap () returned 0x630000 [0050.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0050.097] GetProcessHeap () returned 0x630000 [0050.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65b278 [0050.097] GetProcessHeap () returned 0x630000 [0050.097] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0050.097] GetProcessHeap () returned 0x630000 [0050.097] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0050.097] GetProcessHeap () returned 0x630000 [0050.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0050.097] GetProcessHeap () returned 0x630000 [0050.097] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0050.097] GetProcessHeap () returned 0x630000 [0050.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x6554a0 [0050.097] GetProcessHeap () returned 0x630000 [0050.097] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b278 | out: hHeap=0x630000) returned 1 [0050.097] GetProcessHeap () returned 0x630000 [0050.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0050.097] GetProcessHeap () returned 0x630000 [0050.097] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6554a0 | out: hHeap=0x630000) returned 1 [0050.097] GetProcessHeap () returned 0x630000 [0050.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0050.097] GetProcessHeap () returned 0x630000 [0050.097] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0050.097] GetProcessHeap () returned 0x630000 [0050.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0050.097] GetProcessHeap () returned 0x630000 [0050.097] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0050.097] GetProcessHeap () returned 0x630000 [0050.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0050.097] GetProcessHeap () returned 0x630000 [0050.097] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0050.097] GetProcessHeap () returned 0x630000 [0050.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0050.097] GetProcessHeap () returned 0x630000 [0050.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0050.098] GetProcessHeap () returned 0x630000 [0050.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.098] GetProcessHeap () returned 0x630000 [0050.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.098] GetProcessHeap () returned 0x630000 [0050.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0050.098] GetProcessHeap () returned 0x630000 [0050.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0050.098] GetProcessHeap () returned 0x630000 [0050.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0050.098] GetProcessHeap () returned 0x630000 [0050.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0050.098] GetProcessHeap () returned 0x630000 [0050.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0050.098] GetProcessHeap () returned 0x630000 [0050.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0050.098] GetProcessHeap () returned 0x630000 [0050.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0050.098] GetProcessHeap () returned 0x630000 [0050.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0050.098] GetProcessHeap () returned 0x630000 [0050.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0050.098] GetProcessHeap () returned 0x630000 [0050.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0050.098] GetProcessHeap () returned 0x630000 [0050.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.098] GetProcessHeap () returned 0x630000 [0050.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.098] GetProcessHeap () returned 0x630000 [0050.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0050.098] GetProcessHeap () returned 0x630000 [0050.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0050.098] GetProcessHeap () returned 0x630000 [0050.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.098] GetProcessHeap () returned 0x630000 [0050.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.098] GetProcessHeap () returned 0x630000 [0050.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0050.099] GetProcessHeap () returned 0x630000 [0050.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0050.099] GetProcessHeap () returned 0x630000 [0050.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0050.099] GetProcessHeap () returned 0x630000 [0050.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0050.099] GetProcessHeap () returned 0x630000 [0050.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.099] GetProcessHeap () returned 0x630000 [0050.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.099] GetProcessHeap () returned 0x630000 [0050.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.099] GetProcessHeap () returned 0x630000 [0050.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.099] GetProcessHeap () returned 0x630000 [0050.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0050.099] GetProcessHeap () returned 0x630000 [0050.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0050.099] GetProcessHeap () returned 0x630000 [0050.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0050.099] GetProcessHeap () returned 0x630000 [0050.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0050.099] GetProcessHeap () returned 0x630000 [0050.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0050.099] GetProcessHeap () returned 0x630000 [0050.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0050.099] GetProcessHeap () returned 0x630000 [0050.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.099] GetProcessHeap () returned 0x630000 [0050.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.099] GetProcessHeap () returned 0x630000 [0050.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.099] GetProcessHeap () returned 0x630000 [0050.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.099] GetProcessHeap () returned 0x630000 [0050.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0050.099] GetProcessHeap () returned 0x630000 [0050.100] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0050.100] GetProcessHeap () returned 0x630000 [0050.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0050.100] GetProcessHeap () returned 0x630000 [0050.100] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0050.100] GetProcessHeap () returned 0x630000 [0050.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0050.100] GetProcessHeap () returned 0x630000 [0050.100] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0050.100] GetProcessHeap () returned 0x630000 [0050.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0050.100] GetProcessHeap () returned 0x630000 [0050.100] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0050.100] GetProcessHeap () returned 0x630000 [0050.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0050.100] GetProcessHeap () returned 0x630000 [0050.100] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0050.100] GetProcessHeap () returned 0x630000 [0050.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0050.100] GetProcessHeap () returned 0x630000 [0050.100] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0050.101] GetProcessHeap () returned 0x630000 [0050.101] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0050.101] GetProcessHeap () returned 0x630000 [0050.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0050.101] GetProcessHeap () returned 0x630000 [0050.101] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.101] GetProcessHeap () returned 0x630000 [0050.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.101] GetProcessHeap () returned 0x630000 [0050.101] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.101] GetProcessHeap () returned 0x630000 [0050.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.101] GetProcessHeap () returned 0x630000 [0050.101] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0050.101] GetProcessHeap () returned 0x630000 [0050.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0050.101] GetProcessHeap () returned 0x630000 [0050.101] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.101] GetProcessHeap () returned 0x630000 [0050.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.101] GetProcessHeap () returned 0x630000 [0050.101] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0050.101] GetProcessHeap () returned 0x630000 [0050.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0050.101] GetProcessHeap () returned 0x630000 [0050.101] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0050.101] GetProcessHeap () returned 0x630000 [0050.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0050.101] GetProcessHeap () returned 0x630000 [0050.101] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0050.101] GetProcessHeap () returned 0x630000 [0050.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0050.102] GetProcessHeap () returned 0x630000 [0050.102] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0050.102] GetProcessHeap () returned 0x630000 [0050.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0050.102] GetProcessHeap () returned 0x630000 [0050.102] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.102] GetProcessHeap () returned 0x630000 [0050.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.102] GetProcessHeap () returned 0x630000 [0050.102] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0050.102] GetProcessHeap () returned 0x630000 [0050.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0050.102] GetProcessHeap () returned 0x630000 [0050.102] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0050.102] GetProcessHeap () returned 0x630000 [0050.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0050.102] GetProcessHeap () returned 0x630000 [0050.102] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.102] GetProcessHeap () returned 0x630000 [0050.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.102] GetProcessHeap () returned 0x630000 [0050.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0050.102] GetProcessHeap () returned 0x630000 [0050.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0050.102] GetProcessHeap () returned 0x630000 [0050.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0050.102] GetProcessHeap () returned 0x630000 [0050.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0050.102] GetProcessHeap () returned 0x630000 [0050.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0050.102] GetProcessHeap () returned 0x630000 [0050.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655da0 | out: hHeap=0x630000) returned 1 [0050.102] GetProcessHeap () returned 0x630000 [0050.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0050.102] GetProcessHeap () returned 0x630000 [0050.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655260 | out: hHeap=0x630000) returned 1 [0050.102] GetProcessHeap () returned 0x630000 [0050.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0050.103] GetProcessHeap () returned 0x630000 [0050.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0050.103] GetProcessHeap () returned 0x630000 [0050.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0050.103] WriteFile (in: hFile=0x230, lpBuffer=0x65b498*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65b498*, lpNumberOfBytesWritten=0x243d864*=0x388, lpOverlapped=0x0) returned 1 [0050.140] GetProcessHeap () returned 0x630000 [0050.140] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65b498, Size=0x30) returned 0x65b498 [0050.140] GetProcessHeap () returned 0x630000 [0050.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0050.140] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.140] GetProcessHeap () returned 0x630000 [0050.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9d2d0) returned 0x1f30020 [0050.151] ReadFile (in: hFile=0x230, lpBuffer=0x1f30020, nNumberOfBytesToRead=0x9d2d0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x1f30020*, lpNumberOfBytesRead=0x243d7e8*=0x9d2d0, lpOverlapped=0x0) returned 1 [0050.162] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.162] WriteFile (in: hFile=0x230, lpBuffer=0x1f30020*, nNumberOfBytesToWrite=0x9d2d0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x1f30020*, lpNumberOfBytesWritten=0x243d7e4*=0x9d2d0, lpOverlapped=0x0) returned 1 [0050.204] GetProcessHeap () returned 0x630000 [0050.204] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x1f30020 | out: hHeap=0x630000) returned 1 [0050.207] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0050.207] WriteFile (in: hFile=0x230, lpBuffer=0x65b498*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65b498*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0050.208] CloseHandle (hObject=0x230) returned 1 [0050.219] GetProcessHeap () returned 0x630000 [0050.219] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f10 | out: hHeap=0x630000) returned 1 [0050.219] GetProcessHeap () returned 0x630000 [0050.219] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0050.219] GetProcessHeap () returned 0x630000 [0050.219] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0050.220] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\DW20.EXE" | out: lpString1="C:\\Windows10Upgrade\\DW20.EXE") returned="C:\\Windows10Upgrade\\DW20.EXE" [0050.220] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\DW20.EXE", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\DW20.EXE.happythreechoose") returned="C:\\Windows10Upgrade\\DW20.EXE.happythreechoose" [0050.220] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\DW20.EXE" (normalized: "c:\\windows10upgrade\\dw20.exe"), lpNewFileName="C:\\Windows10Upgrade\\DW20.EXE.happythreechoose" (normalized: "c:\\windows10upgrade\\dw20.exe.happythreechoose"), dwFlags=0x1) returned 1 [0050.220] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\DW20.EXE" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0050.220] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0050.220] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\Decryption INFO.html" [0050.220] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\decryption info.html")) returned 0x20 [0050.220] GetProcessHeap () returned 0x630000 [0050.220] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0050.220] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea385605, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea385605, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xc2c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DWDCW20.DLL", cAlternateFileName="")) returned 1 [0050.221] lstrcmpiW (lpString1="DWDCW20.DLL", lpString2=".") returned 1 [0050.221] lstrcmpiW (lpString1="DWDCW20.DLL", lpString2="..") returned 1 [0050.221] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="DWDCW20.DLL" | out: lpString1="C:\\Windows10Upgrade\\DWDCW20.DLL") returned="C:\\Windows10Upgrade\\DWDCW20.DLL" [0050.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DWDCW20.DLL", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0050.221] GetProcessHeap () returned 0x630000 [0050.221] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0050.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DWDCW20.DLL", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DWDCW20.DLL", lpUsedDefaultChar=0x0) returned 12 [0050.221] lstrlenA (lpString="DWDCW20.DLL") returned 11 [0050.221] lstrlenA (lpString=".happythreechoose") returned 17 [0050.221] lstrcmpiW (lpString1="DWDCW20.DLL", lpString2="Decryption INFO.html") returned 1 [0050.221] lstrcmpiW (lpString1="DWDCW20.DLL", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0050.221] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0050.221] lstrcmpiW (lpString1="DWDCW20.DLL", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0050.221] GetProcessHeap () returned 0x630000 [0050.221] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0050.221] CreateFileW (lpFileName="C:\\Windows10Upgrade\\DWDCW20.DLL" (normalized: "c:\\windows10upgrade\\dwdcw20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0050.222] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=49864) returned 1 [0050.222] GetProcessHeap () returned 0x630000 [0050.222] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x63e830 [0050.222] GetProcessHeap () returned 0x630000 [0050.222] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0050.222] lstrlenW (lpString="C:\\Windows10Upgrade\\DWDCW20.DLL") returned 31 [0050.222] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0050.222] GetProcessHeap () returned 0x630000 [0050.222] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0050.222] GetProcessHeap () returned 0x630000 [0050.222] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x388) returned 0x65b4d0 [0050.222] lstrlenA (lpString="rsa_encrypt") returned 11 [0050.222] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0050.223] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0050.223] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0050.223] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0050.223] GetProcessHeap () returned 0x630000 [0050.223] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0050.223] lstrlenA (lpString="010001") returned 6 [0050.223] GetProcessHeap () returned 0x630000 [0050.223] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2b8 [0050.223] GetProcessHeap () returned 0x630000 [0050.223] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0050.223] GetProcessHeap () returned 0x630000 [0050.223] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x6551d0 [0050.223] GetProcessHeap () returned 0x630000 [0050.223] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0050.223] GetProcessHeap () returned 0x630000 [0050.223] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655ad0 [0050.223] GetProcessHeap () returned 0x630000 [0050.223] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656db0 [0050.223] GetProcessHeap () returned 0x630000 [0050.223] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0050.223] GetProcessHeap () returned 0x630000 [0050.223] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0050.223] GetProcessHeap () returned 0x630000 [0050.223] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0050.223] GetProcessHeap () returned 0x630000 [0050.223] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0050.223] GetProcessHeap () returned 0x630000 [0050.223] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0050.223] GetProcessHeap () returned 0x630000 [0050.223] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657210 [0050.224] GetProcessHeap () returned 0x630000 [0050.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.224] GetProcessHeap () returned 0x630000 [0050.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0050.224] GetProcessHeap () returned 0x630000 [0050.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655f50 [0050.224] GetProcessHeap () returned 0x630000 [0050.224] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0050.224] GetProcessHeap () returned 0x630000 [0050.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0050.224] GetProcessHeap () returned 0x630000 [0050.224] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655f50 | out: hHeap=0x630000) returned 1 [0050.224] GetProcessHeap () returned 0x630000 [0050.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0050.224] GetProcessHeap () returned 0x630000 [0050.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65b218 [0050.224] GetProcessHeap () returned 0x630000 [0050.224] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.224] GetProcessHeap () returned 0x630000 [0050.224] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0050.224] GetProcessHeap () returned 0x630000 [0050.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0050.224] GetProcessHeap () returned 0x630000 [0050.224] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0050.224] GetProcessHeap () returned 0x630000 [0050.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x655fe0 [0050.224] GetProcessHeap () returned 0x630000 [0050.224] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b218 | out: hHeap=0x630000) returned 1 [0050.224] GetProcessHeap () returned 0x630000 [0050.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0050.224] GetProcessHeap () returned 0x630000 [0050.224] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655fe0 | out: hHeap=0x630000) returned 1 [0050.224] GetProcessHeap () returned 0x630000 [0050.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0050.224] GetProcessHeap () returned 0x630000 [0050.224] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0050.224] GetProcessHeap () returned 0x630000 [0050.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0050.224] GetProcessHeap () returned 0x630000 [0050.224] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0050.225] GetProcessHeap () returned 0x630000 [0050.225] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0050.225] GetProcessHeap () returned 0x630000 [0050.225] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0050.225] GetProcessHeap () returned 0x630000 [0050.225] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0050.225] GetProcessHeap () returned 0x630000 [0050.225] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0050.225] GetProcessHeap () returned 0x630000 [0050.225] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0050.225] GetProcessHeap () returned 0x630000 [0050.225] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0050.225] GetProcessHeap () returned 0x630000 [0050.225] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.225] GetProcessHeap () returned 0x630000 [0050.225] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.225] GetProcessHeap () returned 0x630000 [0050.225] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.225] GetProcessHeap () returned 0x630000 [0050.225] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.225] GetProcessHeap () returned 0x630000 [0050.225] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.225] GetProcessHeap () returned 0x630000 [0050.225] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.225] GetProcessHeap () returned 0x630000 [0050.225] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0050.226] GetProcessHeap () returned 0x630000 [0050.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0050.226] GetProcessHeap () returned 0x630000 [0050.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0050.226] GetProcessHeap () returned 0x630000 [0050.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0050.226] GetProcessHeap () returned 0x630000 [0050.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0050.226] GetProcessHeap () returned 0x630000 [0050.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0050.226] GetProcessHeap () returned 0x630000 [0050.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.226] GetProcessHeap () returned 0x630000 [0050.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.226] GetProcessHeap () returned 0x630000 [0050.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0050.226] GetProcessHeap () returned 0x630000 [0050.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0050.226] GetProcessHeap () returned 0x630000 [0050.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0050.226] GetProcessHeap () returned 0x630000 [0050.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0050.226] GetProcessHeap () returned 0x630000 [0050.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0050.226] GetProcessHeap () returned 0x630000 [0050.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0050.226] GetProcessHeap () returned 0x630000 [0050.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0050.226] GetProcessHeap () returned 0x630000 [0050.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0050.226] GetProcessHeap () returned 0x630000 [0050.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0050.226] GetProcessHeap () returned 0x630000 [0050.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0050.226] GetProcessHeap () returned 0x630000 [0050.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.226] GetProcessHeap () returned 0x630000 [0050.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.227] GetProcessHeap () returned 0x630000 [0050.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.227] GetProcessHeap () returned 0x630000 [0050.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.227] GetProcessHeap () returned 0x630000 [0050.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0050.227] GetProcessHeap () returned 0x630000 [0050.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0050.227] GetProcessHeap () returned 0x630000 [0050.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0050.227] GetProcessHeap () returned 0x630000 [0050.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0050.227] GetProcessHeap () returned 0x630000 [0050.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0050.227] GetProcessHeap () returned 0x630000 [0050.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0050.227] GetProcessHeap () returned 0x630000 [0050.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0050.227] GetProcessHeap () returned 0x630000 [0050.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0050.227] GetProcessHeap () returned 0x630000 [0050.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0050.227] GetProcessHeap () returned 0x630000 [0050.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0050.227] GetProcessHeap () returned 0x630000 [0050.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.227] GetProcessHeap () returned 0x630000 [0050.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.227] GetProcessHeap () returned 0x630000 [0050.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0050.227] GetProcessHeap () returned 0x630000 [0050.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0050.227] GetProcessHeap () returned 0x630000 [0050.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0050.227] GetProcessHeap () returned 0x630000 [0050.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0050.227] GetProcessHeap () returned 0x630000 [0050.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0050.227] GetProcessHeap () returned 0x630000 [0050.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0050.228] GetProcessHeap () returned 0x630000 [0050.228] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0050.228] GetProcessHeap () returned 0x630000 [0050.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0050.228] GetProcessHeap () returned 0x630000 [0050.228] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0050.228] GetProcessHeap () returned 0x630000 [0050.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0050.228] GetProcessHeap () returned 0x630000 [0050.228] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0050.228] GetProcessHeap () returned 0x630000 [0050.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0050.228] GetProcessHeap () returned 0x630000 [0050.228] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0050.228] GetProcessHeap () returned 0x630000 [0050.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0050.228] GetProcessHeap () returned 0x630000 [0050.228] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.228] GetProcessHeap () returned 0x630000 [0050.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.228] GetProcessHeap () returned 0x630000 [0050.228] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0050.228] GetProcessHeap () returned 0x630000 [0050.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0050.228] GetProcessHeap () returned 0x630000 [0050.228] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0050.228] GetProcessHeap () returned 0x630000 [0050.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0050.228] GetProcessHeap () returned 0x630000 [0050.228] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.228] GetProcessHeap () returned 0x630000 [0050.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.228] GetProcessHeap () returned 0x630000 [0050.228] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0050.228] GetProcessHeap () returned 0x630000 [0050.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0050.228] GetProcessHeap () returned 0x630000 [0050.229] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.229] GetProcessHeap () returned 0x630000 [0050.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.229] GetProcessHeap () returned 0x630000 [0050.229] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.229] GetProcessHeap () returned 0x630000 [0050.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.229] GetProcessHeap () returned 0x630000 [0050.229] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.229] GetProcessHeap () returned 0x630000 [0050.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.229] GetProcessHeap () returned 0x630000 [0050.229] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0050.229] GetProcessHeap () returned 0x630000 [0050.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0050.229] GetProcessHeap () returned 0x630000 [0050.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0050.229] GetProcessHeap () returned 0x630000 [0050.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0050.229] GetProcessHeap () returned 0x630000 [0050.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0050.229] GetProcessHeap () returned 0x630000 [0050.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0050.229] GetProcessHeap () returned 0x630000 [0050.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0050.229] GetProcessHeap () returned 0x630000 [0050.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655ad0 | out: hHeap=0x630000) returned 1 [0050.229] GetProcessHeap () returned 0x630000 [0050.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0050.229] GetProcessHeap () returned 0x630000 [0050.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6551d0 | out: hHeap=0x630000) returned 1 [0050.229] GetProcessHeap () returned 0x630000 [0050.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0050.229] GetProcessHeap () returned 0x630000 [0050.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0050.229] GetProcessHeap () returned 0x630000 [0050.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0050.229] WriteFile (in: hFile=0x230, lpBuffer=0x65b4d0*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65b4d0*, lpNumberOfBytesWritten=0x243d864*=0x388, lpOverlapped=0x0) returned 1 [0050.257] GetProcessHeap () returned 0x630000 [0050.257] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65b4d0, Size=0x30) returned 0x65b4d0 [0050.257] GetProcessHeap () returned 0x630000 [0050.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0050.257] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.257] GetProcessHeap () returned 0x630000 [0050.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc2d0) returned 0x65b508 [0050.257] ReadFile (in: hFile=0x230, lpBuffer=0x65b508, nNumberOfBytesToRead=0xc2d0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65b508*, lpNumberOfBytesRead=0x243d7e8*=0xc2d0, lpOverlapped=0x0) returned 1 [0050.258] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.258] WriteFile (in: hFile=0x230, lpBuffer=0x65b508*, nNumberOfBytesToWrite=0xc2d0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65b508*, lpNumberOfBytesWritten=0x243d7e4*=0xc2d0, lpOverlapped=0x0) returned 1 [0050.310] GetProcessHeap () returned 0x630000 [0050.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b508 | out: hHeap=0x630000) returned 1 [0050.311] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0050.311] WriteFile (in: hFile=0x230, lpBuffer=0x65b4d0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65b4d0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0050.313] CloseHandle (hObject=0x230) returned 1 [0050.315] GetProcessHeap () returned 0x630000 [0050.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0050.315] GetProcessHeap () returned 0x630000 [0050.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0050.315] GetProcessHeap () returned 0x630000 [0050.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0050.316] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\DWDCW20.DLL" | out: lpString1="C:\\Windows10Upgrade\\DWDCW20.DLL") returned="C:\\Windows10Upgrade\\DWDCW20.DLL" [0050.316] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\DWDCW20.DLL", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\DWDCW20.DLL.happythreechoose") returned="C:\\Windows10Upgrade\\DWDCW20.DLL.happythreechoose" [0050.316] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\DWDCW20.DLL" (normalized: "c:\\windows10upgrade\\dwdcw20.dll"), lpNewFileName="C:\\Windows10Upgrade\\DWDCW20.DLL.happythreechoose" (normalized: "c:\\windows10upgrade\\dwdcw20.dll.happythreechoose"), dwFlags=0x1) returned 1 [0050.316] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\DWDCW20.DLL" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0050.316] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0050.316] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\Decryption INFO.html" [0050.316] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\decryption info.html")) returned 0x20 [0050.316] GetProcessHeap () returned 0x630000 [0050.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0050.316] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea386943, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea386943, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xb2c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 1 [0050.316] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2=".") returned 1 [0050.316] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2="..") returned 1 [0050.317] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="DWTRIG20.EXE" | out: lpString1="C:\\Windows10Upgrade\\DWTRIG20.EXE") returned="C:\\Windows10Upgrade\\DWTRIG20.EXE" [0050.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DWTRIG20.EXE", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0050.317] GetProcessHeap () returned 0x630000 [0050.317] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd) returned 0x64c9f0 [0050.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DWTRIG20.EXE", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DWTRIG20.EXE", lpUsedDefaultChar=0x0) returned 13 [0050.317] lstrlenA (lpString="DWTRIG20.EXE") returned 12 [0050.317] lstrlenA (lpString=".happythreechoose") returned 17 [0050.317] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2="Decryption INFO.html") returned 1 [0050.317] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0050.317] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0050.317] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0050.317] GetProcessHeap () returned 0x630000 [0050.317] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651ec0 [0050.317] CreateFileW (lpFileName="C:\\Windows10Upgrade\\DWTRIG20.EXE" (normalized: "c:\\windows10upgrade\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0050.317] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=45768) returned 1 [0050.317] GetProcessHeap () returned 0x630000 [0050.317] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x63e830 [0050.317] GetProcessHeap () returned 0x630000 [0050.317] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0050.317] lstrlenW (lpString="C:\\Windows10Upgrade\\DWTRIG20.EXE") returned 32 [0050.317] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0050.317] GetProcessHeap () returned 0x630000 [0050.317] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0050.318] GetProcessHeap () returned 0x630000 [0050.318] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x65b508 [0050.319] lstrlenA (lpString="rsa_encrypt") returned 11 [0050.319] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0050.320] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0050.320] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0050.320] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0050.320] GetProcessHeap () returned 0x630000 [0050.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0050.320] lstrlenA (lpString="010001") returned 6 [0050.320] GetProcessHeap () returned 0x630000 [0050.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a308 [0050.320] GetProcessHeap () returned 0x630000 [0050.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0050.320] GetProcessHeap () returned 0x630000 [0050.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655e30 [0050.320] GetProcessHeap () returned 0x630000 [0050.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0050.320] GetProcessHeap () returned 0x630000 [0050.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655890 [0050.320] GetProcessHeap () returned 0x630000 [0050.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656a68 [0050.320] GetProcessHeap () returned 0x630000 [0050.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a398 [0050.320] GetProcessHeap () returned 0x630000 [0050.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0050.320] GetProcessHeap () returned 0x630000 [0050.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0050.320] GetProcessHeap () returned 0x630000 [0050.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0050.320] GetProcessHeap () returned 0x630000 [0050.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0050.320] GetProcessHeap () returned 0x630000 [0050.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657328 [0050.320] GetProcessHeap () returned 0x630000 [0050.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0050.320] GetProcessHeap () returned 0x630000 [0050.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0050.321] GetProcessHeap () returned 0x630000 [0050.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655bf0 [0050.321] GetProcessHeap () returned 0x630000 [0050.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0050.321] GetProcessHeap () returned 0x630000 [0050.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0050.321] GetProcessHeap () returned 0x630000 [0050.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655bf0 | out: hHeap=0x630000) returned 1 [0050.321] GetProcessHeap () returned 0x630000 [0050.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.321] GetProcessHeap () returned 0x630000 [0050.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65b2d8 [0050.321] GetProcessHeap () returned 0x630000 [0050.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0050.321] GetProcessHeap () returned 0x630000 [0050.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.321] GetProcessHeap () returned 0x630000 [0050.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.321] GetProcessHeap () returned 0x630000 [0050.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.321] GetProcessHeap () returned 0x630000 [0050.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x655d10 [0050.321] GetProcessHeap () returned 0x630000 [0050.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b2d8 | out: hHeap=0x630000) returned 1 [0050.321] GetProcessHeap () returned 0x630000 [0050.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0050.321] GetProcessHeap () returned 0x630000 [0050.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655d10 | out: hHeap=0x630000) returned 1 [0050.321] GetProcessHeap () returned 0x630000 [0050.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0050.321] GetProcessHeap () returned 0x630000 [0050.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0050.321] GetProcessHeap () returned 0x630000 [0050.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.321] GetProcessHeap () returned 0x630000 [0050.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.321] GetProcessHeap () returned 0x630000 [0050.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0050.322] GetProcessHeap () returned 0x630000 [0050.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0050.322] GetProcessHeap () returned 0x630000 [0050.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.322] GetProcessHeap () returned 0x630000 [0050.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.322] GetProcessHeap () returned 0x630000 [0050.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0050.322] GetProcessHeap () returned 0x630000 [0050.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0050.322] GetProcessHeap () returned 0x630000 [0050.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0050.322] GetProcessHeap () returned 0x630000 [0050.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0050.322] GetProcessHeap () returned 0x630000 [0050.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0050.322] GetProcessHeap () returned 0x630000 [0050.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0050.322] GetProcessHeap () returned 0x630000 [0050.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.322] GetProcessHeap () returned 0x630000 [0050.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.322] GetProcessHeap () returned 0x630000 [0050.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0050.322] GetProcessHeap () returned 0x630000 [0050.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0050.322] GetProcessHeap () returned 0x630000 [0050.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0050.322] GetProcessHeap () returned 0x630000 [0050.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0050.322] GetProcessHeap () returned 0x630000 [0050.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0050.322] GetProcessHeap () returned 0x630000 [0050.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0050.322] GetProcessHeap () returned 0x630000 [0050.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.322] GetProcessHeap () returned 0x630000 [0050.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.323] GetProcessHeap () returned 0x630000 [0050.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0050.323] GetProcessHeap () returned 0x630000 [0050.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0050.323] GetProcessHeap () returned 0x630000 [0050.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.323] GetProcessHeap () returned 0x630000 [0050.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.323] GetProcessHeap () returned 0x630000 [0050.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0050.323] GetProcessHeap () returned 0x630000 [0050.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0050.323] GetProcessHeap () returned 0x630000 [0050.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.323] GetProcessHeap () returned 0x630000 [0050.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.323] GetProcessHeap () returned 0x630000 [0050.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0050.323] GetProcessHeap () returned 0x630000 [0050.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0050.323] GetProcessHeap () returned 0x630000 [0050.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0050.323] GetProcessHeap () returned 0x630000 [0050.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0050.323] GetProcessHeap () returned 0x630000 [0050.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0050.323] GetProcessHeap () returned 0x630000 [0050.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0050.323] GetProcessHeap () returned 0x630000 [0050.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.323] GetProcessHeap () returned 0x630000 [0050.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.323] GetProcessHeap () returned 0x630000 [0050.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0050.323] GetProcessHeap () returned 0x630000 [0050.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0050.324] GetProcessHeap () returned 0x630000 [0050.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0050.324] GetProcessHeap () returned 0x630000 [0050.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0050.324] GetProcessHeap () returned 0x630000 [0050.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0050.324] GetProcessHeap () returned 0x630000 [0050.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0050.324] GetProcessHeap () returned 0x630000 [0050.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0050.324] GetProcessHeap () returned 0x630000 [0050.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0050.324] GetProcessHeap () returned 0x630000 [0050.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0050.324] GetProcessHeap () returned 0x630000 [0050.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0050.324] GetProcessHeap () returned 0x630000 [0050.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0050.324] GetProcessHeap () returned 0x630000 [0050.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0050.324] GetProcessHeap () returned 0x630000 [0050.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.324] GetProcessHeap () returned 0x630000 [0050.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.324] GetProcessHeap () returned 0x630000 [0050.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0050.324] GetProcessHeap () returned 0x630000 [0050.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0050.324] GetProcessHeap () returned 0x630000 [0050.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0050.324] GetProcessHeap () returned 0x630000 [0050.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0050.324] GetProcessHeap () returned 0x630000 [0050.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0050.324] GetProcessHeap () returned 0x630000 [0050.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0050.324] GetProcessHeap () returned 0x630000 [0050.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0050.324] GetProcessHeap () returned 0x630000 [0050.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0050.325] GetProcessHeap () returned 0x630000 [0050.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0050.325] GetProcessHeap () returned 0x630000 [0050.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0050.325] GetProcessHeap () returned 0x630000 [0050.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0050.325] GetProcessHeap () returned 0x630000 [0050.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0050.325] GetProcessHeap () returned 0x630000 [0050.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.325] GetProcessHeap () returned 0x630000 [0050.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.325] GetProcessHeap () returned 0x630000 [0050.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.325] GetProcessHeap () returned 0x630000 [0050.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.325] GetProcessHeap () returned 0x630000 [0050.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0050.325] GetProcessHeap () returned 0x630000 [0050.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0050.325] GetProcessHeap () returned 0x630000 [0050.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0050.325] GetProcessHeap () returned 0x630000 [0050.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0050.325] GetProcessHeap () returned 0x630000 [0050.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0050.325] GetProcessHeap () returned 0x630000 [0050.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0050.325] GetProcessHeap () returned 0x630000 [0050.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0050.325] GetProcessHeap () returned 0x630000 [0050.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0050.325] GetProcessHeap () returned 0x630000 [0050.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0050.325] GetProcessHeap () returned 0x630000 [0050.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0050.325] GetProcessHeap () returned 0x630000 [0050.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0050.325] GetProcessHeap () returned 0x630000 [0050.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0050.326] GetProcessHeap () returned 0x630000 [0050.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0050.326] GetProcessHeap () returned 0x630000 [0050.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0050.326] GetProcessHeap () returned 0x630000 [0050.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0050.326] GetProcessHeap () returned 0x630000 [0050.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0050.326] GetProcessHeap () returned 0x630000 [0050.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0050.326] GetProcessHeap () returned 0x630000 [0050.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655890 | out: hHeap=0x630000) returned 1 [0050.326] GetProcessHeap () returned 0x630000 [0050.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0050.326] GetProcessHeap () returned 0x630000 [0050.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655e30 | out: hHeap=0x630000) returned 1 [0050.326] GetProcessHeap () returned 0x630000 [0050.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0050.326] GetProcessHeap () returned 0x630000 [0050.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.326] GetProcessHeap () returned 0x630000 [0050.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0050.326] WriteFile (in: hFile=0x230, lpBuffer=0x65b508*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65b508*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0050.338] GetProcessHeap () returned 0x630000 [0050.338] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65b508, Size=0x30) returned 0x65b508 [0050.338] GetProcessHeap () returned 0x630000 [0050.338] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0050.339] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.339] GetProcessHeap () returned 0x630000 [0050.339] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb2c8) returned 0x65b540 [0050.339] ReadFile (in: hFile=0x230, lpBuffer=0x65b540, nNumberOfBytesToRead=0xb2c8, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65b540*, lpNumberOfBytesRead=0x243d7e8*=0xb2c8, lpOverlapped=0x0) returned 1 [0050.340] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.340] WriteFile (in: hFile=0x230, lpBuffer=0x65b540*, nNumberOfBytesToWrite=0xb2c8, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65b540*, lpNumberOfBytesWritten=0x243d7e4*=0xb2c8, lpOverlapped=0x0) returned 1 [0050.350] GetProcessHeap () returned 0x630000 [0050.350] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b540 | out: hHeap=0x630000) returned 1 [0050.350] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0050.350] WriteFile (in: hFile=0x230, lpBuffer=0x65b508*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65b508*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0050.351] CloseHandle (hObject=0x230) returned 1 [0050.353] GetProcessHeap () returned 0x630000 [0050.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651ec0 | out: hHeap=0x630000) returned 1 [0050.353] GetProcessHeap () returned 0x630000 [0050.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0050.353] GetProcessHeap () returned 0x630000 [0050.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0050.353] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\DWTRIG20.EXE" | out: lpString1="C:\\Windows10Upgrade\\DWTRIG20.EXE") returned="C:\\Windows10Upgrade\\DWTRIG20.EXE" [0050.353] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\DWTRIG20.EXE", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\DWTRIG20.EXE.happythreechoose") returned="C:\\Windows10Upgrade\\DWTRIG20.EXE.happythreechoose" [0050.353] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\DWTRIG20.EXE" (normalized: "c:\\windows10upgrade\\dwtrig20.exe"), lpNewFileName="C:\\Windows10Upgrade\\DWTRIG20.EXE.happythreechoose" (normalized: "c:\\windows10upgrade\\dwtrig20.exe.happythreechoose"), dwFlags=0x1) returned 1 [0050.354] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\DWTRIG20.EXE" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0050.354] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0050.354] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\Decryption INFO.html" [0050.354] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\decryption info.html")) returned 0x20 [0050.354] GetProcessHeap () returned 0x630000 [0050.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0050.354] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea387cd0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea387cd0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x2652, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EnableWiFiTracing.cmd", cAlternateFileName="ENABLE~1.CMD")) returned 1 [0050.354] lstrcmpiW (lpString1="EnableWiFiTracing.cmd", lpString2=".") returned 1 [0050.354] lstrcmpiW (lpString1="EnableWiFiTracing.cmd", lpString2="..") returned 1 [0050.354] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="EnableWiFiTracing.cmd" | out: lpString1="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd") returned="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd" [0050.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EnableWiFiTracing.cmd", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0050.354] GetProcessHeap () returned 0x630000 [0050.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x645d18 [0050.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EnableWiFiTracing.cmd", cchWideChar=-1, lpMultiByteStr=0x645d18, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EnableWiFiTracing.cmd", lpUsedDefaultChar=0x0) returned 22 [0050.354] lstrlenA (lpString="EnableWiFiTracing.cmd") returned 21 [0050.354] lstrlenA (lpString=".happythreechoose") returned 17 [0050.354] lstrlenA (lpString=".happythreechoose") returned 17 [0050.354] lstrlenA (lpString="EnableWiFiTracing.cmd") returned 21 [0050.354] lstrcmpiA (lpString1="leWiFiTracing.cmd", lpString2=".happythreechoose") returned 1 [0050.354] lstrcmpiW (lpString1="EnableWiFiTracing.cmd", lpString2="Decryption INFO.html") returned 1 [0050.354] lstrcmpiW (lpString1="EnableWiFiTracing.cmd", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0050.354] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0050.354] lstrcmpiW (lpString1="EnableWiFiTracing.cmd", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0050.354] GetProcessHeap () returned 0x630000 [0050.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0050.354] CreateFileW (lpFileName="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd" (normalized: "c:\\windows10upgrade\\enablewifitracing.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0050.355] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=9810) returned 1 [0050.355] GetProcessHeap () returned 0x630000 [0050.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x63e830 [0050.355] GetProcessHeap () returned 0x630000 [0050.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0050.355] lstrlenW (lpString="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd") returned 41 [0050.355] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0050.355] GetProcessHeap () returned 0x630000 [0050.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0050.355] GetProcessHeap () returned 0x630000 [0050.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x65b540 [0050.355] lstrlenA (lpString="rsa_encrypt") returned 11 [0050.355] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0050.356] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0050.356] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0050.356] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0050.356] GetProcessHeap () returned 0x630000 [0050.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0050.356] lstrlenA (lpString="010001") returned 6 [0050.356] GetProcessHeap () returned 0x630000 [0050.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a308 [0050.356] GetProcessHeap () returned 0x630000 [0050.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0050.356] GetProcessHeap () returned 0x630000 [0050.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655920 [0050.356] GetProcessHeap () returned 0x630000 [0050.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0050.356] GetProcessHeap () returned 0x630000 [0050.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655a40 [0050.356] GetProcessHeap () returned 0x630000 [0050.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656c98 [0050.356] GetProcessHeap () returned 0x630000 [0050.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a328 [0050.356] GetProcessHeap () returned 0x630000 [0050.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0050.356] GetProcessHeap () returned 0x630000 [0050.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.356] GetProcessHeap () returned 0x630000 [0050.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0050.356] GetProcessHeap () returned 0x630000 [0050.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0050.356] GetProcessHeap () returned 0x630000 [0050.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x6570f8 [0050.357] GetProcessHeap () returned 0x630000 [0050.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.357] GetProcessHeap () returned 0x630000 [0050.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0050.357] GetProcessHeap () returned 0x630000 [0050.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655260 [0050.357] GetProcessHeap () returned 0x630000 [0050.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0050.357] GetProcessHeap () returned 0x630000 [0050.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0050.357] GetProcessHeap () returned 0x630000 [0050.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655260 | out: hHeap=0x630000) returned 1 [0050.357] GetProcessHeap () returned 0x630000 [0050.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0050.357] GetProcessHeap () returned 0x630000 [0050.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0050.357] GetProcessHeap () returned 0x630000 [0050.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.357] GetProcessHeap () returned 0x630000 [0050.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0050.357] GetProcessHeap () returned 0x630000 [0050.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0050.357] GetProcessHeap () returned 0x630000 [0050.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0050.357] GetProcessHeap () returned 0x630000 [0050.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x655ad0 [0050.357] GetProcessHeap () returned 0x630000 [0050.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0050.357] GetProcessHeap () returned 0x630000 [0050.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0050.357] GetProcessHeap () returned 0x630000 [0050.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655ad0 | out: hHeap=0x630000) returned 1 [0050.357] GetProcessHeap () returned 0x630000 [0050.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.357] GetProcessHeap () returned 0x630000 [0050.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.357] GetProcessHeap () returned 0x630000 [0050.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.357] GetProcessHeap () returned 0x630000 [0050.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.357] GetProcessHeap () returned 0x630000 [0050.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0050.358] GetProcessHeap () returned 0x630000 [0050.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0050.358] GetProcessHeap () returned 0x630000 [0050.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.358] GetProcessHeap () returned 0x630000 [0050.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.358] GetProcessHeap () returned 0x630000 [0050.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0050.358] GetProcessHeap () returned 0x630000 [0050.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0050.358] GetProcessHeap () returned 0x630000 [0050.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0050.358] GetProcessHeap () returned 0x630000 [0050.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0050.358] GetProcessHeap () returned 0x630000 [0050.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0050.358] GetProcessHeap () returned 0x630000 [0050.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0050.358] GetProcessHeap () returned 0x630000 [0050.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0050.358] GetProcessHeap () returned 0x630000 [0050.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0050.358] GetProcessHeap () returned 0x630000 [0050.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.358] GetProcessHeap () returned 0x630000 [0050.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.358] GetProcessHeap () returned 0x630000 [0050.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0050.358] GetProcessHeap () returned 0x630000 [0050.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0050.358] GetProcessHeap () returned 0x630000 [0050.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0050.358] GetProcessHeap () returned 0x630000 [0050.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0050.358] GetProcessHeap () returned 0x630000 [0050.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.358] GetProcessHeap () returned 0x630000 [0050.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.359] GetProcessHeap () returned 0x630000 [0050.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0050.359] GetProcessHeap () returned 0x630000 [0050.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0050.359] GetProcessHeap () returned 0x630000 [0050.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0050.359] GetProcessHeap () returned 0x630000 [0050.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0050.359] GetProcessHeap () returned 0x630000 [0050.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0050.359] GetProcessHeap () returned 0x630000 [0050.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0050.359] GetProcessHeap () returned 0x630000 [0050.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0050.359] GetProcessHeap () returned 0x630000 [0050.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0050.359] GetProcessHeap () returned 0x630000 [0050.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0050.359] GetProcessHeap () returned 0x630000 [0050.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0050.359] GetProcessHeap () returned 0x630000 [0050.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0050.359] GetProcessHeap () returned 0x630000 [0050.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0050.359] GetProcessHeap () returned 0x630000 [0050.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.359] GetProcessHeap () returned 0x630000 [0050.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.359] GetProcessHeap () returned 0x630000 [0050.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.359] GetProcessHeap () returned 0x630000 [0050.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.359] GetProcessHeap () returned 0x630000 [0050.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0050.359] GetProcessHeap () returned 0x630000 [0050.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0050.359] GetProcessHeap () returned 0x630000 [0050.360] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0050.360] GetProcessHeap () returned 0x630000 [0050.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0050.360] GetProcessHeap () returned 0x630000 [0050.360] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0050.360] GetProcessHeap () returned 0x630000 [0050.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0050.360] GetProcessHeap () returned 0x630000 [0050.360] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0050.360] GetProcessHeap () returned 0x630000 [0050.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0050.360] GetProcessHeap () returned 0x630000 [0050.360] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.360] GetProcessHeap () returned 0x630000 [0050.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.360] GetProcessHeap () returned 0x630000 [0050.360] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0050.360] GetProcessHeap () returned 0x630000 [0050.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0050.360] GetProcessHeap () returned 0x630000 [0050.360] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.360] GetProcessHeap () returned 0x630000 [0050.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.360] GetProcessHeap () returned 0x630000 [0050.360] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0050.360] GetProcessHeap () returned 0x630000 [0050.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0050.360] GetProcessHeap () returned 0x630000 [0050.360] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.360] GetProcessHeap () returned 0x630000 [0050.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.360] GetProcessHeap () returned 0x630000 [0050.360] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0050.360] GetProcessHeap () returned 0x630000 [0050.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0050.360] GetProcessHeap () returned 0x630000 [0050.360] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.360] GetProcessHeap () returned 0x630000 [0050.361] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.361] GetProcessHeap () returned 0x630000 [0050.361] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0050.361] GetProcessHeap () returned 0x630000 [0050.361] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0050.361] GetProcessHeap () returned 0x630000 [0050.361] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0050.361] GetProcessHeap () returned 0x630000 [0050.361] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0050.361] GetProcessHeap () returned 0x630000 [0050.361] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0050.361] GetProcessHeap () returned 0x630000 [0050.361] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0050.361] GetProcessHeap () returned 0x630000 [0050.361] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0050.361] GetProcessHeap () returned 0x630000 [0050.361] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0050.361] GetProcessHeap () returned 0x630000 [0050.361] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0050.361] GetProcessHeap () returned 0x630000 [0050.361] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0050.361] GetProcessHeap () returned 0x630000 [0050.361] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.361] GetProcessHeap () returned 0x630000 [0050.361] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.361] GetProcessHeap () returned 0x630000 [0050.361] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0050.361] GetProcessHeap () returned 0x630000 [0050.361] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0050.361] GetProcessHeap () returned 0x630000 [0050.361] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0050.361] GetProcessHeap () returned 0x630000 [0050.361] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0050.361] GetProcessHeap () returned 0x630000 [0050.361] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0050.361] GetProcessHeap () returned 0x630000 [0050.361] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0050.362] GetProcessHeap () returned 0x630000 [0050.362] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0050.362] GetProcessHeap () returned 0x630000 [0050.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0050.362] GetProcessHeap () returned 0x630000 [0050.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0050.362] GetProcessHeap () returned 0x630000 [0050.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0050.362] GetProcessHeap () returned 0x630000 [0050.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0050.362] GetProcessHeap () returned 0x630000 [0050.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0050.362] GetProcessHeap () returned 0x630000 [0050.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0050.362] GetProcessHeap () returned 0x630000 [0050.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655a40 | out: hHeap=0x630000) returned 1 [0050.362] GetProcessHeap () returned 0x630000 [0050.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0050.362] GetProcessHeap () returned 0x630000 [0050.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655920 | out: hHeap=0x630000) returned 1 [0050.362] GetProcessHeap () returned 0x630000 [0050.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0050.362] GetProcessHeap () returned 0x630000 [0050.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.362] GetProcessHeap () returned 0x630000 [0050.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0050.362] WriteFile (in: hFile=0x230, lpBuffer=0x65b540*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65b540*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0050.438] GetProcessHeap () returned 0x630000 [0050.438] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65b540, Size=0x30) returned 0x65b540 [0050.438] GetProcessHeap () returned 0x630000 [0050.438] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0050.438] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.438] GetProcessHeap () returned 0x630000 [0050.438] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2652) returned 0x65b578 [0050.438] ReadFile (in: hFile=0x230, lpBuffer=0x65b578, nNumberOfBytesToRead=0x2652, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65b578*, lpNumberOfBytesRead=0x243d7e8*=0x2652, lpOverlapped=0x0) returned 1 [0050.439] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.439] WriteFile (in: hFile=0x230, lpBuffer=0x65b578*, nNumberOfBytesToWrite=0x2652, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65b578*, lpNumberOfBytesWritten=0x243d7e4*=0x2652, lpOverlapped=0x0) returned 1 [0050.440] GetProcessHeap () returned 0x630000 [0050.440] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b578 | out: hHeap=0x630000) returned 1 [0050.440] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0050.440] WriteFile (in: hFile=0x230, lpBuffer=0x65b540*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65b540*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0050.441] CloseHandle (hObject=0x230) returned 1 [0050.442] GetProcessHeap () returned 0x630000 [0050.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0050.442] GetProcessHeap () returned 0x630000 [0050.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0050.442] GetProcessHeap () returned 0x630000 [0050.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0050.442] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd" | out: lpString1="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd") returned="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd" [0050.442] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd.happythreechoose") returned="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd.happythreechoose" [0050.442] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd" (normalized: "c:\\windows10upgrade\\enablewifitracing.cmd"), lpNewFileName="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd.happythreechoose" (normalized: "c:\\windows10upgrade\\enablewifitracing.cmd.happythreechoose"), dwFlags=0x1) returned 1 [0050.443] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0050.443] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0050.443] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\Decryption INFO.html" [0050.443] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\decryption info.html")) returned 0x20 [0050.443] GetProcessHeap () returned 0x630000 [0050.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645d18 | out: hHeap=0x630000) returned 1 [0050.443] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea389060, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea389060, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x10cc8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESDHelper.dll", cAlternateFileName="ESDHEL~1.DLL")) returned 1 [0050.443] lstrcmpiW (lpString1="ESDHelper.dll", lpString2=".") returned 1 [0050.443] lstrcmpiW (lpString1="ESDHelper.dll", lpString2="..") returned 1 [0050.443] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="ESDHelper.dll" | out: lpString1="C:\\Windows10Upgrade\\ESDHelper.dll") returned="C:\\Windows10Upgrade\\ESDHelper.dll" [0050.443] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ESDHelper.dll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0050.443] GetProcessHeap () returned 0x630000 [0050.443] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x64c9f0 [0050.443] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ESDHelper.dll", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ESDHelper.dll", lpUsedDefaultChar=0x0) returned 14 [0050.443] lstrlenA (lpString="ESDHelper.dll") returned 13 [0050.443] lstrlenA (lpString=".happythreechoose") returned 17 [0050.443] lstrcmpiW (lpString1="ESDHelper.dll", lpString2="Decryption INFO.html") returned 1 [0050.443] lstrcmpiW (lpString1="ESDHelper.dll", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0050.443] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0050.443] lstrcmpiW (lpString1="ESDHelper.dll", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0050.443] GetProcessHeap () returned 0x630000 [0050.443] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0050.443] CreateFileW (lpFileName="C:\\Windows10Upgrade\\ESDHelper.dll" (normalized: "c:\\windows10upgrade\\esdhelper.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0050.444] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=68808) returned 1 [0050.444] GetProcessHeap () returned 0x630000 [0050.444] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x63e830 [0050.444] GetProcessHeap () returned 0x630000 [0050.444] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0050.444] lstrlenW (lpString="C:\\Windows10Upgrade\\ESDHelper.dll") returned 33 [0050.444] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0050.444] GetProcessHeap () returned 0x630000 [0050.444] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0050.445] GetProcessHeap () returned 0x630000 [0050.445] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x388) returned 0x65b578 [0050.445] lstrlenA (lpString="rsa_encrypt") returned 11 [0050.445] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0050.445] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0050.445] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0050.445] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0050.445] GetProcessHeap () returned 0x630000 [0050.445] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0050.445] lstrlenA (lpString="010001") returned 6 [0050.445] GetProcessHeap () returned 0x630000 [0050.445] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a368 [0050.446] GetProcessHeap () returned 0x630000 [0050.446] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0050.446] GetProcessHeap () returned 0x630000 [0050.446] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655530 [0050.446] GetProcessHeap () returned 0x630000 [0050.446] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0050.446] GetProcessHeap () returned 0x630000 [0050.446] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655140 [0050.446] GetProcessHeap () returned 0x630000 [0050.446] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656950 [0050.446] GetProcessHeap () returned 0x630000 [0050.446] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3f8 [0050.446] GetProcessHeap () returned 0x630000 [0050.446] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0050.446] GetProcessHeap () returned 0x630000 [0050.446] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0050.446] GetProcessHeap () returned 0x630000 [0050.446] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0050.446] GetProcessHeap () returned 0x630000 [0050.446] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0050.446] GetProcessHeap () returned 0x630000 [0050.446] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656fe0 [0050.446] GetProcessHeap () returned 0x630000 [0050.446] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.446] GetProcessHeap () returned 0x630000 [0050.446] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0050.446] GetProcessHeap () returned 0x630000 [0050.446] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655380 [0050.446] GetProcessHeap () returned 0x630000 [0050.446] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0050.446] GetProcessHeap () returned 0x630000 [0050.446] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0050.446] GetProcessHeap () returned 0x630000 [0050.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655380 | out: hHeap=0x630000) returned 1 [0050.447] GetProcessHeap () returned 0x630000 [0050.447] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0050.447] GetProcessHeap () returned 0x630000 [0050.447] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65b0c8 [0050.447] GetProcessHeap () returned 0x630000 [0050.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.447] GetProcessHeap () returned 0x630000 [0050.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0050.447] GetProcessHeap () returned 0x630000 [0050.447] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.447] GetProcessHeap () returned 0x630000 [0050.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.447] GetProcessHeap () returned 0x630000 [0050.447] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x655920 [0050.447] GetProcessHeap () returned 0x630000 [0050.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b0c8 | out: hHeap=0x630000) returned 1 [0050.447] GetProcessHeap () returned 0x630000 [0050.447] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0050.447] GetProcessHeap () returned 0x630000 [0050.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655920 | out: hHeap=0x630000) returned 1 [0050.447] GetProcessHeap () returned 0x630000 [0050.447] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0050.447] GetProcessHeap () returned 0x630000 [0050.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0050.447] GetProcessHeap () returned 0x630000 [0050.447] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0050.447] GetProcessHeap () returned 0x630000 [0050.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0050.447] GetProcessHeap () returned 0x630000 [0050.447] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0050.447] GetProcessHeap () returned 0x630000 [0050.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0050.447] GetProcessHeap () returned 0x630000 [0050.447] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.447] GetProcessHeap () returned 0x630000 [0050.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.447] GetProcessHeap () returned 0x630000 [0050.447] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0050.448] GetProcessHeap () returned 0x630000 [0050.448] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0050.448] GetProcessHeap () returned 0x630000 [0050.448] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0050.448] GetProcessHeap () returned 0x630000 [0050.448] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0050.448] GetProcessHeap () returned 0x630000 [0050.448] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.448] GetProcessHeap () returned 0x630000 [0050.448] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.448] GetProcessHeap () returned 0x630000 [0050.448] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0050.448] GetProcessHeap () returned 0x630000 [0050.448] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0050.448] GetProcessHeap () returned 0x630000 [0050.448] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.448] GetProcessHeap () returned 0x630000 [0050.448] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.448] GetProcessHeap () returned 0x630000 [0050.448] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.448] GetProcessHeap () returned 0x630000 [0050.448] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.448] GetProcessHeap () returned 0x630000 [0050.448] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.448] GetProcessHeap () returned 0x630000 [0050.448] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.448] GetProcessHeap () returned 0x630000 [0050.448] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0050.448] GetProcessHeap () returned 0x630000 [0050.448] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0050.448] GetProcessHeap () returned 0x630000 [0050.448] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0050.448] GetProcessHeap () returned 0x630000 [0050.448] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0050.448] GetProcessHeap () returned 0x630000 [0050.448] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.448] GetProcessHeap () returned 0x630000 [0050.448] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.449] GetProcessHeap () returned 0x630000 [0050.449] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0050.449] GetProcessHeap () returned 0x630000 [0050.449] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0050.449] GetProcessHeap () returned 0x630000 [0050.449] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0050.449] GetProcessHeap () returned 0x630000 [0050.449] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0050.449] GetProcessHeap () returned 0x630000 [0050.449] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0050.449] GetProcessHeap () returned 0x630000 [0050.449] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0050.449] GetProcessHeap () returned 0x630000 [0050.449] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.449] GetProcessHeap () returned 0x630000 [0050.449] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.449] GetProcessHeap () returned 0x630000 [0050.449] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0050.449] GetProcessHeap () returned 0x630000 [0050.449] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0050.449] GetProcessHeap () returned 0x630000 [0050.449] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.449] GetProcessHeap () returned 0x630000 [0050.449] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.449] GetProcessHeap () returned 0x630000 [0050.449] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0050.449] GetProcessHeap () returned 0x630000 [0050.449] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0050.449] GetProcessHeap () returned 0x630000 [0050.449] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0050.449] GetProcessHeap () returned 0x630000 [0050.449] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0050.449] GetProcessHeap () returned 0x630000 [0050.449] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.449] GetProcessHeap () returned 0x630000 [0050.449] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.449] GetProcessHeap () returned 0x630000 [0050.449] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0050.450] GetProcessHeap () returned 0x630000 [0050.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0050.450] GetProcessHeap () returned 0x630000 [0050.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.450] GetProcessHeap () returned 0x630000 [0050.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.450] GetProcessHeap () returned 0x630000 [0050.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0050.450] GetProcessHeap () returned 0x630000 [0050.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0050.450] GetProcessHeap () returned 0x630000 [0050.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0050.450] GetProcessHeap () returned 0x630000 [0050.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0050.450] GetProcessHeap () returned 0x630000 [0050.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.450] GetProcessHeap () returned 0x630000 [0050.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.450] GetProcessHeap () returned 0x630000 [0050.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0050.450] GetProcessHeap () returned 0x630000 [0050.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0050.450] GetProcessHeap () returned 0x630000 [0050.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0050.450] GetProcessHeap () returned 0x630000 [0050.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0050.450] GetProcessHeap () returned 0x630000 [0050.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0050.450] GetProcessHeap () returned 0x630000 [0050.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0050.450] GetProcessHeap () returned 0x630000 [0050.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0050.450] GetProcessHeap () returned 0x630000 [0050.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0050.450] GetProcessHeap () returned 0x630000 [0050.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.450] GetProcessHeap () returned 0x630000 [0050.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.451] GetProcessHeap () returned 0x630000 [0050.451] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.451] GetProcessHeap () returned 0x630000 [0050.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.451] GetProcessHeap () returned 0x630000 [0050.451] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0050.451] GetProcessHeap () returned 0x630000 [0050.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0050.451] GetProcessHeap () returned 0x630000 [0050.451] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.451] GetProcessHeap () returned 0x630000 [0050.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.451] GetProcessHeap () returned 0x630000 [0050.451] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0050.451] GetProcessHeap () returned 0x630000 [0050.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0050.451] GetProcessHeap () returned 0x630000 [0050.451] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0050.451] GetProcessHeap () returned 0x630000 [0050.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0050.451] GetProcessHeap () returned 0x630000 [0050.451] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.451] GetProcessHeap () returned 0x630000 [0050.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.451] GetProcessHeap () returned 0x630000 [0050.451] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.451] GetProcessHeap () returned 0x630000 [0050.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.451] GetProcessHeap () returned 0x630000 [0050.451] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0050.451] GetProcessHeap () returned 0x630000 [0050.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0050.451] GetProcessHeap () returned 0x630000 [0050.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0050.451] GetProcessHeap () returned 0x630000 [0050.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0050.451] GetProcessHeap () returned 0x630000 [0050.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0050.451] GetProcessHeap () returned 0x630000 [0050.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0050.452] GetProcessHeap () returned 0x630000 [0050.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0050.452] GetProcessHeap () returned 0x630000 [0050.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655140 | out: hHeap=0x630000) returned 1 [0050.452] GetProcessHeap () returned 0x630000 [0050.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0050.452] GetProcessHeap () returned 0x630000 [0050.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655530 | out: hHeap=0x630000) returned 1 [0050.452] GetProcessHeap () returned 0x630000 [0050.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0050.452] GetProcessHeap () returned 0x630000 [0050.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0050.452] GetProcessHeap () returned 0x630000 [0050.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0050.452] WriteFile (in: hFile=0x230, lpBuffer=0x65b578*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65b578*, lpNumberOfBytesWritten=0x243d864*=0x388, lpOverlapped=0x0) returned 1 [0050.460] GetProcessHeap () returned 0x630000 [0050.460] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65b578, Size=0x30) returned 0x65b578 [0050.460] GetProcessHeap () returned 0x630000 [0050.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0050.460] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.460] GetProcessHeap () returned 0x630000 [0050.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10cd0) returned 0x65b5b0 [0050.461] ReadFile (in: hFile=0x230, lpBuffer=0x65b5b0, nNumberOfBytesToRead=0x10cd0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65b5b0*, lpNumberOfBytesRead=0x243d7e8*=0x10cd0, lpOverlapped=0x0) returned 1 [0050.462] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.462] WriteFile (in: hFile=0x230, lpBuffer=0x65b5b0*, nNumberOfBytesToWrite=0x10cd0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65b5b0*, lpNumberOfBytesWritten=0x243d7e4*=0x10cd0, lpOverlapped=0x0) returned 1 [0050.470] GetProcessHeap () returned 0x630000 [0050.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b5b0 | out: hHeap=0x630000) returned 1 [0050.470] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0050.470] WriteFile (in: hFile=0x230, lpBuffer=0x65b578*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65b578*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0050.471] CloseHandle (hObject=0x230) returned 1 [0050.474] GetProcessHeap () returned 0x630000 [0050.474] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0050.474] GetProcessHeap () returned 0x630000 [0050.474] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0050.474] GetProcessHeap () returned 0x630000 [0050.474] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0050.474] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\ESDHelper.dll" | out: lpString1="C:\\Windows10Upgrade\\ESDHelper.dll") returned="C:\\Windows10Upgrade\\ESDHelper.dll" [0050.474] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\ESDHelper.dll", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\ESDHelper.dll.happythreechoose") returned="C:\\Windows10Upgrade\\ESDHelper.dll.happythreechoose" [0050.474] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\ESDHelper.dll" (normalized: "c:\\windows10upgrade\\esdhelper.dll"), lpNewFileName="C:\\Windows10Upgrade\\ESDHelper.dll.happythreechoose" (normalized: "c:\\windows10upgrade\\esdhelper.dll.happythreechoose"), dwFlags=0x1) returned 1 [0050.474] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\ESDHelper.dll" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0050.474] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0050.475] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\Decryption INFO.html" [0050.475] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\decryption info.html")) returned 0x20 [0050.475] GetProcessHeap () returned 0x630000 [0050.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0050.475] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea38cadd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea38cadd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x9ec8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="esdstub.dll", cAlternateFileName="")) returned 1 [0050.475] lstrcmpiW (lpString1="esdstub.dll", lpString2=".") returned 1 [0050.475] lstrcmpiW (lpString1="esdstub.dll", lpString2="..") returned 1 [0050.475] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="esdstub.dll" | out: lpString1="C:\\Windows10Upgrade\\esdstub.dll") returned="C:\\Windows10Upgrade\\esdstub.dll" [0050.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esdstub.dll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0050.475] GetProcessHeap () returned 0x630000 [0050.475] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0050.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esdstub.dll", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="esdstub.dll", lpUsedDefaultChar=0x0) returned 12 [0050.475] lstrlenA (lpString="esdstub.dll") returned 11 [0050.475] lstrlenA (lpString=".happythreechoose") returned 17 [0050.475] lstrcmpiW (lpString1="esdstub.dll", lpString2="Decryption INFO.html") returned 1 [0050.475] lstrcmpiW (lpString1="esdstub.dll", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0050.475] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0050.475] lstrcmpiW (lpString1="esdstub.dll", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0050.475] GetProcessHeap () returned 0x630000 [0050.475] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0050.475] CreateFileW (lpFileName="C:\\Windows10Upgrade\\esdstub.dll" (normalized: "c:\\windows10upgrade\\esdstub.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0050.476] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=40648) returned 1 [0050.476] GetProcessHeap () returned 0x630000 [0050.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x63e830 [0050.476] GetProcessHeap () returned 0x630000 [0050.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0050.476] lstrlenW (lpString="C:\\Windows10Upgrade\\esdstub.dll") returned 31 [0050.476] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0050.476] GetProcessHeap () returned 0x630000 [0050.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0050.476] GetProcessHeap () returned 0x630000 [0050.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x388) returned 0x65b5b0 [0050.477] lstrlenA (lpString="rsa_encrypt") returned 11 [0050.477] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0050.477] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0050.477] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0050.477] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0050.477] GetProcessHeap () returned 0x630000 [0050.477] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0050.477] lstrlenA (lpString="010001") returned 6 [0050.477] GetProcessHeap () returned 0x630000 [0050.477] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0050.477] GetProcessHeap () returned 0x630000 [0050.477] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0050.477] GetProcessHeap () returned 0x630000 [0050.477] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655530 [0050.477] GetProcessHeap () returned 0x630000 [0050.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0050.477] GetProcessHeap () returned 0x630000 [0050.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655ec0 [0050.478] GetProcessHeap () returned 0x630000 [0050.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656fe0 [0050.478] GetProcessHeap () returned 0x630000 [0050.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0050.478] GetProcessHeap () returned 0x630000 [0050.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0050.478] GetProcessHeap () returned 0x630000 [0050.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0050.478] GetProcessHeap () returned 0x630000 [0050.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0050.478] GetProcessHeap () returned 0x630000 [0050.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0050.478] GetProcessHeap () returned 0x630000 [0050.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657670 [0050.478] GetProcessHeap () returned 0x630000 [0050.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0050.478] GetProcessHeap () returned 0x630000 [0050.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0050.478] GetProcessHeap () returned 0x630000 [0050.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655ad0 [0050.478] GetProcessHeap () returned 0x630000 [0050.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0050.478] GetProcessHeap () returned 0x630000 [0050.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0050.478] GetProcessHeap () returned 0x630000 [0050.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655ad0 | out: hHeap=0x630000) returned 1 [0050.478] GetProcessHeap () returned 0x630000 [0050.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0050.478] GetProcessHeap () returned 0x630000 [0050.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65b0e0 [0050.478] GetProcessHeap () returned 0x630000 [0050.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0050.478] GetProcessHeap () returned 0x630000 [0050.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0050.478] GetProcessHeap () returned 0x630000 [0050.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0050.478] GetProcessHeap () returned 0x630000 [0050.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0050.478] GetProcessHeap () returned 0x630000 [0050.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x655410 [0050.479] GetProcessHeap () returned 0x630000 [0050.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b0e0 | out: hHeap=0x630000) returned 1 [0050.479] GetProcessHeap () returned 0x630000 [0050.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0050.479] GetProcessHeap () returned 0x630000 [0050.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655410 | out: hHeap=0x630000) returned 1 [0050.479] GetProcessHeap () returned 0x630000 [0050.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0050.479] GetProcessHeap () returned 0x630000 [0050.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0050.479] GetProcessHeap () returned 0x630000 [0050.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0050.479] GetProcessHeap () returned 0x630000 [0050.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0050.479] GetProcessHeap () returned 0x630000 [0050.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0050.479] GetProcessHeap () returned 0x630000 [0050.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0050.479] GetProcessHeap () returned 0x630000 [0050.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0050.479] GetProcessHeap () returned 0x630000 [0050.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0050.479] GetProcessHeap () returned 0x630000 [0050.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.479] GetProcessHeap () returned 0x630000 [0050.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.479] GetProcessHeap () returned 0x630000 [0050.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.479] GetProcessHeap () returned 0x630000 [0050.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.479] GetProcessHeap () returned 0x630000 [0050.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0050.479] GetProcessHeap () returned 0x630000 [0050.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0050.479] GetProcessHeap () returned 0x630000 [0050.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0050.479] GetProcessHeap () returned 0x630000 [0050.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0050.480] GetProcessHeap () returned 0x630000 [0050.480] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0050.480] GetProcessHeap () returned 0x630000 [0050.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0050.480] GetProcessHeap () returned 0x630000 [0050.480] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0050.480] GetProcessHeap () returned 0x630000 [0050.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0050.480] GetProcessHeap () returned 0x630000 [0050.480] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0050.480] GetProcessHeap () returned 0x630000 [0050.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0050.480] GetProcessHeap () returned 0x630000 [0050.480] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0050.480] GetProcessHeap () returned 0x630000 [0050.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0050.480] GetProcessHeap () returned 0x630000 [0050.480] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0050.480] GetProcessHeap () returned 0x630000 [0050.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0050.480] GetProcessHeap () returned 0x630000 [0050.480] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.480] GetProcessHeap () returned 0x630000 [0050.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.480] GetProcessHeap () returned 0x630000 [0050.480] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0050.480] GetProcessHeap () returned 0x630000 [0050.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0050.480] GetProcessHeap () returned 0x630000 [0050.480] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0050.480] GetProcessHeap () returned 0x630000 [0050.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0050.480] GetProcessHeap () returned 0x630000 [0050.480] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0050.480] GetProcessHeap () returned 0x630000 [0050.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0050.480] GetProcessHeap () returned 0x630000 [0050.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0050.481] GetProcessHeap () returned 0x630000 [0050.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0050.481] GetProcessHeap () returned 0x630000 [0050.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0050.481] GetProcessHeap () returned 0x630000 [0050.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0050.481] GetProcessHeap () returned 0x630000 [0050.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0050.481] GetProcessHeap () returned 0x630000 [0050.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0050.481] GetProcessHeap () returned 0x630000 [0050.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0050.481] GetProcessHeap () returned 0x630000 [0050.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0050.481] GetProcessHeap () returned 0x630000 [0050.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.481] GetProcessHeap () returned 0x630000 [0050.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.481] GetProcessHeap () returned 0x630000 [0050.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0050.481] GetProcessHeap () returned 0x630000 [0050.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0050.481] GetProcessHeap () returned 0x630000 [0050.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0050.481] GetProcessHeap () returned 0x630000 [0050.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0050.481] GetProcessHeap () returned 0x630000 [0050.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0050.481] GetProcessHeap () returned 0x630000 [0050.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0050.481] GetProcessHeap () returned 0x630000 [0050.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.481] GetProcessHeap () returned 0x630000 [0050.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.481] GetProcessHeap () returned 0x630000 [0050.482] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0050.482] GetProcessHeap () returned 0x630000 [0050.482] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0050.482] GetProcessHeap () returned 0x630000 [0050.482] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0050.482] GetProcessHeap () returned 0x630000 [0050.482] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0050.482] GetProcessHeap () returned 0x630000 [0050.482] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0050.482] GetProcessHeap () returned 0x630000 [0050.482] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0050.482] GetProcessHeap () returned 0x630000 [0050.482] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0050.482] GetProcessHeap () returned 0x630000 [0050.482] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0050.482] GetProcessHeap () returned 0x630000 [0050.482] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.482] GetProcessHeap () returned 0x630000 [0050.482] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.482] GetProcessHeap () returned 0x630000 [0050.482] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0050.482] GetProcessHeap () returned 0x630000 [0050.482] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0050.482] GetProcessHeap () returned 0x630000 [0050.482] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0050.482] GetProcessHeap () returned 0x630000 [0050.482] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0050.482] GetProcessHeap () returned 0x630000 [0050.482] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.482] GetProcessHeap () returned 0x630000 [0050.482] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.482] GetProcessHeap () returned 0x630000 [0050.482] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0050.482] GetProcessHeap () returned 0x630000 [0050.482] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0050.482] GetProcessHeap () returned 0x630000 [0050.482] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0050.483] GetProcessHeap () returned 0x630000 [0050.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0050.483] GetProcessHeap () returned 0x630000 [0050.483] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0050.483] GetProcessHeap () returned 0x630000 [0050.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0050.483] GetProcessHeap () returned 0x630000 [0050.483] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0050.483] GetProcessHeap () returned 0x630000 [0050.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0050.483] GetProcessHeap () returned 0x630000 [0050.483] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0050.483] GetProcessHeap () returned 0x630000 [0050.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0050.483] GetProcessHeap () returned 0x630000 [0050.483] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.483] GetProcessHeap () returned 0x630000 [0050.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.483] GetProcessHeap () returned 0x630000 [0050.483] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0050.483] GetProcessHeap () returned 0x630000 [0050.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0050.483] GetProcessHeap () returned 0x630000 [0050.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0050.483] GetProcessHeap () returned 0x630000 [0050.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0050.483] GetProcessHeap () returned 0x630000 [0050.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0050.483] GetProcessHeap () returned 0x630000 [0050.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0050.483] GetProcessHeap () returned 0x630000 [0050.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0050.483] GetProcessHeap () returned 0x630000 [0050.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655ec0 | out: hHeap=0x630000) returned 1 [0050.483] GetProcessHeap () returned 0x630000 [0050.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0050.484] GetProcessHeap () returned 0x630000 [0050.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655530 | out: hHeap=0x630000) returned 1 [0050.484] GetProcessHeap () returned 0x630000 [0050.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0050.484] GetProcessHeap () returned 0x630000 [0050.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0050.484] GetProcessHeap () returned 0x630000 [0050.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0050.484] WriteFile (in: hFile=0x230, lpBuffer=0x65b5b0*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65b5b0*, lpNumberOfBytesWritten=0x243d864*=0x388, lpOverlapped=0x0) returned 1 [0050.560] GetProcessHeap () returned 0x630000 [0050.560] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65b5b0, Size=0x30) returned 0x65b5b0 [0050.560] GetProcessHeap () returned 0x630000 [0050.560] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0050.560] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.560] GetProcessHeap () returned 0x630000 [0050.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9ed0) returned 0x65b5e8 [0050.561] ReadFile (in: hFile=0x230, lpBuffer=0x65b5e8, nNumberOfBytesToRead=0x9ed0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65b5e8*, lpNumberOfBytesRead=0x243d7e8*=0x9ed0, lpOverlapped=0x0) returned 1 [0050.562] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.562] WriteFile (in: hFile=0x230, lpBuffer=0x65b5e8*, nNumberOfBytesToWrite=0x9ed0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65b5e8*, lpNumberOfBytesWritten=0x243d7e4*=0x9ed0, lpOverlapped=0x0) returned 1 [0050.569] GetProcessHeap () returned 0x630000 [0050.569] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b5e8 | out: hHeap=0x630000) returned 1 [0050.570] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0050.570] WriteFile (in: hFile=0x230, lpBuffer=0x65b5b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65b5b0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0050.572] CloseHandle (hObject=0x230) returned 1 [0050.574] GetProcessHeap () returned 0x630000 [0050.574] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0050.574] GetProcessHeap () returned 0x630000 [0050.574] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0050.574] GetProcessHeap () returned 0x630000 [0050.574] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0050.574] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\esdstub.dll" | out: lpString1="C:\\Windows10Upgrade\\esdstub.dll") returned="C:\\Windows10Upgrade\\esdstub.dll" [0050.574] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\esdstub.dll", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\esdstub.dll.happythreechoose") returned="C:\\Windows10Upgrade\\esdstub.dll.happythreechoose" [0050.574] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\esdstub.dll" (normalized: "c:\\windows10upgrade\\esdstub.dll"), lpNewFileName="C:\\Windows10Upgrade\\esdstub.dll.happythreechoose" (normalized: "c:\\windows10upgrade\\esdstub.dll.happythreechoose"), dwFlags=0x1) returned 1 [0050.575] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\esdstub.dll" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0050.575] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0050.575] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\Decryption INFO.html" [0050.575] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\decryption info.html")) returned 0x20 [0050.575] GetProcessHeap () returned 0x630000 [0050.575] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0050.575] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea38de7f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea38de7f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x89ec8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GatherOSState.EXE", cAlternateFileName="GATHER~1.EXE")) returned 1 [0050.575] lstrcmpiW (lpString1="GatherOSState.EXE", lpString2=".") returned 1 [0050.575] lstrcmpiW (lpString1="GatherOSState.EXE", lpString2="..") returned 1 [0050.575] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="GatherOSState.EXE" | out: lpString1="C:\\Windows10Upgrade\\GatherOSState.EXE") returned="C:\\Windows10Upgrade\\GatherOSState.EXE" [0050.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GatherOSState.EXE", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0050.575] GetProcessHeap () returned 0x630000 [0050.575] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x645c78 [0050.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GatherOSState.EXE", cchWideChar=-1, lpMultiByteStr=0x645c78, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GatherOSState.EXE", lpUsedDefaultChar=0x0) returned 18 [0050.575] lstrlenA (lpString="GatherOSState.EXE") returned 17 [0050.575] lstrlenA (lpString=".happythreechoose") returned 17 [0050.575] lstrlenA (lpString=".happythreechoose") returned 17 [0050.575] lstrlenA (lpString="GatherOSState.EXE") returned 17 [0050.575] lstrcmpiA (lpString1="GatherOSState.EXE", lpString2=".happythreechoose") returned 1 [0050.575] lstrcmpiW (lpString1="GatherOSState.EXE", lpString2="Decryption INFO.html") returned 1 [0050.575] lstrcmpiW (lpString1="GatherOSState.EXE", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0050.575] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0050.575] lstrcmpiW (lpString1="GatherOSState.EXE", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0050.575] GetProcessHeap () returned 0x630000 [0050.575] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0050.575] CreateFileW (lpFileName="C:\\Windows10Upgrade\\GatherOSState.EXE" (normalized: "c:\\windows10upgrade\\gatherosstate.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0050.576] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=564936) returned 1 [0050.576] GetProcessHeap () returned 0x630000 [0050.576] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x63e830 [0050.576] GetProcessHeap () returned 0x630000 [0050.576] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0050.576] lstrlenW (lpString="C:\\Windows10Upgrade\\GatherOSState.EXE") returned 37 [0050.576] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0050.576] GetProcessHeap () returned 0x630000 [0050.576] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0050.576] GetProcessHeap () returned 0x630000 [0050.576] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x388) returned 0x65b5e8 [0050.577] lstrlenA (lpString="rsa_encrypt") returned 11 [0050.577] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0050.578] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0050.578] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0050.578] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0050.578] GetProcessHeap () returned 0x630000 [0050.578] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0050.578] lstrlenA (lpString="010001") returned 6 [0050.578] GetProcessHeap () returned 0x630000 [0050.578] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0050.578] GetProcessHeap () returned 0x630000 [0050.578] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0050.578] GetProcessHeap () returned 0x630000 [0050.578] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655f50 [0050.578] GetProcessHeap () returned 0x630000 [0050.578] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0050.578] GetProcessHeap () returned 0x630000 [0050.578] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x6554a0 [0050.578] GetProcessHeap () returned 0x630000 [0050.578] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656c98 [0050.578] GetProcessHeap () returned 0x630000 [0050.578] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2b8 [0050.579] GetProcessHeap () returned 0x630000 [0050.579] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0050.579] GetProcessHeap () returned 0x630000 [0050.579] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0050.579] GetProcessHeap () returned 0x630000 [0050.579] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0050.579] GetProcessHeap () returned 0x630000 [0050.579] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0050.579] GetProcessHeap () returned 0x630000 [0050.579] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656b80 [0050.579] GetProcessHeap () returned 0x630000 [0050.579] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.579] GetProcessHeap () returned 0x630000 [0050.579] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0050.579] GetProcessHeap () returned 0x630000 [0050.579] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655530 [0050.579] GetProcessHeap () returned 0x630000 [0050.579] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0050.579] GetProcessHeap () returned 0x630000 [0050.579] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0050.579] GetProcessHeap () returned 0x630000 [0050.579] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655530 | out: hHeap=0x630000) returned 1 [0050.579] GetProcessHeap () returned 0x630000 [0050.579] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.579] GetProcessHeap () returned 0x630000 [0050.579] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0050.579] GetProcessHeap () returned 0x630000 [0050.579] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.579] GetProcessHeap () returned 0x630000 [0050.579] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.579] GetProcessHeap () returned 0x630000 [0050.579] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.579] GetProcessHeap () returned 0x630000 [0050.579] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.579] GetProcessHeap () returned 0x630000 [0050.579] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x655fe0 [0050.579] GetProcessHeap () returned 0x630000 [0050.579] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0050.579] GetProcessHeap () returned 0x630000 [0050.579] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0050.580] GetProcessHeap () returned 0x630000 [0050.580] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655fe0 | out: hHeap=0x630000) returned 1 [0050.580] GetProcessHeap () returned 0x630000 [0050.580] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0050.580] GetProcessHeap () returned 0x630000 [0050.580] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0050.580] GetProcessHeap () returned 0x630000 [0050.580] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0050.580] GetProcessHeap () returned 0x630000 [0050.580] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0050.580] GetProcessHeap () returned 0x630000 [0050.580] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0050.580] GetProcessHeap () returned 0x630000 [0050.580] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0050.580] GetProcessHeap () returned 0x630000 [0050.580] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.580] GetProcessHeap () returned 0x630000 [0050.580] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.580] GetProcessHeap () returned 0x630000 [0050.580] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0050.580] GetProcessHeap () returned 0x630000 [0050.580] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0050.580] GetProcessHeap () returned 0x630000 [0050.580] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0050.580] GetProcessHeap () returned 0x630000 [0050.580] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0050.580] GetProcessHeap () returned 0x630000 [0050.580] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0050.580] GetProcessHeap () returned 0x630000 [0050.580] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0050.580] GetProcessHeap () returned 0x630000 [0050.580] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0050.580] GetProcessHeap () returned 0x630000 [0050.580] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0050.580] GetProcessHeap () returned 0x630000 [0050.580] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.580] GetProcessHeap () returned 0x630000 [0050.581] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.581] GetProcessHeap () returned 0x630000 [0050.581] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0050.581] GetProcessHeap () returned 0x630000 [0050.581] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0050.581] GetProcessHeap () returned 0x630000 [0050.581] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0050.581] GetProcessHeap () returned 0x630000 [0050.581] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0050.581] GetProcessHeap () returned 0x630000 [0050.581] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0050.581] GetProcessHeap () returned 0x630000 [0050.581] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0050.581] GetProcessHeap () returned 0x630000 [0050.581] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0050.581] GetProcessHeap () returned 0x630000 [0050.581] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0050.581] GetProcessHeap () returned 0x630000 [0050.581] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.581] GetProcessHeap () returned 0x630000 [0050.581] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.581] GetProcessHeap () returned 0x630000 [0050.581] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0050.581] GetProcessHeap () returned 0x630000 [0050.581] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0050.581] GetProcessHeap () returned 0x630000 [0050.581] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0050.581] GetProcessHeap () returned 0x630000 [0050.581] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0050.581] GetProcessHeap () returned 0x630000 [0050.581] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0050.581] GetProcessHeap () returned 0x630000 [0050.581] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0050.581] GetProcessHeap () returned 0x630000 [0050.581] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0050.581] GetProcessHeap () returned 0x630000 [0050.581] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0050.582] GetProcessHeap () returned 0x630000 [0050.582] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.582] GetProcessHeap () returned 0x630000 [0050.582] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.582] GetProcessHeap () returned 0x630000 [0050.582] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0050.582] GetProcessHeap () returned 0x630000 [0050.582] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0050.582] GetProcessHeap () returned 0x630000 [0050.582] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0050.582] GetProcessHeap () returned 0x630000 [0050.582] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0050.582] GetProcessHeap () returned 0x630000 [0050.582] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0050.582] GetProcessHeap () returned 0x630000 [0050.582] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0050.582] GetProcessHeap () returned 0x630000 [0050.582] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0050.582] GetProcessHeap () returned 0x630000 [0050.582] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0050.582] GetProcessHeap () returned 0x630000 [0050.582] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0050.582] GetProcessHeap () returned 0x630000 [0050.582] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0050.582] GetProcessHeap () returned 0x630000 [0050.582] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0050.582] GetProcessHeap () returned 0x630000 [0050.582] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0050.582] GetProcessHeap () returned 0x630000 [0050.582] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0050.582] GetProcessHeap () returned 0x630000 [0050.582] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0050.582] GetProcessHeap () returned 0x630000 [0050.582] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.582] GetProcessHeap () returned 0x630000 [0050.582] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.582] GetProcessHeap () returned 0x630000 [0050.583] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.583] GetProcessHeap () returned 0x630000 [0050.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.583] GetProcessHeap () returned 0x630000 [0050.583] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0050.583] GetProcessHeap () returned 0x630000 [0050.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0050.583] GetProcessHeap () returned 0x630000 [0050.583] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.583] GetProcessHeap () returned 0x630000 [0050.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.583] GetProcessHeap () returned 0x630000 [0050.583] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0050.583] GetProcessHeap () returned 0x630000 [0050.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0050.583] GetProcessHeap () returned 0x630000 [0050.583] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0050.583] GetProcessHeap () returned 0x630000 [0050.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0050.583] GetProcessHeap () returned 0x630000 [0050.583] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0050.583] GetProcessHeap () returned 0x630000 [0050.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0050.583] GetProcessHeap () returned 0x630000 [0050.583] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.583] GetProcessHeap () returned 0x630000 [0050.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.583] GetProcessHeap () returned 0x630000 [0050.583] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0050.583] GetProcessHeap () returned 0x630000 [0050.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0050.583] GetProcessHeap () returned 0x630000 [0050.583] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0050.583] GetProcessHeap () returned 0x630000 [0050.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0050.583] GetProcessHeap () returned 0x630000 [0050.583] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0050.584] GetProcessHeap () returned 0x630000 [0050.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0050.584] GetProcessHeap () returned 0x630000 [0050.584] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0050.584] GetProcessHeap () returned 0x630000 [0050.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0050.584] GetProcessHeap () returned 0x630000 [0050.584] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0050.584] GetProcessHeap () returned 0x630000 [0050.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0050.584] GetProcessHeap () returned 0x630000 [0050.584] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.584] GetProcessHeap () returned 0x630000 [0050.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.584] GetProcessHeap () returned 0x630000 [0050.584] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.584] GetProcessHeap () returned 0x630000 [0050.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.584] GetProcessHeap () returned 0x630000 [0050.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0050.584] GetProcessHeap () returned 0x630000 [0050.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0050.584] GetProcessHeap () returned 0x630000 [0050.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0050.584] GetProcessHeap () returned 0x630000 [0050.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0050.584] GetProcessHeap () returned 0x630000 [0050.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0050.584] GetProcessHeap () returned 0x630000 [0050.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6554a0 | out: hHeap=0x630000) returned 1 [0050.584] GetProcessHeap () returned 0x630000 [0050.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0050.584] GetProcessHeap () returned 0x630000 [0050.585] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655f50 | out: hHeap=0x630000) returned 1 [0050.585] GetProcessHeap () returned 0x630000 [0050.585] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0050.585] GetProcessHeap () returned 0x630000 [0050.585] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0050.585] GetProcessHeap () returned 0x630000 [0050.586] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0050.586] WriteFile (in: hFile=0x230, lpBuffer=0x65b5e8*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65b5e8*, lpNumberOfBytesWritten=0x243d864*=0x388, lpOverlapped=0x0) returned 1 [0050.589] GetProcessHeap () returned 0x630000 [0050.589] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65b5e8, Size=0x30) returned 0x65b5e8 [0050.589] GetProcessHeap () returned 0x630000 [0050.589] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0050.590] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.590] GetProcessHeap () returned 0x630000 [0050.590] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x89ed0) returned 0x1f32020 [0050.600] ReadFile (in: hFile=0x230, lpBuffer=0x1f32020, nNumberOfBytesToRead=0x89ed0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x1f32020*, lpNumberOfBytesRead=0x243d7e8*=0x89ed0, lpOverlapped=0x0) returned 1 [0050.609] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.609] WriteFile (in: hFile=0x230, lpBuffer=0x1f32020*, nNumberOfBytesToWrite=0x89ed0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x1f32020*, lpNumberOfBytesWritten=0x243d7e4*=0x89ed0, lpOverlapped=0x0) returned 1 [0050.658] GetProcessHeap () returned 0x630000 [0050.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x1f32020 | out: hHeap=0x630000) returned 1 [0050.661] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0050.661] WriteFile (in: hFile=0x230, lpBuffer=0x65b5e8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65b5e8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0050.662] CloseHandle (hObject=0x230) returned 1 [0050.673] GetProcessHeap () returned 0x630000 [0050.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0050.673] GetProcessHeap () returned 0x630000 [0050.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0050.673] GetProcessHeap () returned 0x630000 [0050.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0050.673] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\GatherOSState.EXE" | out: lpString1="C:\\Windows10Upgrade\\GatherOSState.EXE") returned="C:\\Windows10Upgrade\\GatherOSState.EXE" [0050.673] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\GatherOSState.EXE", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\GatherOSState.EXE.happythreechoose") returned="C:\\Windows10Upgrade\\GatherOSState.EXE.happythreechoose" [0050.673] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\GatherOSState.EXE" (normalized: "c:\\windows10upgrade\\gatherosstate.exe"), lpNewFileName="C:\\Windows10Upgrade\\GatherOSState.EXE.happythreechoose" (normalized: "c:\\windows10upgrade\\gatherosstate.exe.happythreechoose"), dwFlags=0x1) returned 1 [0050.673] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\GatherOSState.EXE" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0050.673] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0050.673] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\Decryption INFO.html" [0050.674] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\decryption info.html")) returned 0x20 [0050.674] GetProcessHeap () returned 0x630000 [0050.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645c78 | out: hHeap=0x630000) returned 1 [0050.674] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39058e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39058e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x83cc8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GetCurrentDeploy.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1 [0050.674] lstrcmpiW (lpString1="GetCurrentDeploy.dll", lpString2=".") returned 1 [0050.674] lstrcmpiW (lpString1="GetCurrentDeploy.dll", lpString2="..") returned 1 [0050.674] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="GetCurrentDeploy.dll" | out: lpString1="C:\\Windows10Upgrade\\GetCurrentDeploy.dll") returned="C:\\Windows10Upgrade\\GetCurrentDeploy.dll" [0050.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetCurrentDeploy.dll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0050.674] GetProcessHeap () returned 0x630000 [0050.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x15) returned 0x645cd8 [0050.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetCurrentDeploy.dll", cchWideChar=-1, lpMultiByteStr=0x645cd8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetCurrentDeploy.dll", lpUsedDefaultChar=0x0) returned 21 [0050.674] lstrlenA (lpString="GetCurrentDeploy.dll") returned 20 [0050.674] lstrlenA (lpString=".happythreechoose") returned 17 [0050.674] lstrlenA (lpString=".happythreechoose") returned 17 [0050.674] lstrlenA (lpString="GetCurrentDeploy.dll") returned 20 [0050.674] lstrcmpiA (lpString1="CurrentDeploy.dll", lpString2=".happythreechoose") returned 1 [0050.674] lstrcmpiW (lpString1="GetCurrentDeploy.dll", lpString2="Decryption INFO.html") returned 1 [0050.674] lstrcmpiW (lpString1="GetCurrentDeploy.dll", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0050.674] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0050.674] lstrcmpiW (lpString1="GetCurrentDeploy.dll", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0050.674] GetProcessHeap () returned 0x630000 [0050.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0050.674] CreateFileW (lpFileName="C:\\Windows10Upgrade\\GetCurrentDeploy.dll" (normalized: "c:\\windows10upgrade\\getcurrentdeploy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0050.675] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=539848) returned 1 [0050.675] GetProcessHeap () returned 0x630000 [0050.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x63e830 [0050.675] GetProcessHeap () returned 0x630000 [0050.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0050.675] lstrlenW (lpString="C:\\Windows10Upgrade\\GetCurrentDeploy.dll") returned 40 [0050.675] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0050.675] GetProcessHeap () returned 0x630000 [0050.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0050.675] GetProcessHeap () returned 0x630000 [0050.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x65c980 [0050.675] lstrlenA (lpString="rsa_encrypt") returned 11 [0050.675] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0050.676] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0050.676] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0050.676] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0050.676] GetProcessHeap () returned 0x630000 [0050.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0050.676] lstrlenA (lpString="010001") returned 6 [0050.676] GetProcessHeap () returned 0x630000 [0050.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a368 [0050.676] GetProcessHeap () returned 0x630000 [0050.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0050.676] GetProcessHeap () returned 0x630000 [0050.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655890 [0050.676] GetProcessHeap () returned 0x630000 [0050.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0050.676] GetProcessHeap () returned 0x630000 [0050.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655800 [0050.676] GetProcessHeap () returned 0x630000 [0050.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657440 [0050.676] GetProcessHeap () returned 0x630000 [0050.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a328 [0050.676] GetProcessHeap () returned 0x630000 [0050.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0050.676] GetProcessHeap () returned 0x630000 [0050.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.676] GetProcessHeap () returned 0x630000 [0050.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0050.676] GetProcessHeap () returned 0x630000 [0050.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0050.676] GetProcessHeap () returned 0x630000 [0050.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656db0 [0050.676] GetProcessHeap () returned 0x630000 [0050.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0050.676] GetProcessHeap () returned 0x630000 [0050.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0050.676] GetProcessHeap () returned 0x630000 [0050.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655920 [0050.676] GetProcessHeap () returned 0x630000 [0050.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0050.677] GetProcessHeap () returned 0x630000 [0050.677] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0050.677] GetProcessHeap () returned 0x630000 [0050.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655920 | out: hHeap=0x630000) returned 1 [0050.677] GetProcessHeap () returned 0x630000 [0050.677] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.677] GetProcessHeap () returned 0x630000 [0050.677] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0050.677] GetProcessHeap () returned 0x630000 [0050.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0050.677] GetProcessHeap () returned 0x630000 [0050.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.677] GetProcessHeap () returned 0x630000 [0050.677] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0050.677] GetProcessHeap () returned 0x630000 [0050.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0050.677] GetProcessHeap () returned 0x630000 [0050.677] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x655140 [0050.677] GetProcessHeap () returned 0x630000 [0050.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0050.677] GetProcessHeap () returned 0x630000 [0050.677] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0050.677] GetProcessHeap () returned 0x630000 [0050.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655140 | out: hHeap=0x630000) returned 1 [0050.677] GetProcessHeap () returned 0x630000 [0050.677] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.677] GetProcessHeap () returned 0x630000 [0050.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.677] GetProcessHeap () returned 0x630000 [0050.677] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.677] GetProcessHeap () returned 0x630000 [0050.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.677] GetProcessHeap () returned 0x630000 [0050.677] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0050.677] GetProcessHeap () returned 0x630000 [0050.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0050.677] GetProcessHeap () returned 0x630000 [0050.677] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.677] GetProcessHeap () returned 0x630000 [0050.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.678] GetProcessHeap () returned 0x630000 [0050.678] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0050.678] GetProcessHeap () returned 0x630000 [0050.678] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0050.678] GetProcessHeap () returned 0x630000 [0050.678] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0050.678] GetProcessHeap () returned 0x630000 [0050.678] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0050.678] GetProcessHeap () returned 0x630000 [0050.678] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.678] GetProcessHeap () returned 0x630000 [0050.678] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.678] GetProcessHeap () returned 0x630000 [0050.678] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.678] GetProcessHeap () returned 0x630000 [0050.678] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.678] GetProcessHeap () returned 0x630000 [0050.678] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0050.678] GetProcessHeap () returned 0x630000 [0050.678] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0050.678] GetProcessHeap () returned 0x630000 [0050.678] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0050.678] GetProcessHeap () returned 0x630000 [0050.678] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0050.678] GetProcessHeap () returned 0x630000 [0050.678] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0050.678] GetProcessHeap () returned 0x630000 [0050.678] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0050.678] GetProcessHeap () returned 0x630000 [0050.678] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.678] GetProcessHeap () returned 0x630000 [0050.679] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.679] GetProcessHeap () returned 0x630000 [0050.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0050.679] GetProcessHeap () returned 0x630000 [0050.679] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0050.679] GetProcessHeap () returned 0x630000 [0050.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0050.679] GetProcessHeap () returned 0x630000 [0050.679] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0050.679] GetProcessHeap () returned 0x630000 [0050.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.679] GetProcessHeap () returned 0x630000 [0050.679] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.679] GetProcessHeap () returned 0x630000 [0050.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0050.679] GetProcessHeap () returned 0x630000 [0050.679] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0050.679] GetProcessHeap () returned 0x630000 [0050.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.679] GetProcessHeap () returned 0x630000 [0050.679] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.679] GetProcessHeap () returned 0x630000 [0050.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0050.679] GetProcessHeap () returned 0x630000 [0050.679] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0050.679] GetProcessHeap () returned 0x630000 [0050.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0050.679] GetProcessHeap () returned 0x630000 [0050.679] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0050.679] GetProcessHeap () returned 0x630000 [0050.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0050.679] GetProcessHeap () returned 0x630000 [0050.679] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0050.679] GetProcessHeap () returned 0x630000 [0050.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0050.679] GetProcessHeap () returned 0x630000 [0050.680] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0050.680] GetProcessHeap () returned 0x630000 [0050.680] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0050.680] GetProcessHeap () returned 0x630000 [0050.680] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0050.680] GetProcessHeap () returned 0x630000 [0050.680] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0050.680] GetProcessHeap () returned 0x630000 [0050.680] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0050.680] GetProcessHeap () returned 0x630000 [0050.680] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0050.680] GetProcessHeap () returned 0x630000 [0050.680] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0050.680] GetProcessHeap () returned 0x630000 [0050.680] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0050.680] GetProcessHeap () returned 0x630000 [0050.680] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0050.680] GetProcessHeap () returned 0x630000 [0050.680] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0050.680] GetProcessHeap () returned 0x630000 [0050.680] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0050.680] GetProcessHeap () returned 0x630000 [0050.680] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0050.680] GetProcessHeap () returned 0x630000 [0050.680] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0050.680] GetProcessHeap () returned 0x630000 [0050.680] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0050.680] GetProcessHeap () returned 0x630000 [0050.680] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0050.680] GetProcessHeap () returned 0x630000 [0050.680] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.680] GetProcessHeap () returned 0x630000 [0050.680] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.680] GetProcessHeap () returned 0x630000 [0050.680] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0050.680] GetProcessHeap () returned 0x630000 [0050.680] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0050.680] GetProcessHeap () returned 0x630000 [0050.681] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.681] GetProcessHeap () returned 0x630000 [0050.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.681] GetProcessHeap () returned 0x630000 [0050.681] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0050.681] GetProcessHeap () returned 0x630000 [0050.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0050.681] GetProcessHeap () returned 0x630000 [0050.681] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.681] GetProcessHeap () returned 0x630000 [0050.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.681] GetProcessHeap () returned 0x630000 [0050.681] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0050.681] GetProcessHeap () returned 0x630000 [0050.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0050.681] GetProcessHeap () returned 0x630000 [0050.681] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0050.681] GetProcessHeap () returned 0x630000 [0050.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0050.681] GetProcessHeap () returned 0x630000 [0050.681] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0050.681] GetProcessHeap () returned 0x630000 [0050.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0050.681] GetProcessHeap () returned 0x630000 [0050.681] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.681] GetProcessHeap () returned 0x630000 [0050.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.681] GetProcessHeap () returned 0x630000 [0050.681] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0050.681] GetProcessHeap () returned 0x630000 [0050.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0050.681] GetProcessHeap () returned 0x630000 [0050.681] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.681] GetProcessHeap () returned 0x630000 [0050.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.681] GetProcessHeap () returned 0x630000 [0050.681] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0050.681] GetProcessHeap () returned 0x630000 [0050.682] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0050.682] GetProcessHeap () returned 0x630000 [0050.682] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0050.682] GetProcessHeap () returned 0x630000 [0050.682] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0050.682] GetProcessHeap () returned 0x630000 [0050.682] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0050.682] GetProcessHeap () returned 0x630000 [0050.682] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0050.682] GetProcessHeap () returned 0x630000 [0050.682] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0050.682] GetProcessHeap () returned 0x630000 [0050.682] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0050.682] GetProcessHeap () returned 0x630000 [0050.682] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0050.682] GetProcessHeap () returned 0x630000 [0050.682] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655800 | out: hHeap=0x630000) returned 1 [0050.682] GetProcessHeap () returned 0x630000 [0050.682] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0050.682] GetProcessHeap () returned 0x630000 [0050.682] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655890 | out: hHeap=0x630000) returned 1 [0050.682] GetProcessHeap () returned 0x630000 [0050.682] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0050.682] GetProcessHeap () returned 0x630000 [0050.682] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0050.682] GetProcessHeap () returned 0x630000 [0050.682] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0050.682] WriteFile (in: hFile=0x230, lpBuffer=0x65c980*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65c980*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0050.688] GetProcessHeap () returned 0x630000 [0050.688] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65c980, Size=0x30) returned 0x65c980 [0050.688] GetProcessHeap () returned 0x630000 [0050.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0050.688] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.688] GetProcessHeap () returned 0x630000 [0050.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x83cc8) returned 0x1f37020 [0050.698] ReadFile (in: hFile=0x230, lpBuffer=0x1f37020, nNumberOfBytesToRead=0x83cc8, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x1f37020*, lpNumberOfBytesRead=0x243d7e8*=0x83cc8, lpOverlapped=0x0) returned 1 [0050.706] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.706] WriteFile (in: hFile=0x230, lpBuffer=0x1f37020*, nNumberOfBytesToWrite=0x83cc8, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x1f37020*, lpNumberOfBytesWritten=0x243d7e4*=0x83cc8, lpOverlapped=0x0) returned 1 [0050.881] GetProcessHeap () returned 0x630000 [0050.881] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x1f37020 | out: hHeap=0x630000) returned 1 [0050.886] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0050.889] WriteFile (in: hFile=0x230, lpBuffer=0x65c980*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65c980*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0050.891] CloseHandle (hObject=0x230) returned 1 [0050.900] GetProcessHeap () returned 0x630000 [0050.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0050.901] GetProcessHeap () returned 0x630000 [0050.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0050.901] GetProcessHeap () returned 0x630000 [0050.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0050.901] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\GetCurrentDeploy.dll" | out: lpString1="C:\\Windows10Upgrade\\GetCurrentDeploy.dll") returned="C:\\Windows10Upgrade\\GetCurrentDeploy.dll" [0050.901] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\GetCurrentDeploy.dll", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\GetCurrentDeploy.dll.happythreechoose") returned="C:\\Windows10Upgrade\\GetCurrentDeploy.dll.happythreechoose" [0050.901] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\GetCurrentDeploy.dll" (normalized: "c:\\windows10upgrade\\getcurrentdeploy.dll"), lpNewFileName="C:\\Windows10Upgrade\\GetCurrentDeploy.dll.happythreechoose" (normalized: "c:\\windows10upgrade\\getcurrentdeploy.dll.happythreechoose"), dwFlags=0x1) returned 1 [0050.902] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\GetCurrentDeploy.dll" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0050.902] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0050.902] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\Decryption INFO.html" [0050.902] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\decryption info.html")) returned 0x20 [0050.902] GetProcessHeap () returned 0x630000 [0050.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645cd8 | out: hHeap=0x630000) returned 1 [0050.902] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea392ca4, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea392ca4, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~2.DLL")) returned 1 [0050.902] lstrcmpiW (lpString1="GetCurrentOOBE.dll", lpString2=".") returned 1 [0050.902] lstrcmpiW (lpString1="GetCurrentOOBE.dll", lpString2="..") returned 1 [0050.902] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="GetCurrentOOBE.dll" | out: lpString1="C:\\Windows10Upgrade\\GetCurrentOOBE.dll") returned="C:\\Windows10Upgrade\\GetCurrentOOBE.dll" [0050.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetCurrentOOBE.dll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0050.902] GetProcessHeap () returned 0x630000 [0050.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x13) returned 0x645d18 [0050.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetCurrentOOBE.dll", cchWideChar=-1, lpMultiByteStr=0x645d18, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetCurrentOOBE.dll", lpUsedDefaultChar=0x0) returned 19 [0050.902] lstrlenA (lpString="GetCurrentOOBE.dll") returned 18 [0050.902] lstrlenA (lpString=".happythreechoose") returned 17 [0050.902] lstrlenA (lpString=".happythreechoose") returned 17 [0050.903] lstrlenA (lpString="GetCurrentOOBE.dll") returned 18 [0050.903] lstrcmpiA (lpString1="etCurrentOOBE.dll", lpString2=".happythreechoose") returned 1 [0050.903] lstrcmpiW (lpString1="GetCurrentOOBE.dll", lpString2="Decryption INFO.html") returned 1 [0050.903] lstrcmpiW (lpString1="GetCurrentOOBE.dll", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0050.903] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0050.903] lstrcmpiW (lpString1="GetCurrentOOBE.dll", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0050.903] GetProcessHeap () returned 0x630000 [0050.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0050.903] CreateFileW (lpFileName="C:\\Windows10Upgrade\\GetCurrentOOBE.dll" (normalized: "c:\\windows10upgrade\\getcurrentoobe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0050.903] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=144072) returned 1 [0050.903] GetProcessHeap () returned 0x630000 [0050.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x63e830 [0050.903] GetProcessHeap () returned 0x630000 [0050.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0050.903] lstrlenW (lpString="C:\\Windows10Upgrade\\GetCurrentOOBE.dll") returned 38 [0050.903] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0050.903] GetProcessHeap () returned 0x630000 [0050.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0050.904] GetProcessHeap () returned 0x630000 [0050.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x65c9b8 [0050.904] lstrlenA (lpString="rsa_encrypt") returned 11 [0050.904] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0050.905] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0050.905] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0050.905] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0050.905] GetProcessHeap () returned 0x630000 [0050.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0050.905] lstrlenA (lpString="010001") returned 6 [0050.905] GetProcessHeap () returned 0x630000 [0050.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0050.905] GetProcessHeap () returned 0x630000 [0050.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0050.905] GetProcessHeap () returned 0x630000 [0050.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655fe0 [0050.905] GetProcessHeap () returned 0x630000 [0050.905] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0050.905] GetProcessHeap () returned 0x630000 [0050.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655800 [0050.905] GetProcessHeap () returned 0x630000 [0050.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656a68 [0050.905] GetProcessHeap () returned 0x630000 [0050.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3f8 [0050.905] GetProcessHeap () returned 0x630000 [0050.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0050.905] GetProcessHeap () returned 0x630000 [0050.905] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0050.905] GetProcessHeap () returned 0x630000 [0050.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0050.905] GetProcessHeap () returned 0x630000 [0050.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0050.905] GetProcessHeap () returned 0x630000 [0050.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656db0 [0050.905] GetProcessHeap () returned 0x630000 [0050.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0050.906] GetProcessHeap () returned 0x630000 [0050.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0050.906] GetProcessHeap () returned 0x630000 [0050.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655920 [0050.906] GetProcessHeap () returned 0x630000 [0050.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0050.906] GetProcessHeap () returned 0x630000 [0050.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0050.906] GetProcessHeap () returned 0x630000 [0050.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655920 | out: hHeap=0x630000) returned 1 [0050.906] GetProcessHeap () returned 0x630000 [0050.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0050.906] GetProcessHeap () returned 0x630000 [0050.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0050.906] GetProcessHeap () returned 0x630000 [0050.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0050.906] GetProcessHeap () returned 0x630000 [0050.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0050.906] GetProcessHeap () returned 0x630000 [0050.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0050.906] GetProcessHeap () returned 0x630000 [0050.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0050.906] GetProcessHeap () returned 0x630000 [0050.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x655f50 [0050.906] GetProcessHeap () returned 0x630000 [0050.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0050.906] GetProcessHeap () returned 0x630000 [0050.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0050.906] GetProcessHeap () returned 0x630000 [0050.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655f50 | out: hHeap=0x630000) returned 1 [0050.906] GetProcessHeap () returned 0x630000 [0050.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0050.906] GetProcessHeap () returned 0x630000 [0050.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0050.906] GetProcessHeap () returned 0x630000 [0050.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0050.906] GetProcessHeap () returned 0x630000 [0050.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0050.907] GetProcessHeap () returned 0x630000 [0050.907] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.907] GetProcessHeap () returned 0x630000 [0050.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.907] GetProcessHeap () returned 0x630000 [0050.907] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0050.907] GetProcessHeap () returned 0x630000 [0050.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0050.907] GetProcessHeap () returned 0x630000 [0050.907] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0050.907] GetProcessHeap () returned 0x630000 [0050.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0050.907] GetProcessHeap () returned 0x630000 [0050.907] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0050.907] GetProcessHeap () returned 0x630000 [0050.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0050.907] GetProcessHeap () returned 0x630000 [0050.907] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0050.907] GetProcessHeap () returned 0x630000 [0050.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0050.907] GetProcessHeap () returned 0x630000 [0050.907] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0050.907] GetProcessHeap () returned 0x630000 [0050.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0050.907] GetProcessHeap () returned 0x630000 [0050.907] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.907] GetProcessHeap () returned 0x630000 [0050.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.907] GetProcessHeap () returned 0x630000 [0050.907] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0050.907] GetProcessHeap () returned 0x630000 [0050.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0050.907] GetProcessHeap () returned 0x630000 [0050.908] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0050.908] GetProcessHeap () returned 0x630000 [0050.908] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0050.908] GetProcessHeap () returned 0x630000 [0050.908] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0050.908] GetProcessHeap () returned 0x630000 [0050.908] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0050.908] GetProcessHeap () returned 0x630000 [0050.908] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0050.908] GetProcessHeap () returned 0x630000 [0050.908] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0050.908] GetProcessHeap () returned 0x630000 [0050.908] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0050.908] GetProcessHeap () returned 0x630000 [0050.908] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0050.908] GetProcessHeap () returned 0x630000 [0050.908] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.908] GetProcessHeap () returned 0x630000 [0050.908] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.908] GetProcessHeap () returned 0x630000 [0050.908] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0050.908] GetProcessHeap () returned 0x630000 [0050.908] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0050.908] GetProcessHeap () returned 0x630000 [0050.908] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.908] GetProcessHeap () returned 0x630000 [0050.908] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.908] GetProcessHeap () returned 0x630000 [0050.908] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0050.908] GetProcessHeap () returned 0x630000 [0050.908] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0050.908] GetProcessHeap () returned 0x630000 [0050.908] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0050.909] GetProcessHeap () returned 0x630000 [0050.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0050.909] GetProcessHeap () returned 0x630000 [0050.909] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.909] GetProcessHeap () returned 0x630000 [0050.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.909] GetProcessHeap () returned 0x630000 [0050.909] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.909] GetProcessHeap () returned 0x630000 [0050.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.909] GetProcessHeap () returned 0x630000 [0050.909] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0050.909] GetProcessHeap () returned 0x630000 [0050.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0050.909] GetProcessHeap () returned 0x630000 [0050.909] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0050.909] GetProcessHeap () returned 0x630000 [0050.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0050.909] GetProcessHeap () returned 0x630000 [0050.909] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0050.909] GetProcessHeap () returned 0x630000 [0050.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0050.909] GetProcessHeap () returned 0x630000 [0050.909] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.909] GetProcessHeap () returned 0x630000 [0050.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.909] GetProcessHeap () returned 0x630000 [0050.909] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.909] GetProcessHeap () returned 0x630000 [0050.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.909] GetProcessHeap () returned 0x630000 [0050.909] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0050.909] GetProcessHeap () returned 0x630000 [0050.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0050.910] GetProcessHeap () returned 0x630000 [0050.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0050.910] GetProcessHeap () returned 0x630000 [0050.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0050.910] GetProcessHeap () returned 0x630000 [0050.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0050.910] GetProcessHeap () returned 0x630000 [0050.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0050.910] GetProcessHeap () returned 0x630000 [0050.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0050.910] GetProcessHeap () returned 0x630000 [0050.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0050.910] GetProcessHeap () returned 0x630000 [0050.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0050.910] GetProcessHeap () returned 0x630000 [0050.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0050.910] GetProcessHeap () returned 0x630000 [0050.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0050.910] GetProcessHeap () returned 0x630000 [0050.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0050.910] GetProcessHeap () returned 0x630000 [0050.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0050.910] GetProcessHeap () returned 0x630000 [0050.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0050.910] GetProcessHeap () returned 0x630000 [0050.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.910] GetProcessHeap () returned 0x630000 [0050.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.910] GetProcessHeap () returned 0x630000 [0050.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.910] GetProcessHeap () returned 0x630000 [0050.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.910] GetProcessHeap () returned 0x630000 [0050.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0050.910] GetProcessHeap () returned 0x630000 [0050.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0050.911] GetProcessHeap () returned 0x630000 [0050.911] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.911] GetProcessHeap () returned 0x630000 [0050.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.911] GetProcessHeap () returned 0x630000 [0050.911] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0050.911] GetProcessHeap () returned 0x630000 [0050.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0050.911] GetProcessHeap () returned 0x630000 [0050.911] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0050.911] GetProcessHeap () returned 0x630000 [0050.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0050.911] GetProcessHeap () returned 0x630000 [0050.911] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0050.911] GetProcessHeap () returned 0x630000 [0050.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0050.911] GetProcessHeap () returned 0x630000 [0050.911] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0050.911] GetProcessHeap () returned 0x630000 [0050.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0050.911] GetProcessHeap () returned 0x630000 [0050.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0050.911] GetProcessHeap () returned 0x630000 [0050.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0050.911] GetProcessHeap () returned 0x630000 [0050.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0050.911] GetProcessHeap () returned 0x630000 [0050.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0050.911] GetProcessHeap () returned 0x630000 [0050.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0050.911] GetProcessHeap () returned 0x630000 [0050.912] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655800 | out: hHeap=0x630000) returned 1 [0050.912] GetProcessHeap () returned 0x630000 [0050.912] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0050.912] GetProcessHeap () returned 0x630000 [0050.912] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655fe0 | out: hHeap=0x630000) returned 1 [0050.912] GetProcessHeap () returned 0x630000 [0050.912] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0050.912] GetProcessHeap () returned 0x630000 [0050.912] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0050.912] GetProcessHeap () returned 0x630000 [0050.912] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0050.912] WriteFile (in: hFile=0x230, lpBuffer=0x65c9b8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65c9b8*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0050.922] GetProcessHeap () returned 0x630000 [0050.922] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65c9b8, Size=0x30) returned 0x65c9b8 [0050.922] GetProcessHeap () returned 0x630000 [0050.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0050.922] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.922] GetProcessHeap () returned 0x630000 [0050.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x232c8) returned 0x65c9f0 [0050.925] ReadFile (in: hFile=0x230, lpBuffer=0x65c9f0, nNumberOfBytesToRead=0x232c8, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65c9f0*, lpNumberOfBytesRead=0x243d7e8*=0x232c8, lpOverlapped=0x0) returned 1 [0050.928] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.928] WriteFile (in: hFile=0x230, lpBuffer=0x65c9f0*, nNumberOfBytesToWrite=0x232c8, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65c9f0*, lpNumberOfBytesWritten=0x243d7e4*=0x232c8, lpOverlapped=0x0) returned 1 [0050.948] GetProcessHeap () returned 0x630000 [0050.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65c9f0 | out: hHeap=0x630000) returned 1 [0050.949] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0050.949] WriteFile (in: hFile=0x230, lpBuffer=0x65c9b8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65c9b8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0050.950] CloseHandle (hObject=0x230) returned 1 [0050.953] GetProcessHeap () returned 0x630000 [0050.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0050.953] GetProcessHeap () returned 0x630000 [0050.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0050.953] GetProcessHeap () returned 0x630000 [0050.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0050.953] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\GetCurrentOOBE.dll" | out: lpString1="C:\\Windows10Upgrade\\GetCurrentOOBE.dll") returned="C:\\Windows10Upgrade\\GetCurrentOOBE.dll" [0050.953] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\GetCurrentOOBE.dll", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\GetCurrentOOBE.dll.happythreechoose") returned="C:\\Windows10Upgrade\\GetCurrentOOBE.dll.happythreechoose" [0050.953] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\GetCurrentOOBE.dll" (normalized: "c:\\windows10upgrade\\getcurrentoobe.dll"), lpNewFileName="C:\\Windows10Upgrade\\GetCurrentOOBE.dll.happythreechoose" (normalized: "c:\\windows10upgrade\\getcurrentoobe.dll.happythreechoose"), dwFlags=0x1) returned 1 [0050.954] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\GetCurrentOOBE.dll" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0050.954] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0050.954] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\Decryption INFO.html" [0050.954] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\decryption info.html")) returned 0x20 [0050.954] GetProcessHeap () returned 0x630000 [0050.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645d18 | out: hHeap=0x630000) returned 1 [0050.954] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39539e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39539e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x11ec8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GetCurrentRollback.EXE", cAlternateFileName="GETCUR~1.EXE")) returned 1 [0050.954] lstrcmpiW (lpString1="GetCurrentRollback.EXE", lpString2=".") returned 1 [0050.954] lstrcmpiW (lpString1="GetCurrentRollback.EXE", lpString2="..") returned 1 [0050.954] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="GetCurrentRollback.EXE" | out: lpString1="C:\\Windows10Upgrade\\GetCurrentRollback.EXE") returned="C:\\Windows10Upgrade\\GetCurrentRollback.EXE" [0050.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetCurrentRollback.EXE", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0050.954] GetProcessHeap () returned 0x630000 [0050.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x17) returned 0x645cd8 [0050.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetCurrentRollback.EXE", cchWideChar=-1, lpMultiByteStr=0x645cd8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetCurrentRollback.EXE", lpUsedDefaultChar=0x0) returned 23 [0050.954] lstrlenA (lpString="GetCurrentRollback.EXE") returned 22 [0050.954] lstrlenA (lpString=".happythreechoose") returned 17 [0050.954] lstrlenA (lpString=".happythreechoose") returned 17 [0050.954] lstrlenA (lpString="GetCurrentRollback.EXE") returned 22 [0050.955] lstrcmpiA (lpString1="rrentRollback.EXE", lpString2=".happythreechoose") returned 1 [0050.955] lstrcmpiW (lpString1="GetCurrentRollback.EXE", lpString2="Decryption INFO.html") returned 1 [0050.955] lstrcmpiW (lpString1="GetCurrentRollback.EXE", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0050.955] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0050.955] lstrcmpiW (lpString1="GetCurrentRollback.EXE", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0050.955] GetProcessHeap () returned 0x630000 [0050.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0050.955] CreateFileW (lpFileName="C:\\Windows10Upgrade\\GetCurrentRollback.EXE" (normalized: "c:\\windows10upgrade\\getcurrentrollback.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0050.956] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=73416) returned 1 [0050.956] GetProcessHeap () returned 0x630000 [0050.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x63e830 [0050.956] GetProcessHeap () returned 0x630000 [0050.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0050.956] lstrlenW (lpString="C:\\Windows10Upgrade\\GetCurrentRollback.EXE") returned 42 [0050.956] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0050.956] GetProcessHeap () returned 0x630000 [0050.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0050.957] GetProcessHeap () returned 0x630000 [0050.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x388) returned 0x65c9f0 [0050.957] lstrlenA (lpString="rsa_encrypt") returned 11 [0050.957] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0050.957] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0050.957] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0050.957] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0050.957] GetProcessHeap () returned 0x630000 [0050.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0050.957] lstrlenA (lpString="010001") returned 6 [0050.957] GetProcessHeap () returned 0x630000 [0050.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2a8 [0050.957] GetProcessHeap () returned 0x630000 [0050.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0050.957] GetProcessHeap () returned 0x630000 [0050.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x6555c0 [0050.958] GetProcessHeap () returned 0x630000 [0050.958] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0050.958] GetProcessHeap () returned 0x630000 [0050.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655800 [0050.958] GetProcessHeap () returned 0x630000 [0050.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656b80 [0050.958] GetProcessHeap () returned 0x630000 [0050.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0050.958] GetProcessHeap () returned 0x630000 [0050.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0050.958] GetProcessHeap () returned 0x630000 [0050.958] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0050.958] GetProcessHeap () returned 0x630000 [0050.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0050.958] GetProcessHeap () returned 0x630000 [0050.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0050.958] GetProcessHeap () returned 0x630000 [0050.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657670 [0050.958] GetProcessHeap () returned 0x630000 [0050.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0050.958] GetProcessHeap () returned 0x630000 [0050.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0050.958] GetProcessHeap () returned 0x630000 [0050.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655920 [0050.958] GetProcessHeap () returned 0x630000 [0050.958] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0050.958] GetProcessHeap () returned 0x630000 [0050.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0050.958] GetProcessHeap () returned 0x630000 [0050.958] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655920 | out: hHeap=0x630000) returned 1 [0050.958] GetProcessHeap () returned 0x630000 [0050.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0050.958] GetProcessHeap () returned 0x630000 [0050.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0050.958] GetProcessHeap () returned 0x630000 [0050.958] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0050.959] GetProcessHeap () returned 0x630000 [0050.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0050.959] GetProcessHeap () returned 0x630000 [0050.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.959] GetProcessHeap () returned 0x630000 [0050.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.959] GetProcessHeap () returned 0x630000 [0050.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x655530 [0050.959] GetProcessHeap () returned 0x630000 [0050.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0050.959] GetProcessHeap () returned 0x630000 [0050.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0050.959] GetProcessHeap () returned 0x630000 [0050.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655530 | out: hHeap=0x630000) returned 1 [0050.959] GetProcessHeap () returned 0x630000 [0050.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.959] GetProcessHeap () returned 0x630000 [0050.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.959] GetProcessHeap () returned 0x630000 [0050.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0050.959] GetProcessHeap () returned 0x630000 [0050.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0050.959] GetProcessHeap () returned 0x630000 [0050.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0050.959] GetProcessHeap () returned 0x630000 [0050.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0050.959] GetProcessHeap () returned 0x630000 [0050.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0050.959] GetProcessHeap () returned 0x630000 [0050.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0050.959] GetProcessHeap () returned 0x630000 [0050.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.959] GetProcessHeap () returned 0x630000 [0050.960] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.960] GetProcessHeap () returned 0x630000 [0050.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0050.960] GetProcessHeap () returned 0x630000 [0050.960] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0050.960] GetProcessHeap () returned 0x630000 [0050.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0050.960] GetProcessHeap () returned 0x630000 [0050.960] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0050.960] GetProcessHeap () returned 0x630000 [0050.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0050.960] GetProcessHeap () returned 0x630000 [0050.960] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0050.960] GetProcessHeap () returned 0x630000 [0050.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0050.960] GetProcessHeap () returned 0x630000 [0050.960] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0050.960] GetProcessHeap () returned 0x630000 [0050.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0050.960] GetProcessHeap () returned 0x630000 [0050.960] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0050.960] GetProcessHeap () returned 0x630000 [0050.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.960] GetProcessHeap () returned 0x630000 [0050.960] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.960] GetProcessHeap () returned 0x630000 [0050.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.960] GetProcessHeap () returned 0x630000 [0050.960] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.960] GetProcessHeap () returned 0x630000 [0050.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.960] GetProcessHeap () returned 0x630000 [0050.960] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.960] GetProcessHeap () returned 0x630000 [0050.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0050.961] GetProcessHeap () returned 0x630000 [0050.961] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0050.961] GetProcessHeap () returned 0x630000 [0050.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0050.961] GetProcessHeap () returned 0x630000 [0050.961] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0050.961] GetProcessHeap () returned 0x630000 [0050.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0050.961] GetProcessHeap () returned 0x630000 [0050.961] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0050.961] GetProcessHeap () returned 0x630000 [0050.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.961] GetProcessHeap () returned 0x630000 [0050.961] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.961] GetProcessHeap () returned 0x630000 [0050.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0050.961] GetProcessHeap () returned 0x630000 [0050.961] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0050.961] GetProcessHeap () returned 0x630000 [0050.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0050.961] GetProcessHeap () returned 0x630000 [0050.961] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0050.961] GetProcessHeap () returned 0x630000 [0050.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0050.961] GetProcessHeap () returned 0x630000 [0050.961] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0050.961] GetProcessHeap () returned 0x630000 [0050.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0050.961] GetProcessHeap () returned 0x630000 [0050.961] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0050.961] GetProcessHeap () returned 0x630000 [0050.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0050.961] GetProcessHeap () returned 0x630000 [0050.961] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0050.962] GetProcessHeap () returned 0x630000 [0050.962] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.962] GetProcessHeap () returned 0x630000 [0050.962] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.962] GetProcessHeap () returned 0x630000 [0050.962] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.962] GetProcessHeap () returned 0x630000 [0050.962] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.962] GetProcessHeap () returned 0x630000 [0050.962] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0050.962] GetProcessHeap () returned 0x630000 [0050.962] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0050.962] GetProcessHeap () returned 0x630000 [0050.962] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0050.962] GetProcessHeap () returned 0x630000 [0050.962] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0050.962] GetProcessHeap () returned 0x630000 [0050.962] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0050.962] GetProcessHeap () returned 0x630000 [0050.962] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0050.962] GetProcessHeap () returned 0x630000 [0050.962] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0050.962] GetProcessHeap () returned 0x630000 [0050.962] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0050.962] GetProcessHeap () returned 0x630000 [0050.962] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.962] GetProcessHeap () returned 0x630000 [0050.962] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.962] GetProcessHeap () returned 0x630000 [0050.962] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0050.962] GetProcessHeap () returned 0x630000 [0050.962] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0050.962] GetProcessHeap () returned 0x630000 [0050.962] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0050.962] GetProcessHeap () returned 0x630000 [0050.963] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0050.963] GetProcessHeap () returned 0x630000 [0050.963] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0050.963] GetProcessHeap () returned 0x630000 [0050.963] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0050.963] GetProcessHeap () returned 0x630000 [0050.963] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0050.963] GetProcessHeap () returned 0x630000 [0050.963] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0050.963] GetProcessHeap () returned 0x630000 [0050.963] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0050.963] GetProcessHeap () returned 0x630000 [0050.963] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0050.963] GetProcessHeap () returned 0x630000 [0050.963] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0050.963] GetProcessHeap () returned 0x630000 [0050.963] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0050.963] GetProcessHeap () returned 0x630000 [0050.963] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0050.963] GetProcessHeap () returned 0x630000 [0050.963] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0050.963] GetProcessHeap () returned 0x630000 [0050.963] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0050.963] GetProcessHeap () returned 0x630000 [0050.963] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0050.963] GetProcessHeap () returned 0x630000 [0050.963] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.963] GetProcessHeap () returned 0x630000 [0050.963] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.963] GetProcessHeap () returned 0x630000 [0050.963] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0050.963] GetProcessHeap () returned 0x630000 [0050.963] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0050.963] GetProcessHeap () returned 0x630000 [0050.963] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0050.964] GetProcessHeap () returned 0x630000 [0050.964] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0050.964] GetProcessHeap () returned 0x630000 [0050.964] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0050.964] GetProcessHeap () returned 0x630000 [0050.964] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0050.964] GetProcessHeap () returned 0x630000 [0050.964] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0050.964] GetProcessHeap () returned 0x630000 [0050.964] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0050.964] GetProcessHeap () returned 0x630000 [0050.964] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0050.964] GetProcessHeap () returned 0x630000 [0050.964] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0050.964] GetProcessHeap () returned 0x630000 [0050.964] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0050.964] GetProcessHeap () returned 0x630000 [0050.964] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655800 | out: hHeap=0x630000) returned 1 [0050.964] GetProcessHeap () returned 0x630000 [0050.964] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0050.964] GetProcessHeap () returned 0x630000 [0050.964] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6555c0 | out: hHeap=0x630000) returned 1 [0050.964] GetProcessHeap () returned 0x630000 [0050.964] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0050.964] GetProcessHeap () returned 0x630000 [0050.964] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0050.964] GetProcessHeap () returned 0x630000 [0050.964] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0050.964] WriteFile (in: hFile=0x230, lpBuffer=0x65c9f0*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65c9f0*, lpNumberOfBytesWritten=0x243d864*=0x388, lpOverlapped=0x0) returned 1 [0050.973] GetProcessHeap () returned 0x630000 [0050.973] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65c9f0, Size=0x30) returned 0x65c9f0 [0050.973] GetProcessHeap () returned 0x630000 [0050.973] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0050.973] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.973] GetProcessHeap () returned 0x630000 [0050.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11ed0) returned 0x65ca28 [0050.973] ReadFile (in: hFile=0x230, lpBuffer=0x65ca28, nNumberOfBytesToRead=0x11ed0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ca28*, lpNumberOfBytesRead=0x243d7e8*=0x11ed0, lpOverlapped=0x0) returned 1 [0050.974] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0050.975] WriteFile (in: hFile=0x230, lpBuffer=0x65ca28*, nNumberOfBytesToWrite=0x11ed0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ca28*, lpNumberOfBytesWritten=0x243d7e4*=0x11ed0, lpOverlapped=0x0) returned 1 [0051.001] GetProcessHeap () returned 0x630000 [0051.001] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ca28 | out: hHeap=0x630000) returned 1 [0051.001] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0051.001] WriteFile (in: hFile=0x230, lpBuffer=0x65c9f0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65c9f0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0051.002] CloseHandle (hObject=0x230) returned 1 [0051.004] GetProcessHeap () returned 0x630000 [0051.004] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0051.004] GetProcessHeap () returned 0x630000 [0051.004] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0051.004] GetProcessHeap () returned 0x630000 [0051.004] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0051.004] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\GetCurrentRollback.EXE" | out: lpString1="C:\\Windows10Upgrade\\GetCurrentRollback.EXE") returned="C:\\Windows10Upgrade\\GetCurrentRollback.EXE" [0051.004] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\GetCurrentRollback.EXE", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\GetCurrentRollback.EXE.happythreechoose") returned="C:\\Windows10Upgrade\\GetCurrentRollback.EXE.happythreechoose" [0051.005] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\GetCurrentRollback.EXE" (normalized: "c:\\windows10upgrade\\getcurrentrollback.exe"), lpNewFileName="C:\\Windows10Upgrade\\GetCurrentRollback.EXE.happythreechoose" (normalized: "c:\\windows10upgrade\\getcurrentrollback.exe.happythreechoose"), dwFlags=0x1) returned 1 [0051.005] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\GetCurrentRollback.EXE" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0051.005] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0051.005] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\Decryption INFO.html" [0051.005] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\decryption info.html")) returned 0x20 [0051.005] GetProcessHeap () returned 0x630000 [0051.005] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645cd8 | out: hHeap=0x630000) returned 1 [0051.005] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39673d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39673d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x6cc8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HttpHelper.exe", cAlternateFileName="HTTPHE~1.EXE")) returned 1 [0051.005] lstrcmpiW (lpString1="HttpHelper.exe", lpString2=".") returned 1 [0051.005] lstrcmpiW (lpString1="HttpHelper.exe", lpString2="..") returned 1 [0051.005] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="HttpHelper.exe" | out: lpString1="C:\\Windows10Upgrade\\HttpHelper.exe") returned="C:\\Windows10Upgrade\\HttpHelper.exe" [0051.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HttpHelper.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0051.006] GetProcessHeap () returned 0x630000 [0051.006] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0051.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HttpHelper.exe", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HttpHelper.exe", lpUsedDefaultChar=0x0) returned 15 [0051.006] lstrlenA (lpString="HttpHelper.exe") returned 14 [0051.006] lstrlenA (lpString=".happythreechoose") returned 17 [0051.006] lstrcmpiW (lpString1="HttpHelper.exe", lpString2="Decryption INFO.html") returned 1 [0051.006] lstrcmpiW (lpString1="HttpHelper.exe", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0051.006] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0051.006] lstrcmpiW (lpString1="HttpHelper.exe", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0051.006] GetProcessHeap () returned 0x630000 [0051.006] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0051.006] CreateFileW (lpFileName="C:\\Windows10Upgrade\\HttpHelper.exe" (normalized: "c:\\windows10upgrade\\httphelper.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0051.006] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=27848) returned 1 [0051.007] GetProcessHeap () returned 0x630000 [0051.007] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x63e830 [0051.007] GetProcessHeap () returned 0x630000 [0051.007] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0051.007] lstrlenW (lpString="C:\\Windows10Upgrade\\HttpHelper.exe") returned 34 [0051.007] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0051.007] GetProcessHeap () returned 0x630000 [0051.007] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0051.007] GetProcessHeap () returned 0x630000 [0051.007] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x65ca28 [0051.007] lstrlenA (lpString="rsa_encrypt") returned 11 [0051.007] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0051.008] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0051.008] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0051.008] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0051.008] GetProcessHeap () returned 0x630000 [0051.008] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0051.008] lstrlenA (lpString="010001") returned 6 [0051.008] GetProcessHeap () returned 0x630000 [0051.008] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0051.009] GetProcessHeap () returned 0x630000 [0051.009] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0051.009] GetProcessHeap () returned 0x630000 [0051.009] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x656070 [0051.009] GetProcessHeap () returned 0x630000 [0051.009] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0051.009] GetProcessHeap () returned 0x630000 [0051.009] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655530 [0051.009] GetProcessHeap () returned 0x630000 [0051.009] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x6570f8 [0051.009] GetProcessHeap () returned 0x630000 [0051.009] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a308 [0051.009] GetProcessHeap () returned 0x630000 [0051.009] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0051.009] GetProcessHeap () returned 0x630000 [0051.009] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.009] GetProcessHeap () returned 0x630000 [0051.009] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0051.009] GetProcessHeap () returned 0x630000 [0051.009] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0051.009] GetProcessHeap () returned 0x630000 [0051.009] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656a68 [0051.009] GetProcessHeap () returned 0x630000 [0051.009] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0051.009] GetProcessHeap () returned 0x630000 [0051.009] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0051.009] GetProcessHeap () returned 0x630000 [0051.009] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655a40 [0051.009] GetProcessHeap () returned 0x630000 [0051.009] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0051.009] GetProcessHeap () returned 0x630000 [0051.009] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0051.009] GetProcessHeap () returned 0x630000 [0051.009] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655a40 | out: hHeap=0x630000) returned 1 [0051.009] GetProcessHeap () returned 0x630000 [0051.010] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.010] GetProcessHeap () returned 0x630000 [0051.010] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65b0b0 [0051.010] GetProcessHeap () returned 0x630000 [0051.010] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0051.010] GetProcessHeap () returned 0x630000 [0051.010] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.010] GetProcessHeap () returned 0x630000 [0051.010] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.010] GetProcessHeap () returned 0x630000 [0051.010] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.010] GetProcessHeap () returned 0x630000 [0051.010] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x6552f0 [0051.010] GetProcessHeap () returned 0x630000 [0051.010] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b0b0 | out: hHeap=0x630000) returned 1 [0051.010] GetProcessHeap () returned 0x630000 [0051.010] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0051.010] GetProcessHeap () returned 0x630000 [0051.010] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6552f0 | out: hHeap=0x630000) returned 1 [0051.010] GetProcessHeap () returned 0x630000 [0051.010] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0051.010] GetProcessHeap () returned 0x630000 [0051.010] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0051.010] GetProcessHeap () returned 0x630000 [0051.010] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.010] GetProcessHeap () returned 0x630000 [0051.010] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.010] GetProcessHeap () returned 0x630000 [0051.010] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0051.010] GetProcessHeap () returned 0x630000 [0051.010] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0051.010] GetProcessHeap () returned 0x630000 [0051.010] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.010] GetProcessHeap () returned 0x630000 [0051.010] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.010] GetProcessHeap () returned 0x630000 [0051.010] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.011] GetProcessHeap () returned 0x630000 [0051.011] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.011] GetProcessHeap () returned 0x630000 [0051.011] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.011] GetProcessHeap () returned 0x630000 [0051.011] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.011] GetProcessHeap () returned 0x630000 [0051.011] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0051.011] GetProcessHeap () returned 0x630000 [0051.011] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.011] GetProcessHeap () returned 0x630000 [0051.011] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.011] GetProcessHeap () returned 0x630000 [0051.011] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.011] GetProcessHeap () returned 0x630000 [0051.011] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.011] GetProcessHeap () returned 0x630000 [0051.011] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.011] GetProcessHeap () returned 0x630000 [0051.011] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0051.011] GetProcessHeap () returned 0x630000 [0051.011] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0051.011] GetProcessHeap () returned 0x630000 [0051.011] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0051.011] GetProcessHeap () returned 0x630000 [0051.011] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0051.011] GetProcessHeap () returned 0x630000 [0051.011] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.011] GetProcessHeap () returned 0x630000 [0051.011] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.011] GetProcessHeap () returned 0x630000 [0051.011] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0051.011] GetProcessHeap () returned 0x630000 [0051.011] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0051.012] GetProcessHeap () returned 0x630000 [0051.012] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0051.012] GetProcessHeap () returned 0x630000 [0051.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0051.012] GetProcessHeap () returned 0x630000 [0051.012] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.012] GetProcessHeap () returned 0x630000 [0051.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.012] GetProcessHeap () returned 0x630000 [0051.012] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.012] GetProcessHeap () returned 0x630000 [0051.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.012] GetProcessHeap () returned 0x630000 [0051.012] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.012] GetProcessHeap () returned 0x630000 [0051.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.012] GetProcessHeap () returned 0x630000 [0051.012] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.012] GetProcessHeap () returned 0x630000 [0051.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.012] GetProcessHeap () returned 0x630000 [0051.012] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.012] GetProcessHeap () returned 0x630000 [0051.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.012] GetProcessHeap () returned 0x630000 [0051.012] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.012] GetProcessHeap () returned 0x630000 [0051.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.012] GetProcessHeap () returned 0x630000 [0051.012] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0051.012] GetProcessHeap () returned 0x630000 [0051.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0051.012] GetProcessHeap () returned 0x630000 [0051.012] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0051.012] GetProcessHeap () returned 0x630000 [0051.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0051.013] GetProcessHeap () returned 0x630000 [0051.013] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0051.013] GetProcessHeap () returned 0x630000 [0051.013] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0051.013] GetProcessHeap () returned 0x630000 [0051.013] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.013] GetProcessHeap () returned 0x630000 [0051.013] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.013] GetProcessHeap () returned 0x630000 [0051.013] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0051.013] GetProcessHeap () returned 0x630000 [0051.013] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0051.013] GetProcessHeap () returned 0x630000 [0051.013] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0051.013] GetProcessHeap () returned 0x630000 [0051.013] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0051.013] GetProcessHeap () returned 0x630000 [0051.013] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.013] GetProcessHeap () returned 0x630000 [0051.013] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.013] GetProcessHeap () returned 0x630000 [0051.013] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.013] GetProcessHeap () returned 0x630000 [0051.013] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.013] GetProcessHeap () returned 0x630000 [0051.013] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0051.013] GetProcessHeap () returned 0x630000 [0051.013] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0051.013] GetProcessHeap () returned 0x630000 [0051.013] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0051.013] GetProcessHeap () returned 0x630000 [0051.013] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0051.013] GetProcessHeap () returned 0x630000 [0051.013] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0051.013] GetProcessHeap () returned 0x630000 [0051.013] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0051.014] GetProcessHeap () returned 0x630000 [0051.014] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0051.014] GetProcessHeap () returned 0x630000 [0051.014] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0051.014] GetProcessHeap () returned 0x630000 [0051.014] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.014] GetProcessHeap () returned 0x630000 [0051.014] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.014] GetProcessHeap () returned 0x630000 [0051.014] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.014] GetProcessHeap () returned 0x630000 [0051.014] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.014] GetProcessHeap () returned 0x630000 [0051.014] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0051.014] GetProcessHeap () returned 0x630000 [0051.014] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0051.014] GetProcessHeap () returned 0x630000 [0051.014] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0051.014] GetProcessHeap () returned 0x630000 [0051.014] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0051.014] GetProcessHeap () returned 0x630000 [0051.014] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0051.014] GetProcessHeap () returned 0x630000 [0051.014] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0051.014] GetProcessHeap () returned 0x630000 [0051.014] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.014] GetProcessHeap () returned 0x630000 [0051.014] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.014] GetProcessHeap () returned 0x630000 [0051.014] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.014] GetProcessHeap () returned 0x630000 [0051.014] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.014] GetProcessHeap () returned 0x630000 [0051.014] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0051.014] GetProcessHeap () returned 0x630000 [0051.014] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0051.015] GetProcessHeap () returned 0x630000 [0051.015] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.015] GetProcessHeap () returned 0x630000 [0051.015] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.015] GetProcessHeap () returned 0x630000 [0051.015] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0051.015] GetProcessHeap () returned 0x630000 [0051.015] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0051.015] GetProcessHeap () returned 0x630000 [0051.015] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0051.015] GetProcessHeap () returned 0x630000 [0051.015] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0051.015] GetProcessHeap () returned 0x630000 [0051.015] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0051.015] GetProcessHeap () returned 0x630000 [0051.015] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655530 | out: hHeap=0x630000) returned 1 [0051.015] GetProcessHeap () returned 0x630000 [0051.015] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0051.015] GetProcessHeap () returned 0x630000 [0051.015] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656070 | out: hHeap=0x630000) returned 1 [0051.015] GetProcessHeap () returned 0x630000 [0051.015] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0051.015] GetProcessHeap () returned 0x630000 [0051.015] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.015] GetProcessHeap () returned 0x630000 [0051.015] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0051.015] WriteFile (in: hFile=0x230, lpBuffer=0x65ca28*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65ca28*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0051.070] GetProcessHeap () returned 0x630000 [0051.070] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65ca28, Size=0x30) returned 0x65ca28 [0051.070] GetProcessHeap () returned 0x630000 [0051.070] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0051.070] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.070] GetProcessHeap () returned 0x630000 [0051.070] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6cc8) returned 0x65ca60 [0051.070] ReadFile (in: hFile=0x230, lpBuffer=0x65ca60, nNumberOfBytesToRead=0x6cc8, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ca60*, lpNumberOfBytesRead=0x243d7e8*=0x6cc8, lpOverlapped=0x0) returned 1 [0051.071] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.071] WriteFile (in: hFile=0x230, lpBuffer=0x65ca60*, nNumberOfBytesToWrite=0x6cc8, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ca60*, lpNumberOfBytesWritten=0x243d7e4*=0x6cc8, lpOverlapped=0x0) returned 1 [0051.077] GetProcessHeap () returned 0x630000 [0051.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ca60 | out: hHeap=0x630000) returned 1 [0051.078] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0051.079] WriteFile (in: hFile=0x230, lpBuffer=0x65ca28*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65ca28*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0051.079] CloseHandle (hObject=0x230) returned 1 [0051.082] GetProcessHeap () returned 0x630000 [0051.082] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0051.082] GetProcessHeap () returned 0x630000 [0051.082] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0051.082] GetProcessHeap () returned 0x630000 [0051.082] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0051.082] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\HttpHelper.exe" | out: lpString1="C:\\Windows10Upgrade\\HttpHelper.exe") returned="C:\\Windows10Upgrade\\HttpHelper.exe" [0051.082] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\HttpHelper.exe", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\HttpHelper.exe.happythreechoose") returned="C:\\Windows10Upgrade\\HttpHelper.exe.happythreechoose" [0051.083] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\HttpHelper.exe" (normalized: "c:\\windows10upgrade\\httphelper.exe"), lpNewFileName="C:\\Windows10Upgrade\\HttpHelper.exe.happythreechoose" (normalized: "c:\\windows10upgrade\\httphelper.exe.happythreechoose"), dwFlags=0x1) returned 1 [0051.083] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\HttpHelper.exe" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0051.083] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0051.083] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\Decryption INFO.html" [0051.083] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\decryption info.html")) returned 0x20 [0051.083] GetProcessHeap () returned 0x630000 [0051.083] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0051.083] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PostOOBEScript.cmd", cAlternateFileName="POSTOO~1.CMD")) returned 1 [0051.083] lstrcmpiW (lpString1="PostOOBEScript.cmd", lpString2=".") returned 1 [0051.084] lstrcmpiW (lpString1="PostOOBEScript.cmd", lpString2="..") returned 1 [0051.084] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="PostOOBEScript.cmd" | out: lpString1="C:\\Windows10Upgrade\\PostOOBEScript.cmd") returned="C:\\Windows10Upgrade\\PostOOBEScript.cmd" [0051.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PostOOBEScript.cmd", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0051.084] GetProcessHeap () returned 0x630000 [0051.084] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x13) returned 0x645e78 [0051.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PostOOBEScript.cmd", cchWideChar=-1, lpMultiByteStr=0x645e78, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PostOOBEScript.cmd", lpUsedDefaultChar=0x0) returned 19 [0051.084] lstrlenA (lpString="PostOOBEScript.cmd") returned 18 [0051.084] lstrlenA (lpString=".happythreechoose") returned 17 [0051.084] lstrlenA (lpString=".happythreechoose") returned 17 [0051.084] lstrlenA (lpString="PostOOBEScript.cmd") returned 18 [0051.084] lstrcmpiA (lpString1="ostOOBEScript.cmd", lpString2=".happythreechoose") returned 1 [0051.084] lstrcmpiW (lpString1="PostOOBEScript.cmd", lpString2="Decryption INFO.html") returned 1 [0051.084] lstrcmpiW (lpString1="PostOOBEScript.cmd", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0051.084] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0051.084] lstrcmpiW (lpString1="PostOOBEScript.cmd", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0051.084] GetProcessHeap () returned 0x630000 [0051.084] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0051.084] CreateFileW (lpFileName="C:\\Windows10Upgrade\\PostOOBEScript.cmd" (normalized: "c:\\windows10upgrade\\postoobescript.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0051.085] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=577) returned 1 [0051.085] GetProcessHeap () returned 0x630000 [0051.085] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x63e830 [0051.085] GetProcessHeap () returned 0x630000 [0051.085] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0051.085] lstrlenW (lpString="C:\\Windows10Upgrade\\PostOOBEScript.cmd") returned 38 [0051.085] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0051.085] GetProcessHeap () returned 0x630000 [0051.085] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0051.086] GetProcessHeap () returned 0x630000 [0051.086] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38f) returned 0x65ca60 [0051.087] lstrlenA (lpString="rsa_encrypt") returned 11 [0051.087] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0051.087] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0051.087] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0051.087] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0051.087] GetProcessHeap () returned 0x630000 [0051.087] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0051.087] lstrlenA (lpString="010001") returned 6 [0051.087] GetProcessHeap () returned 0x630000 [0051.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a308 [0051.088] GetProcessHeap () returned 0x630000 [0051.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0051.088] GetProcessHeap () returned 0x630000 [0051.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655380 [0051.088] GetProcessHeap () returned 0x630000 [0051.088] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0051.088] GetProcessHeap () returned 0x630000 [0051.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x6555c0 [0051.088] GetProcessHeap () returned 0x630000 [0051.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x6570f8 [0051.088] GetProcessHeap () returned 0x630000 [0051.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a378 [0051.088] GetProcessHeap () returned 0x630000 [0051.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0051.088] GetProcessHeap () returned 0x630000 [0051.088] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0051.088] GetProcessHeap () returned 0x630000 [0051.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0051.088] GetProcessHeap () returned 0x630000 [0051.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0051.088] GetProcessHeap () returned 0x630000 [0051.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656fe0 [0051.088] GetProcessHeap () returned 0x630000 [0051.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0051.088] GetProcessHeap () returned 0x630000 [0051.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0051.088] GetProcessHeap () returned 0x630000 [0051.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655770 [0051.088] GetProcessHeap () returned 0x630000 [0051.088] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0051.088] GetProcessHeap () returned 0x630000 [0051.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0051.088] GetProcessHeap () returned 0x630000 [0051.088] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655770 | out: hHeap=0x630000) returned 1 [0051.089] GetProcessHeap () returned 0x630000 [0051.089] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0051.089] GetProcessHeap () returned 0x630000 [0051.089] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0051.089] GetProcessHeap () returned 0x630000 [0051.089] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0051.089] GetProcessHeap () returned 0x630000 [0051.089] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0051.089] GetProcessHeap () returned 0x630000 [0051.089] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0051.089] GetProcessHeap () returned 0x630000 [0051.089] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0051.089] GetProcessHeap () returned 0x630000 [0051.089] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x655b60 [0051.089] GetProcessHeap () returned 0x630000 [0051.089] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0051.089] GetProcessHeap () returned 0x630000 [0051.089] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0051.089] GetProcessHeap () returned 0x630000 [0051.089] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655b60 | out: hHeap=0x630000) returned 1 [0051.089] GetProcessHeap () returned 0x630000 [0051.089] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0051.089] GetProcessHeap () returned 0x630000 [0051.089] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.089] GetProcessHeap () returned 0x630000 [0051.089] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0051.089] GetProcessHeap () returned 0x630000 [0051.089] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.089] GetProcessHeap () returned 0x630000 [0051.089] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.089] GetProcessHeap () returned 0x630000 [0051.089] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.089] GetProcessHeap () returned 0x630000 [0051.089] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.089] GetProcessHeap () returned 0x630000 [0051.089] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.089] GetProcessHeap () returned 0x630000 [0051.090] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0051.090] GetProcessHeap () returned 0x630000 [0051.090] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0051.090] GetProcessHeap () returned 0x630000 [0051.090] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.090] GetProcessHeap () returned 0x630000 [0051.090] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.090] GetProcessHeap () returned 0x630000 [0051.090] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0051.090] GetProcessHeap () returned 0x630000 [0051.090] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0051.090] GetProcessHeap () returned 0x630000 [0051.090] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.090] GetProcessHeap () returned 0x630000 [0051.090] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.090] GetProcessHeap () returned 0x630000 [0051.090] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0051.090] GetProcessHeap () returned 0x630000 [0051.090] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.090] GetProcessHeap () returned 0x630000 [0051.090] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0051.090] GetProcessHeap () returned 0x630000 [0051.090] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0051.090] GetProcessHeap () returned 0x630000 [0051.090] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0051.090] GetProcessHeap () returned 0x630000 [0051.090] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0051.090] GetProcessHeap () returned 0x630000 [0051.090] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.090] GetProcessHeap () returned 0x630000 [0051.090] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.090] GetProcessHeap () returned 0x630000 [0051.090] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0051.090] GetProcessHeap () returned 0x630000 [0051.090] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0051.091] GetProcessHeap () returned 0x630000 [0051.091] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0051.091] GetProcessHeap () returned 0x630000 [0051.091] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0051.091] GetProcessHeap () returned 0x630000 [0051.091] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0051.091] GetProcessHeap () returned 0x630000 [0051.091] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0051.091] GetProcessHeap () returned 0x630000 [0051.091] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.091] GetProcessHeap () returned 0x630000 [0051.091] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.091] GetProcessHeap () returned 0x630000 [0051.091] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0051.091] GetProcessHeap () returned 0x630000 [0051.091] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0051.091] GetProcessHeap () returned 0x630000 [0051.091] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.091] GetProcessHeap () returned 0x630000 [0051.091] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.091] GetProcessHeap () returned 0x630000 [0051.091] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0051.091] GetProcessHeap () returned 0x630000 [0051.091] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0051.091] GetProcessHeap () returned 0x630000 [0051.091] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0051.091] GetProcessHeap () returned 0x630000 [0051.091] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0051.091] GetProcessHeap () returned 0x630000 [0051.091] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.091] GetProcessHeap () returned 0x630000 [0051.091] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.091] GetProcessHeap () returned 0x630000 [0051.091] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.091] GetProcessHeap () returned 0x630000 [0051.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.092] GetProcessHeap () returned 0x630000 [0051.092] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0051.092] GetProcessHeap () returned 0x630000 [0051.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0051.092] GetProcessHeap () returned 0x630000 [0051.092] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0051.092] GetProcessHeap () returned 0x630000 [0051.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0051.092] GetProcessHeap () returned 0x630000 [0051.092] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0051.092] GetProcessHeap () returned 0x630000 [0051.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.092] GetProcessHeap () returned 0x630000 [0051.092] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0051.092] GetProcessHeap () returned 0x630000 [0051.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0051.092] GetProcessHeap () returned 0x630000 [0051.092] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.092] GetProcessHeap () returned 0x630000 [0051.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.092] GetProcessHeap () returned 0x630000 [0051.092] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.092] GetProcessHeap () returned 0x630000 [0051.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.092] GetProcessHeap () returned 0x630000 [0051.092] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.092] GetProcessHeap () returned 0x630000 [0051.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.092] GetProcessHeap () returned 0x630000 [0051.092] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0051.092] GetProcessHeap () returned 0x630000 [0051.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0051.092] GetProcessHeap () returned 0x630000 [0051.092] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.093] GetProcessHeap () returned 0x630000 [0051.093] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.093] GetProcessHeap () returned 0x630000 [0051.093] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0051.093] GetProcessHeap () returned 0x630000 [0051.093] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0051.093] GetProcessHeap () returned 0x630000 [0051.093] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.093] GetProcessHeap () returned 0x630000 [0051.093] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.093] GetProcessHeap () returned 0x630000 [0051.093] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0051.093] GetProcessHeap () returned 0x630000 [0051.093] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0051.093] GetProcessHeap () returned 0x630000 [0051.093] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0051.093] GetProcessHeap () returned 0x630000 [0051.093] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0051.093] GetProcessHeap () returned 0x630000 [0051.093] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0051.093] GetProcessHeap () returned 0x630000 [0051.093] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0051.093] GetProcessHeap () returned 0x630000 [0051.093] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.093] GetProcessHeap () returned 0x630000 [0051.093] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.093] GetProcessHeap () returned 0x630000 [0051.093] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0051.093] GetProcessHeap () returned 0x630000 [0051.093] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0051.093] GetProcessHeap () returned 0x630000 [0051.093] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.093] GetProcessHeap () returned 0x630000 [0051.093] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.093] GetProcessHeap () returned 0x630000 [0051.094] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0051.094] GetProcessHeap () returned 0x630000 [0051.094] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.094] GetProcessHeap () returned 0x630000 [0051.094] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0051.094] GetProcessHeap () returned 0x630000 [0051.094] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0051.094] GetProcessHeap () returned 0x630000 [0051.094] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0051.094] GetProcessHeap () returned 0x630000 [0051.094] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0051.094] GetProcessHeap () returned 0x630000 [0051.094] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0051.094] GetProcessHeap () returned 0x630000 [0051.094] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0051.094] GetProcessHeap () returned 0x630000 [0051.094] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0051.094] GetProcessHeap () returned 0x630000 [0051.094] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6555c0 | out: hHeap=0x630000) returned 1 [0051.094] GetProcessHeap () returned 0x630000 [0051.094] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0051.094] GetProcessHeap () returned 0x630000 [0051.094] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655380 | out: hHeap=0x630000) returned 1 [0051.094] GetProcessHeap () returned 0x630000 [0051.094] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0051.094] GetProcessHeap () returned 0x630000 [0051.094] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.094] GetProcessHeap () returned 0x630000 [0051.094] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0051.094] WriteFile (in: hFile=0x230, lpBuffer=0x65ca60*, nNumberOfBytesToWrite=0x38f, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65ca60*, lpNumberOfBytesWritten=0x243d864*=0x38f, lpOverlapped=0x0) returned 1 [0051.098] GetProcessHeap () returned 0x630000 [0051.098] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65ca60, Size=0x30) returned 0x65ca60 [0051.098] GetProcessHeap () returned 0x630000 [0051.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0051.098] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.098] GetProcessHeap () returned 0x630000 [0051.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x250) returned 0x64cc78 [0051.098] ReadFile (in: hFile=0x230, lpBuffer=0x64cc78, nNumberOfBytesToRead=0x250, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x64cc78*, lpNumberOfBytesRead=0x243d7e8*=0x250, lpOverlapped=0x0) returned 1 [0051.098] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.099] WriteFile (in: hFile=0x230, lpBuffer=0x64cc78*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x64cc78*, lpNumberOfBytesWritten=0x243d7e4*=0x250, lpOverlapped=0x0) returned 1 [0051.099] GetProcessHeap () returned 0x630000 [0051.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0051.099] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0051.100] WriteFile (in: hFile=0x230, lpBuffer=0x65ca60*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65ca60*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0051.101] CloseHandle (hObject=0x230) returned 1 [0051.102] GetProcessHeap () returned 0x630000 [0051.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0051.102] GetProcessHeap () returned 0x630000 [0051.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0051.102] GetProcessHeap () returned 0x630000 [0051.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0051.102] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\PostOOBEScript.cmd" | out: lpString1="C:\\Windows10Upgrade\\PostOOBEScript.cmd") returned="C:\\Windows10Upgrade\\PostOOBEScript.cmd" [0051.102] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\PostOOBEScript.cmd", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\PostOOBEScript.cmd.happythreechoose") returned="C:\\Windows10Upgrade\\PostOOBEScript.cmd.happythreechoose" [0051.102] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\PostOOBEScript.cmd" (normalized: "c:\\windows10upgrade\\postoobescript.cmd"), lpNewFileName="C:\\Windows10Upgrade\\PostOOBEScript.cmd.happythreechoose" (normalized: "c:\\windows10upgrade\\postoobescript.cmd.happythreechoose"), dwFlags=0x1) returned 1 [0051.103] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\PostOOBEScript.cmd" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0051.103] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0051.103] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\Decryption INFO.html" [0051.103] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\decryption info.html")) returned 0x20 [0051.103] GetProcessHeap () returned 0x630000 [0051.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645e78 | out: hHeap=0x630000) returned 1 [0051.103] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b3c1b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3b3c1b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="resources", cAlternateFileName="RESOUR~1")) returned 1 [0051.103] lstrcmpiW (lpString1="resources", lpString2=".") returned 1 [0051.103] lstrcmpiW (lpString1="resources", lpString2="..") returned 1 [0051.103] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="resources" | out: lpString1="C:\\Windows10Upgrade\\resources") returned="C:\\Windows10Upgrade\\resources" [0051.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="resources", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0051.103] GetProcessHeap () returned 0x630000 [0051.103] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x64ca20 [0051.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="resources", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="resources", lpUsedDefaultChar=0x0) returned 10 [0051.103] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0051.103] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0051.103] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0051.103] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0051.103] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0051.103] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0051.103] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0051.103] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0051.103] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0051.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0051.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0051.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0051.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0051.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0051.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0051.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0051.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0051.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0051.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0051.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0051.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0051.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0051.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0051.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0051.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0051.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0051.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0051.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0051.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0051.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0051.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0051.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0051.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0051.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0051.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0051.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0051.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0051.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0051.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0051.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0051.105] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0051.105] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0051.105] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0051.105] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources", lpString2="\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\") returned="C:\\Windows10Upgrade\\resources\\" [0051.105] GetProcessHeap () returned 0x630000 [0051.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a338 [0051.105] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\") returned 30 [0051.105] GetProcessHeap () returned 0x630000 [0051.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3e) returned 0x642310 [0051.105] lstrcpyW (in: lpString1=0x642310, lpString2="C:\\Windows10Upgrade\\resources\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\") returned="C:\\Windows10Upgrade\\resources\\" [0051.105] GetProcessHeap () returned 0x630000 [0051.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0051.105] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea9ef415, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea9ef415, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x624407ed, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0x3d14a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="upgrader_default.log", cAlternateFileName="UPGRAD~1.LOG")) returned 1 [0051.105] lstrcmpiW (lpString1="upgrader_default.log", lpString2=".") returned 1 [0051.105] lstrcmpiW (lpString1="upgrader_default.log", lpString2="..") returned 1 [0051.105] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="upgrader_default.log" | out: lpString1="C:\\Windows10Upgrade\\upgrader_default.log") returned="C:\\Windows10Upgrade\\upgrader_default.log" [0051.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="upgrader_default.log", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0051.105] GetProcessHeap () returned 0x630000 [0051.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x15) returned 0x645d18 [0051.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="upgrader_default.log", cchWideChar=-1, lpMultiByteStr=0x645d18, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="upgrader_default.log", lpUsedDefaultChar=0x0) returned 21 [0051.105] lstrlenA (lpString="upgrader_default.log") returned 20 [0051.105] lstrlenA (lpString=".happythreechoose") returned 17 [0051.105] lstrlenA (lpString=".happythreechoose") returned 17 [0051.105] lstrlenA (lpString="upgrader_default.log") returned 20 [0051.105] lstrcmpiA (lpString1="rader_default.log", lpString2=".happythreechoose") returned 1 [0051.105] lstrcmpiW (lpString1="upgrader_default.log", lpString2="Decryption INFO.html") returned 1 [0051.105] lstrcmpiW (lpString1="upgrader_default.log", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0051.105] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0051.105] lstrcmpiW (lpString1="upgrader_default.log", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0051.105] GetProcessHeap () returned 0x630000 [0051.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0051.105] CreateFileW (lpFileName="C:\\Windows10Upgrade\\upgrader_default.log" (normalized: "c:\\windows10upgrade\\upgrader_default.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0051.106] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=250186) returned 1 [0051.106] GetProcessHeap () returned 0x630000 [0051.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x63e830 [0051.106] GetProcessHeap () returned 0x630000 [0051.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0051.107] lstrlenW (lpString="C:\\Windows10Upgrade\\upgrader_default.log") returned 40 [0051.107] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0051.107] GetProcessHeap () returned 0x630000 [0051.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0051.107] GetProcessHeap () returned 0x630000 [0051.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x386) returned 0x65ca98 [0051.107] lstrlenA (lpString="rsa_encrypt") returned 11 [0051.107] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0051.107] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0051.107] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0051.107] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0051.107] GetProcessHeap () returned 0x630000 [0051.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0051.107] lstrlenA (lpString="010001") returned 6 [0051.108] GetProcessHeap () returned 0x630000 [0051.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0051.108] GetProcessHeap () returned 0x630000 [0051.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0051.108] GetProcessHeap () returned 0x630000 [0051.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x6551d0 [0051.108] GetProcessHeap () returned 0x630000 [0051.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0051.108] GetProcessHeap () returned 0x630000 [0051.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655ec0 [0051.108] GetProcessHeap () returned 0x630000 [0051.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656fe0 [0051.108] GetProcessHeap () returned 0x630000 [0051.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a348 [0051.108] GetProcessHeap () returned 0x630000 [0051.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0051.108] GetProcessHeap () returned 0x630000 [0051.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.108] GetProcessHeap () returned 0x630000 [0051.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0051.108] GetProcessHeap () returned 0x630000 [0051.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0051.108] GetProcessHeap () returned 0x630000 [0051.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657210 [0051.108] GetProcessHeap () returned 0x630000 [0051.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0051.108] GetProcessHeap () returned 0x630000 [0051.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0051.108] GetProcessHeap () returned 0x630000 [0051.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655920 [0051.108] GetProcessHeap () returned 0x630000 [0051.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0051.108] GetProcessHeap () returned 0x630000 [0051.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0051.108] GetProcessHeap () returned 0x630000 [0051.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655920 | out: hHeap=0x630000) returned 1 [0051.109] GetProcessHeap () returned 0x630000 [0051.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.109] GetProcessHeap () returned 0x630000 [0051.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0051.109] GetProcessHeap () returned 0x630000 [0051.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0051.109] GetProcessHeap () returned 0x630000 [0051.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.109] GetProcessHeap () returned 0x630000 [0051.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.109] GetProcessHeap () returned 0x630000 [0051.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.109] GetProcessHeap () returned 0x630000 [0051.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x655890 [0051.109] GetProcessHeap () returned 0x630000 [0051.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0051.109] GetProcessHeap () returned 0x630000 [0051.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0051.109] GetProcessHeap () returned 0x630000 [0051.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655890 | out: hHeap=0x630000) returned 1 [0051.109] GetProcessHeap () returned 0x630000 [0051.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0051.109] GetProcessHeap () returned 0x630000 [0051.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0051.109] GetProcessHeap () returned 0x630000 [0051.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0051.109] GetProcessHeap () returned 0x630000 [0051.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0051.109] GetProcessHeap () returned 0x630000 [0051.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.109] GetProcessHeap () returned 0x630000 [0051.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.109] GetProcessHeap () returned 0x630000 [0051.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.109] GetProcessHeap () returned 0x630000 [0051.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.110] GetProcessHeap () returned 0x630000 [0051.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0051.110] GetProcessHeap () returned 0x630000 [0051.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.110] GetProcessHeap () returned 0x630000 [0051.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0051.110] GetProcessHeap () returned 0x630000 [0051.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0051.110] GetProcessHeap () returned 0x630000 [0051.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.110] GetProcessHeap () returned 0x630000 [0051.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.110] GetProcessHeap () returned 0x630000 [0051.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0051.110] GetProcessHeap () returned 0x630000 [0051.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0051.110] GetProcessHeap () returned 0x630000 [0051.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.110] GetProcessHeap () returned 0x630000 [0051.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.110] GetProcessHeap () returned 0x630000 [0051.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.110] GetProcessHeap () returned 0x630000 [0051.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.110] GetProcessHeap () returned 0x630000 [0051.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.110] GetProcessHeap () returned 0x630000 [0051.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.110] GetProcessHeap () returned 0x630000 [0051.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0051.110] GetProcessHeap () returned 0x630000 [0051.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.110] GetProcessHeap () returned 0x630000 [0051.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0051.110] GetProcessHeap () returned 0x630000 [0051.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0051.111] GetProcessHeap () returned 0x630000 [0051.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.111] GetProcessHeap () returned 0x630000 [0051.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.111] GetProcessHeap () returned 0x630000 [0051.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.111] GetProcessHeap () returned 0x630000 [0051.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.111] GetProcessHeap () returned 0x630000 [0051.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0051.111] GetProcessHeap () returned 0x630000 [0051.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0051.111] GetProcessHeap () returned 0x630000 [0051.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0051.111] GetProcessHeap () returned 0x630000 [0051.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.111] GetProcessHeap () returned 0x630000 [0051.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.111] GetProcessHeap () returned 0x630000 [0051.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.111] GetProcessHeap () returned 0x630000 [0051.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0051.111] GetProcessHeap () returned 0x630000 [0051.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0051.111] GetProcessHeap () returned 0x630000 [0051.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.111] GetProcessHeap () returned 0x630000 [0051.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.111] GetProcessHeap () returned 0x630000 [0051.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0051.111] GetProcessHeap () returned 0x630000 [0051.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0051.111] GetProcessHeap () returned 0x630000 [0051.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0051.112] GetProcessHeap () returned 0x630000 [0051.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.112] GetProcessHeap () returned 0x630000 [0051.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.112] GetProcessHeap () returned 0x630000 [0051.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.112] GetProcessHeap () returned 0x630000 [0051.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0051.112] GetProcessHeap () returned 0x630000 [0051.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0051.112] GetProcessHeap () returned 0x630000 [0051.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.112] GetProcessHeap () returned 0x630000 [0051.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.112] GetProcessHeap () returned 0x630000 [0051.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0051.112] GetProcessHeap () returned 0x630000 [0051.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.112] GetProcessHeap () returned 0x630000 [0051.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0051.112] GetProcessHeap () returned 0x630000 [0051.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0051.112] GetProcessHeap () returned 0x630000 [0051.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.112] GetProcessHeap () returned 0x630000 [0051.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.112] GetProcessHeap () returned 0x630000 [0051.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0051.112] GetProcessHeap () returned 0x630000 [0051.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0051.112] GetProcessHeap () returned 0x630000 [0051.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0051.112] GetProcessHeap () returned 0x630000 [0051.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0051.113] GetProcessHeap () returned 0x630000 [0051.113] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0051.113] GetProcessHeap () returned 0x630000 [0051.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0051.113] GetProcessHeap () returned 0x630000 [0051.113] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0051.113] GetProcessHeap () returned 0x630000 [0051.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0051.113] GetProcessHeap () returned 0x630000 [0051.113] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.113] GetProcessHeap () returned 0x630000 [0051.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.113] GetProcessHeap () returned 0x630000 [0051.113] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.113] GetProcessHeap () returned 0x630000 [0051.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.113] GetProcessHeap () returned 0x630000 [0051.113] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0051.113] GetProcessHeap () returned 0x630000 [0051.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0051.113] GetProcessHeap () returned 0x630000 [0051.113] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.113] GetProcessHeap () returned 0x630000 [0051.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.113] GetProcessHeap () returned 0x630000 [0051.113] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.113] GetProcessHeap () returned 0x630000 [0051.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.113] GetProcessHeap () returned 0x630000 [0051.113] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0051.113] GetProcessHeap () returned 0x630000 [0051.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0051.113] GetProcessHeap () returned 0x630000 [0051.113] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.113] GetProcessHeap () returned 0x630000 [0051.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.113] GetProcessHeap () returned 0x630000 [0051.114] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.114] GetProcessHeap () returned 0x630000 [0051.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.114] GetProcessHeap () returned 0x630000 [0051.114] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0051.114] GetProcessHeap () returned 0x630000 [0051.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0051.114] GetProcessHeap () returned 0x630000 [0051.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0051.114] GetProcessHeap () returned 0x630000 [0051.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0051.114] GetProcessHeap () returned 0x630000 [0051.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0051.114] GetProcessHeap () returned 0x630000 [0051.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0051.114] GetProcessHeap () returned 0x630000 [0051.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0051.114] GetProcessHeap () returned 0x630000 [0051.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655ec0 | out: hHeap=0x630000) returned 1 [0051.114] GetProcessHeap () returned 0x630000 [0051.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0051.114] GetProcessHeap () returned 0x630000 [0051.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6551d0 | out: hHeap=0x630000) returned 1 [0051.114] GetProcessHeap () returned 0x630000 [0051.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0051.114] GetProcessHeap () returned 0x630000 [0051.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.114] GetProcessHeap () returned 0x630000 [0051.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0051.114] WriteFile (in: hFile=0x230, lpBuffer=0x65ca98*, nNumberOfBytesToWrite=0x386, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65ca98*, lpNumberOfBytesWritten=0x243d864*=0x386, lpOverlapped=0x0) returned 1 [0051.118] GetProcessHeap () returned 0x630000 [0051.118] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65ca98, Size=0x30) returned 0x65ca98 [0051.119] GetProcessHeap () returned 0x630000 [0051.119] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0051.119] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.119] GetProcessHeap () returned 0x630000 [0051.119] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3d150) returned 0x65cad0 [0051.122] ReadFile (in: hFile=0x230, lpBuffer=0x65cad0, nNumberOfBytesToRead=0x3d150, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65cad0*, lpNumberOfBytesRead=0x243d7e8*=0x3d150, lpOverlapped=0x0) returned 1 [0051.126] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.126] WriteFile (in: hFile=0x230, lpBuffer=0x65cad0*, nNumberOfBytesToWrite=0x3d150, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65cad0*, lpNumberOfBytesWritten=0x243d7e4*=0x3d150, lpOverlapped=0x0) returned 1 [0051.154] GetProcessHeap () returned 0x630000 [0051.154] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cad0 | out: hHeap=0x630000) returned 1 [0051.154] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0051.155] WriteFile (in: hFile=0x230, lpBuffer=0x65ca98*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65ca98*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0051.156] CloseHandle (hObject=0x230) returned 1 [0051.161] GetProcessHeap () returned 0x630000 [0051.161] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0051.161] GetProcessHeap () returned 0x630000 [0051.161] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0051.161] GetProcessHeap () returned 0x630000 [0051.161] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0051.161] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\upgrader_default.log" | out: lpString1="C:\\Windows10Upgrade\\upgrader_default.log") returned="C:\\Windows10Upgrade\\upgrader_default.log" [0051.161] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\upgrader_default.log", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\upgrader_default.log.happythreechoose") returned="C:\\Windows10Upgrade\\upgrader_default.log.happythreechoose" [0051.161] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\upgrader_default.log" (normalized: "c:\\windows10upgrade\\upgrader_default.log"), lpNewFileName="C:\\Windows10Upgrade\\upgrader_default.log.happythreechoose" (normalized: "c:\\windows10upgrade\\upgrader_default.log.happythreechoose"), dwFlags=0x1) returned 1 [0051.162] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\upgrader_default.log" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0051.162] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0051.162] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\Decryption INFO.html" [0051.162] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\decryption info.html")) returned 0x20 [0051.162] GetProcessHeap () returned 0x630000 [0051.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645d18 | out: hHeap=0x630000) returned 1 [0051.162] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccdc86a8, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x32fe02cc, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x5044, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="upgrader_win10.log", cAlternateFileName="UPGRAD~2.LOG")) returned 1 [0051.162] lstrcmpiW (lpString1="upgrader_win10.log", lpString2=".") returned 1 [0051.162] lstrcmpiW (lpString1="upgrader_win10.log", lpString2="..") returned 1 [0051.162] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="upgrader_win10.log" | out: lpString1="C:\\Windows10Upgrade\\upgrader_win10.log") returned="C:\\Windows10Upgrade\\upgrader_win10.log" [0051.162] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="upgrader_win10.log", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0051.162] GetProcessHeap () returned 0x630000 [0051.162] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x13) returned 0x645f98 [0051.162] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="upgrader_win10.log", cchWideChar=-1, lpMultiByteStr=0x645f98, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="upgrader_win10.log", lpUsedDefaultChar=0x0) returned 19 [0051.162] lstrlenA (lpString="upgrader_win10.log") returned 18 [0051.162] lstrlenA (lpString=".happythreechoose") returned 17 [0051.162] lstrlenA (lpString=".happythreechoose") returned 17 [0051.162] lstrlenA (lpString="upgrader_win10.log") returned 18 [0051.162] lstrcmpiA (lpString1="pgrader_win10.log", lpString2=".happythreechoose") returned 1 [0051.162] lstrcmpiW (lpString1="upgrader_win10.log", lpString2="Decryption INFO.html") returned 1 [0051.162] lstrcmpiW (lpString1="upgrader_win10.log", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0051.162] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0051.162] lstrcmpiW (lpString1="upgrader_win10.log", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0051.162] GetProcessHeap () returned 0x630000 [0051.162] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0051.162] CreateFileW (lpFileName="C:\\Windows10Upgrade\\upgrader_win10.log" (normalized: "c:\\windows10upgrade\\upgrader_win10.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0051.163] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=20548) returned 1 [0051.163] GetProcessHeap () returned 0x630000 [0051.163] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x63e830 [0051.163] GetProcessHeap () returned 0x630000 [0051.163] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0051.163] lstrlenW (lpString="C:\\Windows10Upgrade\\upgrader_win10.log") returned 38 [0051.163] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0051.163] GetProcessHeap () returned 0x630000 [0051.163] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0051.164] GetProcessHeap () returned 0x630000 [0051.164] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38c) returned 0x65cad0 [0051.164] lstrlenA (lpString="rsa_encrypt") returned 11 [0051.164] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0051.164] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0051.164] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0051.164] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0051.164] GetProcessHeap () returned 0x630000 [0051.164] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0051.164] lstrlenA (lpString="010001") returned 6 [0051.164] GetProcessHeap () returned 0x630000 [0051.164] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a308 [0051.164] GetProcessHeap () returned 0x630000 [0051.165] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0051.165] GetProcessHeap () returned 0x630000 [0051.165] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655ec0 [0051.165] GetProcessHeap () returned 0x630000 [0051.165] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0051.165] GetProcessHeap () returned 0x630000 [0051.165] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655800 [0051.165] GetProcessHeap () returned 0x630000 [0051.165] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657788 [0051.165] GetProcessHeap () returned 0x630000 [0051.165] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a328 [0051.165] GetProcessHeap () returned 0x630000 [0051.165] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0051.165] GetProcessHeap () returned 0x630000 [0051.165] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.165] GetProcessHeap () returned 0x630000 [0051.165] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0051.165] GetProcessHeap () returned 0x630000 [0051.165] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0051.165] GetProcessHeap () returned 0x630000 [0051.165] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656950 [0051.165] GetProcessHeap () returned 0x630000 [0051.165] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.165] GetProcessHeap () returned 0x630000 [0051.165] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0051.165] GetProcessHeap () returned 0x630000 [0051.165] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655b60 [0051.165] GetProcessHeap () returned 0x630000 [0051.165] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0051.165] GetProcessHeap () returned 0x630000 [0051.165] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0051.165] GetProcessHeap () returned 0x630000 [0051.165] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655b60 | out: hHeap=0x630000) returned 1 [0051.165] GetProcessHeap () returned 0x630000 [0051.165] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.165] GetProcessHeap () returned 0x630000 [0051.165] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0051.166] GetProcessHeap () returned 0x630000 [0051.166] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.166] GetProcessHeap () returned 0x630000 [0051.166] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.166] GetProcessHeap () returned 0x630000 [0051.166] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0051.166] GetProcessHeap () returned 0x630000 [0051.166] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0051.166] GetProcessHeap () returned 0x630000 [0051.166] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x655410 [0051.166] GetProcessHeap () returned 0x630000 [0051.166] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0051.166] GetProcessHeap () returned 0x630000 [0051.166] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0051.166] GetProcessHeap () returned 0x630000 [0051.166] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655410 | out: hHeap=0x630000) returned 1 [0051.166] GetProcessHeap () returned 0x630000 [0051.166] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.166] GetProcessHeap () returned 0x630000 [0051.166] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.166] GetProcessHeap () returned 0x630000 [0051.166] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.166] GetProcessHeap () returned 0x630000 [0051.166] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.166] GetProcessHeap () returned 0x630000 [0051.166] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0051.166] GetProcessHeap () returned 0x630000 [0051.166] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0051.166] GetProcessHeap () returned 0x630000 [0051.166] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0051.166] GetProcessHeap () returned 0x630000 [0051.166] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0051.166] GetProcessHeap () returned 0x630000 [0051.166] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0051.166] GetProcessHeap () returned 0x630000 [0051.167] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0051.167] GetProcessHeap () returned 0x630000 [0051.167] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.167] GetProcessHeap () returned 0x630000 [0051.167] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.167] GetProcessHeap () returned 0x630000 [0051.167] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.167] GetProcessHeap () returned 0x630000 [0051.167] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.167] GetProcessHeap () returned 0x630000 [0051.167] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0051.167] GetProcessHeap () returned 0x630000 [0051.167] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0051.167] GetProcessHeap () returned 0x630000 [0051.167] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.167] GetProcessHeap () returned 0x630000 [0051.167] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.167] GetProcessHeap () returned 0x630000 [0051.167] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0051.167] GetProcessHeap () returned 0x630000 [0051.167] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0051.167] GetProcessHeap () returned 0x630000 [0051.167] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0051.167] GetProcessHeap () returned 0x630000 [0051.167] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.167] GetProcessHeap () returned 0x630000 [0051.167] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0051.167] GetProcessHeap () returned 0x630000 [0051.167] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0051.167] GetProcessHeap () returned 0x630000 [0051.167] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0051.167] GetProcessHeap () returned 0x630000 [0051.167] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0051.167] GetProcessHeap () returned 0x630000 [0051.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0051.168] GetProcessHeap () returned 0x630000 [0051.168] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.168] GetProcessHeap () returned 0x630000 [0051.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.168] GetProcessHeap () returned 0x630000 [0051.168] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.168] GetProcessHeap () returned 0x630000 [0051.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.168] GetProcessHeap () returned 0x630000 [0051.168] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.168] GetProcessHeap () returned 0x630000 [0051.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.168] GetProcessHeap () returned 0x630000 [0051.168] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.168] GetProcessHeap () returned 0x630000 [0051.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.168] GetProcessHeap () returned 0x630000 [0051.168] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.168] GetProcessHeap () returned 0x630000 [0051.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0051.168] GetProcessHeap () returned 0x630000 [0051.168] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0051.168] GetProcessHeap () returned 0x630000 [0051.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.168] GetProcessHeap () returned 0x630000 [0051.168] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.168] GetProcessHeap () returned 0x630000 [0051.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0051.168] GetProcessHeap () returned 0x630000 [0051.168] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0051.168] GetProcessHeap () returned 0x630000 [0051.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0051.168] GetProcessHeap () returned 0x630000 [0051.168] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0051.169] GetProcessHeap () returned 0x630000 [0051.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.169] GetProcessHeap () returned 0x630000 [0051.169] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.169] GetProcessHeap () returned 0x630000 [0051.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0051.169] GetProcessHeap () returned 0x630000 [0051.169] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0051.169] GetProcessHeap () returned 0x630000 [0051.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0051.169] GetProcessHeap () returned 0x630000 [0051.169] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0051.169] GetProcessHeap () returned 0x630000 [0051.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.169] GetProcessHeap () returned 0x630000 [0051.169] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.169] GetProcessHeap () returned 0x630000 [0051.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.169] GetProcessHeap () returned 0x630000 [0051.169] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.169] GetProcessHeap () returned 0x630000 [0051.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0051.169] GetProcessHeap () returned 0x630000 [0051.169] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0051.169] GetProcessHeap () returned 0x630000 [0051.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0051.169] GetProcessHeap () returned 0x630000 [0051.169] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0051.169] GetProcessHeap () returned 0x630000 [0051.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0051.169] GetProcessHeap () returned 0x630000 [0051.169] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0051.169] GetProcessHeap () returned 0x630000 [0051.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0051.169] GetProcessHeap () returned 0x630000 [0051.169] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0051.170] GetProcessHeap () returned 0x630000 [0051.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.170] GetProcessHeap () returned 0x630000 [0051.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.170] GetProcessHeap () returned 0x630000 [0051.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0051.170] GetProcessHeap () returned 0x630000 [0051.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0051.170] GetProcessHeap () returned 0x630000 [0051.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.170] GetProcessHeap () returned 0x630000 [0051.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.170] GetProcessHeap () returned 0x630000 [0051.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.170] GetProcessHeap () returned 0x630000 [0051.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.170] GetProcessHeap () returned 0x630000 [0051.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0051.170] GetProcessHeap () returned 0x630000 [0051.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0051.170] GetProcessHeap () returned 0x630000 [0051.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.170] GetProcessHeap () returned 0x630000 [0051.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.170] GetProcessHeap () returned 0x630000 [0051.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.170] GetProcessHeap () returned 0x630000 [0051.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.170] GetProcessHeap () returned 0x630000 [0051.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.170] GetProcessHeap () returned 0x630000 [0051.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.170] GetProcessHeap () returned 0x630000 [0051.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0051.170] GetProcessHeap () returned 0x630000 [0051.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0051.171] GetProcessHeap () returned 0x630000 [0051.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.171] GetProcessHeap () returned 0x630000 [0051.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.171] GetProcessHeap () returned 0x630000 [0051.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0051.171] GetProcessHeap () returned 0x630000 [0051.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0051.171] GetProcessHeap () returned 0x630000 [0051.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0051.171] GetProcessHeap () returned 0x630000 [0051.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0051.171] GetProcessHeap () returned 0x630000 [0051.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0051.171] GetProcessHeap () returned 0x630000 [0051.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655800 | out: hHeap=0x630000) returned 1 [0051.171] GetProcessHeap () returned 0x630000 [0051.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0051.171] GetProcessHeap () returned 0x630000 [0051.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655ec0 | out: hHeap=0x630000) returned 1 [0051.171] GetProcessHeap () returned 0x630000 [0051.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0051.171] GetProcessHeap () returned 0x630000 [0051.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.171] GetProcessHeap () returned 0x630000 [0051.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0051.171] WriteFile (in: hFile=0x230, lpBuffer=0x65cad0*, nNumberOfBytesToWrite=0x38c, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65cad0*, lpNumberOfBytesWritten=0x243d864*=0x38c, lpOverlapped=0x0) returned 1 [0051.175] GetProcessHeap () returned 0x630000 [0051.175] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65cad0, Size=0x30) returned 0x65cad0 [0051.175] GetProcessHeap () returned 0x630000 [0051.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0051.175] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.175] GetProcessHeap () returned 0x630000 [0051.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5050) returned 0x65cb08 [0051.175] ReadFile (in: hFile=0x230, lpBuffer=0x65cb08, nNumberOfBytesToRead=0x5050, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65cb08*, lpNumberOfBytesRead=0x243d7e8*=0x5050, lpOverlapped=0x0) returned 1 [0051.176] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.176] WriteFile (in: hFile=0x230, lpBuffer=0x65cb08*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65cb08*, lpNumberOfBytesWritten=0x243d7e4*=0x5050, lpOverlapped=0x0) returned 1 [0051.178] GetProcessHeap () returned 0x630000 [0051.178] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cb08 | out: hHeap=0x630000) returned 1 [0051.180] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0051.180] WriteFile (in: hFile=0x230, lpBuffer=0x65cad0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65cad0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0051.182] CloseHandle (hObject=0x230) returned 1 [0051.183] GetProcessHeap () returned 0x630000 [0051.183] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0051.183] GetProcessHeap () returned 0x630000 [0051.183] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0051.183] GetProcessHeap () returned 0x630000 [0051.183] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0051.183] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\upgrader_win10.log" | out: lpString1="C:\\Windows10Upgrade\\upgrader_win10.log") returned="C:\\Windows10Upgrade\\upgrader_win10.log" [0051.183] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\upgrader_win10.log", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\upgrader_win10.log.happythreechoose") returned="C:\\Windows10Upgrade\\upgrader_win10.log.happythreechoose" [0051.183] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\upgrader_win10.log" (normalized: "c:\\windows10upgrade\\upgrader_win10.log"), lpNewFileName="C:\\Windows10Upgrade\\upgrader_win10.log.happythreechoose" (normalized: "c:\\windows10upgrade\\upgrader_win10.log.happythreechoose"), dwFlags=0x1) returned 1 [0051.184] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\upgrader_win10.log" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0051.184] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0051.184] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\Decryption INFO.html" [0051.184] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\decryption info.html")) returned 0x20 [0051.184] GetProcessHeap () returned 0x630000 [0051.184] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645f98 | out: hHeap=0x630000) returned 1 [0051.184] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea63f06a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63f06a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x880c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wimgapi.dll", cAlternateFileName="")) returned 1 [0051.184] lstrcmpiW (lpString1="wimgapi.dll", lpString2=".") returned 1 [0051.184] lstrcmpiW (lpString1="wimgapi.dll", lpString2="..") returned 1 [0051.184] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="wimgapi.dll" | out: lpString1="C:\\Windows10Upgrade\\wimgapi.dll") returned="C:\\Windows10Upgrade\\wimgapi.dll" [0051.184] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wimgapi.dll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0051.184] GetProcessHeap () returned 0x630000 [0051.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0051.184] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wimgapi.dll", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wimgapi.dll", lpUsedDefaultChar=0x0) returned 12 [0051.184] lstrlenA (lpString="wimgapi.dll") returned 11 [0051.184] lstrlenA (lpString=".happythreechoose") returned 17 [0051.184] lstrcmpiW (lpString1="wimgapi.dll", lpString2="Decryption INFO.html") returned 1 [0051.185] lstrcmpiW (lpString1="wimgapi.dll", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0051.185] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0051.185] lstrcmpiW (lpString1="wimgapi.dll", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0051.185] GetProcessHeap () returned 0x630000 [0051.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0051.185] CreateFileW (lpFileName="C:\\Windows10Upgrade\\wimgapi.dll" (normalized: "c:\\windows10upgrade\\wimgapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0051.186] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=557256) returned 1 [0051.186] GetProcessHeap () returned 0x630000 [0051.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x63e830 [0051.186] GetProcessHeap () returned 0x630000 [0051.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0051.186] lstrlenW (lpString="C:\\Windows10Upgrade\\wimgapi.dll") returned 31 [0051.186] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0051.186] GetProcessHeap () returned 0x630000 [0051.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0051.186] GetProcessHeap () returned 0x630000 [0051.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x388) returned 0x65cb08 [0051.187] lstrlenA (lpString="rsa_encrypt") returned 11 [0051.187] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0051.188] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0051.188] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0051.188] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0051.188] GetProcessHeap () returned 0x630000 [0051.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0051.188] lstrlenA (lpString="010001") returned 6 [0051.188] GetProcessHeap () returned 0x630000 [0051.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3c8 [0051.188] GetProcessHeap () returned 0x630000 [0051.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0051.188] GetProcessHeap () returned 0x630000 [0051.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x656070 [0051.188] GetProcessHeap () returned 0x630000 [0051.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0051.188] GetProcessHeap () returned 0x630000 [0051.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655f50 [0051.188] GetProcessHeap () returned 0x630000 [0051.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657670 [0051.188] GetProcessHeap () returned 0x630000 [0051.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a308 [0051.188] GetProcessHeap () returned 0x630000 [0051.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0051.188] GetProcessHeap () returned 0x630000 [0051.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.188] GetProcessHeap () returned 0x630000 [0051.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0051.188] GetProcessHeap () returned 0x630000 [0051.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0051.188] GetProcessHeap () returned 0x630000 [0051.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656a68 [0051.188] GetProcessHeap () returned 0x630000 [0051.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0051.189] GetProcessHeap () returned 0x630000 [0051.189] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0051.189] GetProcessHeap () returned 0x630000 [0051.189] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x6555c0 [0051.189] GetProcessHeap () returned 0x630000 [0051.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0051.189] GetProcessHeap () returned 0x630000 [0051.189] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0051.189] GetProcessHeap () returned 0x630000 [0051.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6555c0 | out: hHeap=0x630000) returned 1 [0051.189] GetProcessHeap () returned 0x630000 [0051.189] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.189] GetProcessHeap () returned 0x630000 [0051.189] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65b0c8 [0051.189] GetProcessHeap () returned 0x630000 [0051.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.189] GetProcessHeap () returned 0x630000 [0051.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.189] GetProcessHeap () returned 0x630000 [0051.189] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0051.189] GetProcessHeap () returned 0x630000 [0051.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0051.189] GetProcessHeap () returned 0x630000 [0051.189] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x655140 [0051.189] GetProcessHeap () returned 0x630000 [0051.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b0c8 | out: hHeap=0x630000) returned 1 [0051.189] GetProcessHeap () returned 0x630000 [0051.189] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0051.189] GetProcessHeap () returned 0x630000 [0051.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655140 | out: hHeap=0x630000) returned 1 [0051.189] GetProcessHeap () returned 0x630000 [0051.189] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0051.189] GetProcessHeap () returned 0x630000 [0051.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0051.189] GetProcessHeap () returned 0x630000 [0051.189] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.190] GetProcessHeap () returned 0x630000 [0051.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.190] GetProcessHeap () returned 0x630000 [0051.190] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.190] GetProcessHeap () returned 0x630000 [0051.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.190] GetProcessHeap () returned 0x630000 [0051.190] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.190] GetProcessHeap () returned 0x630000 [0051.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.190] GetProcessHeap () returned 0x630000 [0051.190] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0051.190] GetProcessHeap () returned 0x630000 [0051.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.190] GetProcessHeap () returned 0x630000 [0051.190] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0051.190] GetProcessHeap () returned 0x630000 [0051.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0051.190] GetProcessHeap () returned 0x630000 [0051.190] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.190] GetProcessHeap () returned 0x630000 [0051.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.190] GetProcessHeap () returned 0x630000 [0051.190] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.190] GetProcessHeap () returned 0x630000 [0051.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.190] GetProcessHeap () returned 0x630000 [0051.190] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.190] GetProcessHeap () returned 0x630000 [0051.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.190] GetProcessHeap () returned 0x630000 [0051.190] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.190] GetProcessHeap () returned 0x630000 [0051.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.191] GetProcessHeap () returned 0x630000 [0051.191] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0051.191] GetProcessHeap () returned 0x630000 [0051.191] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.191] GetProcessHeap () returned 0x630000 [0051.191] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0051.191] GetProcessHeap () returned 0x630000 [0051.191] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0051.191] GetProcessHeap () returned 0x630000 [0051.191] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0051.191] GetProcessHeap () returned 0x630000 [0051.191] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0051.191] GetProcessHeap () returned 0x630000 [0051.191] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.191] GetProcessHeap () returned 0x630000 [0051.191] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.191] GetProcessHeap () returned 0x630000 [0051.191] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.191] GetProcessHeap () returned 0x630000 [0051.191] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.191] GetProcessHeap () returned 0x630000 [0051.191] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0051.191] GetProcessHeap () returned 0x630000 [0051.191] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0051.191] GetProcessHeap () returned 0x630000 [0051.191] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0051.191] GetProcessHeap () returned 0x630000 [0051.191] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0051.191] GetProcessHeap () returned 0x630000 [0051.191] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0051.191] GetProcessHeap () returned 0x630000 [0051.191] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0051.191] GetProcessHeap () returned 0x630000 [0051.191] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.191] GetProcessHeap () returned 0x630000 [0051.192] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.192] GetProcessHeap () returned 0x630000 [0051.192] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0051.192] GetProcessHeap () returned 0x630000 [0051.192] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0051.192] GetProcessHeap () returned 0x630000 [0051.192] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.192] GetProcessHeap () returned 0x630000 [0051.192] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.192] GetProcessHeap () returned 0x630000 [0051.192] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.192] GetProcessHeap () returned 0x630000 [0051.192] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.192] GetProcessHeap () returned 0x630000 [0051.192] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.192] GetProcessHeap () returned 0x630000 [0051.192] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.192] GetProcessHeap () returned 0x630000 [0051.192] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0051.192] GetProcessHeap () returned 0x630000 [0051.192] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0051.192] GetProcessHeap () returned 0x630000 [0051.192] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0051.192] GetProcessHeap () returned 0x630000 [0051.192] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0051.192] GetProcessHeap () returned 0x630000 [0051.192] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0051.192] GetProcessHeap () returned 0x630000 [0051.192] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0051.192] GetProcessHeap () returned 0x630000 [0051.192] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.192] GetProcessHeap () returned 0x630000 [0051.192] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.192] GetProcessHeap () returned 0x630000 [0051.193] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.193] GetProcessHeap () returned 0x630000 [0051.193] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.193] GetProcessHeap () returned 0x630000 [0051.193] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0051.193] GetProcessHeap () returned 0x630000 [0051.193] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0051.193] GetProcessHeap () returned 0x630000 [0051.193] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.193] GetProcessHeap () returned 0x630000 [0051.193] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.193] GetProcessHeap () returned 0x630000 [0051.193] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0051.193] GetProcessHeap () returned 0x630000 [0051.193] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0051.193] GetProcessHeap () returned 0x630000 [0051.193] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0051.193] GetProcessHeap () returned 0x630000 [0051.193] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0051.193] GetProcessHeap () returned 0x630000 [0051.193] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.193] GetProcessHeap () returned 0x630000 [0051.193] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.193] GetProcessHeap () returned 0x630000 [0051.193] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.193] GetProcessHeap () returned 0x630000 [0051.193] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.193] GetProcessHeap () returned 0x630000 [0051.193] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.193] GetProcessHeap () returned 0x630000 [0051.193] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.193] GetProcessHeap () returned 0x630000 [0051.193] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.193] GetProcessHeap () returned 0x630000 [0051.193] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.193] GetProcessHeap () returned 0x630000 [0051.194] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.194] GetProcessHeap () returned 0x630000 [0051.194] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.194] GetProcessHeap () returned 0x630000 [0051.194] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0051.194] GetProcessHeap () returned 0x630000 [0051.194] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0051.194] GetProcessHeap () returned 0x630000 [0051.194] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.194] GetProcessHeap () returned 0x630000 [0051.194] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.194] GetProcessHeap () returned 0x630000 [0051.194] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.194] GetProcessHeap () returned 0x630000 [0051.194] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.194] GetProcessHeap () returned 0x630000 [0051.194] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.195] GetProcessHeap () returned 0x630000 [0051.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.195] GetProcessHeap () returned 0x630000 [0051.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0051.195] GetProcessHeap () returned 0x630000 [0051.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0051.195] GetProcessHeap () returned 0x630000 [0051.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0051.195] GetProcessHeap () returned 0x630000 [0051.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0051.195] GetProcessHeap () returned 0x630000 [0051.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0051.195] GetProcessHeap () returned 0x630000 [0051.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655f50 | out: hHeap=0x630000) returned 1 [0051.195] GetProcessHeap () returned 0x630000 [0051.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0051.195] GetProcessHeap () returned 0x630000 [0051.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656070 | out: hHeap=0x630000) returned 1 [0051.195] GetProcessHeap () returned 0x630000 [0051.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0051.195] GetProcessHeap () returned 0x630000 [0051.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0051.195] GetProcessHeap () returned 0x630000 [0051.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0051.195] WriteFile (in: hFile=0x230, lpBuffer=0x65cb08*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65cb08*, lpNumberOfBytesWritten=0x243d864*=0x388, lpOverlapped=0x0) returned 1 [0051.205] GetProcessHeap () returned 0x630000 [0051.205] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65cb08, Size=0x30) returned 0x65cb08 [0051.205] GetProcessHeap () returned 0x630000 [0051.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0051.205] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.205] GetProcessHeap () returned 0x630000 [0051.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x880d0) returned 0x1f34020 [0051.215] ReadFile (in: hFile=0x230, lpBuffer=0x1f34020, nNumberOfBytesToRead=0x880d0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x1f34020*, lpNumberOfBytesRead=0x243d7e8*=0x880d0, lpOverlapped=0x0) returned 1 [0051.223] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.223] WriteFile (in: hFile=0x230, lpBuffer=0x1f34020*, nNumberOfBytesToWrite=0x880d0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x1f34020*, lpNumberOfBytesWritten=0x243d7e4*=0x880d0, lpOverlapped=0x0) returned 1 [0051.252] GetProcessHeap () returned 0x630000 [0051.252] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x1f34020 | out: hHeap=0x630000) returned 1 [0051.255] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0051.255] WriteFile (in: hFile=0x230, lpBuffer=0x65cb08*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65cb08*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0051.257] CloseHandle (hObject=0x230) returned 1 [0051.267] GetProcessHeap () returned 0x630000 [0051.267] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0051.267] GetProcessHeap () returned 0x630000 [0051.267] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0051.267] GetProcessHeap () returned 0x630000 [0051.267] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0051.267] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\wimgapi.dll" | out: lpString1="C:\\Windows10Upgrade\\wimgapi.dll") returned="C:\\Windows10Upgrade\\wimgapi.dll" [0051.267] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\wimgapi.dll", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\wimgapi.dll.happythreechoose") returned="C:\\Windows10Upgrade\\wimgapi.dll.happythreechoose" [0051.267] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\wimgapi.dll" (normalized: "c:\\windows10upgrade\\wimgapi.dll"), lpNewFileName="C:\\Windows10Upgrade\\wimgapi.dll.happythreechoose" (normalized: "c:\\windows10upgrade\\wimgapi.dll.happythreechoose"), dwFlags=0x1) returned 1 [0051.268] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\wimgapi.dll" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0051.268] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0051.268] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\Decryption INFO.html" [0051.268] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\decryption info.html")) returned 0x20 [0051.268] GetProcessHeap () returned 0x630000 [0051.268] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0051.268] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea642af3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea642af3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xdf8c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="windlp.dll", cAlternateFileName="")) returned 1 [0051.268] lstrcmpiW (lpString1="windlp.dll", lpString2=".") returned 1 [0051.268] lstrcmpiW (lpString1="windlp.dll", lpString2="..") returned 1 [0051.268] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="windlp.dll" | out: lpString1="C:\\Windows10Upgrade\\windlp.dll") returned="C:\\Windows10Upgrade\\windlp.dll" [0051.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windlp.dll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0051.268] GetProcessHeap () returned 0x630000 [0051.268] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb) returned 0x64c9f0 [0051.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windlp.dll", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windlp.dll", lpUsedDefaultChar=0x0) returned 11 [0051.268] lstrlenA (lpString="windlp.dll") returned 10 [0051.268] lstrlenA (lpString=".happythreechoose") returned 17 [0051.268] lstrcmpiW (lpString1="windlp.dll", lpString2="Decryption INFO.html") returned 1 [0051.269] lstrcmpiW (lpString1="windlp.dll", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0051.269] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0051.269] lstrcmpiW (lpString1="windlp.dll", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0051.269] GetProcessHeap () returned 0x630000 [0051.269] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0051.269] CreateFileW (lpFileName="C:\\Windows10Upgrade\\windlp.dll" (normalized: "c:\\windows10upgrade\\windlp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0051.269] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=915656) returned 1 [0051.269] GetProcessHeap () returned 0x630000 [0051.269] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x63e830 [0051.269] GetProcessHeap () returned 0x630000 [0051.269] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0051.269] lstrlenW (lpString="C:\\Windows10Upgrade\\windlp.dll") returned 30 [0051.269] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0051.269] GetProcessHeap () returned 0x630000 [0051.269] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0051.269] GetProcessHeap () returned 0x630000 [0051.269] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x65cb40 [0051.269] lstrlenA (lpString="rsa_encrypt") returned 11 [0051.269] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0051.270] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0051.270] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0051.270] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0051.270] GetProcessHeap () returned 0x630000 [0051.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0051.270] lstrlenA (lpString="010001") returned 6 [0051.270] GetProcessHeap () returned 0x630000 [0051.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a368 [0051.270] GetProcessHeap () returned 0x630000 [0051.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0051.270] GetProcessHeap () returned 0x630000 [0051.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655890 [0051.270] GetProcessHeap () returned 0x630000 [0051.270] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0051.270] GetProcessHeap () returned 0x630000 [0051.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655800 [0051.270] GetProcessHeap () returned 0x630000 [0051.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657440 [0051.270] GetProcessHeap () returned 0x630000 [0051.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a328 [0051.270] GetProcessHeap () returned 0x630000 [0051.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0051.271] GetProcessHeap () returned 0x630000 [0051.271] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.271] GetProcessHeap () returned 0x630000 [0051.271] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0051.271] GetProcessHeap () returned 0x630000 [0051.271] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0051.271] GetProcessHeap () returned 0x630000 [0051.271] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656db0 [0051.271] GetProcessHeap () returned 0x630000 [0051.271] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0051.271] GetProcessHeap () returned 0x630000 [0051.271] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0051.271] GetProcessHeap () returned 0x630000 [0051.271] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655920 [0051.271] GetProcessHeap () returned 0x630000 [0051.271] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0051.271] GetProcessHeap () returned 0x630000 [0051.271] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0051.271] GetProcessHeap () returned 0x630000 [0051.271] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655920 | out: hHeap=0x630000) returned 1 [0051.271] GetProcessHeap () returned 0x630000 [0051.271] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.271] GetProcessHeap () returned 0x630000 [0051.271] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65b308 [0051.271] GetProcessHeap () returned 0x630000 [0051.271] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0051.271] GetProcessHeap () returned 0x630000 [0051.271] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.271] GetProcessHeap () returned 0x630000 [0051.271] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.271] GetProcessHeap () returned 0x630000 [0051.271] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.271] GetProcessHeap () returned 0x630000 [0051.271] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x6555c0 [0051.271] GetProcessHeap () returned 0x630000 [0051.271] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b308 | out: hHeap=0x630000) returned 1 [0051.271] GetProcessHeap () returned 0x630000 [0051.271] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0051.271] GetProcessHeap () returned 0x630000 [0051.271] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6555c0 | out: hHeap=0x630000) returned 1 [0051.272] GetProcessHeap () returned 0x630000 [0051.272] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.272] GetProcessHeap () returned 0x630000 [0051.272] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.272] GetProcessHeap () returned 0x630000 [0051.272] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.272] GetProcessHeap () returned 0x630000 [0051.272] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.272] GetProcessHeap () returned 0x630000 [0051.272] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0051.272] GetProcessHeap () returned 0x630000 [0051.272] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0051.272] GetProcessHeap () returned 0x630000 [0051.272] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0051.272] GetProcessHeap () returned 0x630000 [0051.272] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0051.272] GetProcessHeap () returned 0x630000 [0051.272] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.272] GetProcessHeap () returned 0x630000 [0051.272] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.272] GetProcessHeap () returned 0x630000 [0051.272] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.272] GetProcessHeap () returned 0x630000 [0051.272] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.272] GetProcessHeap () returned 0x630000 [0051.272] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.272] GetProcessHeap () returned 0x630000 [0051.272] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.272] GetProcessHeap () returned 0x630000 [0051.273] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0051.273] GetProcessHeap () returned 0x630000 [0051.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0051.273] GetProcessHeap () returned 0x630000 [0051.273] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.273] GetProcessHeap () returned 0x630000 [0051.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.273] GetProcessHeap () returned 0x630000 [0051.273] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.273] GetProcessHeap () returned 0x630000 [0051.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.273] GetProcessHeap () returned 0x630000 [0051.273] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.273] GetProcessHeap () returned 0x630000 [0051.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.273] GetProcessHeap () returned 0x630000 [0051.273] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.273] GetProcessHeap () returned 0x630000 [0051.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.273] GetProcessHeap () returned 0x630000 [0051.273] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.273] GetProcessHeap () returned 0x630000 [0051.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.273] GetProcessHeap () returned 0x630000 [0051.273] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0051.273] GetProcessHeap () returned 0x630000 [0051.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0051.273] GetProcessHeap () returned 0x630000 [0051.273] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.273] GetProcessHeap () returned 0x630000 [0051.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.273] GetProcessHeap () returned 0x630000 [0051.273] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.273] GetProcessHeap () returned 0x630000 [0051.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.273] GetProcessHeap () returned 0x630000 [0051.273] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.273] GetProcessHeap () returned 0x630000 [0051.274] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.274] GetProcessHeap () returned 0x630000 [0051.274] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0051.274] GetProcessHeap () returned 0x630000 [0051.274] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0051.274] GetProcessHeap () returned 0x630000 [0051.274] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0051.274] GetProcessHeap () returned 0x630000 [0051.274] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0051.274] GetProcessHeap () returned 0x630000 [0051.274] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.274] GetProcessHeap () returned 0x630000 [0051.274] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.274] GetProcessHeap () returned 0x630000 [0051.274] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0051.274] GetProcessHeap () returned 0x630000 [0051.274] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0051.274] GetProcessHeap () returned 0x630000 [0051.274] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0051.274] GetProcessHeap () returned 0x630000 [0051.274] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0051.274] GetProcessHeap () returned 0x630000 [0051.274] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0051.274] GetProcessHeap () returned 0x630000 [0051.274] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0051.274] GetProcessHeap () returned 0x630000 [0051.274] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0051.274] GetProcessHeap () returned 0x630000 [0051.274] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0051.274] GetProcessHeap () returned 0x630000 [0051.274] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0051.274] GetProcessHeap () returned 0x630000 [0051.274] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0051.274] GetProcessHeap () returned 0x630000 [0051.274] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0051.274] GetProcessHeap () returned 0x630000 [0051.274] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0051.274] GetProcessHeap () returned 0x630000 [0051.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.275] GetProcessHeap () returned 0x630000 [0051.275] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.275] GetProcessHeap () returned 0x630000 [0051.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0051.275] GetProcessHeap () returned 0x630000 [0051.275] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0051.275] GetProcessHeap () returned 0x630000 [0051.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.275] GetProcessHeap () returned 0x630000 [0051.275] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.275] GetProcessHeap () returned 0x630000 [0051.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0051.275] GetProcessHeap () returned 0x630000 [0051.275] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0051.275] GetProcessHeap () returned 0x630000 [0051.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.275] GetProcessHeap () returned 0x630000 [0051.275] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.275] GetProcessHeap () returned 0x630000 [0051.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0051.275] GetProcessHeap () returned 0x630000 [0051.275] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0051.275] GetProcessHeap () returned 0x630000 [0051.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.275] GetProcessHeap () returned 0x630000 [0051.275] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.275] GetProcessHeap () returned 0x630000 [0051.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.275] GetProcessHeap () returned 0x630000 [0051.275] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.275] GetProcessHeap () returned 0x630000 [0051.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.275] GetProcessHeap () returned 0x630000 [0051.275] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.275] GetProcessHeap () returned 0x630000 [0051.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0051.275] GetProcessHeap () returned 0x630000 [0051.275] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0051.276] GetProcessHeap () returned 0x630000 [0051.276] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.276] GetProcessHeap () returned 0x630000 [0051.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.276] GetProcessHeap () returned 0x630000 [0051.276] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.276] GetProcessHeap () returned 0x630000 [0051.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.276] GetProcessHeap () returned 0x630000 [0051.276] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0051.276] GetProcessHeap () returned 0x630000 [0051.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0051.276] GetProcessHeap () returned 0x630000 [0051.276] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0051.276] GetProcessHeap () returned 0x630000 [0051.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0051.276] GetProcessHeap () returned 0x630000 [0051.276] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.276] GetProcessHeap () returned 0x630000 [0051.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.276] GetProcessHeap () returned 0x630000 [0051.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0051.276] GetProcessHeap () returned 0x630000 [0051.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0051.276] GetProcessHeap () returned 0x630000 [0051.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0051.276] GetProcessHeap () returned 0x630000 [0051.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0051.276] GetProcessHeap () returned 0x630000 [0051.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0051.276] GetProcessHeap () returned 0x630000 [0051.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655800 | out: hHeap=0x630000) returned 1 [0051.276] GetProcessHeap () returned 0x630000 [0051.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0051.276] GetProcessHeap () returned 0x630000 [0051.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655890 | out: hHeap=0x630000) returned 1 [0051.276] GetProcessHeap () returned 0x630000 [0051.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0051.277] GetProcessHeap () returned 0x630000 [0051.277] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.277] GetProcessHeap () returned 0x630000 [0051.277] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0051.277] WriteFile (in: hFile=0x230, lpBuffer=0x65cb40*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65cb40*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0051.285] GetProcessHeap () returned 0x630000 [0051.285] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65cb40, Size=0x30) returned 0x65cb40 [0051.285] GetProcessHeap () returned 0x630000 [0051.285] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0051.285] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.285] GetProcessHeap () returned 0x630000 [0051.285] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xdf8c8) returned 0x2448020 [0051.301] ReadFile (in: hFile=0x230, lpBuffer=0x2448020, nNumberOfBytesToRead=0xdf8c8, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x2448020*, lpNumberOfBytesRead=0x243d7e8*=0xdf8c8, lpOverlapped=0x0) returned 1 [0051.314] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.314] WriteFile (in: hFile=0x230, lpBuffer=0x2448020*, nNumberOfBytesToWrite=0xdf8c8, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x2448020*, lpNumberOfBytesWritten=0x243d7e4*=0xdf8c8, lpOverlapped=0x0) returned 1 [0051.364] GetProcessHeap () returned 0x630000 [0051.364] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x2448020 | out: hHeap=0x630000) returned 1 [0051.399] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0051.399] WriteFile (in: hFile=0x230, lpBuffer=0x65cb40*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65cb40*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0051.401] CloseHandle (hObject=0x230) returned 1 [0051.417] GetProcessHeap () returned 0x630000 [0051.417] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0051.417] GetProcessHeap () returned 0x630000 [0051.417] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0051.417] GetProcessHeap () returned 0x630000 [0051.417] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0051.417] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\windlp.dll" | out: lpString1="C:\\Windows10Upgrade\\windlp.dll") returned="C:\\Windows10Upgrade\\windlp.dll" [0051.417] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\windlp.dll", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\windlp.dll.happythreechoose") returned="C:\\Windows10Upgrade\\windlp.dll.happythreechoose" [0051.417] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\windlp.dll" (normalized: "c:\\windows10upgrade\\windlp.dll"), lpNewFileName="C:\\Windows10Upgrade\\windlp.dll.happythreechoose" (normalized: "c:\\windows10upgrade\\windlp.dll.happythreechoose"), dwFlags=0x1) returned 1 [0051.418] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\windlp.dll" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0051.418] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0051.418] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\Decryption INFO.html" [0051.418] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\decryption info.html")) returned 0x20 [0051.418] GetProcessHeap () returned 0x630000 [0051.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0051.418] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea64a022, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea64a022, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x159ac8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows10UpgraderApp.exe", cAlternateFileName="WINDOW~1.EXE")) returned 1 [0051.419] lstrcmpiW (lpString1="Windows10UpgraderApp.exe", lpString2=".") returned 1 [0051.419] lstrcmpiW (lpString1="Windows10UpgraderApp.exe", lpString2="..") returned 1 [0051.419] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="Windows10UpgraderApp.exe" | out: lpString1="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe") returned="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe" [0051.419] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Windows10UpgraderApp.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0051.419] GetProcessHeap () returned 0x630000 [0051.419] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x19) returned 0x651e48 [0051.419] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Windows10UpgraderApp.exe", cchWideChar=-1, lpMultiByteStr=0x651e48, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows10UpgraderApp.exe", lpUsedDefaultChar=0x0) returned 25 [0051.419] lstrlenA (lpString="Windows10UpgraderApp.exe") returned 24 [0051.419] lstrlenA (lpString=".happythreechoose") returned 17 [0051.419] lstrlenA (lpString=".happythreechoose") returned 17 [0051.419] lstrlenA (lpString="Windows10UpgraderApp.exe") returned 24 [0051.419] lstrcmpiA (lpString1="10UpgraderApp.exe", lpString2=".happythreechoose") returned 1 [0051.419] lstrcmpiW (lpString1="Windows10UpgraderApp.exe", lpString2="Decryption INFO.html") returned 1 [0051.419] lstrcmpiW (lpString1="Windows10UpgraderApp.exe", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0051.419] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0051.419] lstrcmpiW (lpString1="Windows10UpgraderApp.exe", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0051.419] GetProcessHeap () returned 0x630000 [0051.419] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0051.419] CreateFileW (lpFileName="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe" (normalized: "c:\\windows10upgrade\\windows10upgraderapp.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0051.419] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=1415880) returned 1 [0051.419] GetProcessHeap () returned 0x630000 [0051.419] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x63e830 [0051.419] GetProcessHeap () returned 0x630000 [0051.420] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0051.420] lstrlenW (lpString="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe") returned 44 [0051.420] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0051.420] GetProcessHeap () returned 0x630000 [0051.420] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0051.420] GetProcessHeap () returned 0x630000 [0051.420] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x388) returned 0x65cb78 [0051.420] lstrlenA (lpString="rsa_encrypt") returned 11 [0051.420] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0051.420] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0051.420] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0051.420] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0051.420] GetProcessHeap () returned 0x630000 [0051.420] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0051.420] lstrlenA (lpString="010001") returned 6 [0051.421] GetProcessHeap () returned 0x630000 [0051.421] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0051.421] GetProcessHeap () returned 0x630000 [0051.421] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0051.421] GetProcessHeap () returned 0x630000 [0051.421] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655800 [0051.421] GetProcessHeap () returned 0x630000 [0051.421] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0051.421] GetProcessHeap () returned 0x630000 [0051.421] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655260 [0051.421] GetProcessHeap () returned 0x630000 [0051.421] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657558 [0051.421] GetProcessHeap () returned 0x630000 [0051.421] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a398 [0051.421] GetProcessHeap () returned 0x630000 [0051.421] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0051.421] GetProcessHeap () returned 0x630000 [0051.421] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0051.421] GetProcessHeap () returned 0x630000 [0051.421] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0051.421] GetProcessHeap () returned 0x630000 [0051.421] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0051.421] GetProcessHeap () returned 0x630000 [0051.421] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657328 [0051.421] GetProcessHeap () returned 0x630000 [0051.421] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0051.421] GetProcessHeap () returned 0x630000 [0051.421] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0051.421] GetProcessHeap () returned 0x630000 [0051.421] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655770 [0051.421] GetProcessHeap () returned 0x630000 [0051.421] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0051.421] GetProcessHeap () returned 0x630000 [0051.421] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0051.421] GetProcessHeap () returned 0x630000 [0051.421] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655770 | out: hHeap=0x630000) returned 1 [0051.421] GetProcessHeap () returned 0x630000 [0051.421] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0051.421] GetProcessHeap () returned 0x630000 [0051.421] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0051.422] GetProcessHeap () returned 0x630000 [0051.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0051.422] GetProcessHeap () returned 0x630000 [0051.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0051.422] GetProcessHeap () returned 0x630000 [0051.422] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0051.422] GetProcessHeap () returned 0x630000 [0051.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0051.422] GetProcessHeap () returned 0x630000 [0051.422] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x6555c0 [0051.422] GetProcessHeap () returned 0x630000 [0051.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0051.422] GetProcessHeap () returned 0x630000 [0051.422] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0051.422] GetProcessHeap () returned 0x630000 [0051.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6555c0 | out: hHeap=0x630000) returned 1 [0051.422] GetProcessHeap () returned 0x630000 [0051.422] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0051.422] GetProcessHeap () returned 0x630000 [0051.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0051.422] GetProcessHeap () returned 0x630000 [0051.422] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.422] GetProcessHeap () returned 0x630000 [0051.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.422] GetProcessHeap () returned 0x630000 [0051.422] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0051.422] GetProcessHeap () returned 0x630000 [0051.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0051.422] GetProcessHeap () returned 0x630000 [0051.422] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0051.422] GetProcessHeap () returned 0x630000 [0051.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.422] GetProcessHeap () returned 0x630000 [0051.422] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0051.422] GetProcessHeap () returned 0x630000 [0051.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0051.422] GetProcessHeap () returned 0x630000 [0051.422] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0051.422] GetProcessHeap () returned 0x630000 [0051.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0051.423] GetProcessHeap () returned 0x630000 [0051.423] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0051.423] GetProcessHeap () returned 0x630000 [0051.423] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0051.423] GetProcessHeap () returned 0x630000 [0051.423] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.423] GetProcessHeap () returned 0x630000 [0051.423] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.423] GetProcessHeap () returned 0x630000 [0051.423] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0051.423] GetProcessHeap () returned 0x630000 [0051.423] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0051.423] GetProcessHeap () returned 0x630000 [0051.423] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0051.423] GetProcessHeap () returned 0x630000 [0051.423] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0051.423] GetProcessHeap () returned 0x630000 [0051.423] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0051.423] GetProcessHeap () returned 0x630000 [0051.423] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0051.423] GetProcessHeap () returned 0x630000 [0051.423] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0051.423] GetProcessHeap () returned 0x630000 [0051.423] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0051.423] GetProcessHeap () returned 0x630000 [0051.423] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0051.423] GetProcessHeap () returned 0x630000 [0051.423] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.423] GetProcessHeap () returned 0x630000 [0051.423] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.423] GetProcessHeap () returned 0x630000 [0051.423] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.423] GetProcessHeap () returned 0x630000 [0051.423] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0051.423] GetProcessHeap () returned 0x630000 [0051.423] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0051.423] GetProcessHeap () returned 0x630000 [0051.423] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.423] GetProcessHeap () returned 0x630000 [0051.423] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.424] GetProcessHeap () returned 0x630000 [0051.424] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0051.424] GetProcessHeap () returned 0x630000 [0051.424] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.424] GetProcessHeap () returned 0x630000 [0051.424] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0051.424] GetProcessHeap () returned 0x630000 [0051.424] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0051.424] GetProcessHeap () returned 0x630000 [0051.424] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.424] GetProcessHeap () returned 0x630000 [0051.424] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.424] GetProcessHeap () returned 0x630000 [0051.424] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.424] GetProcessHeap () returned 0x630000 [0051.424] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.424] GetProcessHeap () returned 0x630000 [0051.424] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.424] GetProcessHeap () returned 0x630000 [0051.424] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.424] GetProcessHeap () returned 0x630000 [0051.424] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.424] GetProcessHeap () returned 0x630000 [0051.424] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.424] GetProcessHeap () returned 0x630000 [0051.424] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0051.424] GetProcessHeap () returned 0x630000 [0051.424] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.424] GetProcessHeap () returned 0x630000 [0051.424] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.424] GetProcessHeap () returned 0x630000 [0051.424] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.424] GetProcessHeap () returned 0x630000 [0051.424] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.424] GetProcessHeap () returned 0x630000 [0051.424] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.424] GetProcessHeap () returned 0x630000 [0051.424] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0051.424] GetProcessHeap () returned 0x630000 [0051.425] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0051.425] GetProcessHeap () returned 0x630000 [0051.425] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0051.425] GetProcessHeap () returned 0x630000 [0051.425] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0051.425] GetProcessHeap () returned 0x630000 [0051.425] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0051.425] GetProcessHeap () returned 0x630000 [0051.425] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0051.425] GetProcessHeap () returned 0x630000 [0051.425] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0051.425] GetProcessHeap () returned 0x630000 [0051.425] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0051.425] GetProcessHeap () returned 0x630000 [0051.425] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0051.425] GetProcessHeap () returned 0x630000 [0051.425] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0051.425] GetProcessHeap () returned 0x630000 [0051.425] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0051.425] GetProcessHeap () returned 0x630000 [0051.425] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0051.425] GetProcessHeap () returned 0x630000 [0051.425] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0051.425] GetProcessHeap () returned 0x630000 [0051.425] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0051.425] GetProcessHeap () returned 0x630000 [0051.425] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.425] GetProcessHeap () returned 0x630000 [0051.425] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.425] GetProcessHeap () returned 0x630000 [0051.425] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.425] GetProcessHeap () returned 0x630000 [0051.425] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.425] GetProcessHeap () returned 0x630000 [0051.425] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0051.425] GetProcessHeap () returned 0x630000 [0051.425] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0051.425] GetProcessHeap () returned 0x630000 [0051.425] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0051.425] GetProcessHeap () returned 0x630000 [0051.426] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.426] GetProcessHeap () returned 0x630000 [0051.426] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0051.426] GetProcessHeap () returned 0x630000 [0051.426] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0051.426] GetProcessHeap () returned 0x630000 [0051.426] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.426] GetProcessHeap () returned 0x630000 [0051.426] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.426] GetProcessHeap () returned 0x630000 [0051.426] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0051.426] GetProcessHeap () returned 0x630000 [0051.426] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.426] GetProcessHeap () returned 0x630000 [0051.426] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0051.426] GetProcessHeap () returned 0x630000 [0051.426] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0051.426] GetProcessHeap () returned 0x630000 [0051.426] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0051.426] GetProcessHeap () returned 0x630000 [0051.426] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0051.426] GetProcessHeap () returned 0x630000 [0051.426] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0051.426] GetProcessHeap () returned 0x630000 [0051.426] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0051.426] GetProcessHeap () returned 0x630000 [0051.426] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0051.426] GetProcessHeap () returned 0x630000 [0051.426] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0051.426] GetProcessHeap () returned 0x630000 [0051.426] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0051.426] GetProcessHeap () returned 0x630000 [0051.426] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655260 | out: hHeap=0x630000) returned 1 [0051.426] GetProcessHeap () returned 0x630000 [0051.426] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0051.426] GetProcessHeap () returned 0x630000 [0051.426] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655800 | out: hHeap=0x630000) returned 1 [0051.426] GetProcessHeap () returned 0x630000 [0051.427] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0051.427] GetProcessHeap () returned 0x630000 [0051.427] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.427] GetProcessHeap () returned 0x630000 [0051.427] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0051.427] WriteFile (in: hFile=0x230, lpBuffer=0x65cb78*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65cb78*, lpNumberOfBytesWritten=0x243d864*=0x388, lpOverlapped=0x0) returned 1 [0051.431] GetProcessHeap () returned 0x630000 [0051.431] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65cb78, Size=0x30) returned 0x65cb78 [0051.431] GetProcessHeap () returned 0x630000 [0051.431] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0051.431] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.431] GetProcessHeap () returned 0x630000 [0051.431] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x159ad0) returned 0x244b020 [0051.455] ReadFile (in: hFile=0x230, lpBuffer=0x244b020, nNumberOfBytesToRead=0x159ad0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x244b020*, lpNumberOfBytesRead=0x243d7e8*=0x159ad0, lpOverlapped=0x0) returned 1 [0051.485] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.485] WriteFile (in: hFile=0x230, lpBuffer=0x244b020*, nNumberOfBytesToWrite=0x159ad0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x244b020*, lpNumberOfBytesWritten=0x243d7e4*=0x159ad0, lpOverlapped=0x0) returned 1 [0051.604] GetProcessHeap () returned 0x630000 [0051.604] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x244b020 | out: hHeap=0x630000) returned 1 [0051.610] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0051.610] WriteFile (in: hFile=0x230, lpBuffer=0x65cb78*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65cb78*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0051.611] CloseHandle (hObject=0x230) returned 1 [0051.637] GetProcessHeap () returned 0x630000 [0051.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0051.637] GetProcessHeap () returned 0x630000 [0051.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0051.637] GetProcessHeap () returned 0x630000 [0051.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0051.637] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe" | out: lpString1="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe") returned="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe" [0051.637] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe.happythreechoose") returned="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe.happythreechoose" [0051.637] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe" (normalized: "c:\\windows10upgrade\\windows10upgraderapp.exe"), lpNewFileName="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe.happythreechoose" (normalized: "c:\\windows10upgrade\\windows10upgraderapp.exe.happythreechoose"), dwFlags=0x1) returned 1 [0051.637] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0051.637] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0051.638] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\Decryption INFO.html" [0051.638] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\decryption info.html")) returned 0x20 [0051.638] GetProcessHeap () returned 0x630000 [0051.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0051.638] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea64ee41, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea64ee41, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x62c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WinREBootApp32.exe", cAlternateFileName="WINREB~1.EXE")) returned 1 [0051.638] lstrcmpiW (lpString1="WinREBootApp32.exe", lpString2=".") returned 1 [0051.638] lstrcmpiW (lpString1="WinREBootApp32.exe", lpString2="..") returned 1 [0051.638] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="WinREBootApp32.exe" | out: lpString1="C:\\Windows10Upgrade\\WinREBootApp32.exe") returned="C:\\Windows10Upgrade\\WinREBootApp32.exe" [0051.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WinREBootApp32.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0051.638] GetProcessHeap () returned 0x630000 [0051.638] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x13) returned 0x645cd8 [0051.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WinREBootApp32.exe", cchWideChar=-1, lpMultiByteStr=0x645cd8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WinREBootApp32.exe", lpUsedDefaultChar=0x0) returned 19 [0051.638] lstrlenA (lpString="WinREBootApp32.exe") returned 18 [0051.638] lstrlenA (lpString=".happythreechoose") returned 17 [0051.638] lstrlenA (lpString=".happythreechoose") returned 17 [0051.638] lstrlenA (lpString="WinREBootApp32.exe") returned 18 [0051.638] lstrcmpiA (lpString1="inREBootApp32.exe", lpString2=".happythreechoose") returned 1 [0051.638] lstrcmpiW (lpString1="WinREBootApp32.exe", lpString2="Decryption INFO.html") returned 1 [0051.638] lstrcmpiW (lpString1="WinREBootApp32.exe", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0051.638] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0051.638] lstrcmpiW (lpString1="WinREBootApp32.exe", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0051.638] GetProcessHeap () returned 0x630000 [0051.638] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0051.638] CreateFileW (lpFileName="C:\\Windows10Upgrade\\WinREBootApp32.exe" (normalized: "c:\\windows10upgrade\\winrebootapp32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0051.639] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=25288) returned 1 [0051.639] GetProcessHeap () returned 0x630000 [0051.639] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x63e830 [0051.639] GetProcessHeap () returned 0x630000 [0051.639] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0051.639] lstrlenW (lpString="C:\\Windows10Upgrade\\WinREBootApp32.exe") returned 38 [0051.639] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0051.639] GetProcessHeap () returned 0x630000 [0051.639] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0051.639] GetProcessHeap () returned 0x630000 [0051.639] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x65cbb0 [0051.639] lstrlenA (lpString="rsa_encrypt") returned 11 [0051.639] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0051.640] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0051.640] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0051.640] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0051.640] GetProcessHeap () returned 0x630000 [0051.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0051.640] lstrlenA (lpString="010001") returned 6 [0051.640] GetProcessHeap () returned 0x630000 [0051.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a308 [0051.640] GetProcessHeap () returned 0x630000 [0051.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0051.640] GetProcessHeap () returned 0x630000 [0051.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655800 [0051.640] GetProcessHeap () returned 0x630000 [0051.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0051.640] GetProcessHeap () returned 0x630000 [0051.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655410 [0051.640] GetProcessHeap () returned 0x630000 [0051.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656950 [0051.640] GetProcessHeap () returned 0x630000 [0051.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a378 [0051.640] GetProcessHeap () returned 0x630000 [0051.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0051.640] GetProcessHeap () returned 0x630000 [0051.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0051.640] GetProcessHeap () returned 0x630000 [0051.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0051.640] GetProcessHeap () returned 0x630000 [0051.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0051.640] GetProcessHeap () returned 0x630000 [0051.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656a68 [0051.640] GetProcessHeap () returned 0x630000 [0051.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.640] GetProcessHeap () returned 0x630000 [0051.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0051.640] GetProcessHeap () returned 0x630000 [0051.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655ad0 [0051.641] GetProcessHeap () returned 0x630000 [0051.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0051.641] GetProcessHeap () returned 0x630000 [0051.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0051.641] GetProcessHeap () returned 0x630000 [0051.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655ad0 | out: hHeap=0x630000) returned 1 [0051.641] GetProcessHeap () returned 0x630000 [0051.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0051.641] GetProcessHeap () returned 0x630000 [0051.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0051.641] GetProcessHeap () returned 0x630000 [0051.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.641] GetProcessHeap () returned 0x630000 [0051.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0051.641] GetProcessHeap () returned 0x630000 [0051.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.641] GetProcessHeap () returned 0x630000 [0051.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.641] GetProcessHeap () returned 0x630000 [0051.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x655a40 [0051.641] GetProcessHeap () returned 0x630000 [0051.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0051.641] GetProcessHeap () returned 0x630000 [0051.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0051.641] GetProcessHeap () returned 0x630000 [0051.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655a40 | out: hHeap=0x630000) returned 1 [0051.641] GetProcessHeap () returned 0x630000 [0051.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0051.641] GetProcessHeap () returned 0x630000 [0051.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0051.641] GetProcessHeap () returned 0x630000 [0051.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0051.641] GetProcessHeap () returned 0x630000 [0051.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0051.641] GetProcessHeap () returned 0x630000 [0051.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.641] GetProcessHeap () returned 0x630000 [0051.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.641] GetProcessHeap () returned 0x630000 [0051.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.642] GetProcessHeap () returned 0x630000 [0051.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.642] GetProcessHeap () returned 0x630000 [0051.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.642] GetProcessHeap () returned 0x630000 [0051.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.642] GetProcessHeap () returned 0x630000 [0051.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.642] GetProcessHeap () returned 0x630000 [0051.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.642] GetProcessHeap () returned 0x630000 [0051.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.642] GetProcessHeap () returned 0x630000 [0051.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.642] GetProcessHeap () returned 0x630000 [0051.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0051.642] GetProcessHeap () returned 0x630000 [0051.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0051.642] GetProcessHeap () returned 0x630000 [0051.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0051.642] GetProcessHeap () returned 0x630000 [0051.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0051.642] GetProcessHeap () returned 0x630000 [0051.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.642] GetProcessHeap () returned 0x630000 [0051.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.642] GetProcessHeap () returned 0x630000 [0051.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.642] GetProcessHeap () returned 0x630000 [0051.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.642] GetProcessHeap () returned 0x630000 [0051.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.642] GetProcessHeap () returned 0x630000 [0051.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.642] GetProcessHeap () returned 0x630000 [0051.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.642] GetProcessHeap () returned 0x630000 [0051.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.643] GetProcessHeap () returned 0x630000 [0051.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0051.643] GetProcessHeap () returned 0x630000 [0051.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0051.643] GetProcessHeap () returned 0x630000 [0051.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0051.643] GetProcessHeap () returned 0x630000 [0051.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.643] GetProcessHeap () returned 0x630000 [0051.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.643] GetProcessHeap () returned 0x630000 [0051.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.643] GetProcessHeap () returned 0x630000 [0051.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.643] GetProcessHeap () returned 0x630000 [0051.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.643] GetProcessHeap () returned 0x630000 [0051.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0051.643] GetProcessHeap () returned 0x630000 [0051.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0051.643] GetProcessHeap () returned 0x630000 [0051.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.643] GetProcessHeap () returned 0x630000 [0051.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.643] GetProcessHeap () returned 0x630000 [0051.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.643] GetProcessHeap () returned 0x630000 [0051.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.643] GetProcessHeap () returned 0x630000 [0051.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.643] GetProcessHeap () returned 0x630000 [0051.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.643] GetProcessHeap () returned 0x630000 [0051.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.643] GetProcessHeap () returned 0x630000 [0051.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.644] GetProcessHeap () returned 0x630000 [0051.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.644] GetProcessHeap () returned 0x630000 [0051.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.644] GetProcessHeap () returned 0x630000 [0051.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0051.644] GetProcessHeap () returned 0x630000 [0051.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0051.644] GetProcessHeap () returned 0x630000 [0051.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0051.644] GetProcessHeap () returned 0x630000 [0051.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0051.644] GetProcessHeap () returned 0x630000 [0051.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0051.644] GetProcessHeap () returned 0x630000 [0051.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0051.644] GetProcessHeap () returned 0x630000 [0051.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0051.644] GetProcessHeap () returned 0x630000 [0051.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.644] GetProcessHeap () returned 0x630000 [0051.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.644] GetProcessHeap () returned 0x630000 [0051.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.644] GetProcessHeap () returned 0x630000 [0051.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.644] GetProcessHeap () returned 0x630000 [0051.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.644] GetProcessHeap () returned 0x630000 [0051.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0051.644] GetProcessHeap () returned 0x630000 [0051.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0051.644] GetProcessHeap () returned 0x630000 [0051.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.644] GetProcessHeap () returned 0x630000 [0051.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.644] GetProcessHeap () returned 0x630000 [0051.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.644] GetProcessHeap () returned 0x630000 [0051.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.645] GetProcessHeap () returned 0x630000 [0051.645] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0051.645] GetProcessHeap () returned 0x630000 [0051.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0051.645] GetProcessHeap () returned 0x630000 [0051.645] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0051.645] GetProcessHeap () returned 0x630000 [0051.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0051.645] GetProcessHeap () returned 0x630000 [0051.645] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0051.645] GetProcessHeap () returned 0x630000 [0051.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0051.645] GetProcessHeap () returned 0x630000 [0051.645] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.645] GetProcessHeap () returned 0x630000 [0051.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.645] GetProcessHeap () returned 0x630000 [0051.645] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.645] GetProcessHeap () returned 0x630000 [0051.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.645] GetProcessHeap () returned 0x630000 [0051.645] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.645] GetProcessHeap () returned 0x630000 [0051.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.645] GetProcessHeap () returned 0x630000 [0051.645] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0051.645] GetProcessHeap () returned 0x630000 [0051.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0051.645] GetProcessHeap () returned 0x630000 [0051.645] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.645] GetProcessHeap () returned 0x630000 [0051.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.645] GetProcessHeap () returned 0x630000 [0051.645] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.645] GetProcessHeap () returned 0x630000 [0051.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.645] GetProcessHeap () returned 0x630000 [0051.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0051.645] GetProcessHeap () returned 0x630000 [0051.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0051.646] GetProcessHeap () returned 0x630000 [0051.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0051.646] GetProcessHeap () returned 0x630000 [0051.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0051.646] GetProcessHeap () returned 0x630000 [0051.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0051.646] GetProcessHeap () returned 0x630000 [0051.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655410 | out: hHeap=0x630000) returned 1 [0051.646] GetProcessHeap () returned 0x630000 [0051.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0051.646] GetProcessHeap () returned 0x630000 [0051.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655800 | out: hHeap=0x630000) returned 1 [0051.646] GetProcessHeap () returned 0x630000 [0051.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0051.646] GetProcessHeap () returned 0x630000 [0051.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.646] GetProcessHeap () returned 0x630000 [0051.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0051.646] WriteFile (in: hFile=0x230, lpBuffer=0x65cbb0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65cbb0*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0051.654] GetProcessHeap () returned 0x630000 [0051.654] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65cbb0, Size=0x30) returned 0x65cbb0 [0051.654] GetProcessHeap () returned 0x630000 [0051.654] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0051.654] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.654] GetProcessHeap () returned 0x630000 [0051.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x62c8) returned 0x65cbe8 [0051.654] ReadFile (in: hFile=0x230, lpBuffer=0x65cbe8, nNumberOfBytesToRead=0x62c8, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65cbe8*, lpNumberOfBytesRead=0x243d7e8*=0x62c8, lpOverlapped=0x0) returned 1 [0051.655] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.655] WriteFile (in: hFile=0x230, lpBuffer=0x65cbe8*, nNumberOfBytesToWrite=0x62c8, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65cbe8*, lpNumberOfBytesWritten=0x243d7e4*=0x62c8, lpOverlapped=0x0) returned 1 [0051.660] GetProcessHeap () returned 0x630000 [0051.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cbe8 | out: hHeap=0x630000) returned 1 [0051.662] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0051.662] WriteFile (in: hFile=0x230, lpBuffer=0x65cbb0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65cbb0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0051.663] CloseHandle (hObject=0x230) returned 1 [0051.665] GetProcessHeap () returned 0x630000 [0051.665] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0051.665] GetProcessHeap () returned 0x630000 [0051.665] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0051.665] GetProcessHeap () returned 0x630000 [0051.665] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0051.665] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\WinREBootApp32.exe" | out: lpString1="C:\\Windows10Upgrade\\WinREBootApp32.exe") returned="C:\\Windows10Upgrade\\WinREBootApp32.exe" [0051.665] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\WinREBootApp32.exe", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\WinREBootApp32.exe.happythreechoose") returned="C:\\Windows10Upgrade\\WinREBootApp32.exe.happythreechoose" [0051.665] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\WinREBootApp32.exe" (normalized: "c:\\windows10upgrade\\winrebootapp32.exe"), lpNewFileName="C:\\Windows10Upgrade\\WinREBootApp32.exe.happythreechoose" (normalized: "c:\\windows10upgrade\\winrebootapp32.exe.happythreechoose"), dwFlags=0x1) returned 1 [0051.666] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\WinREBootApp32.exe" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0051.666] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0051.666] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\Decryption INFO.html" [0051.666] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\decryption info.html")) returned 0x20 [0051.666] GetProcessHeap () returned 0x630000 [0051.666] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645cd8 | out: hHeap=0x630000) returned 1 [0051.666] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6528e0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6528e0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x64c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WinREBootApp64.exe", cAlternateFileName="WINREB~2.EXE")) returned 1 [0051.666] lstrcmpiW (lpString1="WinREBootApp64.exe", lpString2=".") returned 1 [0051.666] lstrcmpiW (lpString1="WinREBootApp64.exe", lpString2="..") returned 1 [0051.666] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="WinREBootApp64.exe" | out: lpString1="C:\\Windows10Upgrade\\WinREBootApp64.exe") returned="C:\\Windows10Upgrade\\WinREBootApp64.exe" [0051.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WinREBootApp64.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0051.666] GetProcessHeap () returned 0x630000 [0051.666] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x13) returned 0x645d58 [0051.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WinREBootApp64.exe", cchWideChar=-1, lpMultiByteStr=0x645d58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WinREBootApp64.exe", lpUsedDefaultChar=0x0) returned 19 [0051.666] lstrlenA (lpString="WinREBootApp64.exe") returned 18 [0051.666] lstrlenA (lpString=".happythreechoose") returned 17 [0051.666] lstrlenA (lpString=".happythreechoose") returned 17 [0051.666] lstrlenA (lpString="WinREBootApp64.exe") returned 18 [0051.666] lstrcmpiA (lpString1="inREBootApp64.exe", lpString2=".happythreechoose") returned 1 [0051.666] lstrcmpiW (lpString1="WinREBootApp64.exe", lpString2="Decryption INFO.html") returned 1 [0051.666] lstrcmpiW (lpString1="WinREBootApp64.exe", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0051.666] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0051.666] lstrcmpiW (lpString1="WinREBootApp64.exe", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0051.666] GetProcessHeap () returned 0x630000 [0051.666] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0051.666] CreateFileW (lpFileName="C:\\Windows10Upgrade\\WinREBootApp64.exe" (normalized: "c:\\windows10upgrade\\winrebootapp64.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0051.667] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=25800) returned 1 [0051.667] GetProcessHeap () returned 0x630000 [0051.667] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x63e830 [0051.667] GetProcessHeap () returned 0x630000 [0051.667] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0051.667] lstrlenW (lpString="C:\\Windows10Upgrade\\WinREBootApp64.exe") returned 38 [0051.667] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0051.667] GetProcessHeap () returned 0x630000 [0051.667] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0051.667] GetProcessHeap () returned 0x630000 [0051.667] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x65cbe8 [0051.668] lstrlenA (lpString="rsa_encrypt") returned 11 [0051.668] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0051.669] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0051.669] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0051.669] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0051.669] GetProcessHeap () returned 0x630000 [0051.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0051.669] lstrlenA (lpString="010001") returned 6 [0051.669] GetProcessHeap () returned 0x630000 [0051.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a308 [0051.669] GetProcessHeap () returned 0x630000 [0051.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0051.669] GetProcessHeap () returned 0x630000 [0051.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x6559b0 [0051.669] GetProcessHeap () returned 0x630000 [0051.669] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0051.669] GetProcessHeap () returned 0x630000 [0051.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x6555c0 [0051.669] GetProcessHeap () returned 0x630000 [0051.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657558 [0051.669] GetProcessHeap () returned 0x630000 [0051.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a348 [0051.669] GetProcessHeap () returned 0x630000 [0051.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0051.670] GetProcessHeap () returned 0x630000 [0051.670] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.670] GetProcessHeap () returned 0x630000 [0051.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0051.670] GetProcessHeap () returned 0x630000 [0051.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0051.670] GetProcessHeap () returned 0x630000 [0051.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657788 [0051.670] GetProcessHeap () returned 0x630000 [0051.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0051.670] GetProcessHeap () returned 0x630000 [0051.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0051.670] GetProcessHeap () returned 0x630000 [0051.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655ad0 [0051.670] GetProcessHeap () returned 0x630000 [0051.670] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0051.670] GetProcessHeap () returned 0x630000 [0051.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0051.670] GetProcessHeap () returned 0x630000 [0051.670] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655ad0 | out: hHeap=0x630000) returned 1 [0051.670] GetProcessHeap () returned 0x630000 [0051.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0051.670] GetProcessHeap () returned 0x630000 [0051.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0051.670] GetProcessHeap () returned 0x630000 [0051.670] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.670] GetProcessHeap () returned 0x630000 [0051.670] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0051.670] GetProcessHeap () returned 0x630000 [0051.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.670] GetProcessHeap () returned 0x630000 [0051.670] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.670] GetProcessHeap () returned 0x630000 [0051.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x6552f0 [0051.670] GetProcessHeap () returned 0x630000 [0051.670] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0051.670] GetProcessHeap () returned 0x630000 [0051.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0051.670] GetProcessHeap () returned 0x630000 [0051.670] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6552f0 | out: hHeap=0x630000) returned 1 [0051.671] GetProcessHeap () returned 0x630000 [0051.671] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0051.671] GetProcessHeap () returned 0x630000 [0051.671] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0051.671] GetProcessHeap () returned 0x630000 [0051.671] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.671] GetProcessHeap () returned 0x630000 [0051.671] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.671] GetProcessHeap () returned 0x630000 [0051.671] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0051.671] GetProcessHeap () returned 0x630000 [0051.671] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0051.671] GetProcessHeap () returned 0x630000 [0051.671] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.671] GetProcessHeap () returned 0x630000 [0051.671] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.671] GetProcessHeap () returned 0x630000 [0051.671] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.671] GetProcessHeap () returned 0x630000 [0051.671] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.671] GetProcessHeap () returned 0x630000 [0051.671] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.671] GetProcessHeap () returned 0x630000 [0051.671] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.671] GetProcessHeap () returned 0x630000 [0051.671] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0051.671] GetProcessHeap () returned 0x630000 [0051.671] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.671] GetProcessHeap () returned 0x630000 [0051.671] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.671] GetProcessHeap () returned 0x630000 [0051.671] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.671] GetProcessHeap () returned 0x630000 [0051.671] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.671] GetProcessHeap () returned 0x630000 [0051.671] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.671] GetProcessHeap () returned 0x630000 [0051.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0051.672] GetProcessHeap () returned 0x630000 [0051.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0051.672] GetProcessHeap () returned 0x630000 [0051.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0051.672] GetProcessHeap () returned 0x630000 [0051.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0051.672] GetProcessHeap () returned 0x630000 [0051.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.672] GetProcessHeap () returned 0x630000 [0051.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.672] GetProcessHeap () returned 0x630000 [0051.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0051.672] GetProcessHeap () returned 0x630000 [0051.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0051.672] GetProcessHeap () returned 0x630000 [0051.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0051.672] GetProcessHeap () returned 0x630000 [0051.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0051.672] GetProcessHeap () returned 0x630000 [0051.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.672] GetProcessHeap () returned 0x630000 [0051.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.672] GetProcessHeap () returned 0x630000 [0051.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.672] GetProcessHeap () returned 0x630000 [0051.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.672] GetProcessHeap () returned 0x630000 [0051.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.672] GetProcessHeap () returned 0x630000 [0051.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.672] GetProcessHeap () returned 0x630000 [0051.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.672] GetProcessHeap () returned 0x630000 [0051.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.672] GetProcessHeap () returned 0x630000 [0051.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.672] GetProcessHeap () returned 0x630000 [0051.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.673] GetProcessHeap () returned 0x630000 [0051.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.673] GetProcessHeap () returned 0x630000 [0051.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.673] GetProcessHeap () returned 0x630000 [0051.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0051.673] GetProcessHeap () returned 0x630000 [0051.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0051.673] GetProcessHeap () returned 0x630000 [0051.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0051.673] GetProcessHeap () returned 0x630000 [0051.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0051.673] GetProcessHeap () returned 0x630000 [0051.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0051.673] GetProcessHeap () returned 0x630000 [0051.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0051.673] GetProcessHeap () returned 0x630000 [0051.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.673] GetProcessHeap () returned 0x630000 [0051.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.673] GetProcessHeap () returned 0x630000 [0051.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0051.673] GetProcessHeap () returned 0x630000 [0051.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0051.673] GetProcessHeap () returned 0x630000 [0051.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0051.673] GetProcessHeap () returned 0x630000 [0051.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0051.673] GetProcessHeap () returned 0x630000 [0051.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.673] GetProcessHeap () returned 0x630000 [0051.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.673] GetProcessHeap () returned 0x630000 [0051.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.673] GetProcessHeap () returned 0x630000 [0051.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.673] GetProcessHeap () returned 0x630000 [0051.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0051.674] GetProcessHeap () returned 0x630000 [0051.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0051.674] GetProcessHeap () returned 0x630000 [0051.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0051.674] GetProcessHeap () returned 0x630000 [0051.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0051.674] GetProcessHeap () returned 0x630000 [0051.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0051.674] GetProcessHeap () returned 0x630000 [0051.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0051.674] GetProcessHeap () returned 0x630000 [0051.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0051.674] GetProcessHeap () returned 0x630000 [0051.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0051.674] GetProcessHeap () returned 0x630000 [0051.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.674] GetProcessHeap () returned 0x630000 [0051.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.674] GetProcessHeap () returned 0x630000 [0051.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.674] GetProcessHeap () returned 0x630000 [0051.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.674] GetProcessHeap () returned 0x630000 [0051.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0051.674] GetProcessHeap () returned 0x630000 [0051.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0051.674] GetProcessHeap () returned 0x630000 [0051.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0051.674] GetProcessHeap () returned 0x630000 [0051.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0051.674] GetProcessHeap () returned 0x630000 [0051.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0051.674] GetProcessHeap () returned 0x630000 [0051.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0051.674] GetProcessHeap () returned 0x630000 [0051.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.674] GetProcessHeap () returned 0x630000 [0051.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.675] GetProcessHeap () returned 0x630000 [0051.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0051.675] GetProcessHeap () returned 0x630000 [0051.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.675] GetProcessHeap () returned 0x630000 [0051.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0051.675] GetProcessHeap () returned 0x630000 [0051.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0051.675] GetProcessHeap () returned 0x630000 [0051.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.675] GetProcessHeap () returned 0x630000 [0051.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.675] GetProcessHeap () returned 0x630000 [0051.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0051.675] GetProcessHeap () returned 0x630000 [0051.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0051.675] GetProcessHeap () returned 0x630000 [0051.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0051.675] GetProcessHeap () returned 0x630000 [0051.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0051.675] GetProcessHeap () returned 0x630000 [0051.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0051.675] GetProcessHeap () returned 0x630000 [0051.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6555c0 | out: hHeap=0x630000) returned 1 [0051.675] GetProcessHeap () returned 0x630000 [0051.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0051.675] GetProcessHeap () returned 0x630000 [0051.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6559b0 | out: hHeap=0x630000) returned 1 [0051.675] GetProcessHeap () returned 0x630000 [0051.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0051.675] GetProcessHeap () returned 0x630000 [0051.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0051.675] GetProcessHeap () returned 0x630000 [0051.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0051.675] WriteFile (in: hFile=0x230, lpBuffer=0x65cbe8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65cbe8*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0051.684] GetProcessHeap () returned 0x630000 [0051.684] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65cbe8, Size=0x30) returned 0x65cbe8 [0051.684] GetProcessHeap () returned 0x630000 [0051.684] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0051.684] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.684] GetProcessHeap () returned 0x630000 [0051.684] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x64c8) returned 0x65cc20 [0051.685] ReadFile (in: hFile=0x230, lpBuffer=0x65cc20, nNumberOfBytesToRead=0x64c8, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65cc20*, lpNumberOfBytesRead=0x243d7e8*=0x64c8, lpOverlapped=0x0) returned 1 [0051.686] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.686] WriteFile (in: hFile=0x230, lpBuffer=0x65cc20*, nNumberOfBytesToWrite=0x64c8, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65cc20*, lpNumberOfBytesWritten=0x243d7e4*=0x64c8, lpOverlapped=0x0) returned 1 [0051.687] GetProcessHeap () returned 0x630000 [0051.687] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cc20 | out: hHeap=0x630000) returned 1 [0051.687] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0051.687] WriteFile (in: hFile=0x230, lpBuffer=0x65cbe8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65cbe8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0051.688] CloseHandle (hObject=0x230) returned 1 [0051.689] GetProcessHeap () returned 0x630000 [0051.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0051.689] GetProcessHeap () returned 0x630000 [0051.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0051.689] GetProcessHeap () returned 0x630000 [0051.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0051.689] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\WinREBootApp64.exe" | out: lpString1="C:\\Windows10Upgrade\\WinREBootApp64.exe") returned="C:\\Windows10Upgrade\\WinREBootApp64.exe" [0051.689] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\WinREBootApp64.exe", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\WinREBootApp64.exe.happythreechoose") returned="C:\\Windows10Upgrade\\WinREBootApp64.exe.happythreechoose" [0051.690] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\WinREBootApp64.exe" (normalized: "c:\\windows10upgrade\\winrebootapp64.exe"), lpNewFileName="C:\\Windows10Upgrade\\WinREBootApp64.exe.happythreechoose" (normalized: "c:\\windows10upgrade\\winrebootapp64.exe.happythreechoose"), dwFlags=0x1) returned 1 [0051.690] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\WinREBootApp64.exe" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0051.690] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0051.690] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\Decryption INFO.html" [0051.690] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\decryption info.html")) returned 0x20 [0051.690] GetProcessHeap () returned 0x630000 [0051.690] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645d58 | out: hHeap=0x630000) returned 1 [0051.690] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6528e0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6528e0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x64c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WinREBootApp64.exe", cAlternateFileName="WINREB~2.EXE")) returned 0 [0051.690] FindClose (in: hFindFile=0x648b10 | out: hFindFile=0x648b10) returned 1 [0051.690] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Windows10Upgrade\\resources\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\") returned="C:\\Windows10Upgrade\\resources\\" [0051.691] GetProcessHeap () returned 0x630000 [0051.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x642310 | out: hHeap=0x630000) returned 1 [0051.691] GetProcessHeap () returned 0x630000 [0051.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.691] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\") returned 30 [0051.691] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\", lpString2="*" | out: lpString1="C:\\Windows10Upgrade\\resources\\*") returned="C:\\Windows10Upgrade\\resources\\*" [0051.691] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b3c1b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3b3c1b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648850 [0051.691] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0051.691] FindNextFileW (in: hFindFile=0x648850, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b3c1b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3b3c1b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.691] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0051.691] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0051.691] FindNextFileW (in: hFindFile=0x648850, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a5195, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3a5195, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="amd64", cAlternateFileName="")) returned 1 [0051.691] lstrcmpiW (lpString1="amd64", lpString2=".") returned 1 [0051.691] lstrcmpiW (lpString1="amd64", lpString2="..") returned 1 [0051.691] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\", lpString2="amd64" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64") returned="C:\\Windows10Upgrade\\resources\\amd64" [0051.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amd64", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0051.691] GetProcessHeap () returned 0x630000 [0051.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6) returned 0x65a368 [0051.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amd64", cchWideChar=-1, lpMultiByteStr=0x65a368, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amd64", lpUsedDefaultChar=0x0) returned 6 [0051.691] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0051.691] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0051.691] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0051.691] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0051.691] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0051.691] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0051.692] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0051.692] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0051.692] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0051.692] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0051.692] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0051.692] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0051.692] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0051.692] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0051.692] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0051.692] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0051.692] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0051.692] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0051.692] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0051.692] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0051.692] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0051.692] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0051.692] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0051.692] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 1 [0051.692] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0051.692] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0051.692] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 1 [0051.692] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0051.692] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0051.692] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0051.692] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0051.692] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 1 [0051.692] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0051.692] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0051.692] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0051.692] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0051.692] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0051.692] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0051.692] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0051.692] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0051.693] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0051.693] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0051.693] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0051.693] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64", lpString2="\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\") returned="C:\\Windows10Upgrade\\resources\\amd64\\" [0051.693] GetProcessHeap () returned 0x630000 [0051.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a308 [0051.693] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\amd64\\") returned 36 [0051.693] GetProcessHeap () returned 0x630000 [0051.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4a) returned 0x656300 [0051.693] lstrcpyW (in: lpString1=0x656300, lpString2="C:\\Windows10Upgrade\\resources\\amd64\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\") returned="C:\\Windows10Upgrade\\resources\\amd64\\" [0051.693] GetProcessHeap () returned 0x630000 [0051.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.693] FindNextFileW (in: hFindFile=0x648850, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3a78b4, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a78b4, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xc981b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hwcompatShared.txt", cAlternateFileName="HWCOMP~1.TXT")) returned 1 [0051.693] lstrcmpiW (lpString1="hwcompatShared.txt", lpString2=".") returned 1 [0051.693] lstrcmpiW (lpString1="hwcompatShared.txt", lpString2="..") returned 1 [0051.693] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\", lpString2="hwcompatShared.txt" | out: lpString1="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt") returned="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt" [0051.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwcompatShared.txt", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0051.693] GetProcessHeap () returned 0x630000 [0051.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x13) returned 0x645ff8 [0051.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwcompatShared.txt", cchWideChar=-1, lpMultiByteStr=0x645ff8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hwcompatShared.txt", lpUsedDefaultChar=0x0) returned 19 [0051.693] lstrlenA (lpString="hwcompatShared.txt") returned 18 [0051.693] lstrlenA (lpString=".happythreechoose") returned 17 [0051.693] lstrlenA (lpString=".happythreechoose") returned 17 [0051.693] lstrlenA (lpString="hwcompatShared.txt") returned 18 [0051.693] lstrcmpiA (lpString1="wcompatShared.txt", lpString2=".happythreechoose") returned 1 [0051.693] lstrcmpiW (lpString1="hwcompatShared.txt", lpString2="Decryption INFO.html") returned 1 [0051.693] lstrcmpiW (lpString1="hwcompatShared.txt", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0051.693] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0051.693] lstrcmpiW (lpString1="hwcompatShared.txt", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0051.693] GetProcessHeap () returned 0x630000 [0051.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0051.693] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt" (normalized: "c:\\windows10upgrade\\resources\\hwcompatshared.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0051.695] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=825371) returned 1 [0051.695] GetProcessHeap () returned 0x630000 [0051.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x63e830 [0051.695] GetProcessHeap () returned 0x630000 [0051.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0051.695] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt") returned 48 [0051.695] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0051.695] GetProcessHeap () returned 0x630000 [0051.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0051.695] GetProcessHeap () returned 0x630000 [0051.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x385) returned 0x65cc20 [0051.695] lstrlenA (lpString="rsa_encrypt") returned 11 [0051.695] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0051.696] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0051.696] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0051.696] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0051.696] GetProcessHeap () returned 0x630000 [0051.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0051.696] lstrlenA (lpString="010001") returned 6 [0051.696] GetProcessHeap () returned 0x630000 [0051.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a328 [0051.696] GetProcessHeap () returned 0x630000 [0051.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0051.696] GetProcessHeap () returned 0x630000 [0051.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x6556e0 [0051.696] GetProcessHeap () returned 0x630000 [0051.696] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0051.696] GetProcessHeap () returned 0x630000 [0051.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655890 [0051.696] GetProcessHeap () returned 0x630000 [0051.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656b80 [0051.696] GetProcessHeap () returned 0x630000 [0051.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a368 [0051.696] GetProcessHeap () returned 0x630000 [0051.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0051.696] GetProcessHeap () returned 0x630000 [0051.696] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.696] GetProcessHeap () returned 0x630000 [0051.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0051.696] GetProcessHeap () returned 0x630000 [0051.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0051.696] GetProcessHeap () returned 0x630000 [0051.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656a68 [0051.696] GetProcessHeap () returned 0x630000 [0051.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0051.696] GetProcessHeap () returned 0x630000 [0051.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0051.696] GetProcessHeap () returned 0x630000 [0051.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655b60 [0051.696] GetProcessHeap () returned 0x630000 [0051.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0051.697] GetProcessHeap () returned 0x630000 [0051.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0051.697] GetProcessHeap () returned 0x630000 [0051.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655b60 | out: hHeap=0x630000) returned 1 [0051.697] GetProcessHeap () returned 0x630000 [0051.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0051.697] GetProcessHeap () returned 0x630000 [0051.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0051.697] GetProcessHeap () returned 0x630000 [0051.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0051.697] GetProcessHeap () returned 0x630000 [0051.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.697] GetProcessHeap () returned 0x630000 [0051.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.697] GetProcessHeap () returned 0x630000 [0051.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.697] GetProcessHeap () returned 0x630000 [0051.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x6554a0 [0051.697] GetProcessHeap () returned 0x630000 [0051.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0051.697] GetProcessHeap () returned 0x630000 [0051.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0051.697] GetProcessHeap () returned 0x630000 [0051.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6554a0 | out: hHeap=0x630000) returned 1 [0051.697] GetProcessHeap () returned 0x630000 [0051.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.697] GetProcessHeap () returned 0x630000 [0051.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.697] GetProcessHeap () returned 0x630000 [0051.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0051.697] GetProcessHeap () returned 0x630000 [0051.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0051.697] GetProcessHeap () returned 0x630000 [0051.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.697] GetProcessHeap () returned 0x630000 [0051.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.697] GetProcessHeap () returned 0x630000 [0051.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0051.697] GetProcessHeap () returned 0x630000 [0051.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.698] GetProcessHeap () returned 0x630000 [0051.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0051.698] GetProcessHeap () returned 0x630000 [0051.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0051.698] GetProcessHeap () returned 0x630000 [0051.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0051.698] GetProcessHeap () returned 0x630000 [0051.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0051.698] GetProcessHeap () returned 0x630000 [0051.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.698] GetProcessHeap () returned 0x630000 [0051.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.698] GetProcessHeap () returned 0x630000 [0051.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0051.698] GetProcessHeap () returned 0x630000 [0051.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0051.698] GetProcessHeap () returned 0x630000 [0051.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0051.698] GetProcessHeap () returned 0x630000 [0051.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0051.698] GetProcessHeap () returned 0x630000 [0051.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0051.698] GetProcessHeap () returned 0x630000 [0051.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0051.698] GetProcessHeap () returned 0x630000 [0051.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.698] GetProcessHeap () returned 0x630000 [0051.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.698] GetProcessHeap () returned 0x630000 [0051.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0051.698] GetProcessHeap () returned 0x630000 [0051.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0051.698] GetProcessHeap () returned 0x630000 [0051.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.698] GetProcessHeap () returned 0x630000 [0051.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.698] GetProcessHeap () returned 0x630000 [0051.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0051.699] GetProcessHeap () returned 0x630000 [0051.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0051.699] GetProcessHeap () returned 0x630000 [0051.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0051.699] GetProcessHeap () returned 0x630000 [0051.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0051.699] GetProcessHeap () returned 0x630000 [0051.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.699] GetProcessHeap () returned 0x630000 [0051.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.699] GetProcessHeap () returned 0x630000 [0051.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.699] GetProcessHeap () returned 0x630000 [0051.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.699] GetProcessHeap () returned 0x630000 [0051.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0051.699] GetProcessHeap () returned 0x630000 [0051.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0051.699] GetProcessHeap () returned 0x630000 [0051.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0051.699] GetProcessHeap () returned 0x630000 [0051.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0051.699] GetProcessHeap () returned 0x630000 [0051.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0051.699] GetProcessHeap () returned 0x630000 [0051.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.699] GetProcessHeap () returned 0x630000 [0051.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0051.699] GetProcessHeap () returned 0x630000 [0051.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0051.699] GetProcessHeap () returned 0x630000 [0051.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0051.699] GetProcessHeap () returned 0x630000 [0051.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0051.699] GetProcessHeap () returned 0x630000 [0051.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.699] GetProcessHeap () returned 0x630000 [0051.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.700] GetProcessHeap () returned 0x630000 [0051.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.700] GetProcessHeap () returned 0x630000 [0051.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.700] GetProcessHeap () returned 0x630000 [0051.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0051.700] GetProcessHeap () returned 0x630000 [0051.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0051.700] GetProcessHeap () returned 0x630000 [0051.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0051.700] GetProcessHeap () returned 0x630000 [0051.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0051.700] GetProcessHeap () returned 0x630000 [0051.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0051.700] GetProcessHeap () returned 0x630000 [0051.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0051.700] GetProcessHeap () returned 0x630000 [0051.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0051.700] GetProcessHeap () returned 0x630000 [0051.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0051.700] GetProcessHeap () returned 0x630000 [0051.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.700] GetProcessHeap () returned 0x630000 [0051.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.700] GetProcessHeap () returned 0x630000 [0051.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0051.700] GetProcessHeap () returned 0x630000 [0051.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0051.700] GetProcessHeap () returned 0x630000 [0051.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0051.700] GetProcessHeap () returned 0x630000 [0051.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0051.700] GetProcessHeap () returned 0x630000 [0051.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.700] GetProcessHeap () returned 0x630000 [0051.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.700] GetProcessHeap () returned 0x630000 [0051.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0051.701] GetProcessHeap () returned 0x630000 [0051.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0051.701] GetProcessHeap () returned 0x630000 [0051.701] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.701] GetProcessHeap () returned 0x630000 [0051.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.701] GetProcessHeap () returned 0x630000 [0051.701] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0051.701] GetProcessHeap () returned 0x630000 [0051.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.701] GetProcessHeap () returned 0x630000 [0051.701] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0051.701] GetProcessHeap () returned 0x630000 [0051.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0051.701] GetProcessHeap () returned 0x630000 [0051.701] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.701] GetProcessHeap () returned 0x630000 [0051.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.701] GetProcessHeap () returned 0x630000 [0051.701] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.701] GetProcessHeap () returned 0x630000 [0051.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.701] GetProcessHeap () returned 0x630000 [0051.701] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.701] GetProcessHeap () returned 0x630000 [0051.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.701] GetProcessHeap () returned 0x630000 [0051.701] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.701] GetProcessHeap () returned 0x630000 [0051.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.701] GetProcessHeap () returned 0x630000 [0051.701] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0051.701] GetProcessHeap () returned 0x630000 [0051.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.701] GetProcessHeap () returned 0x630000 [0051.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0051.701] GetProcessHeap () returned 0x630000 [0051.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0051.701] GetProcessHeap () returned 0x630000 [0051.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0051.702] GetProcessHeap () returned 0x630000 [0051.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0051.702] GetProcessHeap () returned 0x630000 [0051.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0051.702] GetProcessHeap () returned 0x630000 [0051.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655890 | out: hHeap=0x630000) returned 1 [0051.702] GetProcessHeap () returned 0x630000 [0051.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0051.702] GetProcessHeap () returned 0x630000 [0051.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6556e0 | out: hHeap=0x630000) returned 1 [0051.702] GetProcessHeap () returned 0x630000 [0051.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0051.702] GetProcessHeap () returned 0x630000 [0051.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0051.702] GetProcessHeap () returned 0x630000 [0051.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0051.702] WriteFile (in: hFile=0x230, lpBuffer=0x65cc20*, nNumberOfBytesToWrite=0x385, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65cc20*, lpNumberOfBytesWritten=0x243d864*=0x385, lpOverlapped=0x0) returned 1 [0051.705] GetProcessHeap () returned 0x630000 [0051.705] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65cc20, Size=0x30) returned 0x65cc20 [0051.705] GetProcessHeap () returned 0x630000 [0051.705] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0051.705] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.705] GetProcessHeap () returned 0x630000 [0051.705] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc9820) returned 0x244a020 [0051.720] ReadFile (in: hFile=0x230, lpBuffer=0x244a020, nNumberOfBytesToRead=0xc9820, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x244a020*, lpNumberOfBytesRead=0x243d7e8*=0xc9820, lpOverlapped=0x0) returned 1 [0051.730] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.730] WriteFile (in: hFile=0x230, lpBuffer=0x244a020*, nNumberOfBytesToWrite=0xc9820, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x244a020*, lpNumberOfBytesWritten=0x243d7e4*=0xc9820, lpOverlapped=0x0) returned 1 [0051.761] GetProcessHeap () returned 0x630000 [0051.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x244a020 | out: hHeap=0x630000) returned 1 [0051.765] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0051.765] WriteFile (in: hFile=0x230, lpBuffer=0x65cc20*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65cc20*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0051.766] CloseHandle (hObject=0x230) returned 1 [0051.779] GetProcessHeap () returned 0x630000 [0051.779] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0051.779] GetProcessHeap () returned 0x630000 [0051.779] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0051.779] GetProcessHeap () returned 0x630000 [0051.779] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0051.780] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt" | out: lpString1="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt") returned="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt" [0051.780] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt.happythreechoose" [0051.780] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt" (normalized: "c:\\windows10upgrade\\resources\\hwcompatshared.txt"), lpNewFileName="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\hwcompatshared.txt.happythreechoose"), dwFlags=0x1) returned 1 [0051.780] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt" | out: pszPath="C:\\Windows10Upgrade\\resources") returned 1 [0051.780] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources" | out: pszPath="C:\\Windows10Upgrade\\resources\\") returned="" [0051.780] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\Decryption INFO.html" [0051.780] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\decryption info.html")) returned 0xffffffff [0051.780] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0051.783] GetProcessHeap () returned 0x630000 [0051.783] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x63e830 [0051.783] GetProcessHeap () returned 0x630000 [0051.783] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0051.790] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.791] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.791] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.791] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.791] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.791] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.793] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.793] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.793] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.793] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.793] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.793] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.793] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.793] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.793] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.793] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.793] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.793] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.793] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.794] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.794] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.794] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.794] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.794] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.794] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.794] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.795] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.795] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.795] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.795] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.795] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.795] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.795] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.795] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.795] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.795] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.795] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.796] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.796] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.796] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.796] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.796] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.796] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.796] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.796] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.796] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.796] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.796] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.796] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.796] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.796] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.796] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.797] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.797] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.797] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.797] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.797] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.797] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.797] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.797] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.797] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.797] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.797] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.797] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.797] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.797] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.798] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.798] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.798] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.798] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.798] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.798] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.798] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.798] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.798] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.798] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.798] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.798] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.798] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.799] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.799] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.799] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.799] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.799] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.799] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.799] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.799] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.799] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.799] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.799] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.799] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.799] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.799] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.800] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.800] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.800] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.800] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.800] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.800] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.800] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.800] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.800] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.800] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.800] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.800] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.800] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.800] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.801] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.801] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.801] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.801] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.801] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.801] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.801] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.801] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.801] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.801] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.801] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.801] GetProcessHeap () returned 0x630000 [0051.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0051.801] GetProcessHeap () returned 0x630000 [0051.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0051.801] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0051.802] GetProcessHeap () returned 0x630000 [0051.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x63e830 [0051.802] GetProcessHeap () returned 0x630000 [0051.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0051.809] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.809] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.809] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.809] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.809] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.809] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.809] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.809] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.809] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.809] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.810] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.810] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.810] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.810] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.810] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.810] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.810] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.810] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.810] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.810] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.810] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.810] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.810] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.810] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.810] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.811] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.811] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.811] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.811] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.811] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.811] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.811] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.811] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.811] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.811] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.811] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.811] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.811] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.811] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.812] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.812] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.812] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.812] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.812] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.812] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.812] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.812] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.812] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.812] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.812] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.812] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.812] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.812] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.813] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.813] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.813] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.813] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.813] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.813] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.813] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.813] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.813] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.813] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.813] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.813] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.813] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.813] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.814] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.814] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.814] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.814] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.814] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.814] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.814] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.814] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.814] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.814] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.814] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.815] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.815] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.815] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.815] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.815] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.815] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.815] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.815] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.815] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.815] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.815] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.815] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.815] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.815] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.816] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.816] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.816] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.816] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.816] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.816] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.817] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.817] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.817] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.817] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.817] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.817] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.818] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.818] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.818] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.818] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.818] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.818] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.818] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.818] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.818] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.818] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.818] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.818] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.818] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.819] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.819] GetProcessHeap () returned 0x630000 [0051.819] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0051.820] GetProcessHeap () returned 0x630000 [0051.820] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0051.820] CloseHandle (hObject=0x230) returned 1 [0051.820] GetProcessHeap () returned 0x630000 [0051.820] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645ff8 | out: hHeap=0x630000) returned 1 [0051.820] FindNextFileW (in: hFindFile=0x648850, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3a9fd3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b1515, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3b1515, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="i386", cAlternateFileName="")) returned 1 [0051.820] lstrcmpiW (lpString1="i386", lpString2=".") returned 1 [0051.820] lstrcmpiW (lpString1="i386", lpString2="..") returned 1 [0051.820] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\", lpString2="i386" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386") returned="C:\\Windows10Upgrade\\resources\\i386" [0051.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i386", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0051.820] GetProcessHeap () returned 0x630000 [0051.820] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5) returned 0x65a2a8 [0051.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i386", cchWideChar=-1, lpMultiByteStr=0x65a2a8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="i386", lpUsedDefaultChar=0x0) returned 5 [0051.820] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0051.820] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0051.820] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0051.820] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0051.820] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0051.820] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0051.820] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0051.820] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0051.820] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0051.820] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0051.820] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0051.821] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0051.821] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0051.821] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0051.821] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0051.821] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0051.821] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0051.821] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0051.821] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0051.821] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0051.821] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0051.821] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0051.821] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0051.821] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0051.821] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0051.821] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0051.821] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0051.821] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0051.821] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0051.821] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0051.821] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0051.821] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0051.821] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0051.821] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0051.821] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0051.821] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0051.821] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0051.821] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0051.821] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0051.821] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0051.821] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0051.821] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0051.821] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0051.821] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386", lpString2="\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\") returned="C:\\Windows10Upgrade\\resources\\i386\\" [0051.821] GetProcessHeap () returned 0x630000 [0051.821] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a328 [0051.822] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\i386\\") returned 35 [0051.822] GetProcessHeap () returned 0x630000 [0051.822] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x48) returned 0x653ca0 [0051.822] lstrcpyW (in: lpString1=0x653ca0, lpString2="C:\\Windows10Upgrade\\resources\\i386\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\") returned="C:\\Windows10Upgrade\\resources\\i386\\" [0051.822] GetProcessHeap () returned 0x630000 [0051.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0051.822] FindNextFileW (in: hFindFile=0x648850, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3b3c1b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea63c947, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ux", cAlternateFileName="")) returned 1 [0051.822] lstrcmpiW (lpString1="ux", lpString2=".") returned 1 [0051.822] lstrcmpiW (lpString1="ux", lpString2="..") returned 1 [0051.822] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\", lpString2="ux" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0051.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ux", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0051.822] GetProcessHeap () returned 0x630000 [0051.822] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3) returned 0x65a2b8 [0051.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ux", cchWideChar=-1, lpMultiByteStr=0x65a2b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ux", lpUsedDefaultChar=0x0) returned 3 [0051.822] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0051.822] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0051.822] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0051.822] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0051.822] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0051.822] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0051.822] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0051.822] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0051.822] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0051.822] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0051.822] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0051.822] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0051.822] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0051.822] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0051.822] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0051.822] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0051.822] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0051.822] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0051.822] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0051.822] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0051.823] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0051.823] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0051.823] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0051.823] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0051.823] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 3 [0051.823] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 3 [0051.823] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0051.823] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0051.823] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 3 [0051.823] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 3 [0051.823] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 3 [0051.823] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0051.823] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0051.823] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0051.823] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0051.823] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0051.823] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0051.823] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0051.823] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0051.823] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0051.823] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0051.823] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0051.823] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0051.823] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux", lpString2="\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0051.823] GetProcessHeap () returned 0x630000 [0051.823] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a278 [0051.823] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\") returned 33 [0051.823] GetProcessHeap () returned 0x630000 [0051.823] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x44) returned 0x653de0 [0051.823] lstrcpyW (in: lpString1=0x653de0, lpString2="C:\\Windows10Upgrade\\resources\\ux\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0051.823] GetProcessHeap () returned 0x630000 [0051.823] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0051.823] FindNextFileW (in: hFindFile=0x648850, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3b3c1b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea63c947, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ux", cAlternateFileName="")) returned 0 [0051.823] FindClose (in: hFindFile=0x648850 | out: hFindFile=0x648850) returned 1 [0051.824] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0051.824] GetProcessHeap () returned 0x630000 [0051.824] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653de0 | out: hHeap=0x630000) returned 1 [0051.824] GetProcessHeap () returned 0x630000 [0051.824] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0051.824] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\") returned 33 [0051.824] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="*" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\*") returned="C:\\Windows10Upgrade\\resources\\ux\\*" [0051.824] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3b3c1b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea63c947, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6486d0 [0051.826] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0051.826] FindNextFileW (in: hFindFile=0x6486d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3b3c1b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea63c947, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.826] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0051.826] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0051.826] FindNextFileW (in: hFindFile=0x6486d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b4fa7, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b4fa7, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x397, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="block.png", cAlternateFileName="")) returned 1 [0051.826] lstrcmpiW (lpString1="block.png", lpString2=".") returned 1 [0051.826] lstrcmpiW (lpString1="block.png", lpString2="..") returned 1 [0051.826] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="block.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\block.png") returned="C:\\Windows10Upgrade\\resources\\ux\\block.png" [0051.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="block.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0051.826] GetProcessHeap () returned 0x630000 [0051.826] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x64c9f0 [0051.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="block.png", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="block.png", lpUsedDefaultChar=0x0) returned 10 [0051.826] lstrlenA (lpString="block.png") returned 9 [0051.826] lstrlenA (lpString=".happythreechoose") returned 17 [0051.826] lstrcmpiW (lpString1="block.png", lpString2="Decryption INFO.html") returned -1 [0051.826] lstrcmpiW (lpString1="block.png", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0051.826] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0051.826] lstrcmpiW (lpString1="block.png", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0051.826] GetProcessHeap () returned 0x630000 [0051.826] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0051.826] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\block.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\block.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0051.827] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=919) returned 1 [0051.827] GetProcessHeap () returned 0x630000 [0051.827] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x63e830 [0051.827] GetProcessHeap () returned 0x630000 [0051.827] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0051.827] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\block.png") returned 42 [0051.827] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0051.827] GetProcessHeap () returned 0x630000 [0051.827] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0051.827] GetProcessHeap () returned 0x630000 [0051.827] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x389) returned 0x65cc58 [0051.827] lstrlenA (lpString="rsa_encrypt") returned 11 [0051.827] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0051.828] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0051.828] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0051.828] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0051.828] GetProcessHeap () returned 0x630000 [0051.828] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0051.828] lstrlenA (lpString="010001") returned 6 [0051.828] GetProcessHeap () returned 0x630000 [0051.828] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0051.828] GetProcessHeap () returned 0x630000 [0051.828] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0051.828] GetProcessHeap () returned 0x630000 [0051.828] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655920 [0051.828] GetProcessHeap () returned 0x630000 [0051.828] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0051.828] GetProcessHeap () returned 0x630000 [0051.828] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655650 [0051.828] GetProcessHeap () returned 0x630000 [0051.828] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657558 [0051.828] GetProcessHeap () returned 0x630000 [0051.828] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2b8 [0051.828] GetProcessHeap () returned 0x630000 [0051.828] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0051.828] GetProcessHeap () returned 0x630000 [0051.828] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0051.828] GetProcessHeap () returned 0x630000 [0051.829] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0051.829] GetProcessHeap () returned 0x630000 [0051.829] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0051.829] GetProcessHeap () returned 0x630000 [0051.829] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656a68 [0051.829] GetProcessHeap () returned 0x630000 [0051.829] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0051.829] GetProcessHeap () returned 0x630000 [0051.829] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0051.829] GetProcessHeap () returned 0x630000 [0051.829] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655ec0 [0051.829] GetProcessHeap () returned 0x630000 [0051.829] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0051.829] GetProcessHeap () returned 0x630000 [0051.829] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0051.829] GetProcessHeap () returned 0x630000 [0051.829] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655ec0 | out: hHeap=0x630000) returned 1 [0051.829] GetProcessHeap () returned 0x630000 [0051.829] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.829] GetProcessHeap () returned 0x630000 [0051.829] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65b2f0 [0051.829] GetProcessHeap () returned 0x630000 [0051.829] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0051.829] GetProcessHeap () returned 0x630000 [0051.829] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.829] GetProcessHeap () returned 0x630000 [0051.829] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.829] GetProcessHeap () returned 0x630000 [0051.829] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.829] GetProcessHeap () returned 0x630000 [0051.829] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x655770 [0051.829] GetProcessHeap () returned 0x630000 [0051.829] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b2f0 | out: hHeap=0x630000) returned 1 [0051.829] GetProcessHeap () returned 0x630000 [0051.829] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0051.829] GetProcessHeap () returned 0x630000 [0051.829] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655770 | out: hHeap=0x630000) returned 1 [0051.829] GetProcessHeap () returned 0x630000 [0051.829] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0051.830] GetProcessHeap () returned 0x630000 [0051.830] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.830] GetProcessHeap () returned 0x630000 [0051.830] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0051.830] GetProcessHeap () returned 0x630000 [0051.830] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0051.830] GetProcessHeap () returned 0x630000 [0051.830] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.830] GetProcessHeap () returned 0x630000 [0051.830] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.830] GetProcessHeap () returned 0x630000 [0051.830] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0051.830] GetProcessHeap () returned 0x630000 [0051.830] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0051.830] GetProcessHeap () returned 0x630000 [0051.830] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0051.830] GetProcessHeap () returned 0x630000 [0051.830] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.830] GetProcessHeap () returned 0x630000 [0051.830] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.830] GetProcessHeap () returned 0x630000 [0051.830] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.830] GetProcessHeap () returned 0x630000 [0051.830] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.830] GetProcessHeap () returned 0x630000 [0051.830] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.830] GetProcessHeap () returned 0x630000 [0051.830] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0051.830] GetProcessHeap () returned 0x630000 [0051.830] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0051.830] GetProcessHeap () returned 0x630000 [0051.830] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.830] GetProcessHeap () returned 0x630000 [0051.830] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.830] GetProcessHeap () returned 0x630000 [0051.830] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.830] GetProcessHeap () returned 0x630000 [0051.830] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.831] GetProcessHeap () returned 0x630000 [0051.831] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.831] GetProcessHeap () returned 0x630000 [0051.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.831] GetProcessHeap () returned 0x630000 [0051.831] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.831] GetProcessHeap () returned 0x630000 [0051.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.831] GetProcessHeap () returned 0x630000 [0051.831] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0051.831] GetProcessHeap () returned 0x630000 [0051.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0051.831] GetProcessHeap () returned 0x630000 [0051.831] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.831] GetProcessHeap () returned 0x630000 [0051.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.831] GetProcessHeap () returned 0x630000 [0051.831] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.831] GetProcessHeap () returned 0x630000 [0051.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.831] GetProcessHeap () returned 0x630000 [0051.831] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0051.831] GetProcessHeap () returned 0x630000 [0051.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0051.831] GetProcessHeap () returned 0x630000 [0051.831] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0051.831] GetProcessHeap () returned 0x630000 [0051.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0051.831] GetProcessHeap () returned 0x630000 [0051.831] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0051.831] GetProcessHeap () returned 0x630000 [0051.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0051.831] GetProcessHeap () returned 0x630000 [0051.831] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.831] GetProcessHeap () returned 0x630000 [0051.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.832] GetProcessHeap () returned 0x630000 [0051.832] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0051.832] GetProcessHeap () returned 0x630000 [0051.832] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0051.832] GetProcessHeap () returned 0x630000 [0051.832] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.832] GetProcessHeap () returned 0x630000 [0051.832] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.832] GetProcessHeap () returned 0x630000 [0051.832] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.832] GetProcessHeap () returned 0x630000 [0051.832] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.832] GetProcessHeap () returned 0x630000 [0051.832] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.832] GetProcessHeap () returned 0x630000 [0051.832] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.832] GetProcessHeap () returned 0x630000 [0051.832] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.832] GetProcessHeap () returned 0x630000 [0051.832] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.832] GetProcessHeap () returned 0x630000 [0051.832] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.832] GetProcessHeap () returned 0x630000 [0051.832] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.832] GetProcessHeap () returned 0x630000 [0051.832] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0051.832] GetProcessHeap () returned 0x630000 [0051.832] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0051.832] GetProcessHeap () returned 0x630000 [0051.832] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0051.832] GetProcessHeap () returned 0x630000 [0051.832] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0051.832] GetProcessHeap () returned 0x630000 [0051.832] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.832] GetProcessHeap () returned 0x630000 [0051.832] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.832] GetProcessHeap () returned 0x630000 [0051.832] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.832] GetProcessHeap () returned 0x630000 [0051.833] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.833] GetProcessHeap () returned 0x630000 [0051.833] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.833] GetProcessHeap () returned 0x630000 [0051.833] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.833] GetProcessHeap () returned 0x630000 [0051.833] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0051.833] GetProcessHeap () returned 0x630000 [0051.833] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0051.833] GetProcessHeap () returned 0x630000 [0051.833] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.833] GetProcessHeap () returned 0x630000 [0051.833] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.833] GetProcessHeap () returned 0x630000 [0051.833] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.833] GetProcessHeap () returned 0x630000 [0051.833] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.833] GetProcessHeap () returned 0x630000 [0051.833] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.833] GetProcessHeap () returned 0x630000 [0051.833] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.833] GetProcessHeap () returned 0x630000 [0051.833] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.833] GetProcessHeap () returned 0x630000 [0051.833] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.833] GetProcessHeap () returned 0x630000 [0051.833] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.833] GetProcessHeap () returned 0x630000 [0051.833] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.833] GetProcessHeap () returned 0x630000 [0051.833] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0051.833] GetProcessHeap () returned 0x630000 [0051.833] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.833] GetProcessHeap () returned 0x630000 [0051.833] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.833] GetProcessHeap () returned 0x630000 [0051.833] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.833] GetProcessHeap () returned 0x630000 [0051.834] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.834] GetProcessHeap () returned 0x630000 [0051.834] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.834] GetProcessHeap () returned 0x630000 [0051.834] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.834] GetProcessHeap () returned 0x630000 [0051.834] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.834] GetProcessHeap () returned 0x630000 [0051.834] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0051.834] GetProcessHeap () returned 0x630000 [0051.834] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0051.834] GetProcessHeap () returned 0x630000 [0051.834] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0051.834] GetProcessHeap () returned 0x630000 [0051.834] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0051.834] GetProcessHeap () returned 0x630000 [0051.834] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0051.834] GetProcessHeap () returned 0x630000 [0051.834] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0051.834] GetProcessHeap () returned 0x630000 [0051.834] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0051.834] GetProcessHeap () returned 0x630000 [0051.834] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655650 | out: hHeap=0x630000) returned 1 [0051.834] GetProcessHeap () returned 0x630000 [0051.834] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0051.834] GetProcessHeap () returned 0x630000 [0051.834] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655920 | out: hHeap=0x630000) returned 1 [0051.834] GetProcessHeap () returned 0x630000 [0051.834] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0051.834] GetProcessHeap () returned 0x630000 [0051.834] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0051.834] GetProcessHeap () returned 0x630000 [0051.835] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0051.835] WriteFile (in: hFile=0x230, lpBuffer=0x65cc58*, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65cc58*, lpNumberOfBytesWritten=0x243d864*=0x389, lpOverlapped=0x0) returned 1 [0051.839] GetProcessHeap () returned 0x630000 [0051.839] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65cc58, Size=0x30) returned 0x65cc58 [0051.839] GetProcessHeap () returned 0x630000 [0051.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0051.839] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.839] GetProcessHeap () returned 0x630000 [0051.839] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3a0) returned 0x65cc90 [0051.839] ReadFile (in: hFile=0x230, lpBuffer=0x65cc90, nNumberOfBytesToRead=0x3a0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65cc90*, lpNumberOfBytesRead=0x243d7e8*=0x3a0, lpOverlapped=0x0) returned 1 [0051.839] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.839] WriteFile (in: hFile=0x230, lpBuffer=0x65cc90*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65cc90*, lpNumberOfBytesWritten=0x243d7e4*=0x3a0, lpOverlapped=0x0) returned 1 [0051.840] GetProcessHeap () returned 0x630000 [0051.840] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cc90 | out: hHeap=0x630000) returned 1 [0051.840] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0051.840] WriteFile (in: hFile=0x230, lpBuffer=0x65cc58*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65cc58*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0051.841] CloseHandle (hObject=0x230) returned 1 [0051.842] GetProcessHeap () returned 0x630000 [0051.842] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0051.842] GetProcessHeap () returned 0x630000 [0051.842] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0051.842] GetProcessHeap () returned 0x630000 [0051.842] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0051.842] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\block.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\block.png") returned="C:\\Windows10Upgrade\\resources\\ux\\block.png" [0051.842] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\block.png", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\block.png.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\block.png.happythreechoose" [0051.842] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\block.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\block.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\block.png.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\block.png.happythreechoose"), dwFlags=0x1) returned 1 [0051.843] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\block.png" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0051.843] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0051.843] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html" [0051.843] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\decryption info.html")) returned 0xffffffff [0051.843] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0051.844] GetProcessHeap () returned 0x630000 [0051.844] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x63e830 [0051.844] GetProcessHeap () returned 0x630000 [0051.844] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0051.852] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.853] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.853] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.853] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.853] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.853] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.853] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.853] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.853] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.853] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.853] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.853] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.853] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.854] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.854] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.854] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.854] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.854] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.854] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.854] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.854] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.854] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.854] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.854] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.854] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.854] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.855] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.855] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.855] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.855] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.855] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.855] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.855] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.855] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.855] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.855] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.855] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.856] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.856] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.856] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.856] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.856] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.856] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.856] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.856] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.857] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.857] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.857] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.857] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.857] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.857] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.857] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.857] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.857] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.857] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.857] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.857] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.857] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.858] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.858] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.858] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.858] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.861] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.861] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.861] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.861] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.861] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.861] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.861] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.861] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.862] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.862] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.862] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.862] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.862] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.862] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.862] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.862] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.862] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.862] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.862] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.862] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.862] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.862] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.863] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.863] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.863] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.863] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.863] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.863] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.863] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.863] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.863] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.863] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.863] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.863] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.863] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.863] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.864] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.864] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.864] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.864] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.864] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.864] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.864] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.864] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.864] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.864] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.864] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.864] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.864] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.864] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.865] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.865] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.865] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.865] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.865] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.865] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.865] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.865] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.865] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.865] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.865] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.865] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.865] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.865] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.866] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.866] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.869] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.869] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.869] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.869] GetProcessHeap () returned 0x630000 [0051.869] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0051.869] GetProcessHeap () returned 0x630000 [0051.869] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0051.869] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0051.869] GetProcessHeap () returned 0x630000 [0051.869] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x63e830 [0051.869] GetProcessHeap () returned 0x630000 [0051.869] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0051.876] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.876] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.876] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.876] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.881] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.881] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.881] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.881] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.881] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.881] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.881] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.881] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.881] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.881] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.881] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.917] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.917] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.917] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.917] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.917] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.917] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.917] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.917] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.917] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.917] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.917] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.918] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.918] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.918] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.918] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.918] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.918] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.918] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.918] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.918] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.918] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.918] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.918] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.918] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.918] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.919] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.919] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.919] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.919] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.919] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.919] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.919] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.919] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.919] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.919] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.919] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.919] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.919] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.919] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.920] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.920] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.920] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.920] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.920] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.920] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.920] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.920] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0051.921] GetProcessHeap () returned 0x630000 [0051.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0051.921] GetProcessHeap () returned 0x630000 [0051.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0051.921] CloseHandle (hObject=0x230) returned 1 [0051.921] GetProcessHeap () returned 0x630000 [0051.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0051.921] FindNextFileW (in: hFindFile=0x6486d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b8a24, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b8a24, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x749e0600, ftLastWriteTime.dwHighDateTime=0x1d2ea8c, nFileSizeHigh=0x0, nFileSizeLow=0x1ba8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bluelogo.png", cAlternateFileName="")) returned 1 [0051.921] lstrcmpiW (lpString1="bluelogo.png", lpString2=".") returned 1 [0051.921] lstrcmpiW (lpString1="bluelogo.png", lpString2="..") returned 1 [0051.921] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="bluelogo.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png") returned="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png" [0051.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bluelogo.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0051.922] GetProcessHeap () returned 0x630000 [0051.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd) returned 0x64c9f0 [0051.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bluelogo.png", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bluelogo.png", lpUsedDefaultChar=0x0) returned 13 [0051.922] lstrlenA (lpString="bluelogo.png") returned 12 [0051.922] lstrlenA (lpString=".happythreechoose") returned 17 [0051.922] lstrcmpiW (lpString1="bluelogo.png", lpString2="Decryption INFO.html") returned -1 [0051.922] lstrcmpiW (lpString1="bluelogo.png", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0051.922] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0051.922] lstrcmpiW (lpString1="bluelogo.png", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0051.922] GetProcessHeap () returned 0x630000 [0051.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0051.922] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bluelogo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0051.924] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=7080) returned 1 [0051.924] GetProcessHeap () returned 0x630000 [0051.924] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x63e830 [0051.924] GetProcessHeap () returned 0x630000 [0051.924] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0051.924] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png") returned 45 [0051.924] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0051.924] GetProcessHeap () returned 0x630000 [0051.924] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0051.924] GetProcessHeap () returned 0x630000 [0051.924] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x388) returned 0x65cc90 [0051.925] lstrlenA (lpString="rsa_encrypt") returned 11 [0051.925] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0051.925] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0051.925] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0051.925] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0051.925] GetProcessHeap () returned 0x630000 [0051.925] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0051.925] lstrlenA (lpString="010001") returned 6 [0051.925] GetProcessHeap () returned 0x630000 [0051.925] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a398 [0051.925] GetProcessHeap () returned 0x630000 [0051.925] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0051.925] GetProcessHeap () returned 0x630000 [0051.925] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655140 [0051.925] GetProcessHeap () returned 0x630000 [0051.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0051.925] GetProcessHeap () returned 0x630000 [0051.926] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655530 [0051.926] GetProcessHeap () returned 0x630000 [0051.926] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656a68 [0051.926] GetProcessHeap () returned 0x630000 [0051.926] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2b8 [0051.926] GetProcessHeap () returned 0x630000 [0051.926] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0051.926] GetProcessHeap () returned 0x630000 [0051.926] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0051.926] GetProcessHeap () returned 0x630000 [0051.926] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0051.926] GetProcessHeap () returned 0x630000 [0051.926] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0051.926] GetProcessHeap () returned 0x630000 [0051.926] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656fe0 [0051.926] GetProcessHeap () returned 0x630000 [0051.926] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.926] GetProcessHeap () returned 0x630000 [0051.926] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0051.926] GetProcessHeap () returned 0x630000 [0051.926] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655410 [0051.926] GetProcessHeap () returned 0x630000 [0051.926] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0051.926] GetProcessHeap () returned 0x630000 [0051.926] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0051.926] GetProcessHeap () returned 0x630000 [0051.926] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655410 | out: hHeap=0x630000) returned 1 [0051.926] GetProcessHeap () returned 0x630000 [0051.926] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.926] GetProcessHeap () returned 0x630000 [0051.926] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65b278 [0051.926] GetProcessHeap () returned 0x630000 [0051.926] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.926] GetProcessHeap () returned 0x630000 [0051.926] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.926] GetProcessHeap () returned 0x630000 [0051.926] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0051.926] GetProcessHeap () returned 0x630000 [0051.926] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0051.926] GetProcessHeap () returned 0x630000 [0051.927] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x655a40 [0051.927] GetProcessHeap () returned 0x630000 [0051.927] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b278 | out: hHeap=0x630000) returned 1 [0051.927] GetProcessHeap () returned 0x630000 [0051.927] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0051.927] GetProcessHeap () returned 0x630000 [0051.927] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655a40 | out: hHeap=0x630000) returned 1 [0051.927] GetProcessHeap () returned 0x630000 [0051.927] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0051.927] GetProcessHeap () returned 0x630000 [0051.927] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0051.927] GetProcessHeap () returned 0x630000 [0051.927] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0051.927] GetProcessHeap () returned 0x630000 [0051.927] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.927] GetProcessHeap () returned 0x630000 [0051.927] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.927] GetProcessHeap () returned 0x630000 [0051.927] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.927] GetProcessHeap () returned 0x630000 [0051.927] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.927] GetProcessHeap () returned 0x630000 [0051.927] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.927] GetProcessHeap () returned 0x630000 [0051.927] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.927] GetProcessHeap () returned 0x630000 [0051.927] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.927] GetProcessHeap () returned 0x630000 [0051.927] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.927] GetProcessHeap () returned 0x630000 [0051.927] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.927] GetProcessHeap () returned 0x630000 [0051.927] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0051.927] GetProcessHeap () returned 0x630000 [0051.927] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0051.927] GetProcessHeap () returned 0x630000 [0051.927] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.927] GetProcessHeap () returned 0x630000 [0051.927] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.927] GetProcessHeap () returned 0x630000 [0051.928] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0051.928] GetProcessHeap () returned 0x630000 [0051.928] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0051.928] GetProcessHeap () returned 0x630000 [0051.928] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0051.928] GetProcessHeap () returned 0x630000 [0051.928] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0051.928] GetProcessHeap () returned 0x630000 [0051.928] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.928] GetProcessHeap () returned 0x630000 [0051.928] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.928] GetProcessHeap () returned 0x630000 [0051.928] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0051.928] GetProcessHeap () returned 0x630000 [0051.928] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0051.928] GetProcessHeap () returned 0x630000 [0051.928] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0051.928] GetProcessHeap () returned 0x630000 [0051.928] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0051.928] GetProcessHeap () returned 0x630000 [0051.928] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.928] GetProcessHeap () returned 0x630000 [0051.928] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.928] GetProcessHeap () returned 0x630000 [0051.928] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.929] GetProcessHeap () returned 0x630000 [0051.929] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.929] GetProcessHeap () returned 0x630000 [0051.929] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0051.929] GetProcessHeap () returned 0x630000 [0051.929] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0051.929] GetProcessHeap () returned 0x630000 [0051.929] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0051.929] GetProcessHeap () returned 0x630000 [0051.929] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0051.929] GetProcessHeap () returned 0x630000 [0051.929] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0051.929] GetProcessHeap () returned 0x630000 [0051.929] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0051.929] GetProcessHeap () returned 0x630000 [0051.929] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0051.929] GetProcessHeap () returned 0x630000 [0051.929] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0051.929] GetProcessHeap () returned 0x630000 [0051.929] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.929] GetProcessHeap () returned 0x630000 [0051.929] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.929] GetProcessHeap () returned 0x630000 [0051.929] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0051.929] GetProcessHeap () returned 0x630000 [0051.929] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0051.929] GetProcessHeap () returned 0x630000 [0051.929] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.929] GetProcessHeap () returned 0x630000 [0051.929] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.929] GetProcessHeap () returned 0x630000 [0051.929] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.929] GetProcessHeap () returned 0x630000 [0051.929] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.930] GetProcessHeap () returned 0x630000 [0051.930] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0051.930] GetProcessHeap () returned 0x630000 [0051.930] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0051.930] GetProcessHeap () returned 0x630000 [0051.930] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.930] GetProcessHeap () returned 0x630000 [0051.930] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.930] GetProcessHeap () returned 0x630000 [0051.930] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.930] GetProcessHeap () returned 0x630000 [0051.930] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.930] GetProcessHeap () returned 0x630000 [0051.930] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.930] GetProcessHeap () returned 0x630000 [0051.930] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.930] GetProcessHeap () returned 0x630000 [0051.930] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0051.930] GetProcessHeap () returned 0x630000 [0051.930] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0051.930] GetProcessHeap () returned 0x630000 [0051.930] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.930] GetProcessHeap () returned 0x630000 [0051.930] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.930] GetProcessHeap () returned 0x630000 [0051.930] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0051.930] GetProcessHeap () returned 0x630000 [0051.930] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.930] GetProcessHeap () returned 0x630000 [0051.930] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0051.930] GetProcessHeap () returned 0x630000 [0051.930] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0051.930] GetProcessHeap () returned 0x630000 [0051.930] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0051.930] GetProcessHeap () returned 0x630000 [0051.930] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0051.930] GetProcessHeap () returned 0x630000 [0051.930] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0051.930] GetProcessHeap () returned 0x630000 [0051.931] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0051.931] GetProcessHeap () returned 0x630000 [0051.931] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0051.931] GetProcessHeap () returned 0x630000 [0051.931] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.931] GetProcessHeap () returned 0x630000 [0051.931] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.931] GetProcessHeap () returned 0x630000 [0051.931] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.931] GetProcessHeap () returned 0x630000 [0051.931] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0051.931] GetProcessHeap () returned 0x630000 [0051.931] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0051.931] GetProcessHeap () returned 0x630000 [0051.931] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.931] GetProcessHeap () returned 0x630000 [0051.931] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.931] GetProcessHeap () returned 0x630000 [0051.931] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.931] GetProcessHeap () returned 0x630000 [0051.931] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.931] GetProcessHeap () returned 0x630000 [0051.931] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0051.931] GetProcessHeap () returned 0x630000 [0051.931] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0051.931] GetProcessHeap () returned 0x630000 [0051.931] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.931] GetProcessHeap () returned 0x630000 [0051.931] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.931] GetProcessHeap () returned 0x630000 [0051.931] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.931] GetProcessHeap () returned 0x630000 [0051.931] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.931] GetProcessHeap () returned 0x630000 [0051.931] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0051.931] GetProcessHeap () returned 0x630000 [0051.931] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0051.931] GetProcessHeap () returned 0x630000 [0051.931] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0051.931] GetProcessHeap () returned 0x630000 [0051.932] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0051.932] GetProcessHeap () returned 0x630000 [0051.932] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0051.932] GetProcessHeap () returned 0x630000 [0051.932] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655530 | out: hHeap=0x630000) returned 1 [0051.932] GetProcessHeap () returned 0x630000 [0051.932] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0051.932] GetProcessHeap () returned 0x630000 [0051.932] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655140 | out: hHeap=0x630000) returned 1 [0051.932] GetProcessHeap () returned 0x630000 [0051.932] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0051.932] GetProcessHeap () returned 0x630000 [0051.932] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0051.932] GetProcessHeap () returned 0x630000 [0051.932] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0051.932] WriteFile (in: hFile=0x230, lpBuffer=0x65cc90*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65cc90*, lpNumberOfBytesWritten=0x243d864*=0x388, lpOverlapped=0x0) returned 1 [0051.936] GetProcessHeap () returned 0x630000 [0051.936] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65cc90, Size=0x30) returned 0x65cc90 [0051.936] GetProcessHeap () returned 0x630000 [0051.936] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0051.936] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.936] GetProcessHeap () returned 0x630000 [0051.936] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1bb0) returned 0x65ccc8 [0051.936] ReadFile (in: hFile=0x230, lpBuffer=0x65ccc8, nNumberOfBytesToRead=0x1bb0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ccc8*, lpNumberOfBytesRead=0x243d7e8*=0x1bb0, lpOverlapped=0x0) returned 1 [0051.937] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.937] WriteFile (in: hFile=0x230, lpBuffer=0x65ccc8*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ccc8*, lpNumberOfBytesWritten=0x243d7e4*=0x1bb0, lpOverlapped=0x0) returned 1 [0051.938] GetProcessHeap () returned 0x630000 [0051.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ccc8 | out: hHeap=0x630000) returned 1 [0051.938] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0051.938] WriteFile (in: hFile=0x230, lpBuffer=0x65cc90*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65cc90*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0051.939] CloseHandle (hObject=0x230) returned 1 [0051.940] GetProcessHeap () returned 0x630000 [0051.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0051.940] GetProcessHeap () returned 0x630000 [0051.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0051.940] GetProcessHeap () returned 0x630000 [0051.941] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0051.941] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png") returned="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png" [0051.941] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png.happythreechoose" [0051.941] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bluelogo.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\bluelogo.png.happythreechoose"), dwFlags=0x1) returned 1 [0051.945] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0051.945] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0051.945] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html" [0051.945] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\decryption info.html")) returned 0x20 [0051.945] GetProcessHeap () returned 0x630000 [0051.945] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0051.945] FindNextFileW (in: hFindFile=0x6486d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b9dbd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b9dbd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bullet.png", cAlternateFileName="")) returned 1 [0051.945] lstrcmpiW (lpString1="bullet.png", lpString2=".") returned 1 [0051.945] lstrcmpiW (lpString1="bullet.png", lpString2="..") returned 1 [0051.945] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="bullet.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\bullet.png") returned="C:\\Windows10Upgrade\\resources\\ux\\bullet.png" [0051.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bullet.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0051.945] GetProcessHeap () returned 0x630000 [0051.945] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb) returned 0x64ca20 [0051.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bullet.png", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bullet.png", lpUsedDefaultChar=0x0) returned 11 [0051.945] lstrlenA (lpString="bullet.png") returned 10 [0051.945] lstrlenA (lpString=".happythreechoose") returned 17 [0051.945] lstrcmpiW (lpString1="bullet.png", lpString2="Decryption INFO.html") returned -1 [0051.945] lstrcmpiW (lpString1="bullet.png", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0051.945] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0051.945] lstrcmpiW (lpString1="bullet.png", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0051.945] GetProcessHeap () returned 0x630000 [0051.945] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0051.945] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\bullet.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bullet.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0051.946] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=221) returned 1 [0051.946] GetProcessHeap () returned 0x630000 [0051.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x65b0c0 [0051.946] GetProcessHeap () returned 0x630000 [0051.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0051.946] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\bullet.png") returned 43 [0051.946] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0051.946] GetProcessHeap () returned 0x630000 [0051.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0051.946] GetProcessHeap () returned 0x630000 [0051.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x383) returned 0x65ccc8 [0051.946] lstrlenA (lpString="rsa_encrypt") returned 11 [0051.946] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0051.947] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0051.947] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0051.947] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0051.947] GetProcessHeap () returned 0x630000 [0051.947] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0051.947] lstrlenA (lpString="010001") returned 6 [0051.947] GetProcessHeap () returned 0x630000 [0051.947] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a298 [0051.947] GetProcessHeap () returned 0x630000 [0051.947] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0051.947] GetProcessHeap () returned 0x630000 [0051.947] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655f50 [0051.947] GetProcessHeap () returned 0x630000 [0051.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0051.947] GetProcessHeap () returned 0x630000 [0051.947] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655380 [0051.947] GetProcessHeap () returned 0x630000 [0051.947] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657670 [0051.947] GetProcessHeap () returned 0x630000 [0051.947] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0051.947] GetProcessHeap () returned 0x630000 [0051.947] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0051.947] GetProcessHeap () returned 0x630000 [0051.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.947] GetProcessHeap () returned 0x630000 [0051.947] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0051.947] GetProcessHeap () returned 0x630000 [0051.947] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0051.947] GetProcessHeap () returned 0x630000 [0051.947] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x6570f8 [0051.947] GetProcessHeap () returned 0x630000 [0051.947] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0051.947] GetProcessHeap () returned 0x630000 [0051.947] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0051.948] GetProcessHeap () returned 0x630000 [0051.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x6559b0 [0051.948] GetProcessHeap () returned 0x630000 [0051.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0051.948] GetProcessHeap () returned 0x630000 [0051.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0051.948] GetProcessHeap () returned 0x630000 [0051.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6559b0 | out: hHeap=0x630000) returned 1 [0051.948] GetProcessHeap () returned 0x630000 [0051.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.948] GetProcessHeap () returned 0x630000 [0051.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65d370 [0051.948] GetProcessHeap () returned 0x630000 [0051.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0051.948] GetProcessHeap () returned 0x630000 [0051.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.948] GetProcessHeap () returned 0x630000 [0051.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.948] GetProcessHeap () returned 0x630000 [0051.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.948] GetProcessHeap () returned 0x630000 [0051.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x656070 [0051.948] GetProcessHeap () returned 0x630000 [0051.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65d370 | out: hHeap=0x630000) returned 1 [0051.948] GetProcessHeap () returned 0x630000 [0051.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0051.948] GetProcessHeap () returned 0x630000 [0051.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656070 | out: hHeap=0x630000) returned 1 [0051.948] GetProcessHeap () returned 0x630000 [0051.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.948] GetProcessHeap () returned 0x630000 [0051.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.948] GetProcessHeap () returned 0x630000 [0051.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.948] GetProcessHeap () returned 0x630000 [0051.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.948] GetProcessHeap () returned 0x630000 [0051.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0051.948] GetProcessHeap () returned 0x630000 [0051.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0051.948] GetProcessHeap () returned 0x630000 [0051.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0051.949] GetProcessHeap () returned 0x630000 [0051.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0051.949] GetProcessHeap () returned 0x630000 [0051.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0051.949] GetProcessHeap () returned 0x630000 [0051.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0051.949] GetProcessHeap () returned 0x630000 [0051.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.949] GetProcessHeap () returned 0x630000 [0051.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.949] GetProcessHeap () returned 0x630000 [0051.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0051.949] GetProcessHeap () returned 0x630000 [0051.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0051.949] GetProcessHeap () returned 0x630000 [0051.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.949] GetProcessHeap () returned 0x630000 [0051.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.949] GetProcessHeap () returned 0x630000 [0051.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.949] GetProcessHeap () returned 0x630000 [0051.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.949] GetProcessHeap () returned 0x630000 [0051.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.949] GetProcessHeap () returned 0x630000 [0051.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.949] GetProcessHeap () returned 0x630000 [0051.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0051.949] GetProcessHeap () returned 0x630000 [0051.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0051.949] GetProcessHeap () returned 0x630000 [0051.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0051.949] GetProcessHeap () returned 0x630000 [0051.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0051.949] GetProcessHeap () returned 0x630000 [0051.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0051.949] GetProcessHeap () returned 0x630000 [0051.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0051.950] GetProcessHeap () returned 0x630000 [0051.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.950] GetProcessHeap () returned 0x630000 [0051.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.950] GetProcessHeap () returned 0x630000 [0051.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.950] GetProcessHeap () returned 0x630000 [0051.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.950] GetProcessHeap () returned 0x630000 [0051.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0051.950] GetProcessHeap () returned 0x630000 [0051.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0051.950] GetProcessHeap () returned 0x630000 [0051.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.950] GetProcessHeap () returned 0x630000 [0051.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.950] GetProcessHeap () returned 0x630000 [0051.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0051.950] GetProcessHeap () returned 0x630000 [0051.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0051.950] GetProcessHeap () returned 0x630000 [0051.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0051.950] GetProcessHeap () returned 0x630000 [0051.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0051.950] GetProcessHeap () returned 0x630000 [0051.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.950] GetProcessHeap () returned 0x630000 [0051.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.950] GetProcessHeap () returned 0x630000 [0051.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.950] GetProcessHeap () returned 0x630000 [0051.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.950] GetProcessHeap () returned 0x630000 [0051.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.950] GetProcessHeap () returned 0x630000 [0051.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.950] GetProcessHeap () returned 0x630000 [0051.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.951] GetProcessHeap () returned 0x630000 [0051.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.951] GetProcessHeap () returned 0x630000 [0051.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.951] GetProcessHeap () returned 0x630000 [0051.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.951] GetProcessHeap () returned 0x630000 [0051.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0051.951] GetProcessHeap () returned 0x630000 [0051.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0051.951] GetProcessHeap () returned 0x630000 [0051.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0051.951] GetProcessHeap () returned 0x630000 [0051.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0051.951] GetProcessHeap () returned 0x630000 [0051.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.951] GetProcessHeap () returned 0x630000 [0051.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.951] GetProcessHeap () returned 0x630000 [0051.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.951] GetProcessHeap () returned 0x630000 [0051.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.951] GetProcessHeap () returned 0x630000 [0051.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.951] GetProcessHeap () returned 0x630000 [0051.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.951] GetProcessHeap () returned 0x630000 [0051.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.951] GetProcessHeap () returned 0x630000 [0051.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.951] GetProcessHeap () returned 0x630000 [0051.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0051.951] GetProcessHeap () returned 0x630000 [0051.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0051.951] GetProcessHeap () returned 0x630000 [0051.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0051.951] GetProcessHeap () returned 0x630000 [0051.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.951] GetProcessHeap () returned 0x630000 [0051.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.952] GetProcessHeap () returned 0x630000 [0051.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.952] GetProcessHeap () returned 0x630000 [0051.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.952] GetProcessHeap () returned 0x630000 [0051.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.952] GetProcessHeap () returned 0x630000 [0051.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0051.952] GetProcessHeap () returned 0x630000 [0051.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0051.952] GetProcessHeap () returned 0x630000 [0051.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.952] GetProcessHeap () returned 0x630000 [0051.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.952] GetProcessHeap () returned 0x630000 [0051.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.952] GetProcessHeap () returned 0x630000 [0051.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.952] GetProcessHeap () returned 0x630000 [0051.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.952] GetProcessHeap () returned 0x630000 [0051.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.952] GetProcessHeap () returned 0x630000 [0051.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.952] GetProcessHeap () returned 0x630000 [0051.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.952] GetProcessHeap () returned 0x630000 [0051.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.952] GetProcessHeap () returned 0x630000 [0051.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.952] GetProcessHeap () returned 0x630000 [0051.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0051.952] GetProcessHeap () returned 0x630000 [0051.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0051.952] GetProcessHeap () returned 0x630000 [0051.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0051.952] GetProcessHeap () returned 0x630000 [0051.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0051.952] GetProcessHeap () returned 0x630000 [0051.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0051.953] GetProcessHeap () returned 0x630000 [0051.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0051.953] GetProcessHeap () returned 0x630000 [0051.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0051.953] GetProcessHeap () returned 0x630000 [0051.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655380 | out: hHeap=0x630000) returned 1 [0051.953] GetProcessHeap () returned 0x630000 [0051.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0051.953] GetProcessHeap () returned 0x630000 [0051.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655f50 | out: hHeap=0x630000) returned 1 [0051.953] GetProcessHeap () returned 0x630000 [0051.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0051.953] GetProcessHeap () returned 0x630000 [0051.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0051.953] GetProcessHeap () returned 0x630000 [0051.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0051.953] WriteFile (in: hFile=0x230, lpBuffer=0x65ccc8*, nNumberOfBytesToWrite=0x383, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65ccc8*, lpNumberOfBytesWritten=0x243d864*=0x383, lpOverlapped=0x0) returned 1 [0051.959] GetProcessHeap () returned 0x630000 [0051.959] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65ccc8, Size=0x30) returned 0x65ccc8 [0051.959] GetProcessHeap () returned 0x630000 [0051.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0051.959] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.959] GetProcessHeap () returned 0x630000 [0051.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe0) returned 0x641ca8 [0051.959] ReadFile (in: hFile=0x230, lpBuffer=0x641ca8, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x641ca8*, lpNumberOfBytesRead=0x243d7e8*=0xe0, lpOverlapped=0x0) returned 1 [0051.959] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.959] WriteFile (in: hFile=0x230, lpBuffer=0x641ca8*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x641ca8*, lpNumberOfBytesWritten=0x243d7e4*=0xe0, lpOverlapped=0x0) returned 1 [0051.960] GetProcessHeap () returned 0x630000 [0051.960] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x641ca8 | out: hHeap=0x630000) returned 1 [0051.960] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0051.960] WriteFile (in: hFile=0x230, lpBuffer=0x65ccc8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65ccc8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0051.962] CloseHandle (hObject=0x230) returned 1 [0051.963] GetProcessHeap () returned 0x630000 [0051.963] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0051.963] GetProcessHeap () returned 0x630000 [0051.963] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b0c0 | out: hHeap=0x630000) returned 1 [0051.963] GetProcessHeap () returned 0x630000 [0051.963] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0051.963] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\bullet.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\bullet.png") returned="C:\\Windows10Upgrade\\resources\\ux\\bullet.png" [0051.963] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\bullet.png", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\bullet.png.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\bullet.png.happythreechoose" [0051.963] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\bullet.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bullet.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\bullet.png.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\bullet.png.happythreechoose"), dwFlags=0x1) returned 1 [0051.963] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\bullet.png" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0051.964] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0051.964] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html" [0051.964] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\decryption info.html")) returned 0x20 [0051.964] GetProcessHeap () returned 0x630000 [0051.964] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0051.964] FindNextFileW (in: hFindFile=0x6486d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3bb141, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3bb141, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1687, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="default.css", cAlternateFileName="")) returned 1 [0051.964] lstrcmpiW (lpString1="default.css", lpString2=".") returned 1 [0051.964] lstrcmpiW (lpString1="default.css", lpString2="..") returned 1 [0051.964] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="default.css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default.css") returned="C:\\Windows10Upgrade\\resources\\ux\\default.css" [0051.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="default.css", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0051.964] GetProcessHeap () returned 0x630000 [0051.964] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0051.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="default.css", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="default.css", lpUsedDefaultChar=0x0) returned 12 [0051.964] lstrlenA (lpString="default.css") returned 11 [0051.964] lstrlenA (lpString=".happythreechoose") returned 17 [0051.964] lstrcmpiW (lpString1="default.css", lpString2="Decryption INFO.html") returned 1 [0051.964] lstrcmpiW (lpString1="default.css", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0051.964] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0051.964] lstrcmpiW (lpString1="default.css", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0051.964] GetProcessHeap () returned 0x630000 [0051.964] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0051.964] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0051.964] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=5767) returned 1 [0051.965] GetProcessHeap () returned 0x630000 [0051.965] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x65b318 [0051.965] GetProcessHeap () returned 0x630000 [0051.965] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0051.965] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\default.css") returned 44 [0051.965] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0051.965] GetProcessHeap () returned 0x630000 [0051.965] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0051.965] GetProcessHeap () returned 0x630000 [0051.965] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x389) returned 0x65d460 [0051.965] lstrlenA (lpString="rsa_encrypt") returned 11 [0051.965] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0051.965] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0051.965] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0051.965] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0051.965] GetProcessHeap () returned 0x630000 [0051.965] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0051.966] lstrlenA (lpString="010001") returned 6 [0051.966] GetProcessHeap () returned 0x630000 [0051.966] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a348 [0051.966] GetProcessHeap () returned 0x630000 [0051.966] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0051.966] GetProcessHeap () returned 0x630000 [0051.966] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655f50 [0051.966] GetProcessHeap () returned 0x630000 [0051.966] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0051.966] GetProcessHeap () returned 0x630000 [0051.966] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x656070 [0051.966] GetProcessHeap () returned 0x630000 [0051.966] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656db0 [0051.966] GetProcessHeap () returned 0x630000 [0051.966] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0051.966] GetProcessHeap () returned 0x630000 [0051.966] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0051.966] GetProcessHeap () returned 0x630000 [0051.966] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.966] GetProcessHeap () returned 0x630000 [0051.966] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0051.966] GetProcessHeap () returned 0x630000 [0051.966] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0051.966] GetProcessHeap () returned 0x630000 [0051.966] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656b80 [0051.966] GetProcessHeap () returned 0x630000 [0051.966] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0051.966] GetProcessHeap () returned 0x630000 [0051.966] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0051.966] GetProcessHeap () returned 0x630000 [0051.966] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x6556e0 [0051.966] GetProcessHeap () returned 0x630000 [0051.966] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0051.966] GetProcessHeap () returned 0x630000 [0051.966] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0051.966] GetProcessHeap () returned 0x630000 [0051.966] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6556e0 | out: hHeap=0x630000) returned 1 [0051.966] GetProcessHeap () returned 0x630000 [0051.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0051.967] GetProcessHeap () returned 0x630000 [0051.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65d0b8 [0051.967] GetProcessHeap () returned 0x630000 [0051.967] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0051.967] GetProcessHeap () returned 0x630000 [0051.967] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0051.967] GetProcessHeap () returned 0x630000 [0051.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.967] GetProcessHeap () returned 0x630000 [0051.967] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.967] GetProcessHeap () returned 0x630000 [0051.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x6551d0 [0051.967] GetProcessHeap () returned 0x630000 [0051.967] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65d0b8 | out: hHeap=0x630000) returned 1 [0051.967] GetProcessHeap () returned 0x630000 [0051.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0051.967] GetProcessHeap () returned 0x630000 [0051.967] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6551d0 | out: hHeap=0x630000) returned 1 [0051.967] GetProcessHeap () returned 0x630000 [0051.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.967] GetProcessHeap () returned 0x630000 [0051.967] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.967] GetProcessHeap () returned 0x630000 [0051.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.967] GetProcessHeap () returned 0x630000 [0051.967] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.967] GetProcessHeap () returned 0x630000 [0051.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.967] GetProcessHeap () returned 0x630000 [0051.967] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.967] GetProcessHeap () returned 0x630000 [0051.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0051.967] GetProcessHeap () returned 0x630000 [0051.967] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0051.967] GetProcessHeap () returned 0x630000 [0051.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0051.967] GetProcessHeap () returned 0x630000 [0051.967] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0051.967] GetProcessHeap () returned 0x630000 [0051.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.968] GetProcessHeap () returned 0x630000 [0051.968] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.968] GetProcessHeap () returned 0x630000 [0051.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0051.968] GetProcessHeap () returned 0x630000 [0051.968] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.968] GetProcessHeap () returned 0x630000 [0051.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0051.968] GetProcessHeap () returned 0x630000 [0051.968] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0051.968] GetProcessHeap () returned 0x630000 [0051.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0051.968] GetProcessHeap () returned 0x630000 [0051.968] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0051.968] GetProcessHeap () returned 0x630000 [0051.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0051.968] GetProcessHeap () returned 0x630000 [0051.968] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0051.968] GetProcessHeap () returned 0x630000 [0051.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0051.968] GetProcessHeap () returned 0x630000 [0051.968] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0051.968] GetProcessHeap () returned 0x630000 [0051.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0051.968] GetProcessHeap () returned 0x630000 [0051.968] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0051.968] GetProcessHeap () returned 0x630000 [0051.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.968] GetProcessHeap () returned 0x630000 [0051.968] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.968] GetProcessHeap () returned 0x630000 [0051.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0051.968] GetProcessHeap () returned 0x630000 [0051.968] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0051.968] GetProcessHeap () returned 0x630000 [0051.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.968] GetProcessHeap () returned 0x630000 [0051.969] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.969] GetProcessHeap () returned 0x630000 [0051.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0051.969] GetProcessHeap () returned 0x630000 [0051.969] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0051.969] GetProcessHeap () returned 0x630000 [0051.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.969] GetProcessHeap () returned 0x630000 [0051.969] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.969] GetProcessHeap () returned 0x630000 [0051.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0051.969] GetProcessHeap () returned 0x630000 [0051.969] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0051.969] GetProcessHeap () returned 0x630000 [0051.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.969] GetProcessHeap () returned 0x630000 [0051.969] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.969] GetProcessHeap () returned 0x630000 [0051.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.969] GetProcessHeap () returned 0x630000 [0051.969] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.969] GetProcessHeap () returned 0x630000 [0051.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.969] GetProcessHeap () returned 0x630000 [0051.969] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.969] GetProcessHeap () returned 0x630000 [0051.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0051.969] GetProcessHeap () returned 0x630000 [0051.969] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.969] GetProcessHeap () returned 0x630000 [0051.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.969] GetProcessHeap () returned 0x630000 [0051.969] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.969] GetProcessHeap () returned 0x630000 [0051.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0051.969] GetProcessHeap () returned 0x630000 [0051.969] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.969] GetProcessHeap () returned 0x630000 [0051.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0051.970] GetProcessHeap () returned 0x630000 [0051.970] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0051.970] GetProcessHeap () returned 0x630000 [0051.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0051.970] GetProcessHeap () returned 0x630000 [0051.970] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0051.970] GetProcessHeap () returned 0x630000 [0051.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.970] GetProcessHeap () returned 0x630000 [0051.970] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.970] GetProcessHeap () returned 0x630000 [0051.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0051.970] GetProcessHeap () returned 0x630000 [0051.970] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0051.970] GetProcessHeap () returned 0x630000 [0051.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0051.970] GetProcessHeap () returned 0x630000 [0051.970] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0051.970] GetProcessHeap () returned 0x630000 [0051.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.970] GetProcessHeap () returned 0x630000 [0051.970] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.970] GetProcessHeap () returned 0x630000 [0051.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.970] GetProcessHeap () returned 0x630000 [0051.970] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.970] GetProcessHeap () returned 0x630000 [0051.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.970] GetProcessHeap () returned 0x630000 [0051.970] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.970] GetProcessHeap () returned 0x630000 [0051.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.970] GetProcessHeap () returned 0x630000 [0051.970] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.970] GetProcessHeap () returned 0x630000 [0051.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.970] GetProcessHeap () returned 0x630000 [0051.970] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.971] GetProcessHeap () returned 0x630000 [0051.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.971] GetProcessHeap () returned 0x630000 [0051.971] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.971] GetProcessHeap () returned 0x630000 [0051.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0051.971] GetProcessHeap () returned 0x630000 [0051.971] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0051.971] GetProcessHeap () returned 0x630000 [0051.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0051.971] GetProcessHeap () returned 0x630000 [0051.971] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0051.971] GetProcessHeap () returned 0x630000 [0051.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0051.971] GetProcessHeap () returned 0x630000 [0051.971] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0051.971] GetProcessHeap () returned 0x630000 [0051.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.971] GetProcessHeap () returned 0x630000 [0051.971] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.971] GetProcessHeap () returned 0x630000 [0051.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0051.971] GetProcessHeap () returned 0x630000 [0051.971] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0051.971] GetProcessHeap () returned 0x630000 [0051.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0051.971] GetProcessHeap () returned 0x630000 [0051.971] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0051.971] GetProcessHeap () returned 0x630000 [0051.971] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0051.971] GetProcessHeap () returned 0x630000 [0051.971] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0051.971] GetProcessHeap () returned 0x630000 [0051.971] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0051.971] GetProcessHeap () returned 0x630000 [0051.971] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0051.971] GetProcessHeap () returned 0x630000 [0051.971] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0051.972] GetProcessHeap () returned 0x630000 [0051.972] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656070 | out: hHeap=0x630000) returned 1 [0051.972] GetProcessHeap () returned 0x630000 [0051.972] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0051.972] GetProcessHeap () returned 0x630000 [0051.972] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655f50 | out: hHeap=0x630000) returned 1 [0051.972] GetProcessHeap () returned 0x630000 [0051.972] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0051.972] GetProcessHeap () returned 0x630000 [0051.972] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.972] GetProcessHeap () returned 0x630000 [0051.972] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0051.972] WriteFile (in: hFile=0x230, lpBuffer=0x65d460*, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65d460*, lpNumberOfBytesWritten=0x243d864*=0x389, lpOverlapped=0x0) returned 1 [0051.976] GetProcessHeap () returned 0x630000 [0051.976] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65d460, Size=0x30) returned 0x65d460 [0051.976] GetProcessHeap () returned 0x630000 [0051.976] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0051.976] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.976] GetProcessHeap () returned 0x630000 [0051.976] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1690) returned 0x65d498 [0051.976] ReadFile (in: hFile=0x230, lpBuffer=0x65d498, nNumberOfBytesToRead=0x1690, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65d498*, lpNumberOfBytesRead=0x243d7e8*=0x1690, lpOverlapped=0x0) returned 1 [0051.977] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.977] WriteFile (in: hFile=0x230, lpBuffer=0x65d498*, nNumberOfBytesToWrite=0x1690, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65d498*, lpNumberOfBytesWritten=0x243d7e4*=0x1690, lpOverlapped=0x0) returned 1 [0051.978] GetProcessHeap () returned 0x630000 [0051.978] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65d498 | out: hHeap=0x630000) returned 1 [0051.978] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0051.978] WriteFile (in: hFile=0x230, lpBuffer=0x65d460*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65d460*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0051.979] CloseHandle (hObject=0x230) returned 1 [0051.980] GetProcessHeap () returned 0x630000 [0051.980] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0051.980] GetProcessHeap () returned 0x630000 [0051.980] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b318 | out: hHeap=0x630000) returned 1 [0051.981] GetProcessHeap () returned 0x630000 [0051.981] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0051.981] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\default.css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default.css") returned="C:\\Windows10Upgrade\\resources\\ux\\default.css" [0051.981] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default.css", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default.css.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\default.css.happythreechoose" [0051.981] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\default.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.css"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\default.css.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.css.happythreechoose"), dwFlags=0x1) returned 1 [0051.981] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\default.css" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0051.981] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0051.981] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html" [0051.981] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\decryption info.html")) returned 0x20 [0051.981] GetProcessHeap () returned 0x630000 [0051.981] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0051.981] FindNextFileW (in: hFindFile=0x6486d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3bc4cd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3bc4cd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xf44d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="default.htm", cAlternateFileName="")) returned 1 [0051.981] lstrcmpiW (lpString1="default.htm", lpString2=".") returned 1 [0051.981] lstrcmpiW (lpString1="default.htm", lpString2="..") returned 1 [0051.981] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="default.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\default.htm" [0051.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="default.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0051.981] GetProcessHeap () returned 0x630000 [0051.982] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0051.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="default.htm", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="default.htm", lpUsedDefaultChar=0x0) returned 12 [0051.982] lstrlenA (lpString="default.htm") returned 11 [0051.982] lstrlenA (lpString=".happythreechoose") returned 17 [0051.982] lstrcmpiW (lpString1="default.htm", lpString2="Decryption INFO.html") returned 1 [0051.982] lstrcmpiW (lpString1="default.htm", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0051.982] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0051.982] lstrcmpiW (lpString1="default.htm", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0051.982] GetProcessHeap () returned 0x630000 [0051.982] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0051.982] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0051.982] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=62541) returned 1 [0051.982] GetProcessHeap () returned 0x630000 [0051.982] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x65b318 [0051.982] GetProcessHeap () returned 0x630000 [0051.982] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0051.982] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\default.htm") returned 44 [0051.982] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0051.982] GetProcessHeap () returned 0x630000 [0051.982] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0051.982] GetProcessHeap () returned 0x630000 [0051.982] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x65d498 [0051.982] lstrlenA (lpString="rsa_encrypt") returned 11 [0051.982] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0051.983] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0051.983] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0051.983] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0051.983] GetProcessHeap () returned 0x630000 [0051.983] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0051.983] lstrlenA (lpString="010001") returned 6 [0051.983] GetProcessHeap () returned 0x630000 [0051.983] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0051.983] GetProcessHeap () returned 0x630000 [0051.983] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0051.983] GetProcessHeap () returned 0x630000 [0051.983] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655890 [0051.983] GetProcessHeap () returned 0x630000 [0051.983] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0051.983] GetProcessHeap () returned 0x630000 [0051.983] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655fe0 [0051.983] GetProcessHeap () returned 0x630000 [0051.983] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656950 [0051.984] GetProcessHeap () returned 0x630000 [0051.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3c8 [0051.984] GetProcessHeap () returned 0x630000 [0051.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0051.984] GetProcessHeap () returned 0x630000 [0051.984] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0051.984] GetProcessHeap () returned 0x630000 [0051.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0051.984] GetProcessHeap () returned 0x630000 [0051.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0051.984] GetProcessHeap () returned 0x630000 [0051.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656a68 [0051.984] GetProcessHeap () returned 0x630000 [0051.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0051.984] GetProcessHeap () returned 0x630000 [0051.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0051.984] GetProcessHeap () returned 0x630000 [0051.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x6559b0 [0051.984] GetProcessHeap () returned 0x630000 [0051.984] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0051.984] GetProcessHeap () returned 0x630000 [0051.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0051.984] GetProcessHeap () returned 0x630000 [0051.984] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6559b0 | out: hHeap=0x630000) returned 1 [0051.984] GetProcessHeap () returned 0x630000 [0051.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0051.984] GetProcessHeap () returned 0x630000 [0051.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65d9e8 [0051.984] GetProcessHeap () returned 0x630000 [0051.984] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0051.984] GetProcessHeap () returned 0x630000 [0051.984] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0051.984] GetProcessHeap () returned 0x630000 [0051.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.984] GetProcessHeap () returned 0x630000 [0051.984] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.984] GetProcessHeap () returned 0x630000 [0051.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x655a40 [0051.984] GetProcessHeap () returned 0x630000 [0051.984] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65d9e8 | out: hHeap=0x630000) returned 1 [0051.984] GetProcessHeap () returned 0x630000 [0051.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0051.985] GetProcessHeap () returned 0x630000 [0051.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655a40 | out: hHeap=0x630000) returned 1 [0051.985] GetProcessHeap () returned 0x630000 [0051.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.985] GetProcessHeap () returned 0x630000 [0051.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.985] GetProcessHeap () returned 0x630000 [0051.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0051.985] GetProcessHeap () returned 0x630000 [0051.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0051.985] GetProcessHeap () returned 0x630000 [0051.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0051.985] GetProcessHeap () returned 0x630000 [0051.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0051.985] GetProcessHeap () returned 0x630000 [0051.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.985] GetProcessHeap () returned 0x630000 [0051.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.985] GetProcessHeap () returned 0x630000 [0051.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.985] GetProcessHeap () returned 0x630000 [0051.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.985] GetProcessHeap () returned 0x630000 [0051.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0051.985] GetProcessHeap () returned 0x630000 [0051.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0051.985] GetProcessHeap () returned 0x630000 [0051.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0051.985] GetProcessHeap () returned 0x630000 [0051.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0051.985] GetProcessHeap () returned 0x630000 [0051.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0051.985] GetProcessHeap () returned 0x630000 [0051.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0051.985] GetProcessHeap () returned 0x630000 [0051.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0051.985] GetProcessHeap () returned 0x630000 [0051.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0051.985] GetProcessHeap () returned 0x630000 [0051.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0051.986] GetProcessHeap () returned 0x630000 [0051.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0051.986] GetProcessHeap () returned 0x630000 [0051.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0051.986] GetProcessHeap () returned 0x630000 [0051.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0051.986] GetProcessHeap () returned 0x630000 [0051.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.986] GetProcessHeap () returned 0x630000 [0051.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.986] GetProcessHeap () returned 0x630000 [0051.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.986] GetProcessHeap () returned 0x630000 [0051.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.986] GetProcessHeap () returned 0x630000 [0051.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0051.986] GetProcessHeap () returned 0x630000 [0051.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0051.986] GetProcessHeap () returned 0x630000 [0051.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.986] GetProcessHeap () returned 0x630000 [0051.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.986] GetProcessHeap () returned 0x630000 [0051.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0051.986] GetProcessHeap () returned 0x630000 [0051.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0051.986] GetProcessHeap () returned 0x630000 [0051.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.986] GetProcessHeap () returned 0x630000 [0051.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.986] GetProcessHeap () returned 0x630000 [0051.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0051.986] GetProcessHeap () returned 0x630000 [0051.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.986] GetProcessHeap () returned 0x630000 [0051.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0051.986] GetProcessHeap () returned 0x630000 [0051.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0051.987] GetProcessHeap () returned 0x630000 [0051.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0051.987] GetProcessHeap () returned 0x630000 [0051.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0051.987] GetProcessHeap () returned 0x630000 [0051.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.987] GetProcessHeap () returned 0x630000 [0051.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.987] GetProcessHeap () returned 0x630000 [0051.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0051.987] GetProcessHeap () returned 0x630000 [0051.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0051.987] GetProcessHeap () returned 0x630000 [0051.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0051.987] GetProcessHeap () returned 0x630000 [0051.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0051.987] GetProcessHeap () returned 0x630000 [0051.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0051.987] GetProcessHeap () returned 0x630000 [0051.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0051.987] GetProcessHeap () returned 0x630000 [0051.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.987] GetProcessHeap () returned 0x630000 [0051.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.987] GetProcessHeap () returned 0x630000 [0051.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0051.987] GetProcessHeap () returned 0x630000 [0051.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0051.987] GetProcessHeap () returned 0x630000 [0051.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0051.987] GetProcessHeap () returned 0x630000 [0051.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0051.987] GetProcessHeap () returned 0x630000 [0051.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0051.987] GetProcessHeap () returned 0x630000 [0051.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0051.987] GetProcessHeap () returned 0x630000 [0051.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0051.987] GetProcessHeap () returned 0x630000 [0051.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0051.988] GetProcessHeap () returned 0x630000 [0051.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.988] GetProcessHeap () returned 0x630000 [0051.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.988] GetProcessHeap () returned 0x630000 [0051.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0051.988] GetProcessHeap () returned 0x630000 [0051.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0051.988] GetProcessHeap () returned 0x630000 [0051.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0051.988] GetProcessHeap () returned 0x630000 [0051.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0051.988] GetProcessHeap () returned 0x630000 [0051.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0051.988] GetProcessHeap () returned 0x630000 [0051.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0051.988] GetProcessHeap () returned 0x630000 [0051.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0051.988] GetProcessHeap () returned 0x630000 [0051.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0051.988] GetProcessHeap () returned 0x630000 [0051.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0051.988] GetProcessHeap () returned 0x630000 [0051.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0051.988] GetProcessHeap () returned 0x630000 [0051.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0051.988] GetProcessHeap () returned 0x630000 [0051.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0051.988] GetProcessHeap () returned 0x630000 [0051.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.988] GetProcessHeap () returned 0x630000 [0051.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.988] GetProcessHeap () returned 0x630000 [0051.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0051.988] GetProcessHeap () returned 0x630000 [0051.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0051.988] GetProcessHeap () returned 0x630000 [0051.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0051.989] GetProcessHeap () returned 0x630000 [0051.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0051.989] GetProcessHeap () returned 0x630000 [0051.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0051.989] GetProcessHeap () returned 0x630000 [0051.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0051.989] GetProcessHeap () returned 0x630000 [0051.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0051.989] GetProcessHeap () returned 0x630000 [0051.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0051.989] GetProcessHeap () returned 0x630000 [0051.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0051.989] GetProcessHeap () returned 0x630000 [0051.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0051.989] GetProcessHeap () returned 0x630000 [0051.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0051.989] GetProcessHeap () returned 0x630000 [0051.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0051.989] GetProcessHeap () returned 0x630000 [0051.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0051.989] GetProcessHeap () returned 0x630000 [0051.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655fe0 | out: hHeap=0x630000) returned 1 [0051.989] GetProcessHeap () returned 0x630000 [0051.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0051.989] GetProcessHeap () returned 0x630000 [0051.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655890 | out: hHeap=0x630000) returned 1 [0051.989] GetProcessHeap () returned 0x630000 [0051.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0051.989] GetProcessHeap () returned 0x630000 [0051.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0051.989] GetProcessHeap () returned 0x630000 [0051.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0051.989] WriteFile (in: hFile=0x230, lpBuffer=0x65d498*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65d498*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0051.998] GetProcessHeap () returned 0x630000 [0051.998] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65d498, Size=0x30) returned 0x65d498 [0051.998] GetProcessHeap () returned 0x630000 [0051.998] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0051.998] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0051.998] GetProcessHeap () returned 0x630000 [0051.998] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf44d) returned 0x65dc28 [0051.999] ReadFile (in: hFile=0x230, lpBuffer=0x65dc28, nNumberOfBytesToRead=0xf44d, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65dc28*, lpNumberOfBytesRead=0x243d7e8*=0xf44d, lpOverlapped=0x0) returned 1 [0052.000] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.000] WriteFile (in: hFile=0x230, lpBuffer=0x65dc28*, nNumberOfBytesToWrite=0xf44d, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65dc28*, lpNumberOfBytesWritten=0x243d7e4*=0xf44d, lpOverlapped=0x0) returned 1 [0052.002] GetProcessHeap () returned 0x630000 [0052.002] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dc28 | out: hHeap=0x630000) returned 1 [0052.002] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0052.002] WriteFile (in: hFile=0x230, lpBuffer=0x65d498*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65d498*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0052.003] CloseHandle (hObject=0x230) returned 1 [0052.006] GetProcessHeap () returned 0x630000 [0052.006] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0052.006] GetProcessHeap () returned 0x630000 [0052.006] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b318 | out: hHeap=0x630000) returned 1 [0052.006] GetProcessHeap () returned 0x630000 [0052.006] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0052.006] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\default.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\default.htm" [0052.006] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default.htm", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default.htm.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\default.htm.happythreechoose" [0052.006] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\default.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\default.htm.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.htm.happythreechoose"), dwFlags=0x1) returned 1 [0052.007] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\default.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0052.007] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0052.007] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html" [0052.007] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\decryption info.html")) returned 0x20 [0052.007] GetProcessHeap () returned 0x630000 [0052.007] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0052.007] FindNextFileW (in: hFindFile=0x6486d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3bd859, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3bd859, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x13e24500, ftLastWriteTime.dwHighDateTime=0x1d2ee61, nFileSizeHigh=0x0, nFileSizeLow=0x1a2c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="default_eos.css", cAlternateFileName="DEFAUL~1.CSS")) returned 1 [0052.007] lstrcmpiW (lpString1="default_eos.css", lpString2=".") returned 1 [0052.007] lstrcmpiW (lpString1="default_eos.css", lpString2="..") returned 1 [0052.007] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="default_eos.css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css") returned="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css" [0052.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="default_eos.css", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0052.007] GetProcessHeap () returned 0x630000 [0052.007] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x64c9f0 [0052.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="default_eos.css", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="default_eos.css", lpUsedDefaultChar=0x0) returned 16 [0052.007] lstrlenA (lpString="default_eos.css") returned 15 [0052.007] lstrlenA (lpString=".happythreechoose") returned 17 [0052.007] lstrcmpiW (lpString1="default_eos.css", lpString2="Decryption INFO.html") returned 1 [0052.007] lstrcmpiW (lpString1="default_eos.css", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0052.007] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0052.007] lstrcmpiW (lpString1="default_eos.css", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0052.007] GetProcessHeap () returned 0x630000 [0052.007] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0052.007] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0052.008] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=6700) returned 1 [0052.008] GetProcessHeap () returned 0x630000 [0052.008] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x65b318 [0052.008] GetProcessHeap () returned 0x630000 [0052.008] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0052.008] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css") returned 48 [0052.009] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0052.009] GetProcessHeap () returned 0x630000 [0052.009] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0052.009] GetProcessHeap () returned 0x630000 [0052.009] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x384) returned 0x65dc28 [0052.009] lstrlenA (lpString="rsa_encrypt") returned 11 [0052.009] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0052.009] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0052.009] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0052.009] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0052.009] GetProcessHeap () returned 0x630000 [0052.009] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0052.009] lstrlenA (lpString="010001") returned 6 [0052.009] GetProcessHeap () returned 0x630000 [0052.009] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0052.010] GetProcessHeap () returned 0x630000 [0052.010] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0052.010] GetProcessHeap () returned 0x630000 [0052.010] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x6551d0 [0052.010] GetProcessHeap () returned 0x630000 [0052.010] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0052.010] GetProcessHeap () returned 0x630000 [0052.010] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655d10 [0052.010] GetProcessHeap () returned 0x630000 [0052.010] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656db0 [0052.010] GetProcessHeap () returned 0x630000 [0052.010] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0052.010] GetProcessHeap () returned 0x630000 [0052.010] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0052.010] GetProcessHeap () returned 0x630000 [0052.010] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.010] GetProcessHeap () returned 0x630000 [0052.010] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0052.010] GetProcessHeap () returned 0x630000 [0052.010] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0052.010] GetProcessHeap () returned 0x630000 [0052.010] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656b80 [0052.010] GetProcessHeap () returned 0x630000 [0052.010] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0052.010] GetProcessHeap () returned 0x630000 [0052.010] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0052.010] GetProcessHeap () returned 0x630000 [0052.010] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655140 [0052.010] GetProcessHeap () returned 0x630000 [0052.010] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0052.010] GetProcessHeap () returned 0x630000 [0052.010] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0052.010] GetProcessHeap () returned 0x630000 [0052.010] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655140 | out: hHeap=0x630000) returned 1 [0052.010] GetProcessHeap () returned 0x630000 [0052.010] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.010] GetProcessHeap () returned 0x630000 [0052.010] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65d880 [0052.010] GetProcessHeap () returned 0x630000 [0052.010] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0052.011] GetProcessHeap () returned 0x630000 [0052.011] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.011] GetProcessHeap () returned 0x630000 [0052.011] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.011] GetProcessHeap () returned 0x630000 [0052.011] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.011] GetProcessHeap () returned 0x630000 [0052.011] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x655ec0 [0052.011] GetProcessHeap () returned 0x630000 [0052.011] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65d880 | out: hHeap=0x630000) returned 1 [0052.011] GetProcessHeap () returned 0x630000 [0052.011] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0052.011] GetProcessHeap () returned 0x630000 [0052.011] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655ec0 | out: hHeap=0x630000) returned 1 [0052.011] GetProcessHeap () returned 0x630000 [0052.011] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0052.011] GetProcessHeap () returned 0x630000 [0052.011] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0052.011] GetProcessHeap () returned 0x630000 [0052.011] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.011] GetProcessHeap () returned 0x630000 [0052.011] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.011] GetProcessHeap () returned 0x630000 [0052.011] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.011] GetProcessHeap () returned 0x630000 [0052.011] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.011] GetProcessHeap () returned 0x630000 [0052.011] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.011] GetProcessHeap () returned 0x630000 [0052.011] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.011] GetProcessHeap () returned 0x630000 [0052.011] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.011] GetProcessHeap () returned 0x630000 [0052.011] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.011] GetProcessHeap () returned 0x630000 [0052.011] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.011] GetProcessHeap () returned 0x630000 [0052.011] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.011] GetProcessHeap () returned 0x630000 [0052.012] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.012] GetProcessHeap () returned 0x630000 [0052.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.012] GetProcessHeap () returned 0x630000 [0052.012] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.012] GetProcessHeap () returned 0x630000 [0052.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.012] GetProcessHeap () returned 0x630000 [0052.012] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.012] GetProcessHeap () returned 0x630000 [0052.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.012] GetProcessHeap () returned 0x630000 [0052.012] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.012] GetProcessHeap () returned 0x630000 [0052.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.012] GetProcessHeap () returned 0x630000 [0052.012] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.012] GetProcessHeap () returned 0x630000 [0052.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.012] GetProcessHeap () returned 0x630000 [0052.012] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.012] GetProcessHeap () returned 0x630000 [0052.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.012] GetProcessHeap () returned 0x630000 [0052.012] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.012] GetProcessHeap () returned 0x630000 [0052.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.012] GetProcessHeap () returned 0x630000 [0052.012] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.012] GetProcessHeap () returned 0x630000 [0052.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.012] GetProcessHeap () returned 0x630000 [0052.012] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.012] GetProcessHeap () returned 0x630000 [0052.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.012] GetProcessHeap () returned 0x630000 [0052.012] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.012] GetProcessHeap () returned 0x630000 [0052.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.013] GetProcessHeap () returned 0x630000 [0052.013] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.013] GetProcessHeap () returned 0x630000 [0052.013] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.013] GetProcessHeap () returned 0x630000 [0052.013] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.013] GetProcessHeap () returned 0x630000 [0052.013] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.013] GetProcessHeap () returned 0x630000 [0052.013] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.013] GetProcessHeap () returned 0x630000 [0052.013] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.013] GetProcessHeap () returned 0x630000 [0052.013] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.013] GetProcessHeap () returned 0x630000 [0052.013] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.013] GetProcessHeap () returned 0x630000 [0052.013] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0052.013] GetProcessHeap () returned 0x630000 [0052.013] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0052.013] GetProcessHeap () returned 0x630000 [0052.013] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.013] GetProcessHeap () returned 0x630000 [0052.013] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.013] GetProcessHeap () returned 0x630000 [0052.013] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.013] GetProcessHeap () returned 0x630000 [0052.013] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.013] GetProcessHeap () returned 0x630000 [0052.013] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0052.013] GetProcessHeap () returned 0x630000 [0052.013] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0052.013] GetProcessHeap () returned 0x630000 [0052.013] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.013] GetProcessHeap () returned 0x630000 [0052.013] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.013] GetProcessHeap () returned 0x630000 [0052.013] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.013] GetProcessHeap () returned 0x630000 [0052.014] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.014] GetProcessHeap () returned 0x630000 [0052.014] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0052.014] GetProcessHeap () returned 0x630000 [0052.014] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0052.014] GetProcessHeap () returned 0x630000 [0052.014] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.014] GetProcessHeap () returned 0x630000 [0052.014] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.014] GetProcessHeap () returned 0x630000 [0052.014] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.014] GetProcessHeap () returned 0x630000 [0052.014] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.014] GetProcessHeap () returned 0x630000 [0052.014] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.014] GetProcessHeap () returned 0x630000 [0052.014] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.014] GetProcessHeap () returned 0x630000 [0052.014] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.014] GetProcessHeap () returned 0x630000 [0052.014] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.014] GetProcessHeap () returned 0x630000 [0052.014] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0052.014] GetProcessHeap () returned 0x630000 [0052.014] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0052.014] GetProcessHeap () returned 0x630000 [0052.014] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.014] GetProcessHeap () returned 0x630000 [0052.014] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.014] GetProcessHeap () returned 0x630000 [0052.014] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.014] GetProcessHeap () returned 0x630000 [0052.014] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.014] GetProcessHeap () returned 0x630000 [0052.014] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.014] GetProcessHeap () returned 0x630000 [0052.014] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.014] GetProcessHeap () returned 0x630000 [0052.015] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.015] GetProcessHeap () returned 0x630000 [0052.015] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.015] GetProcessHeap () returned 0x630000 [0052.015] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0052.015] GetProcessHeap () returned 0x630000 [0052.015] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0052.015] GetProcessHeap () returned 0x630000 [0052.015] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.015] GetProcessHeap () returned 0x630000 [0052.015] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.015] GetProcessHeap () returned 0x630000 [0052.015] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.015] GetProcessHeap () returned 0x630000 [0052.015] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.015] GetProcessHeap () returned 0x630000 [0052.015] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.015] GetProcessHeap () returned 0x630000 [0052.015] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.015] GetProcessHeap () returned 0x630000 [0052.015] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.015] GetProcessHeap () returned 0x630000 [0052.015] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.015] GetProcessHeap () returned 0x630000 [0052.015] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0052.015] GetProcessHeap () returned 0x630000 [0052.015] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0052.015] GetProcessHeap () returned 0x630000 [0052.015] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0052.015] GetProcessHeap () returned 0x630000 [0052.015] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0052.015] GetProcessHeap () returned 0x630000 [0052.015] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0052.015] GetProcessHeap () returned 0x630000 [0052.015] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655d10 | out: hHeap=0x630000) returned 1 [0052.015] GetProcessHeap () returned 0x630000 [0052.015] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0052.015] GetProcessHeap () returned 0x630000 [0052.016] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6551d0 | out: hHeap=0x630000) returned 1 [0052.016] GetProcessHeap () returned 0x630000 [0052.016] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0052.016] GetProcessHeap () returned 0x630000 [0052.016] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.016] GetProcessHeap () returned 0x630000 [0052.016] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0052.016] WriteFile (in: hFile=0x230, lpBuffer=0x65dc28*, nNumberOfBytesToWrite=0x384, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65dc28*, lpNumberOfBytesWritten=0x243d864*=0x384, lpOverlapped=0x0) returned 1 [0052.019] GetProcessHeap () returned 0x630000 [0052.019] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65dc28, Size=0x30) returned 0x65dc28 [0052.019] GetProcessHeap () returned 0x630000 [0052.019] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0052.019] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.019] GetProcessHeap () returned 0x630000 [0052.019] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a30) returned 0x65dc60 [0052.019] ReadFile (in: hFile=0x230, lpBuffer=0x65dc60, nNumberOfBytesToRead=0x1a30, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65dc60*, lpNumberOfBytesRead=0x243d7e8*=0x1a30, lpOverlapped=0x0) returned 1 [0052.020] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.020] WriteFile (in: hFile=0x230, lpBuffer=0x65dc60*, nNumberOfBytesToWrite=0x1a30, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65dc60*, lpNumberOfBytesWritten=0x243d7e4*=0x1a30, lpOverlapped=0x0) returned 1 [0052.021] GetProcessHeap () returned 0x630000 [0052.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dc60 | out: hHeap=0x630000) returned 1 [0052.023] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0052.023] WriteFile (in: hFile=0x230, lpBuffer=0x65dc28*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65dc28*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0052.024] CloseHandle (hObject=0x230) returned 1 [0052.025] GetProcessHeap () returned 0x630000 [0052.025] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0052.025] GetProcessHeap () returned 0x630000 [0052.025] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b318 | out: hHeap=0x630000) returned 1 [0052.025] GetProcessHeap () returned 0x630000 [0052.025] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0052.025] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css") returned="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css" [0052.025] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css.happythreechoose" [0052.025] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.css"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.css.happythreechoose"), dwFlags=0x1) returned 1 [0052.026] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0052.026] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0052.026] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html" [0052.026] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\decryption info.html")) returned 0x20 [0052.026] GetProcessHeap () returned 0x630000 [0052.026] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0052.026] FindNextFileW (in: hFindFile=0x6486d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3bff6c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3bff6c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea75e900, ftLastWriteTime.dwHighDateTime=0x1d2ee61, nFileSizeHigh=0x0, nFileSizeLow=0xda3a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="default_eos.htm", cAlternateFileName="DEFAUL~1.HTM")) returned 1 [0052.026] lstrcmpiW (lpString1="default_eos.htm", lpString2=".") returned 1 [0052.026] lstrcmpiW (lpString1="default_eos.htm", lpString2="..") returned 1 [0052.026] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="default_eos.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm" [0052.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="default_eos.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0052.026] GetProcessHeap () returned 0x630000 [0052.026] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x64ca20 [0052.026] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="default_eos.htm", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="default_eos.htm", lpUsedDefaultChar=0x0) returned 16 [0052.026] lstrlenA (lpString="default_eos.htm") returned 15 [0052.026] lstrlenA (lpString=".happythreechoose") returned 17 [0052.026] lstrcmpiW (lpString1="default_eos.htm", lpString2="Decryption INFO.html") returned 1 [0052.026] lstrcmpiW (lpString1="default_eos.htm", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0052.026] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0052.026] lstrcmpiW (lpString1="default_eos.htm", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0052.026] GetProcessHeap () returned 0x630000 [0052.026] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651ec0 [0052.026] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0052.027] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=55866) returned 1 [0052.027] GetProcessHeap () returned 0x630000 [0052.027] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x65b138 [0052.027] GetProcessHeap () returned 0x630000 [0052.027] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0052.027] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm") returned 48 [0052.027] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0052.027] GetProcessHeap () returned 0x630000 [0052.027] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0052.027] GetProcessHeap () returned 0x630000 [0052.027] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x386) returned 0x65dc60 [0052.028] lstrlenA (lpString="rsa_encrypt") returned 11 [0052.028] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0052.029] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0052.029] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0052.029] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0052.029] GetProcessHeap () returned 0x630000 [0052.029] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0052.029] lstrlenA (lpString="010001") returned 6 [0052.029] GetProcessHeap () returned 0x630000 [0052.029] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0052.029] GetProcessHeap () returned 0x630000 [0052.029] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0052.029] GetProcessHeap () returned 0x630000 [0052.029] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655bf0 [0052.029] GetProcessHeap () returned 0x630000 [0052.029] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0052.029] GetProcessHeap () returned 0x630000 [0052.029] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x6554a0 [0052.029] GetProcessHeap () returned 0x630000 [0052.029] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657328 [0052.029] GetProcessHeap () returned 0x630000 [0052.029] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a298 [0052.029] GetProcessHeap () returned 0x630000 [0052.029] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0052.029] GetProcessHeap () returned 0x630000 [0052.029] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.029] GetProcessHeap () returned 0x630000 [0052.029] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0052.029] GetProcessHeap () returned 0x630000 [0052.029] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0052.029] GetProcessHeap () returned 0x630000 [0052.029] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657670 [0052.029] GetProcessHeap () returned 0x630000 [0052.029] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.030] GetProcessHeap () returned 0x630000 [0052.030] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0052.030] GetProcessHeap () returned 0x630000 [0052.030] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655530 [0052.030] GetProcessHeap () returned 0x630000 [0052.030] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0052.030] GetProcessHeap () returned 0x630000 [0052.030] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0052.030] GetProcessHeap () returned 0x630000 [0052.030] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655530 | out: hHeap=0x630000) returned 1 [0052.030] GetProcessHeap () returned 0x630000 [0052.030] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.030] GetProcessHeap () returned 0x630000 [0052.030] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65dad8 [0052.030] GetProcessHeap () returned 0x630000 [0052.030] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.030] GetProcessHeap () returned 0x630000 [0052.030] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.030] GetProcessHeap () returned 0x630000 [0052.030] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.030] GetProcessHeap () returned 0x630000 [0052.030] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.030] GetProcessHeap () returned 0x630000 [0052.030] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x6552f0 [0052.030] GetProcessHeap () returned 0x630000 [0052.030] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dad8 | out: hHeap=0x630000) returned 1 [0052.030] GetProcessHeap () returned 0x630000 [0052.030] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0052.030] GetProcessHeap () returned 0x630000 [0052.030] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6552f0 | out: hHeap=0x630000) returned 1 [0052.030] GetProcessHeap () returned 0x630000 [0052.030] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.030] GetProcessHeap () returned 0x630000 [0052.030] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.030] GetProcessHeap () returned 0x630000 [0052.030] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.030] GetProcessHeap () returned 0x630000 [0052.030] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.030] GetProcessHeap () returned 0x630000 [0052.030] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0052.031] GetProcessHeap () returned 0x630000 [0052.031] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0052.031] GetProcessHeap () returned 0x630000 [0052.031] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.031] GetProcessHeap () returned 0x630000 [0052.031] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.031] GetProcessHeap () returned 0x630000 [0052.031] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.031] GetProcessHeap () returned 0x630000 [0052.031] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.031] GetProcessHeap () returned 0x630000 [0052.031] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0052.031] GetProcessHeap () returned 0x630000 [0052.031] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0052.031] GetProcessHeap () returned 0x630000 [0052.031] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.031] GetProcessHeap () returned 0x630000 [0052.031] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.031] GetProcessHeap () returned 0x630000 [0052.031] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.031] GetProcessHeap () returned 0x630000 [0052.031] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.031] GetProcessHeap () returned 0x630000 [0052.031] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0052.031] GetProcessHeap () returned 0x630000 [0052.031] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0052.031] GetProcessHeap () returned 0x630000 [0052.031] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.031] GetProcessHeap () returned 0x630000 [0052.031] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.031] GetProcessHeap () returned 0x630000 [0052.031] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.031] GetProcessHeap () returned 0x630000 [0052.031] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.031] GetProcessHeap () returned 0x630000 [0052.031] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.031] GetProcessHeap () returned 0x630000 [0052.031] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.032] GetProcessHeap () returned 0x630000 [0052.032] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0052.032] GetProcessHeap () returned 0x630000 [0052.032] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0052.032] GetProcessHeap () returned 0x630000 [0052.032] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.032] GetProcessHeap () returned 0x630000 [0052.032] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.032] GetProcessHeap () returned 0x630000 [0052.032] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.032] GetProcessHeap () returned 0x630000 [0052.032] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.032] GetProcessHeap () returned 0x630000 [0052.032] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.032] GetProcessHeap () returned 0x630000 [0052.032] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.032] GetProcessHeap () returned 0x630000 [0052.032] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0052.032] GetProcessHeap () returned 0x630000 [0052.032] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0052.032] GetProcessHeap () returned 0x630000 [0052.032] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.032] GetProcessHeap () returned 0x630000 [0052.032] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.032] GetProcessHeap () returned 0x630000 [0052.032] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.032] GetProcessHeap () returned 0x630000 [0052.032] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.032] GetProcessHeap () returned 0x630000 [0052.032] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.032] GetProcessHeap () returned 0x630000 [0052.032] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.032] GetProcessHeap () returned 0x630000 [0052.032] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.032] GetProcessHeap () returned 0x630000 [0052.032] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.032] GetProcessHeap () returned 0x630000 [0052.032] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.033] GetProcessHeap () returned 0x630000 [0052.033] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.033] GetProcessHeap () returned 0x630000 [0052.033] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.033] GetProcessHeap () returned 0x630000 [0052.033] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.033] GetProcessHeap () returned 0x630000 [0052.033] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.033] GetProcessHeap () returned 0x630000 [0052.033] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.033] GetProcessHeap () returned 0x630000 [0052.033] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0052.033] GetProcessHeap () returned 0x630000 [0052.033] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0052.033] GetProcessHeap () returned 0x630000 [0052.033] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0052.033] GetProcessHeap () returned 0x630000 [0052.033] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0052.033] GetProcessHeap () returned 0x630000 [0052.033] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.033] GetProcessHeap () returned 0x630000 [0052.033] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.033] GetProcessHeap () returned 0x630000 [0052.033] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0052.033] GetProcessHeap () returned 0x630000 [0052.033] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0052.033] GetProcessHeap () returned 0x630000 [0052.033] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0052.033] GetProcessHeap () returned 0x630000 [0052.033] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0052.033] GetProcessHeap () returned 0x630000 [0052.033] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.033] GetProcessHeap () returned 0x630000 [0052.033] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.033] GetProcessHeap () returned 0x630000 [0052.033] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.033] GetProcessHeap () returned 0x630000 [0052.033] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.033] GetProcessHeap () returned 0x630000 [0052.033] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.034] GetProcessHeap () returned 0x630000 [0052.034] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.034] GetProcessHeap () returned 0x630000 [0052.034] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.034] GetProcessHeap () returned 0x630000 [0052.034] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.034] GetProcessHeap () returned 0x630000 [0052.034] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0052.034] GetProcessHeap () returned 0x630000 [0052.034] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0052.034] GetProcessHeap () returned 0x630000 [0052.034] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.034] GetProcessHeap () returned 0x630000 [0052.034] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.034] GetProcessHeap () returned 0x630000 [0052.034] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.034] GetProcessHeap () returned 0x630000 [0052.034] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.034] GetProcessHeap () returned 0x630000 [0052.034] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0052.034] GetProcessHeap () returned 0x630000 [0052.034] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0052.034] GetProcessHeap () returned 0x630000 [0052.034] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.034] GetProcessHeap () returned 0x630000 [0052.034] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.034] GetProcessHeap () returned 0x630000 [0052.034] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.034] GetProcessHeap () returned 0x630000 [0052.034] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.034] GetProcessHeap () returned 0x630000 [0052.034] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0052.034] GetProcessHeap () returned 0x630000 [0052.034] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0052.034] GetProcessHeap () returned 0x630000 [0052.034] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.034] GetProcessHeap () returned 0x630000 [0052.034] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.034] GetProcessHeap () returned 0x630000 [0052.035] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0052.035] GetProcessHeap () returned 0x630000 [0052.035] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0052.035] GetProcessHeap () returned 0x630000 [0052.035] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0052.035] GetProcessHeap () returned 0x630000 [0052.035] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0052.035] GetProcessHeap () returned 0x630000 [0052.035] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0052.035] GetProcessHeap () returned 0x630000 [0052.035] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6554a0 | out: hHeap=0x630000) returned 1 [0052.035] GetProcessHeap () returned 0x630000 [0052.035] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0052.035] GetProcessHeap () returned 0x630000 [0052.035] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655bf0 | out: hHeap=0x630000) returned 1 [0052.035] GetProcessHeap () returned 0x630000 [0052.035] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0052.035] GetProcessHeap () returned 0x630000 [0052.035] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.035] GetProcessHeap () returned 0x630000 [0052.035] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0052.035] WriteFile (in: hFile=0x230, lpBuffer=0x65dc60*, nNumberOfBytesToWrite=0x386, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65dc60*, lpNumberOfBytesWritten=0x243d864*=0x386, lpOverlapped=0x0) returned 1 [0052.038] GetProcessHeap () returned 0x630000 [0052.038] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65dc60, Size=0x30) returned 0x65dc60 [0052.038] GetProcessHeap () returned 0x630000 [0052.038] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0052.038] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.038] GetProcessHeap () returned 0x630000 [0052.039] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xda40) returned 0x65dc98 [0052.040] ReadFile (in: hFile=0x230, lpBuffer=0x65dc98, nNumberOfBytesToRead=0xda40, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65dc98*, lpNumberOfBytesRead=0x243d7e8*=0xda40, lpOverlapped=0x0) returned 1 [0052.042] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.042] WriteFile (in: hFile=0x230, lpBuffer=0x65dc98*, nNumberOfBytesToWrite=0xda40, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65dc98*, lpNumberOfBytesWritten=0x243d7e4*=0xda40, lpOverlapped=0x0) returned 1 [0052.092] GetProcessHeap () returned 0x630000 [0052.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dc98 | out: hHeap=0x630000) returned 1 [0052.094] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0052.094] WriteFile (in: hFile=0x230, lpBuffer=0x65dc60*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65dc60*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0052.095] CloseHandle (hObject=0x230) returned 1 [0052.101] GetProcessHeap () returned 0x630000 [0052.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651ec0 | out: hHeap=0x630000) returned 1 [0052.101] GetProcessHeap () returned 0x630000 [0052.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b138 | out: hHeap=0x630000) returned 1 [0052.101] GetProcessHeap () returned 0x630000 [0052.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0052.101] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm" [0052.101] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm.happythreechoose" [0052.101] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.htm.happythreechoose"), dwFlags=0x1) returned 1 [0052.102] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0052.102] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0052.102] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html" [0052.102] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\decryption info.html")) returned 0x20 [0052.102] GetProcessHeap () returned 0x630000 [0052.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0052.102] FindNextFileW (in: hFindFile=0x6486d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c12fc, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c12fc, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1468, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="default_oobe.css", cAlternateFileName="DEFAUL~2.CSS")) returned 1 [0052.102] lstrcmpiW (lpString1="default_oobe.css", lpString2=".") returned 1 [0052.102] lstrcmpiW (lpString1="default_oobe.css", lpString2="..") returned 1 [0052.102] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="default_oobe.css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css") returned="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css" [0052.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="default_oobe.css", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0052.102] GetProcessHeap () returned 0x630000 [0052.102] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11) returned 0x645f58 [0052.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="default_oobe.css", cchWideChar=-1, lpMultiByteStr=0x645f58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="default_oobe.css", lpUsedDefaultChar=0x0) returned 17 [0052.102] lstrlenA (lpString="default_oobe.css") returned 16 [0052.102] lstrlenA (lpString=".happythreechoose") returned 17 [0052.102] lstrcmpiW (lpString1="default_oobe.css", lpString2="Decryption INFO.html") returned 1 [0052.102] lstrcmpiW (lpString1="default_oobe.css", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0052.102] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0052.103] lstrcmpiW (lpString1="default_oobe.css", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0052.103] GetProcessHeap () returned 0x630000 [0052.103] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0052.103] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0052.103] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=5224) returned 1 [0052.103] GetProcessHeap () returned 0x630000 [0052.103] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x65b048 [0052.103] GetProcessHeap () returned 0x630000 [0052.103] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0052.103] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css") returned 49 [0052.103] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0052.103] GetProcessHeap () returned 0x630000 [0052.103] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0052.104] GetProcessHeap () returned 0x630000 [0052.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x388) returned 0x65dc98 [0052.105] lstrlenA (lpString="rsa_encrypt") returned 11 [0052.105] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0052.106] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0052.106] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0052.106] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0052.106] GetProcessHeap () returned 0x630000 [0052.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0052.106] lstrlenA (lpString="010001") returned 6 [0052.106] GetProcessHeap () returned 0x630000 [0052.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2a8 [0052.106] GetProcessHeap () returned 0x630000 [0052.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0052.106] GetProcessHeap () returned 0x630000 [0052.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x6551d0 [0052.106] GetProcessHeap () returned 0x630000 [0052.106] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0052.107] GetProcessHeap () returned 0x630000 [0052.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655770 [0052.107] GetProcessHeap () returned 0x630000 [0052.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657440 [0052.107] GetProcessHeap () returned 0x630000 [0052.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0052.107] GetProcessHeap () returned 0x630000 [0052.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0052.107] GetProcessHeap () returned 0x630000 [0052.107] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.107] GetProcessHeap () returned 0x630000 [0052.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0052.107] GetProcessHeap () returned 0x630000 [0052.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0052.107] GetProcessHeap () returned 0x630000 [0052.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656c98 [0052.107] GetProcessHeap () returned 0x630000 [0052.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.107] GetProcessHeap () returned 0x630000 [0052.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0052.107] GetProcessHeap () returned 0x630000 [0052.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x6552f0 [0052.107] GetProcessHeap () returned 0x630000 [0052.107] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0052.107] GetProcessHeap () returned 0x630000 [0052.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0052.107] GetProcessHeap () returned 0x630000 [0052.107] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6552f0 | out: hHeap=0x630000) returned 1 [0052.107] GetProcessHeap () returned 0x630000 [0052.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0052.107] GetProcessHeap () returned 0x630000 [0052.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0052.108] GetProcessHeap () returned 0x630000 [0052.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.108] GetProcessHeap () returned 0x630000 [0052.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0052.108] GetProcessHeap () returned 0x630000 [0052.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.108] GetProcessHeap () returned 0x630000 [0052.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.108] GetProcessHeap () returned 0x630000 [0052.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x655ec0 [0052.108] GetProcessHeap () returned 0x630000 [0052.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0052.108] GetProcessHeap () returned 0x630000 [0052.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0052.108] GetProcessHeap () returned 0x630000 [0052.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655ec0 | out: hHeap=0x630000) returned 1 [0052.108] GetProcessHeap () returned 0x630000 [0052.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.108] GetProcessHeap () returned 0x630000 [0052.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.108] GetProcessHeap () returned 0x630000 [0052.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0052.108] GetProcessHeap () returned 0x630000 [0052.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0052.108] GetProcessHeap () returned 0x630000 [0052.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.108] GetProcessHeap () returned 0x630000 [0052.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.108] GetProcessHeap () returned 0x630000 [0052.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.108] GetProcessHeap () returned 0x630000 [0052.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.109] GetProcessHeap () returned 0x630000 [0052.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0052.109] GetProcessHeap () returned 0x630000 [0052.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0052.109] GetProcessHeap () returned 0x630000 [0052.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.109] GetProcessHeap () returned 0x630000 [0052.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.109] GetProcessHeap () returned 0x630000 [0052.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.109] GetProcessHeap () returned 0x630000 [0052.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.109] GetProcessHeap () returned 0x630000 [0052.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0052.109] GetProcessHeap () returned 0x630000 [0052.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0052.109] GetProcessHeap () returned 0x630000 [0052.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.109] GetProcessHeap () returned 0x630000 [0052.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.109] GetProcessHeap () returned 0x630000 [0052.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.109] GetProcessHeap () returned 0x630000 [0052.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.109] GetProcessHeap () returned 0x630000 [0052.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0052.109] GetProcessHeap () returned 0x630000 [0052.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0052.109] GetProcessHeap () returned 0x630000 [0052.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.109] GetProcessHeap () returned 0x630000 [0052.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.110] GetProcessHeap () returned 0x630000 [0052.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0052.110] GetProcessHeap () returned 0x630000 [0052.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0052.110] GetProcessHeap () returned 0x630000 [0052.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0052.110] GetProcessHeap () returned 0x630000 [0052.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0052.110] GetProcessHeap () returned 0x630000 [0052.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.110] GetProcessHeap () returned 0x630000 [0052.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.110] GetProcessHeap () returned 0x630000 [0052.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.110] GetProcessHeap () returned 0x630000 [0052.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.110] GetProcessHeap () returned 0x630000 [0052.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.110] GetProcessHeap () returned 0x630000 [0052.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.110] GetProcessHeap () returned 0x630000 [0052.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.110] GetProcessHeap () returned 0x630000 [0052.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.110] GetProcessHeap () returned 0x630000 [0052.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.110] GetProcessHeap () returned 0x630000 [0052.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.110] GetProcessHeap () returned 0x630000 [0052.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.111] GetProcessHeap () returned 0x630000 [0052.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.111] GetProcessHeap () returned 0x630000 [0052.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0052.111] GetProcessHeap () returned 0x630000 [0052.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0052.111] GetProcessHeap () returned 0x630000 [0052.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.111] GetProcessHeap () returned 0x630000 [0052.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.111] GetProcessHeap () returned 0x630000 [0052.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0052.111] GetProcessHeap () returned 0x630000 [0052.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0052.111] GetProcessHeap () returned 0x630000 [0052.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.111] GetProcessHeap () returned 0x630000 [0052.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.111] GetProcessHeap () returned 0x630000 [0052.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.111] GetProcessHeap () returned 0x630000 [0052.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.111] GetProcessHeap () returned 0x630000 [0052.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.111] GetProcessHeap () returned 0x630000 [0052.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.111] GetProcessHeap () returned 0x630000 [0052.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.111] GetProcessHeap () returned 0x630000 [0052.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.112] GetProcessHeap () returned 0x630000 [0052.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.112] GetProcessHeap () returned 0x630000 [0052.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.112] GetProcessHeap () returned 0x630000 [0052.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0052.112] GetProcessHeap () returned 0x630000 [0052.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0052.112] GetProcessHeap () returned 0x630000 [0052.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.112] GetProcessHeap () returned 0x630000 [0052.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.112] GetProcessHeap () returned 0x630000 [0052.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.112] GetProcessHeap () returned 0x630000 [0052.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.112] GetProcessHeap () returned 0x630000 [0052.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.112] GetProcessHeap () returned 0x630000 [0052.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.112] GetProcessHeap () returned 0x630000 [0052.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.112] GetProcessHeap () returned 0x630000 [0052.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.112] GetProcessHeap () returned 0x630000 [0052.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0052.112] GetProcessHeap () returned 0x630000 [0052.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0052.112] GetProcessHeap () returned 0x630000 [0052.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.112] GetProcessHeap () returned 0x630000 [0052.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.113] GetProcessHeap () returned 0x630000 [0052.113] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0052.113] GetProcessHeap () returned 0x630000 [0052.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0052.113] GetProcessHeap () returned 0x630000 [0052.113] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0052.113] GetProcessHeap () returned 0x630000 [0052.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0052.113] GetProcessHeap () returned 0x630000 [0052.113] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.113] GetProcessHeap () returned 0x630000 [0052.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.113] GetProcessHeap () returned 0x630000 [0052.113] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.113] GetProcessHeap () returned 0x630000 [0052.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.113] GetProcessHeap () returned 0x630000 [0052.113] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.113] GetProcessHeap () returned 0x630000 [0052.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.113] GetProcessHeap () returned 0x630000 [0052.113] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.113] GetProcessHeap () returned 0x630000 [0052.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.113] GetProcessHeap () returned 0x630000 [0052.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0052.113] GetProcessHeap () returned 0x630000 [0052.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0052.113] GetProcessHeap () returned 0x630000 [0052.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0052.113] GetProcessHeap () returned 0x630000 [0052.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0052.114] GetProcessHeap () returned 0x630000 [0052.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0052.114] GetProcessHeap () returned 0x630000 [0052.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655770 | out: hHeap=0x630000) returned 1 [0052.114] GetProcessHeap () returned 0x630000 [0052.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0052.114] GetProcessHeap () returned 0x630000 [0052.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6551d0 | out: hHeap=0x630000) returned 1 [0052.114] GetProcessHeap () returned 0x630000 [0052.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0052.114] GetProcessHeap () returned 0x630000 [0052.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0052.114] GetProcessHeap () returned 0x630000 [0052.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0052.114] WriteFile (in: hFile=0x230, lpBuffer=0x65dc98*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65dc98*, lpNumberOfBytesWritten=0x243d864*=0x388, lpOverlapped=0x0) returned 1 [0052.120] GetProcessHeap () returned 0x630000 [0052.120] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65dc98, Size=0x30) returned 0x65dc98 [0052.120] GetProcessHeap () returned 0x630000 [0052.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0052.120] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.120] GetProcessHeap () returned 0x630000 [0052.120] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1470) returned 0x65dcd0 [0052.120] ReadFile (in: hFile=0x230, lpBuffer=0x65dcd0, nNumberOfBytesToRead=0x1470, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65dcd0*, lpNumberOfBytesRead=0x243d7e8*=0x1470, lpOverlapped=0x0) returned 1 [0052.121] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.121] WriteFile (in: hFile=0x230, lpBuffer=0x65dcd0*, nNumberOfBytesToWrite=0x1470, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65dcd0*, lpNumberOfBytesWritten=0x243d7e4*=0x1470, lpOverlapped=0x0) returned 1 [0052.123] GetProcessHeap () returned 0x630000 [0052.123] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dcd0 | out: hHeap=0x630000) returned 1 [0052.124] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0052.124] WriteFile (in: hFile=0x230, lpBuffer=0x65dc98*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65dc98*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0052.129] CloseHandle (hObject=0x230) returned 1 [0052.131] GetProcessHeap () returned 0x630000 [0052.131] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0052.131] GetProcessHeap () returned 0x630000 [0052.131] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b048 | out: hHeap=0x630000) returned 1 [0052.131] GetProcessHeap () returned 0x630000 [0052.131] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0052.131] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css") returned="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css" [0052.131] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css.happythreechoose" [0052.131] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.css"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.css.happythreechoose"), dwFlags=0x1) returned 1 [0052.132] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0052.132] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0052.132] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html" [0052.132] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\decryption info.html")) returned 0x20 [0052.132] GetProcessHeap () returned 0x630000 [0052.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645f58 | out: hHeap=0x630000) returned 1 [0052.132] FindNextFileW (in: hFindFile=0x6486d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c2685, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c2685, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x7f589b00, ftLastWriteTime.dwHighDateTime=0x1d2ea8c, nFileSizeHigh=0x0, nFileSizeLow=0x100ae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="default_oobe.htm", cAlternateFileName="DEFAUL~2.HTM")) returned 1 [0052.132] lstrcmpiW (lpString1="default_oobe.htm", lpString2=".") returned 1 [0052.132] lstrcmpiW (lpString1="default_oobe.htm", lpString2="..") returned 1 [0052.132] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="default_oobe.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm" [0052.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="default_oobe.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0052.132] GetProcessHeap () returned 0x630000 [0052.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11) returned 0x645f58 [0052.133] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="default_oobe.htm", cchWideChar=-1, lpMultiByteStr=0x645f58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="default_oobe.htm", lpUsedDefaultChar=0x0) returned 17 [0052.133] lstrlenA (lpString="default_oobe.htm") returned 16 [0052.133] lstrlenA (lpString=".happythreechoose") returned 17 [0052.133] lstrcmpiW (lpString1="default_oobe.htm", lpString2="Decryption INFO.html") returned 1 [0052.133] lstrcmpiW (lpString1="default_oobe.htm", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0052.133] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0052.133] lstrcmpiW (lpString1="default_oobe.htm", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0052.133] GetProcessHeap () returned 0x630000 [0052.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f10 [0052.133] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0052.133] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=65710) returned 1 [0052.133] GetProcessHeap () returned 0x630000 [0052.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x65b138 [0052.133] GetProcessHeap () returned 0x630000 [0052.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0052.133] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm") returned 49 [0052.133] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0052.133] GetProcessHeap () returned 0x630000 [0052.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0052.134] GetProcessHeap () returned 0x630000 [0052.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x382) returned 0x65dcd0 [0052.134] lstrlenA (lpString="rsa_encrypt") returned 11 [0052.134] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0052.134] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0052.134] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0052.134] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0052.134] GetProcessHeap () returned 0x630000 [0052.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0052.134] lstrlenA (lpString="010001") returned 6 [0052.134] GetProcessHeap () returned 0x630000 [0052.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a398 [0052.134] GetProcessHeap () returned 0x630000 [0052.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0052.135] GetProcessHeap () returned 0x630000 [0052.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655770 [0052.135] GetProcessHeap () returned 0x630000 [0052.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0052.135] GetProcessHeap () returned 0x630000 [0052.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655410 [0052.135] GetProcessHeap () returned 0x630000 [0052.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657210 [0052.135] GetProcessHeap () returned 0x630000 [0052.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a348 [0052.135] GetProcessHeap () returned 0x630000 [0052.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0052.135] GetProcessHeap () returned 0x630000 [0052.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.135] GetProcessHeap () returned 0x630000 [0052.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0052.135] GetProcessHeap () returned 0x630000 [0052.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0052.135] GetProcessHeap () returned 0x630000 [0052.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656ec8 [0052.135] GetProcessHeap () returned 0x630000 [0052.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.135] GetProcessHeap () returned 0x630000 [0052.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0052.135] GetProcessHeap () returned 0x630000 [0052.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x6555c0 [0052.135] GetProcessHeap () returned 0x630000 [0052.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0052.135] GetProcessHeap () returned 0x630000 [0052.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0052.135] GetProcessHeap () returned 0x630000 [0052.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6555c0 | out: hHeap=0x630000) returned 1 [0052.135] GetProcessHeap () returned 0x630000 [0052.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.135] GetProcessHeap () returned 0x630000 [0052.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0052.135] GetProcessHeap () returned 0x630000 [0052.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.135] GetProcessHeap () returned 0x630000 [0052.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.135] GetProcessHeap () returned 0x630000 [0052.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0052.136] GetProcessHeap () returned 0x630000 [0052.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0052.136] GetProcessHeap () returned 0x630000 [0052.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x655f50 [0052.136] GetProcessHeap () returned 0x630000 [0052.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0052.136] GetProcessHeap () returned 0x630000 [0052.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0052.136] GetProcessHeap () returned 0x630000 [0052.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655f50 | out: hHeap=0x630000) returned 1 [0052.136] GetProcessHeap () returned 0x630000 [0052.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.136] GetProcessHeap () returned 0x630000 [0052.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.136] GetProcessHeap () returned 0x630000 [0052.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.136] GetProcessHeap () returned 0x630000 [0052.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.136] GetProcessHeap () returned 0x630000 [0052.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.136] GetProcessHeap () returned 0x630000 [0052.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.136] GetProcessHeap () returned 0x630000 [0052.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.136] GetProcessHeap () returned 0x630000 [0052.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.136] GetProcessHeap () returned 0x630000 [0052.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.136] GetProcessHeap () returned 0x630000 [0052.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.136] GetProcessHeap () returned 0x630000 [0052.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.136] GetProcessHeap () returned 0x630000 [0052.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.136] GetProcessHeap () returned 0x630000 [0052.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.136] GetProcessHeap () returned 0x630000 [0052.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.137] GetProcessHeap () returned 0x630000 [0052.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0052.137] GetProcessHeap () returned 0x630000 [0052.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0052.137] GetProcessHeap () returned 0x630000 [0052.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0052.137] GetProcessHeap () returned 0x630000 [0052.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0052.137] GetProcessHeap () returned 0x630000 [0052.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.137] GetProcessHeap () returned 0x630000 [0052.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.137] GetProcessHeap () returned 0x630000 [0052.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.137] GetProcessHeap () returned 0x630000 [0052.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.137] GetProcessHeap () returned 0x630000 [0052.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.137] GetProcessHeap () returned 0x630000 [0052.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.137] GetProcessHeap () returned 0x630000 [0052.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.137] GetProcessHeap () returned 0x630000 [0052.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.137] GetProcessHeap () returned 0x630000 [0052.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.137] GetProcessHeap () returned 0x630000 [0052.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.137] GetProcessHeap () returned 0x630000 [0052.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.137] GetProcessHeap () returned 0x630000 [0052.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.137] GetProcessHeap () returned 0x630000 [0052.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.137] GetProcessHeap () returned 0x630000 [0052.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.137] GetProcessHeap () returned 0x630000 [0052.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.138] GetProcessHeap () returned 0x630000 [0052.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.138] GetProcessHeap () returned 0x630000 [0052.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.138] GetProcessHeap () returned 0x630000 [0052.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.138] GetProcessHeap () returned 0x630000 [0052.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.138] GetProcessHeap () returned 0x630000 [0052.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.138] GetProcessHeap () returned 0x630000 [0052.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.138] GetProcessHeap () returned 0x630000 [0052.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.138] GetProcessHeap () returned 0x630000 [0052.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.138] GetProcessHeap () returned 0x630000 [0052.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.138] GetProcessHeap () returned 0x630000 [0052.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.138] GetProcessHeap () returned 0x630000 [0052.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.138] GetProcessHeap () returned 0x630000 [0052.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.138] GetProcessHeap () returned 0x630000 [0052.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.138] GetProcessHeap () returned 0x630000 [0052.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0052.138] GetProcessHeap () returned 0x630000 [0052.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0052.138] GetProcessHeap () returned 0x630000 [0052.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.138] GetProcessHeap () returned 0x630000 [0052.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.138] GetProcessHeap () returned 0x630000 [0052.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.138] GetProcessHeap () returned 0x630000 [0052.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.139] GetProcessHeap () returned 0x630000 [0052.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0052.139] GetProcessHeap () returned 0x630000 [0052.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0052.139] GetProcessHeap () returned 0x630000 [0052.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0052.139] GetProcessHeap () returned 0x630000 [0052.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0052.139] GetProcessHeap () returned 0x630000 [0052.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.139] GetProcessHeap () returned 0x630000 [0052.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.139] GetProcessHeap () returned 0x630000 [0052.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0052.139] GetProcessHeap () returned 0x630000 [0052.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0052.139] GetProcessHeap () returned 0x630000 [0052.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.139] GetProcessHeap () returned 0x630000 [0052.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.139] GetProcessHeap () returned 0x630000 [0052.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.139] GetProcessHeap () returned 0x630000 [0052.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.139] GetProcessHeap () returned 0x630000 [0052.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.139] GetProcessHeap () returned 0x630000 [0052.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.139] GetProcessHeap () returned 0x630000 [0052.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.139] GetProcessHeap () returned 0x630000 [0052.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.139] GetProcessHeap () returned 0x630000 [0052.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0052.139] GetProcessHeap () returned 0x630000 [0052.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0052.140] GetProcessHeap () returned 0x630000 [0052.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.140] GetProcessHeap () returned 0x630000 [0052.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.140] GetProcessHeap () returned 0x630000 [0052.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0052.140] GetProcessHeap () returned 0x630000 [0052.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0052.140] GetProcessHeap () returned 0x630000 [0052.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.140] GetProcessHeap () returned 0x630000 [0052.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.140] GetProcessHeap () returned 0x630000 [0052.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.140] GetProcessHeap () returned 0x630000 [0052.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.140] GetProcessHeap () returned 0x630000 [0052.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.140] GetProcessHeap () returned 0x630000 [0052.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.140] GetProcessHeap () returned 0x630000 [0052.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.140] GetProcessHeap () returned 0x630000 [0052.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.140] GetProcessHeap () returned 0x630000 [0052.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0052.140] GetProcessHeap () returned 0x630000 [0052.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0052.140] GetProcessHeap () returned 0x630000 [0052.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0052.140] GetProcessHeap () returned 0x630000 [0052.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0052.140] GetProcessHeap () returned 0x630000 [0052.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0052.140] GetProcessHeap () returned 0x630000 [0052.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655410 | out: hHeap=0x630000) returned 1 [0052.140] GetProcessHeap () returned 0x630000 [0052.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0052.141] GetProcessHeap () returned 0x630000 [0052.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655770 | out: hHeap=0x630000) returned 1 [0052.141] GetProcessHeap () returned 0x630000 [0052.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0052.141] GetProcessHeap () returned 0x630000 [0052.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0052.141] GetProcessHeap () returned 0x630000 [0052.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0052.141] WriteFile (in: hFile=0x230, lpBuffer=0x65dcd0*, nNumberOfBytesToWrite=0x382, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65dcd0*, lpNumberOfBytesWritten=0x243d864*=0x382, lpOverlapped=0x0) returned 1 [0052.148] GetProcessHeap () returned 0x630000 [0052.148] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65dcd0, Size=0x30) returned 0x65dcd0 [0052.148] GetProcessHeap () returned 0x630000 [0052.148] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0052.148] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.148] GetProcessHeap () returned 0x630000 [0052.148] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x100b0) returned 0x65dd08 [0052.149] ReadFile (in: hFile=0x230, lpBuffer=0x65dd08, nNumberOfBytesToRead=0x100b0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65dd08*, lpNumberOfBytesRead=0x243d7e8*=0x100b0, lpOverlapped=0x0) returned 1 [0052.151] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.151] WriteFile (in: hFile=0x230, lpBuffer=0x65dd08*, nNumberOfBytesToWrite=0x100b0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65dd08*, lpNumberOfBytesWritten=0x243d7e4*=0x100b0, lpOverlapped=0x0) returned 1 [0052.155] GetProcessHeap () returned 0x630000 [0052.155] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dd08 | out: hHeap=0x630000) returned 1 [0052.155] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0052.155] WriteFile (in: hFile=0x230, lpBuffer=0x65dcd0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65dcd0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0052.156] CloseHandle (hObject=0x230) returned 1 [0052.159] GetProcessHeap () returned 0x630000 [0052.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f10 | out: hHeap=0x630000) returned 1 [0052.159] GetProcessHeap () returned 0x630000 [0052.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b138 | out: hHeap=0x630000) returned 1 [0052.159] GetProcessHeap () returned 0x630000 [0052.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0052.159] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm" [0052.159] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm.happythreechoose" [0052.159] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.htm.happythreechoose"), dwFlags=0x1) returned 1 [0052.159] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0052.160] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0052.160] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html" [0052.160] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\decryption info.html")) returned 0x20 [0052.160] GetProcessHeap () returned 0x630000 [0052.160] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645f58 | out: hHeap=0x630000) returned 1 [0052.160] FindNextFileW (in: hFindFile=0x6486d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3c4d9e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea5f6eb5, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA", cAlternateFileName="")) returned 1 [0052.160] lstrcmpiW (lpString1="EULA", lpString2=".") returned 1 [0052.160] lstrcmpiW (lpString1="EULA", lpString2="..") returned 1 [0052.160] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="EULA" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0052.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0052.160] GetProcessHeap () returned 0x630000 [0052.160] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5) returned 0x65a278 [0052.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA", cchWideChar=-1, lpMultiByteStr=0x65a278, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA", lpUsedDefaultChar=0x0) returned 5 [0052.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0052.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0052.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0052.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0052.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0052.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0052.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0052.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0052.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0052.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0052.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0052.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0052.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0052.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0052.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0052.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0052.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0052.160] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0052.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0052.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0052.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0052.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0052.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0052.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0052.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0052.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0052.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0052.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0052.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0052.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0052.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0052.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0052.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0052.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0052.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0052.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0052.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0052.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0052.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0052.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0052.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0052.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0052.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0052.161] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA", lpString2="\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0052.161] GetProcessHeap () returned 0x630000 [0052.161] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a3a8 [0052.161] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned 38 [0052.161] GetProcessHeap () returned 0x630000 [0052.161] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4e) returned 0x6561f8 [0052.161] lstrcpyW (in: lpString1=0x6561f8, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0052.161] GetProcessHeap () returned 0x630000 [0052.161] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.161] FindNextFileW (in: hFindFile=0x6486d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5f6eb5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x52, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="eula.css", cAlternateFileName="")) returned 1 [0052.162] lstrcmpiW (lpString1="eula.css", lpString2=".") returned 1 [0052.162] lstrcmpiW (lpString1="eula.css", lpString2="..") returned 1 [0052.162] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="eula.css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\eula.css") returned="C:\\Windows10Upgrade\\resources\\ux\\eula.css" [0052.162] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eula.css", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0052.162] GetProcessHeap () returned 0x630000 [0052.162] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9) returned 0x64c9f0 [0052.162] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eula.css", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.css", lpUsedDefaultChar=0x0) returned 9 [0052.162] lstrlenA (lpString="eula.css") returned 8 [0052.162] lstrlenA (lpString=".happythreechoose") returned 17 [0052.162] lstrcmpiW (lpString1="eula.css", lpString2="Decryption INFO.html") returned 1 [0052.162] lstrcmpiW (lpString1="eula.css", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0052.162] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0052.162] lstrcmpiW (lpString1="eula.css", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0052.162] GetProcessHeap () returned 0x630000 [0052.162] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0052.162] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\eula.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0052.163] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=82) returned 1 [0052.163] GetProcessHeap () returned 0x630000 [0052.163] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x65b1b0 [0052.163] GetProcessHeap () returned 0x630000 [0052.163] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0052.163] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\eula.css") returned 41 [0052.163] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0052.163] GetProcessHeap () returned 0x630000 [0052.163] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0052.163] GetProcessHeap () returned 0x630000 [0052.163] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38e) returned 0x65dd08 [0052.163] lstrlenA (lpString="rsa_encrypt") returned 11 [0052.163] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0052.164] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0052.164] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0052.164] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0052.164] GetProcessHeap () returned 0x630000 [0052.164] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0052.164] lstrlenA (lpString="010001") returned 6 [0052.164] GetProcessHeap () returned 0x630000 [0052.164] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0052.164] GetProcessHeap () returned 0x630000 [0052.164] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0052.164] GetProcessHeap () returned 0x630000 [0052.164] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655800 [0052.164] GetProcessHeap () returned 0x630000 [0052.164] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0052.164] GetProcessHeap () returned 0x630000 [0052.164] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655260 [0052.164] GetProcessHeap () returned 0x630000 [0052.165] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657558 [0052.165] GetProcessHeap () returned 0x630000 [0052.165] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a398 [0052.165] GetProcessHeap () returned 0x630000 [0052.165] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0052.165] GetProcessHeap () returned 0x630000 [0052.165] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0052.165] GetProcessHeap () returned 0x630000 [0052.165] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0052.165] GetProcessHeap () returned 0x630000 [0052.165] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0052.165] GetProcessHeap () returned 0x630000 [0052.165] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657328 [0052.165] GetProcessHeap () returned 0x630000 [0052.165] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0052.165] GetProcessHeap () returned 0x630000 [0052.165] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0052.165] GetProcessHeap () returned 0x630000 [0052.165] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655770 [0052.165] GetProcessHeap () returned 0x630000 [0052.165] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0052.165] GetProcessHeap () returned 0x630000 [0052.165] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0052.165] GetProcessHeap () returned 0x630000 [0052.165] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655770 | out: hHeap=0x630000) returned 1 [0052.165] GetProcessHeap () returned 0x630000 [0052.165] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.165] GetProcessHeap () returned 0x630000 [0052.165] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65d9d0 [0052.165] GetProcessHeap () returned 0x630000 [0052.165] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0052.165] GetProcessHeap () returned 0x630000 [0052.165] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.165] GetProcessHeap () returned 0x630000 [0052.166] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.166] GetProcessHeap () returned 0x630000 [0052.166] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.166] GetProcessHeap () returned 0x630000 [0052.166] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x655ec0 [0052.166] GetProcessHeap () returned 0x630000 [0052.166] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65d9d0 | out: hHeap=0x630000) returned 1 [0052.166] GetProcessHeap () returned 0x630000 [0052.166] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0052.166] GetProcessHeap () returned 0x630000 [0052.166] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655ec0 | out: hHeap=0x630000) returned 1 [0052.166] GetProcessHeap () returned 0x630000 [0052.166] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0052.166] GetProcessHeap () returned 0x630000 [0052.166] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0052.166] GetProcessHeap () returned 0x630000 [0052.166] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.166] GetProcessHeap () returned 0x630000 [0052.166] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.166] GetProcessHeap () returned 0x630000 [0052.166] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.166] GetProcessHeap () returned 0x630000 [0052.166] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.166] GetProcessHeap () returned 0x630000 [0052.166] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.166] GetProcessHeap () returned 0x630000 [0052.166] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.166] GetProcessHeap () returned 0x630000 [0052.166] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0052.166] GetProcessHeap () returned 0x630000 [0052.166] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0052.166] GetProcessHeap () returned 0x630000 [0052.166] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.166] GetProcessHeap () returned 0x630000 [0052.166] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.167] GetProcessHeap () returned 0x630000 [0052.167] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0052.167] GetProcessHeap () returned 0x630000 [0052.167] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0052.167] GetProcessHeap () returned 0x630000 [0052.167] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.167] GetProcessHeap () returned 0x630000 [0052.167] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.167] GetProcessHeap () returned 0x630000 [0052.167] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.167] GetProcessHeap () returned 0x630000 [0052.167] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.167] GetProcessHeap () returned 0x630000 [0052.167] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.167] GetProcessHeap () returned 0x630000 [0052.167] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.167] GetProcessHeap () returned 0x630000 [0052.167] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.167] GetProcessHeap () returned 0x630000 [0052.167] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.167] GetProcessHeap () returned 0x630000 [0052.167] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.167] GetProcessHeap () returned 0x630000 [0052.167] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.167] GetProcessHeap () returned 0x630000 [0052.167] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0052.167] GetProcessHeap () returned 0x630000 [0052.167] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0052.167] GetProcessHeap () returned 0x630000 [0052.167] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.167] GetProcessHeap () returned 0x630000 [0052.167] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.167] GetProcessHeap () returned 0x630000 [0052.167] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0052.167] GetProcessHeap () returned 0x630000 [0052.167] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0052.168] GetProcessHeap () returned 0x630000 [0052.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.168] GetProcessHeap () returned 0x630000 [0052.168] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.168] GetProcessHeap () returned 0x630000 [0052.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.168] GetProcessHeap () returned 0x630000 [0052.168] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.168] GetProcessHeap () returned 0x630000 [0052.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0052.168] GetProcessHeap () returned 0x630000 [0052.168] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0052.168] GetProcessHeap () returned 0x630000 [0052.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.168] GetProcessHeap () returned 0x630000 [0052.168] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.168] GetProcessHeap () returned 0x630000 [0052.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.168] GetProcessHeap () returned 0x630000 [0052.168] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.168] GetProcessHeap () returned 0x630000 [0052.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.168] GetProcessHeap () returned 0x630000 [0052.168] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.168] GetProcessHeap () returned 0x630000 [0052.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.168] GetProcessHeap () returned 0x630000 [0052.168] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.168] GetProcessHeap () returned 0x630000 [0052.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.168] GetProcessHeap () returned 0x630000 [0052.168] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.168] GetProcessHeap () returned 0x630000 [0052.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.168] GetProcessHeap () returned 0x630000 [0052.168] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.169] GetProcessHeap () returned 0x630000 [0052.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.169] GetProcessHeap () returned 0x630000 [0052.169] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.169] GetProcessHeap () returned 0x630000 [0052.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.169] GetProcessHeap () returned 0x630000 [0052.169] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.169] GetProcessHeap () returned 0x630000 [0052.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0052.169] GetProcessHeap () returned 0x630000 [0052.169] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0052.169] GetProcessHeap () returned 0x630000 [0052.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.169] GetProcessHeap () returned 0x630000 [0052.169] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.169] GetProcessHeap () returned 0x630000 [0052.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.169] GetProcessHeap () returned 0x630000 [0052.169] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.169] GetProcessHeap () returned 0x630000 [0052.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.169] GetProcessHeap () returned 0x630000 [0052.169] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.169] GetProcessHeap () returned 0x630000 [0052.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.169] GetProcessHeap () returned 0x630000 [0052.169] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.169] GetProcessHeap () returned 0x630000 [0052.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.169] GetProcessHeap () returned 0x630000 [0052.169] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.169] GetProcessHeap () returned 0x630000 [0052.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.169] GetProcessHeap () returned 0x630000 [0052.169] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.170] GetProcessHeap () returned 0x630000 [0052.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.170] GetProcessHeap () returned 0x630000 [0052.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.170] GetProcessHeap () returned 0x630000 [0052.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0052.170] GetProcessHeap () returned 0x630000 [0052.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0052.170] GetProcessHeap () returned 0x630000 [0052.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.170] GetProcessHeap () returned 0x630000 [0052.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.170] GetProcessHeap () returned 0x630000 [0052.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.170] GetProcessHeap () returned 0x630000 [0052.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.170] GetProcessHeap () returned 0x630000 [0052.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0052.170] GetProcessHeap () returned 0x630000 [0052.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0052.170] GetProcessHeap () returned 0x630000 [0052.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0052.170] GetProcessHeap () returned 0x630000 [0052.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0052.170] GetProcessHeap () returned 0x630000 [0052.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.170] GetProcessHeap () returned 0x630000 [0052.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.170] GetProcessHeap () returned 0x630000 [0052.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.170] GetProcessHeap () returned 0x630000 [0052.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.170] GetProcessHeap () returned 0x630000 [0052.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0052.170] GetProcessHeap () returned 0x630000 [0052.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0052.171] GetProcessHeap () returned 0x630000 [0052.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0052.171] GetProcessHeap () returned 0x630000 [0052.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0052.171] GetProcessHeap () returned 0x630000 [0052.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0052.171] GetProcessHeap () returned 0x630000 [0052.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655260 | out: hHeap=0x630000) returned 1 [0052.171] GetProcessHeap () returned 0x630000 [0052.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0052.171] GetProcessHeap () returned 0x630000 [0052.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655800 | out: hHeap=0x630000) returned 1 [0052.171] GetProcessHeap () returned 0x630000 [0052.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0052.171] GetProcessHeap () returned 0x630000 [0052.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.171] GetProcessHeap () returned 0x630000 [0052.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0052.171] WriteFile (in: hFile=0x230, lpBuffer=0x65dd08*, nNumberOfBytesToWrite=0x38e, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65dd08*, lpNumberOfBytesWritten=0x243d864*=0x38e, lpOverlapped=0x0) returned 1 [0052.176] GetProcessHeap () returned 0x630000 [0052.176] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65dd08, Size=0x30) returned 0x65dd08 [0052.176] GetProcessHeap () returned 0x630000 [0052.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0052.176] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.176] GetProcessHeap () returned 0x630000 [0052.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x60) returned 0x63e830 [0052.176] ReadFile (in: hFile=0x230, lpBuffer=0x63e830, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x63e830*, lpNumberOfBytesRead=0x243d7e8*=0x60, lpOverlapped=0x0) returned 1 [0052.177] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.177] WriteFile (in: hFile=0x230, lpBuffer=0x63e830*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x63e830*, lpNumberOfBytesWritten=0x243d7e4*=0x60, lpOverlapped=0x0) returned 1 [0052.178] GetProcessHeap () returned 0x630000 [0052.178] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0052.178] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0052.178] WriteFile (in: hFile=0x230, lpBuffer=0x65dd08*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65dd08*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0052.179] CloseHandle (hObject=0x230) returned 1 [0052.180] GetProcessHeap () returned 0x630000 [0052.180] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0052.180] GetProcessHeap () returned 0x630000 [0052.180] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b1b0 | out: hHeap=0x630000) returned 1 [0052.180] GetProcessHeap () returned 0x630000 [0052.180] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0052.180] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\eula.css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\eula.css") returned="C:\\Windows10Upgrade\\resources\\ux\\eula.css" [0052.180] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\eula.css", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\eula.css.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\eula.css.happythreechoose" [0052.180] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\eula.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula.css"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\eula.css.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula.css.happythreechoose"), dwFlags=0x1) returned 1 [0052.181] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\eula.css" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0052.181] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0052.181] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html" [0052.181] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\decryption info.html")) returned 0x20 [0052.181] GetProcessHeap () returned 0x630000 [0052.181] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0052.181] FindNextFileW (in: hFindFile=0x6486d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5f6eb5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xef0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GetStarted.png", cAlternateFileName="GETSTA~1.PNG")) returned 1 [0052.181] lstrcmpiW (lpString1="GetStarted.png", lpString2=".") returned 1 [0052.181] lstrcmpiW (lpString1="GetStarted.png", lpString2="..") returned 1 [0052.181] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="GetStarted.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png") returned="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png" [0052.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetStarted.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0052.181] GetProcessHeap () returned 0x630000 [0052.181] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0052.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetStarted.png", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetStarted.png", lpUsedDefaultChar=0x0) returned 15 [0052.181] lstrlenA (lpString="GetStarted.png") returned 14 [0052.181] lstrlenA (lpString=".happythreechoose") returned 17 [0052.181] lstrcmpiW (lpString1="GetStarted.png", lpString2="Decryption INFO.html") returned 1 [0052.181] lstrcmpiW (lpString1="GetStarted.png", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0052.181] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0052.181] lstrcmpiW (lpString1="GetStarted.png", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0052.182] GetProcessHeap () returned 0x630000 [0052.182] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0052.182] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstarted.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0052.182] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=3824) returned 1 [0052.182] GetProcessHeap () returned 0x630000 [0052.182] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x65b390 [0052.182] GetProcessHeap () returned 0x630000 [0052.182] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0052.182] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png") returned 47 [0052.182] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0052.182] GetProcessHeap () returned 0x630000 [0052.182] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0052.182] GetProcessHeap () returned 0x630000 [0052.182] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x65dd40 [0052.182] lstrlenA (lpString="rsa_encrypt") returned 11 [0052.182] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0052.183] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0052.183] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0052.183] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0052.183] GetProcessHeap () returned 0x630000 [0052.183] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0052.183] lstrlenA (lpString="010001") returned 6 [0052.183] GetProcessHeap () returned 0x630000 [0052.183] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0052.183] GetProcessHeap () returned 0x630000 [0052.183] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0052.183] GetProcessHeap () returned 0x630000 [0052.183] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655ad0 [0052.183] GetProcessHeap () returned 0x630000 [0052.183] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0052.183] GetProcessHeap () returned 0x630000 [0052.183] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x6555c0 [0052.183] GetProcessHeap () returned 0x630000 [0052.183] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657670 [0052.183] GetProcessHeap () returned 0x630000 [0052.183] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0052.183] GetProcessHeap () returned 0x630000 [0052.183] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0052.184] GetProcessHeap () returned 0x630000 [0052.184] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.184] GetProcessHeap () returned 0x630000 [0052.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0052.184] GetProcessHeap () returned 0x630000 [0052.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0052.184] GetProcessHeap () returned 0x630000 [0052.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657210 [0052.184] GetProcessHeap () returned 0x630000 [0052.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.184] GetProcessHeap () returned 0x630000 [0052.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0052.184] GetProcessHeap () returned 0x630000 [0052.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x655650 [0052.184] GetProcessHeap () returned 0x630000 [0052.184] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0052.184] GetProcessHeap () returned 0x630000 [0052.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0052.184] GetProcessHeap () returned 0x630000 [0052.184] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655650 | out: hHeap=0x630000) returned 1 [0052.184] GetProcessHeap () returned 0x630000 [0052.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0052.184] GetProcessHeap () returned 0x630000 [0052.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65d880 [0052.184] GetProcessHeap () returned 0x630000 [0052.184] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.184] GetProcessHeap () returned 0x630000 [0052.184] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0052.184] GetProcessHeap () returned 0x630000 [0052.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.184] GetProcessHeap () returned 0x630000 [0052.184] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.184] GetProcessHeap () returned 0x630000 [0052.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x655890 [0052.184] GetProcessHeap () returned 0x630000 [0052.184] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65d880 | out: hHeap=0x630000) returned 1 [0052.184] GetProcessHeap () returned 0x630000 [0052.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0052.184] GetProcessHeap () returned 0x630000 [0052.184] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655890 | out: hHeap=0x630000) returned 1 [0052.184] GetProcessHeap () returned 0x630000 [0052.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.185] GetProcessHeap () returned 0x630000 [0052.185] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.185] GetProcessHeap () returned 0x630000 [0052.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.185] GetProcessHeap () returned 0x630000 [0052.185] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.185] GetProcessHeap () returned 0x630000 [0052.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0052.185] GetProcessHeap () returned 0x630000 [0052.185] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0052.185] GetProcessHeap () returned 0x630000 [0052.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0052.185] GetProcessHeap () returned 0x630000 [0052.185] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0052.185] GetProcessHeap () returned 0x630000 [0052.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.185] GetProcessHeap () returned 0x630000 [0052.185] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.185] GetProcessHeap () returned 0x630000 [0052.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.185] GetProcessHeap () returned 0x630000 [0052.185] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.185] GetProcessHeap () returned 0x630000 [0052.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.185] GetProcessHeap () returned 0x630000 [0052.185] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.185] GetProcessHeap () returned 0x630000 [0052.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.185] GetProcessHeap () returned 0x630000 [0052.185] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.185] GetProcessHeap () returned 0x630000 [0052.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.185] GetProcessHeap () returned 0x630000 [0052.185] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.185] GetProcessHeap () returned 0x630000 [0052.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.185] GetProcessHeap () returned 0x630000 [0052.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.186] GetProcessHeap () returned 0x630000 [0052.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.186] GetProcessHeap () returned 0x630000 [0052.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.186] GetProcessHeap () returned 0x630000 [0052.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.186] GetProcessHeap () returned 0x630000 [0052.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.186] GetProcessHeap () returned 0x630000 [0052.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.186] GetProcessHeap () returned 0x630000 [0052.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.186] GetProcessHeap () returned 0x630000 [0052.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.186] GetProcessHeap () returned 0x630000 [0052.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.186] GetProcessHeap () returned 0x630000 [0052.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.186] GetProcessHeap () returned 0x630000 [0052.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.186] GetProcessHeap () returned 0x630000 [0052.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.186] GetProcessHeap () returned 0x630000 [0052.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.186] GetProcessHeap () returned 0x630000 [0052.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.186] GetProcessHeap () returned 0x630000 [0052.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.186] GetProcessHeap () returned 0x630000 [0052.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.186] GetProcessHeap () returned 0x630000 [0052.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.186] GetProcessHeap () returned 0x630000 [0052.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.186] GetProcessHeap () returned 0x630000 [0052.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.187] GetProcessHeap () returned 0x630000 [0052.187] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.187] GetProcessHeap () returned 0x630000 [0052.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.187] GetProcessHeap () returned 0x630000 [0052.187] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0052.187] GetProcessHeap () returned 0x630000 [0052.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0052.187] GetProcessHeap () returned 0x630000 [0052.187] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.187] GetProcessHeap () returned 0x630000 [0052.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.187] GetProcessHeap () returned 0x630000 [0052.187] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.187] GetProcessHeap () returned 0x630000 [0052.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.187] GetProcessHeap () returned 0x630000 [0052.187] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.187] GetProcessHeap () returned 0x630000 [0052.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.187] GetProcessHeap () returned 0x630000 [0052.187] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0052.187] GetProcessHeap () returned 0x630000 [0052.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0052.187] GetProcessHeap () returned 0x630000 [0052.187] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.187] GetProcessHeap () returned 0x630000 [0052.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.187] GetProcessHeap () returned 0x630000 [0052.187] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.187] GetProcessHeap () returned 0x630000 [0052.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.187] GetProcessHeap () returned 0x630000 [0052.187] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.187] GetProcessHeap () returned 0x630000 [0052.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.188] GetProcessHeap () returned 0x630000 [0052.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.188] GetProcessHeap () returned 0x630000 [0052.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.188] GetProcessHeap () returned 0x630000 [0052.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.188] GetProcessHeap () returned 0x630000 [0052.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.188] GetProcessHeap () returned 0x630000 [0052.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.188] GetProcessHeap () returned 0x630000 [0052.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.188] GetProcessHeap () returned 0x630000 [0052.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.188] GetProcessHeap () returned 0x630000 [0052.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.188] GetProcessHeap () returned 0x630000 [0052.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0052.188] GetProcessHeap () returned 0x630000 [0052.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0052.188] GetProcessHeap () returned 0x630000 [0052.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.188] GetProcessHeap () returned 0x630000 [0052.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.188] GetProcessHeap () returned 0x630000 [0052.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.188] GetProcessHeap () returned 0x630000 [0052.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.188] GetProcessHeap () returned 0x630000 [0052.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.188] GetProcessHeap () returned 0x630000 [0052.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.188] GetProcessHeap () returned 0x630000 [0052.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.188] GetProcessHeap () returned 0x630000 [0052.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.188] GetProcessHeap () returned 0x630000 [0052.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.189] GetProcessHeap () returned 0x630000 [0052.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.189] GetProcessHeap () returned 0x630000 [0052.189] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.189] GetProcessHeap () returned 0x630000 [0052.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.189] GetProcessHeap () returned 0x630000 [0052.189] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.189] GetProcessHeap () returned 0x630000 [0052.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.189] GetProcessHeap () returned 0x630000 [0052.189] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0052.189] GetProcessHeap () returned 0x630000 [0052.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0052.189] GetProcessHeap () returned 0x630000 [0052.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0052.189] GetProcessHeap () returned 0x630000 [0052.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0052.189] GetProcessHeap () returned 0x630000 [0052.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0052.189] GetProcessHeap () returned 0x630000 [0052.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0052.189] GetProcessHeap () returned 0x630000 [0052.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0052.189] GetProcessHeap () returned 0x630000 [0052.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6555c0 | out: hHeap=0x630000) returned 1 [0052.189] GetProcessHeap () returned 0x630000 [0052.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0052.189] GetProcessHeap () returned 0x630000 [0052.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655ad0 | out: hHeap=0x630000) returned 1 [0052.189] GetProcessHeap () returned 0x630000 [0052.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0052.189] GetProcessHeap () returned 0x630000 [0052.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.189] GetProcessHeap () returned 0x630000 [0052.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0052.189] WriteFile (in: hFile=0x230, lpBuffer=0x65dd40*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65dd40*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0052.197] GetProcessHeap () returned 0x630000 [0052.197] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65dd40, Size=0x30) returned 0x65dd40 [0052.197] GetProcessHeap () returned 0x630000 [0052.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0052.197] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.197] GetProcessHeap () returned 0x630000 [0052.197] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xef0) returned 0x654110 [0052.197] ReadFile (in: hFile=0x230, lpBuffer=0x654110, nNumberOfBytesToRead=0xef0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x654110*, lpNumberOfBytesRead=0x243d7e8*=0xef0, lpOverlapped=0x0) returned 1 [0052.197] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.197] WriteFile (in: hFile=0x230, lpBuffer=0x654110*, nNumberOfBytesToWrite=0xef0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x654110*, lpNumberOfBytesWritten=0x243d7e4*=0xef0, lpOverlapped=0x0) returned 1 [0052.198] GetProcessHeap () returned 0x630000 [0052.198] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x654110 | out: hHeap=0x630000) returned 1 [0052.198] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0052.199] WriteFile (in: hFile=0x230, lpBuffer=0x65dd40*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65dd40*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0052.200] CloseHandle (hObject=0x230) returned 1 [0052.202] GetProcessHeap () returned 0x630000 [0052.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0052.202] GetProcessHeap () returned 0x630000 [0052.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b390 | out: hHeap=0x630000) returned 1 [0052.202] GetProcessHeap () returned 0x630000 [0052.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0052.202] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png") returned="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png" [0052.202] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png.happythreechoose" [0052.202] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstarted.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstarted.png.happythreechoose"), dwFlags=0x1) returned 1 [0052.203] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0052.203] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0052.203] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html" [0052.203] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\decryption info.html")) returned 0x20 [0052.203] GetProcessHeap () returned 0x630000 [0052.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0052.203] FindNextFileW (in: hFindFile=0x6486d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea600acc, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea600acc, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xfe3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GetStartedHoverOver.png", cAlternateFileName="GETSTA~2.PNG")) returned 1 [0052.203] lstrcmpiW (lpString1="GetStartedHoverOver.png", lpString2=".") returned 1 [0052.203] lstrcmpiW (lpString1="GetStartedHoverOver.png", lpString2="..") returned 1 [0052.203] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="GetStartedHoverOver.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png") returned="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png" [0052.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetStartedHoverOver.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0052.203] GetProcessHeap () returned 0x630000 [0052.203] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18) returned 0x645d18 [0052.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetStartedHoverOver.png", cchWideChar=-1, lpMultiByteStr=0x645d18, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetStartedHoverOver.png", lpUsedDefaultChar=0x0) returned 24 [0052.203] lstrlenA (lpString="GetStartedHoverOver.png") returned 23 [0052.203] lstrlenA (lpString=".happythreechoose") returned 17 [0052.203] lstrlenA (lpString=".happythreechoose") returned 17 [0052.203] lstrlenA (lpString="GetStartedHoverOver.png") returned 23 [0052.203] lstrcmpiA (lpString1="rtedHoverOver.png", lpString2=".happythreechoose") returned 1 [0052.203] lstrcmpiW (lpString1="GetStartedHoverOver.png", lpString2="Decryption INFO.html") returned 1 [0052.203] lstrcmpiW (lpString1="GetStartedHoverOver.png", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0052.203] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0052.203] lstrcmpiW (lpString1="GetStartedHoverOver.png", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0052.203] GetProcessHeap () returned 0x630000 [0052.203] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651ec0 [0052.203] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstartedhoverover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0052.204] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=4067) returned 1 [0052.204] GetProcessHeap () returned 0x630000 [0052.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x65b1b0 [0052.204] GetProcessHeap () returned 0x630000 [0052.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0052.204] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png") returned 56 [0052.204] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0052.204] GetProcessHeap () returned 0x630000 [0052.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0052.204] GetProcessHeap () returned 0x630000 [0052.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38d) returned 0x655118 [0052.204] lstrlenA (lpString="rsa_encrypt") returned 11 [0052.204] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0052.205] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0052.205] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0052.205] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0052.205] GetProcessHeap () returned 0x630000 [0052.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0052.205] lstrlenA (lpString="010001") returned 6 [0052.205] GetProcessHeap () returned 0x630000 [0052.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a398 [0052.205] GetProcessHeap () returned 0x630000 [0052.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0052.205] GetProcessHeap () returned 0x630000 [0052.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e730 [0052.205] GetProcessHeap () returned 0x630000 [0052.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0052.205] GetProcessHeap () returned 0x630000 [0052.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ec40 [0052.205] GetProcessHeap () returned 0x630000 [0052.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656b80 [0052.205] GetProcessHeap () returned 0x630000 [0052.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a298 [0052.205] GetProcessHeap () returned 0x630000 [0052.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0052.205] GetProcessHeap () returned 0x630000 [0052.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.205] GetProcessHeap () returned 0x630000 [0052.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0052.205] GetProcessHeap () returned 0x630000 [0052.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0052.205] GetProcessHeap () returned 0x630000 [0052.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657558 [0052.205] GetProcessHeap () returned 0x630000 [0052.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0052.206] GetProcessHeap () returned 0x630000 [0052.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0052.206] GetProcessHeap () returned 0x630000 [0052.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e970 [0052.206] GetProcessHeap () returned 0x630000 [0052.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0052.206] GetProcessHeap () returned 0x630000 [0052.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0052.206] GetProcessHeap () returned 0x630000 [0052.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0052.206] GetProcessHeap () returned 0x630000 [0052.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.206] GetProcessHeap () returned 0x630000 [0052.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0052.206] GetProcessHeap () returned 0x630000 [0052.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0052.206] GetProcessHeap () returned 0x630000 [0052.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.206] GetProcessHeap () returned 0x630000 [0052.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.206] GetProcessHeap () returned 0x630000 [0052.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.206] GetProcessHeap () returned 0x630000 [0052.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e3d0 [0052.206] GetProcessHeap () returned 0x630000 [0052.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0052.206] GetProcessHeap () returned 0x630000 [0052.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0052.206] GetProcessHeap () returned 0x630000 [0052.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0052.206] GetProcessHeap () returned 0x630000 [0052.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.206] GetProcessHeap () returned 0x630000 [0052.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.206] GetProcessHeap () returned 0x630000 [0052.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0052.206] GetProcessHeap () returned 0x630000 [0052.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0052.206] GetProcessHeap () returned 0x630000 [0052.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.207] GetProcessHeap () returned 0x630000 [0052.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.207] GetProcessHeap () returned 0x630000 [0052.207] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0052.207] GetProcessHeap () returned 0x630000 [0052.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0052.207] GetProcessHeap () returned 0x630000 [0052.207] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.207] GetProcessHeap () returned 0x630000 [0052.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.207] GetProcessHeap () returned 0x630000 [0052.207] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.207] GetProcessHeap () returned 0x630000 [0052.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.207] GetProcessHeap () returned 0x630000 [0052.207] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.207] GetProcessHeap () returned 0x630000 [0052.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.207] GetProcessHeap () returned 0x630000 [0052.207] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.207] GetProcessHeap () returned 0x630000 [0052.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.207] GetProcessHeap () returned 0x630000 [0052.207] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.207] GetProcessHeap () returned 0x630000 [0052.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.207] GetProcessHeap () returned 0x630000 [0052.207] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.207] GetProcessHeap () returned 0x630000 [0052.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.207] GetProcessHeap () returned 0x630000 [0052.207] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.207] GetProcessHeap () returned 0x630000 [0052.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.207] GetProcessHeap () returned 0x630000 [0052.207] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.207] GetProcessHeap () returned 0x630000 [0052.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.208] GetProcessHeap () returned 0x630000 [0052.208] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.208] GetProcessHeap () returned 0x630000 [0052.208] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.208] GetProcessHeap () returned 0x630000 [0052.208] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0052.208] GetProcessHeap () returned 0x630000 [0052.208] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0052.208] GetProcessHeap () returned 0x630000 [0052.208] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0052.208] GetProcessHeap () returned 0x630000 [0052.208] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0052.208] GetProcessHeap () returned 0x630000 [0052.208] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.208] GetProcessHeap () returned 0x630000 [0052.208] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.208] GetProcessHeap () returned 0x630000 [0052.208] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.208] GetProcessHeap () returned 0x630000 [0052.208] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.208] GetProcessHeap () returned 0x630000 [0052.208] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.208] GetProcessHeap () returned 0x630000 [0052.208] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.208] GetProcessHeap () returned 0x630000 [0052.208] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0052.208] GetProcessHeap () returned 0x630000 [0052.208] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0052.208] GetProcessHeap () returned 0x630000 [0052.208] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.208] GetProcessHeap () returned 0x630000 [0052.208] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.208] GetProcessHeap () returned 0x630000 [0052.208] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.208] GetProcessHeap () returned 0x630000 [0052.208] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.208] GetProcessHeap () returned 0x630000 [0052.209] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0052.209] GetProcessHeap () returned 0x630000 [0052.209] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0052.209] GetProcessHeap () returned 0x630000 [0052.209] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.209] GetProcessHeap () returned 0x630000 [0052.209] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.209] GetProcessHeap () returned 0x630000 [0052.209] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.209] GetProcessHeap () returned 0x630000 [0052.209] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.209] GetProcessHeap () returned 0x630000 [0052.209] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0052.209] GetProcessHeap () returned 0x630000 [0052.209] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0052.209] GetProcessHeap () returned 0x630000 [0052.209] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.209] GetProcessHeap () returned 0x630000 [0052.209] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.209] GetProcessHeap () returned 0x630000 [0052.209] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.209] GetProcessHeap () returned 0x630000 [0052.209] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.209] GetProcessHeap () returned 0x630000 [0052.209] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0052.209] GetProcessHeap () returned 0x630000 [0052.209] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0052.209] GetProcessHeap () returned 0x630000 [0052.209] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.209] GetProcessHeap () returned 0x630000 [0052.209] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.209] GetProcessHeap () returned 0x630000 [0052.209] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.209] GetProcessHeap () returned 0x630000 [0052.209] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.209] GetProcessHeap () returned 0x630000 [0052.210] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.210] GetProcessHeap () returned 0x630000 [0052.210] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.210] GetProcessHeap () returned 0x630000 [0052.210] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0052.210] GetProcessHeap () returned 0x630000 [0052.210] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0052.210] GetProcessHeap () returned 0x630000 [0052.210] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.210] GetProcessHeap () returned 0x630000 [0052.210] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.210] GetProcessHeap () returned 0x630000 [0052.210] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.210] GetProcessHeap () returned 0x630000 [0052.210] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.210] GetProcessHeap () returned 0x630000 [0052.210] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.210] GetProcessHeap () returned 0x630000 [0052.210] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.210] GetProcessHeap () returned 0x630000 [0052.210] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0052.210] GetProcessHeap () returned 0x630000 [0052.210] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0052.210] GetProcessHeap () returned 0x630000 [0052.210] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.210] GetProcessHeap () returned 0x630000 [0052.210] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.210] GetProcessHeap () returned 0x630000 [0052.210] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.210] GetProcessHeap () returned 0x630000 [0052.210] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.211] GetProcessHeap () returned 0x630000 [0052.211] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.211] GetProcessHeap () returned 0x630000 [0052.211] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.211] GetProcessHeap () returned 0x630000 [0052.211] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.211] GetProcessHeap () returned 0x630000 [0052.211] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.211] GetProcessHeap () returned 0x630000 [0052.211] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.211] GetProcessHeap () returned 0x630000 [0052.211] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.211] GetProcessHeap () returned 0x630000 [0052.211] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0052.211] GetProcessHeap () returned 0x630000 [0052.211] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0052.211] GetProcessHeap () returned 0x630000 [0052.211] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0052.211] GetProcessHeap () returned 0x630000 [0052.211] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0052.211] GetProcessHeap () returned 0x630000 [0052.211] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0052.211] GetProcessHeap () returned 0x630000 [0052.211] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ec40 | out: hHeap=0x630000) returned 1 [0052.211] GetProcessHeap () returned 0x630000 [0052.211] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0052.211] GetProcessHeap () returned 0x630000 [0052.211] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0052.211] GetProcessHeap () returned 0x630000 [0052.211] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0052.211] GetProcessHeap () returned 0x630000 [0052.211] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0052.211] GetProcessHeap () returned 0x630000 [0052.211] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0052.211] WriteFile (in: hFile=0x230, lpBuffer=0x655118*, nNumberOfBytesToWrite=0x38d, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x655118*, lpNumberOfBytesWritten=0x243d864*=0x38d, lpOverlapped=0x0) returned 1 [0052.218] GetProcessHeap () returned 0x630000 [0052.218] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x655118, Size=0x30) returned 0x655118 [0052.218] GetProcessHeap () returned 0x630000 [0052.219] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0052.219] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.219] GetProcessHeap () returned 0x630000 [0052.219] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xff0) returned 0x65ed80 [0052.219] ReadFile (in: hFile=0x230, lpBuffer=0x65ed80, nNumberOfBytesToRead=0xff0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesRead=0x243d7e8*=0xff0, lpOverlapped=0x0) returned 1 [0052.219] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.219] WriteFile (in: hFile=0x230, lpBuffer=0x65ed80*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesWritten=0x243d7e4*=0xff0, lpOverlapped=0x0) returned 1 [0052.220] GetProcessHeap () returned 0x630000 [0052.220] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ed80 | out: hHeap=0x630000) returned 1 [0052.222] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0052.222] WriteFile (in: hFile=0x230, lpBuffer=0x655118*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x655118*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0052.225] CloseHandle (hObject=0x230) returned 1 [0052.226] GetProcessHeap () returned 0x630000 [0052.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651ec0 | out: hHeap=0x630000) returned 1 [0052.226] GetProcessHeap () returned 0x630000 [0052.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b1b0 | out: hHeap=0x630000) returned 1 [0052.226] GetProcessHeap () returned 0x630000 [0052.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0052.226] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png") returned="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png" [0052.226] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png.happythreechoose" [0052.226] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstartedhoverover.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstartedhoverover.png.happythreechoose"), dwFlags=0x1) returned 1 [0052.227] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0052.227] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0052.227] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html" [0052.227] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\decryption info.html")) returned 0x20 [0052.227] GetProcessHeap () returned 0x630000 [0052.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645d18 | out: hHeap=0x630000) returned 1 [0052.227] FindNextFileW (in: hFindFile=0x6486d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea600acc, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea600acc, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x43f3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="loading.gif", cAlternateFileName="")) returned 1 [0052.227] lstrcmpiW (lpString1="loading.gif", lpString2=".") returned 1 [0052.227] lstrcmpiW (lpString1="loading.gif", lpString2="..") returned 1 [0052.227] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="loading.gif" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\loading.gif") returned="C:\\Windows10Upgrade\\resources\\ux\\loading.gif" [0052.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loading.gif", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0052.227] GetProcessHeap () returned 0x630000 [0052.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0052.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loading.gif", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="loading.gif", lpUsedDefaultChar=0x0) returned 12 [0052.227] lstrlenA (lpString="loading.gif") returned 11 [0052.227] lstrlenA (lpString=".happythreechoose") returned 17 [0052.227] lstrcmpiW (lpString1="loading.gif", lpString2="Decryption INFO.html") returned 1 [0052.227] lstrcmpiW (lpString1="loading.gif", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0052.227] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0052.227] lstrcmpiW (lpString1="loading.gif", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0052.227] GetProcessHeap () returned 0x630000 [0052.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0052.228] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\loading.gif" (normalized: "c:\\windows10upgrade\\resources\\ux\\loading.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0052.230] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=17395) returned 1 [0052.230] GetProcessHeap () returned 0x630000 [0052.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x65b0c0 [0052.230] GetProcessHeap () returned 0x630000 [0052.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0052.230] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\loading.gif") returned 44 [0052.230] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0052.230] GetProcessHeap () returned 0x630000 [0052.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0052.230] GetProcessHeap () returned 0x630000 [0052.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38d) returned 0x655150 [0052.230] lstrlenA (lpString="rsa_encrypt") returned 11 [0052.230] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0052.231] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0052.231] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0052.231] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0052.231] GetProcessHeap () returned 0x630000 [0052.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0052.231] lstrlenA (lpString="010001") returned 6 [0052.231] GetProcessHeap () returned 0x630000 [0052.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3c8 [0052.231] GetProcessHeap () returned 0x630000 [0052.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0052.231] GetProcessHeap () returned 0x630000 [0052.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dec0 [0052.231] GetProcessHeap () returned 0x630000 [0052.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0052.231] GetProcessHeap () returned 0x630000 [0052.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ec40 [0052.231] GetProcessHeap () returned 0x630000 [0052.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656c98 [0052.231] GetProcessHeap () returned 0x630000 [0052.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a298 [0052.231] GetProcessHeap () returned 0x630000 [0052.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0052.231] GetProcessHeap () returned 0x630000 [0052.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.231] GetProcessHeap () returned 0x630000 [0052.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0052.232] GetProcessHeap () returned 0x630000 [0052.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0052.232] GetProcessHeap () returned 0x630000 [0052.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656a68 [0052.232] GetProcessHeap () returned 0x630000 [0052.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.232] GetProcessHeap () returned 0x630000 [0052.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0052.232] GetProcessHeap () returned 0x630000 [0052.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e340 [0052.232] GetProcessHeap () returned 0x630000 [0052.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0052.232] GetProcessHeap () returned 0x630000 [0052.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0052.232] GetProcessHeap () returned 0x630000 [0052.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0052.232] GetProcessHeap () returned 0x630000 [0052.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.232] GetProcessHeap () returned 0x630000 [0052.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65d8b0 [0052.232] GetProcessHeap () returned 0x630000 [0052.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.232] GetProcessHeap () returned 0x630000 [0052.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.232] GetProcessHeap () returned 0x630000 [0052.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.232] GetProcessHeap () returned 0x630000 [0052.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.232] GetProcessHeap () returned 0x630000 [0052.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65eb20 [0052.232] GetProcessHeap () returned 0x630000 [0052.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65d8b0 | out: hHeap=0x630000) returned 1 [0052.232] GetProcessHeap () returned 0x630000 [0052.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0052.232] GetProcessHeap () returned 0x630000 [0052.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0052.232] GetProcessHeap () returned 0x630000 [0052.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.232] GetProcessHeap () returned 0x630000 [0052.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.233] GetProcessHeap () returned 0x630000 [0052.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.233] GetProcessHeap () returned 0x630000 [0052.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.233] GetProcessHeap () returned 0x630000 [0052.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0052.233] GetProcessHeap () returned 0x630000 [0052.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0052.233] GetProcessHeap () returned 0x630000 [0052.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.233] GetProcessHeap () returned 0x630000 [0052.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.233] GetProcessHeap () returned 0x630000 [0052.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.233] GetProcessHeap () returned 0x630000 [0052.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.233] GetProcessHeap () returned 0x630000 [0052.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.233] GetProcessHeap () returned 0x630000 [0052.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.233] GetProcessHeap () returned 0x630000 [0052.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.233] GetProcessHeap () returned 0x630000 [0052.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.233] GetProcessHeap () returned 0x630000 [0052.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.233] GetProcessHeap () returned 0x630000 [0052.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.233] GetProcessHeap () returned 0x630000 [0052.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.233] GetProcessHeap () returned 0x630000 [0052.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.233] GetProcessHeap () returned 0x630000 [0052.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.233] GetProcessHeap () returned 0x630000 [0052.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.233] GetProcessHeap () returned 0x630000 [0052.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.234] GetProcessHeap () returned 0x630000 [0052.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.234] GetProcessHeap () returned 0x630000 [0052.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0052.234] GetProcessHeap () returned 0x630000 [0052.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0052.234] GetProcessHeap () returned 0x630000 [0052.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0052.234] GetProcessHeap () returned 0x630000 [0052.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0052.234] GetProcessHeap () returned 0x630000 [0052.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.234] GetProcessHeap () returned 0x630000 [0052.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.234] GetProcessHeap () returned 0x630000 [0052.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0052.234] GetProcessHeap () returned 0x630000 [0052.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0052.234] GetProcessHeap () returned 0x630000 [0052.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0052.234] GetProcessHeap () returned 0x630000 [0052.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0052.234] GetProcessHeap () returned 0x630000 [0052.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.234] GetProcessHeap () returned 0x630000 [0052.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.234] GetProcessHeap () returned 0x630000 [0052.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.234] GetProcessHeap () returned 0x630000 [0052.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.234] GetProcessHeap () returned 0x630000 [0052.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.234] GetProcessHeap () returned 0x630000 [0052.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.234] GetProcessHeap () returned 0x630000 [0052.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.234] GetProcessHeap () returned 0x630000 [0052.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.235] GetProcessHeap () returned 0x630000 [0052.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0052.235] GetProcessHeap () returned 0x630000 [0052.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0052.235] GetProcessHeap () returned 0x630000 [0052.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.235] GetProcessHeap () returned 0x630000 [0052.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.235] GetProcessHeap () returned 0x630000 [0052.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.235] GetProcessHeap () returned 0x630000 [0052.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.235] GetProcessHeap () returned 0x630000 [0052.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.235] GetProcessHeap () returned 0x630000 [0052.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.235] GetProcessHeap () returned 0x630000 [0052.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.235] GetProcessHeap () returned 0x630000 [0052.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.235] GetProcessHeap () returned 0x630000 [0052.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.235] GetProcessHeap () returned 0x630000 [0052.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.235] GetProcessHeap () returned 0x630000 [0052.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.235] GetProcessHeap () returned 0x630000 [0052.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.235] GetProcessHeap () returned 0x630000 [0052.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.235] GetProcessHeap () returned 0x630000 [0052.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.235] GetProcessHeap () returned 0x630000 [0052.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.235] GetProcessHeap () returned 0x630000 [0052.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.235] GetProcessHeap () returned 0x630000 [0052.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0052.236] GetProcessHeap () returned 0x630000 [0052.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0052.236] GetProcessHeap () returned 0x630000 [0052.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.236] GetProcessHeap () returned 0x630000 [0052.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.236] GetProcessHeap () returned 0x630000 [0052.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0052.236] GetProcessHeap () returned 0x630000 [0052.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0052.236] GetProcessHeap () returned 0x630000 [0052.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0052.236] GetProcessHeap () returned 0x630000 [0052.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0052.236] GetProcessHeap () returned 0x630000 [0052.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.236] GetProcessHeap () returned 0x630000 [0052.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.236] GetProcessHeap () returned 0x630000 [0052.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.236] GetProcessHeap () returned 0x630000 [0052.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.236] GetProcessHeap () returned 0x630000 [0052.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.236] GetProcessHeap () returned 0x630000 [0052.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.236] GetProcessHeap () returned 0x630000 [0052.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.236] GetProcessHeap () returned 0x630000 [0052.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.236] GetProcessHeap () returned 0x630000 [0052.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.236] GetProcessHeap () returned 0x630000 [0052.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.236] GetProcessHeap () returned 0x630000 [0052.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.236] GetProcessHeap () returned 0x630000 [0052.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.237] GetProcessHeap () returned 0x630000 [0052.237] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0052.237] GetProcessHeap () returned 0x630000 [0052.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0052.237] GetProcessHeap () returned 0x630000 [0052.237] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.237] GetProcessHeap () returned 0x630000 [0052.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.237] GetProcessHeap () returned 0x630000 [0052.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0052.237] GetProcessHeap () returned 0x630000 [0052.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0052.237] GetProcessHeap () returned 0x630000 [0052.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0052.237] GetProcessHeap () returned 0x630000 [0052.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0052.237] GetProcessHeap () returned 0x630000 [0052.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0052.237] GetProcessHeap () returned 0x630000 [0052.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ec40 | out: hHeap=0x630000) returned 1 [0052.237] GetProcessHeap () returned 0x630000 [0052.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0052.237] GetProcessHeap () returned 0x630000 [0052.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0052.237] GetProcessHeap () returned 0x630000 [0052.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0052.237] GetProcessHeap () returned 0x630000 [0052.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0052.237] GetProcessHeap () returned 0x630000 [0052.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0052.237] WriteFile (in: hFile=0x230, lpBuffer=0x655150*, nNumberOfBytesToWrite=0x38d, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x655150*, lpNumberOfBytesWritten=0x243d864*=0x38d, lpOverlapped=0x0) returned 1 [0052.241] GetProcessHeap () returned 0x630000 [0052.241] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x655150, Size=0x30) returned 0x655150 [0052.241] GetProcessHeap () returned 0x630000 [0052.241] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0052.241] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.242] GetProcessHeap () returned 0x630000 [0052.242] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4400) returned 0x65ed80 [0052.243] ReadFile (in: hFile=0x230, lpBuffer=0x65ed80, nNumberOfBytesToRead=0x4400, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesRead=0x243d7e8*=0x4400, lpOverlapped=0x0) returned 1 [0052.244] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.244] WriteFile (in: hFile=0x230, lpBuffer=0x65ed80*, nNumberOfBytesToWrite=0x4400, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesWritten=0x243d7e4*=0x4400, lpOverlapped=0x0) returned 1 [0052.245] GetProcessHeap () returned 0x630000 [0052.245] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ed80 | out: hHeap=0x630000) returned 1 [0052.246] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0052.246] WriteFile (in: hFile=0x230, lpBuffer=0x655150*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x655150*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0052.247] CloseHandle (hObject=0x230) returned 1 [0052.249] GetProcessHeap () returned 0x630000 [0052.249] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0052.249] GetProcessHeap () returned 0x630000 [0052.249] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b0c0 | out: hHeap=0x630000) returned 1 [0052.249] GetProcessHeap () returned 0x630000 [0052.249] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0052.249] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\loading.gif" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\loading.gif") returned="C:\\Windows10Upgrade\\resources\\ux\\loading.gif" [0052.249] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\loading.gif", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\loading.gif.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\loading.gif.happythreechoose" [0052.249] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\loading.gif" (normalized: "c:\\windows10upgrade\\resources\\ux\\loading.gif"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\loading.gif.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\loading.gif.happythreechoose"), dwFlags=0x1) returned 1 [0052.249] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\loading.gif" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0052.249] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0052.249] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html" [0052.250] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\decryption info.html")) returned 0x20 [0052.250] GetProcessHeap () returned 0x630000 [0052.250] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0052.250] FindNextFileW (in: hFindFile=0x6486d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea600acc, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea600acc, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x749e0600, ftLastWriteTime.dwHighDateTime=0x1d2ea8c, nFileSizeHigh=0x0, nFileSizeLow=0xe5d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="lock.png", cAlternateFileName="")) returned 1 [0052.250] lstrcmpiW (lpString1="lock.png", lpString2=".") returned 1 [0052.250] lstrcmpiW (lpString1="lock.png", lpString2="..") returned 1 [0052.250] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="lock.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\lock.png") returned="C:\\Windows10Upgrade\\resources\\ux\\lock.png" [0052.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lock.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0052.250] GetProcessHeap () returned 0x630000 [0052.250] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9) returned 0x64c9f0 [0052.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lock.png", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lock.png", lpUsedDefaultChar=0x0) returned 9 [0052.250] lstrlenA (lpString="lock.png") returned 8 [0052.250] lstrlenA (lpString=".happythreechoose") returned 17 [0052.250] lstrcmpiW (lpString1="lock.png", lpString2="Decryption INFO.html") returned 1 [0052.250] lstrcmpiW (lpString1="lock.png", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0052.250] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0052.250] lstrcmpiW (lpString1="lock.png", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0052.250] GetProcessHeap () returned 0x630000 [0052.250] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0052.250] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\lock.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\lock.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0052.251] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=3677) returned 1 [0052.251] GetProcessHeap () returned 0x630000 [0052.251] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x65b390 [0052.251] GetProcessHeap () returned 0x630000 [0052.251] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0052.251] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\lock.png") returned 41 [0052.251] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0052.251] GetProcessHeap () returned 0x630000 [0052.251] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0052.251] GetProcessHeap () returned 0x630000 [0052.251] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x383) returned 0x655188 [0052.251] lstrlenA (lpString="rsa_encrypt") returned 11 [0052.251] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0052.252] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0052.252] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0052.252] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0052.252] GetProcessHeap () returned 0x630000 [0052.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0052.252] lstrlenA (lpString="010001") returned 6 [0052.252] GetProcessHeap () returned 0x630000 [0052.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0052.252] GetProcessHeap () returned 0x630000 [0052.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0052.252] GetProcessHeap () returned 0x630000 [0052.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e580 [0052.252] GetProcessHeap () returned 0x630000 [0052.252] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0052.252] GetProcessHeap () returned 0x630000 [0052.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e2b0 [0052.252] GetProcessHeap () returned 0x630000 [0052.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657558 [0052.252] GetProcessHeap () returned 0x630000 [0052.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2b8 [0052.252] GetProcessHeap () returned 0x630000 [0052.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0052.252] GetProcessHeap () returned 0x630000 [0052.252] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0052.253] GetProcessHeap () returned 0x630000 [0052.253] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0052.253] GetProcessHeap () returned 0x630000 [0052.253] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0052.253] GetProcessHeap () returned 0x630000 [0052.253] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656a68 [0052.253] GetProcessHeap () returned 0x630000 [0052.253] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.253] GetProcessHeap () returned 0x630000 [0052.253] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0052.253] GetProcessHeap () returned 0x630000 [0052.253] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea00 [0052.253] GetProcessHeap () returned 0x630000 [0052.253] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0052.253] GetProcessHeap () returned 0x630000 [0052.253] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0052.253] GetProcessHeap () returned 0x630000 [0052.253] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0052.253] GetProcessHeap () returned 0x630000 [0052.253] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0052.253] GetProcessHeap () returned 0x630000 [0052.253] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65daf0 [0052.253] GetProcessHeap () returned 0x630000 [0052.253] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.253] GetProcessHeap () returned 0x630000 [0052.253] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0052.253] GetProcessHeap () returned 0x630000 [0052.253] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.253] GetProcessHeap () returned 0x630000 [0052.253] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.253] GetProcessHeap () returned 0x630000 [0052.253] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e3d0 [0052.253] GetProcessHeap () returned 0x630000 [0052.253] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65daf0 | out: hHeap=0x630000) returned 1 [0052.253] GetProcessHeap () returned 0x630000 [0052.253] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0052.253] GetProcessHeap () returned 0x630000 [0052.253] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0052.253] GetProcessHeap () returned 0x630000 [0052.253] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.254] GetProcessHeap () returned 0x630000 [0052.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.254] GetProcessHeap () returned 0x630000 [0052.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0052.254] GetProcessHeap () returned 0x630000 [0052.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0052.254] GetProcessHeap () returned 0x630000 [0052.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.254] GetProcessHeap () returned 0x630000 [0052.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.254] GetProcessHeap () returned 0x630000 [0052.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0052.254] GetProcessHeap () returned 0x630000 [0052.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0052.254] GetProcessHeap () returned 0x630000 [0052.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.254] GetProcessHeap () returned 0x630000 [0052.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.254] GetProcessHeap () returned 0x630000 [0052.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.254] GetProcessHeap () returned 0x630000 [0052.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.254] GetProcessHeap () returned 0x630000 [0052.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.254] GetProcessHeap () returned 0x630000 [0052.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.254] GetProcessHeap () returned 0x630000 [0052.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.254] GetProcessHeap () returned 0x630000 [0052.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.254] GetProcessHeap () returned 0x630000 [0052.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.254] GetProcessHeap () returned 0x630000 [0052.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.254] GetProcessHeap () returned 0x630000 [0052.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0052.254] GetProcessHeap () returned 0x630000 [0052.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0052.255] GetProcessHeap () returned 0x630000 [0052.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0052.255] GetProcessHeap () returned 0x630000 [0052.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0052.255] GetProcessHeap () returned 0x630000 [0052.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.255] GetProcessHeap () returned 0x630000 [0052.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.255] GetProcessHeap () returned 0x630000 [0052.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.255] GetProcessHeap () returned 0x630000 [0052.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.255] GetProcessHeap () returned 0x630000 [0052.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.255] GetProcessHeap () returned 0x630000 [0052.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.255] GetProcessHeap () returned 0x630000 [0052.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.255] GetProcessHeap () returned 0x630000 [0052.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.255] GetProcessHeap () returned 0x630000 [0052.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0052.255] GetProcessHeap () returned 0x630000 [0052.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0052.255] GetProcessHeap () returned 0x630000 [0052.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.255] GetProcessHeap () returned 0x630000 [0052.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.255] GetProcessHeap () returned 0x630000 [0052.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0052.255] GetProcessHeap () returned 0x630000 [0052.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0052.255] GetProcessHeap () returned 0x630000 [0052.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.255] GetProcessHeap () returned 0x630000 [0052.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.255] GetProcessHeap () returned 0x630000 [0052.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.256] GetProcessHeap () returned 0x630000 [0052.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.256] GetProcessHeap () returned 0x630000 [0052.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.256] GetProcessHeap () returned 0x630000 [0052.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.256] GetProcessHeap () returned 0x630000 [0052.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.256] GetProcessHeap () returned 0x630000 [0052.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.256] GetProcessHeap () returned 0x630000 [0052.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.256] GetProcessHeap () returned 0x630000 [0052.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.256] GetProcessHeap () returned 0x630000 [0052.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.256] GetProcessHeap () returned 0x630000 [0052.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.256] GetProcessHeap () returned 0x630000 [0052.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.256] GetProcessHeap () returned 0x630000 [0052.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.256] GetProcessHeap () returned 0x630000 [0052.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0052.256] GetProcessHeap () returned 0x630000 [0052.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0052.256] GetProcessHeap () returned 0x630000 [0052.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0052.256] GetProcessHeap () returned 0x630000 [0052.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0052.256] GetProcessHeap () returned 0x630000 [0052.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.256] GetProcessHeap () returned 0x630000 [0052.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.256] GetProcessHeap () returned 0x630000 [0052.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.256] GetProcessHeap () returned 0x630000 [0052.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.257] GetProcessHeap () returned 0x630000 [0052.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.257] GetProcessHeap () returned 0x630000 [0052.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.257] GetProcessHeap () returned 0x630000 [0052.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.257] GetProcessHeap () returned 0x630000 [0052.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.257] GetProcessHeap () returned 0x630000 [0052.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.257] GetProcessHeap () returned 0x630000 [0052.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.257] GetProcessHeap () returned 0x630000 [0052.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.257] GetProcessHeap () returned 0x630000 [0052.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.257] GetProcessHeap () returned 0x630000 [0052.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.257] GetProcessHeap () returned 0x630000 [0052.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.257] GetProcessHeap () returned 0x630000 [0052.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.257] GetProcessHeap () returned 0x630000 [0052.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.257] GetProcessHeap () returned 0x630000 [0052.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.257] GetProcessHeap () returned 0x630000 [0052.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.257] GetProcessHeap () returned 0x630000 [0052.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.257] GetProcessHeap () returned 0x630000 [0052.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.257] GetProcessHeap () returned 0x630000 [0052.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.257] GetProcessHeap () returned 0x630000 [0052.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.258] GetProcessHeap () returned 0x630000 [0052.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.258] GetProcessHeap () returned 0x630000 [0052.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.258] GetProcessHeap () returned 0x630000 [0052.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.258] GetProcessHeap () returned 0x630000 [0052.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.258] GetProcessHeap () returned 0x630000 [0052.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.258] GetProcessHeap () returned 0x630000 [0052.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.258] GetProcessHeap () returned 0x630000 [0052.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0052.258] GetProcessHeap () returned 0x630000 [0052.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0052.258] GetProcessHeap () returned 0x630000 [0052.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0052.258] GetProcessHeap () returned 0x630000 [0052.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0052.258] GetProcessHeap () returned 0x630000 [0052.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0052.258] GetProcessHeap () returned 0x630000 [0052.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e2b0 | out: hHeap=0x630000) returned 1 [0052.258] GetProcessHeap () returned 0x630000 [0052.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0052.258] GetProcessHeap () returned 0x630000 [0052.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0052.258] GetProcessHeap () returned 0x630000 [0052.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0052.258] GetProcessHeap () returned 0x630000 [0052.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0052.258] GetProcessHeap () returned 0x630000 [0052.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0052.258] WriteFile (in: hFile=0x230, lpBuffer=0x655188*, nNumberOfBytesToWrite=0x383, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x655188*, lpNumberOfBytesWritten=0x243d864*=0x383, lpOverlapped=0x0) returned 1 [0052.263] GetProcessHeap () returned 0x630000 [0052.263] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x655188, Size=0x30) returned 0x655188 [0052.263] GetProcessHeap () returned 0x630000 [0052.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0052.263] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.263] GetProcessHeap () returned 0x630000 [0052.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe60) returned 0x6551c0 [0052.263] ReadFile (in: hFile=0x230, lpBuffer=0x6551c0, nNumberOfBytesToRead=0xe60, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x6551c0*, lpNumberOfBytesRead=0x243d7e8*=0xe60, lpOverlapped=0x0) returned 1 [0052.263] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.263] WriteFile (in: hFile=0x230, lpBuffer=0x6551c0*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x6551c0*, lpNumberOfBytesWritten=0x243d7e4*=0xe60, lpOverlapped=0x0) returned 1 [0052.264] GetProcessHeap () returned 0x630000 [0052.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6551c0 | out: hHeap=0x630000) returned 1 [0052.264] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0052.264] WriteFile (in: hFile=0x230, lpBuffer=0x655188*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x655188*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0052.265] CloseHandle (hObject=0x230) returned 1 [0052.267] GetProcessHeap () returned 0x630000 [0052.267] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0052.267] GetProcessHeap () returned 0x630000 [0052.267] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b390 | out: hHeap=0x630000) returned 1 [0052.267] GetProcessHeap () returned 0x630000 [0052.267] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0052.267] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\lock.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\lock.png") returned="C:\\Windows10Upgrade\\resources\\ux\\lock.png" [0052.267] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\lock.png", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\lock.png.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\lock.png.happythreechoose" [0052.267] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\lock.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\lock.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\lock.png.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\lock.png.happythreechoose"), dwFlags=0x1) returned 1 [0052.268] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\lock.png" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0052.268] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0052.268] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html" [0052.268] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\decryption info.html")) returned 0x20 [0052.268] GetProcessHeap () returned 0x630000 [0052.268] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0052.268] FindNextFileW (in: hFindFile=0x6486d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xa33, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0052.268] lstrcmpiW (lpString1="logo.png", lpString2=".") returned 1 [0052.268] lstrcmpiW (lpString1="logo.png", lpString2="..") returned 1 [0052.268] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="logo.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\logo.png") returned="C:\\Windows10Upgrade\\resources\\ux\\logo.png" [0052.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0052.268] GetProcessHeap () returned 0x630000 [0052.268] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9) returned 0x64c9f0 [0052.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logo.png", lpUsedDefaultChar=0x0) returned 9 [0052.268] lstrlenA (lpString="logo.png") returned 8 [0052.268] lstrlenA (lpString=".happythreechoose") returned 17 [0052.268] lstrcmpiW (lpString1="logo.png", lpString2="Decryption INFO.html") returned 1 [0052.268] lstrcmpiW (lpString1="logo.png", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0052.268] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0052.268] lstrcmpiW (lpString1="logo.png", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0052.268] GetProcessHeap () returned 0x630000 [0052.268] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0052.268] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\logo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\logo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0052.269] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=2611) returned 1 [0052.269] GetProcessHeap () returned 0x630000 [0052.269] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x65b2a0 [0052.269] GetProcessHeap () returned 0x630000 [0052.269] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0052.269] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\logo.png") returned 41 [0052.269] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0052.269] GetProcessHeap () returned 0x630000 [0052.269] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0052.269] GetProcessHeap () returned 0x630000 [0052.269] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38d) returned 0x6551c0 [0052.269] lstrlenA (lpString="rsa_encrypt") returned 11 [0052.269] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0052.270] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0052.270] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0052.270] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0052.270] GetProcessHeap () returned 0x630000 [0052.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0052.270] lstrlenA (lpString="010001") returned 6 [0052.270] GetProcessHeap () returned 0x630000 [0052.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a298 [0052.270] GetProcessHeap () returned 0x630000 [0052.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0052.270] GetProcessHeap () returned 0x630000 [0052.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dfe0 [0052.270] GetProcessHeap () returned 0x630000 [0052.270] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0052.270] GetProcessHeap () returned 0x630000 [0052.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65eb20 [0052.270] GetProcessHeap () returned 0x630000 [0052.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656950 [0052.270] GetProcessHeap () returned 0x630000 [0052.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3c8 [0052.270] GetProcessHeap () returned 0x630000 [0052.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0052.270] GetProcessHeap () returned 0x630000 [0052.270] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0052.270] GetProcessHeap () returned 0x630000 [0052.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0052.270] GetProcessHeap () returned 0x630000 [0052.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0052.270] GetProcessHeap () returned 0x630000 [0052.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657670 [0052.270] GetProcessHeap () returned 0x630000 [0052.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.271] GetProcessHeap () returned 0x630000 [0052.271] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0052.271] GetProcessHeap () returned 0x630000 [0052.271] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea00 [0052.271] GetProcessHeap () returned 0x630000 [0052.271] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0052.271] GetProcessHeap () returned 0x630000 [0052.271] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0052.271] GetProcessHeap () returned 0x630000 [0052.271] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0052.271] GetProcessHeap () returned 0x630000 [0052.271] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.271] GetProcessHeap () returned 0x630000 [0052.271] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65d8e0 [0052.271] GetProcessHeap () returned 0x630000 [0052.271] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.271] GetProcessHeap () returned 0x630000 [0052.271] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.271] GetProcessHeap () returned 0x630000 [0052.271] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.271] GetProcessHeap () returned 0x630000 [0052.271] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.271] GetProcessHeap () returned 0x630000 [0052.271] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e850 [0052.271] GetProcessHeap () returned 0x630000 [0052.271] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65d8e0 | out: hHeap=0x630000) returned 1 [0052.271] GetProcessHeap () returned 0x630000 [0052.271] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0052.271] GetProcessHeap () returned 0x630000 [0052.271] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0052.271] GetProcessHeap () returned 0x630000 [0052.271] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.271] GetProcessHeap () returned 0x630000 [0052.271] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.271] GetProcessHeap () returned 0x630000 [0052.271] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0052.271] GetProcessHeap () returned 0x630000 [0052.271] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0052.271] GetProcessHeap () returned 0x630000 [0052.271] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.272] GetProcessHeap () returned 0x630000 [0052.272] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.272] GetProcessHeap () returned 0x630000 [0052.272] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0052.272] GetProcessHeap () returned 0x630000 [0052.272] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0052.272] GetProcessHeap () returned 0x630000 [0052.272] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.272] GetProcessHeap () returned 0x630000 [0052.272] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.272] GetProcessHeap () returned 0x630000 [0052.272] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0052.272] GetProcessHeap () returned 0x630000 [0052.272] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0052.272] GetProcessHeap () returned 0x630000 [0052.272] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.272] GetProcessHeap () returned 0x630000 [0052.272] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.272] GetProcessHeap () returned 0x630000 [0052.272] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0052.272] GetProcessHeap () returned 0x630000 [0052.272] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0052.272] GetProcessHeap () returned 0x630000 [0052.272] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0052.272] GetProcessHeap () returned 0x630000 [0052.272] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0052.272] GetProcessHeap () returned 0x630000 [0052.272] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.273] GetProcessHeap () returned 0x630000 [0052.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.273] GetProcessHeap () returned 0x630000 [0052.273] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0052.273] GetProcessHeap () returned 0x630000 [0052.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0052.273] GetProcessHeap () returned 0x630000 [0052.273] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0052.273] GetProcessHeap () returned 0x630000 [0052.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0052.273] GetProcessHeap () returned 0x630000 [0052.273] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.273] GetProcessHeap () returned 0x630000 [0052.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.273] GetProcessHeap () returned 0x630000 [0052.273] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.273] GetProcessHeap () returned 0x630000 [0052.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.273] GetProcessHeap () returned 0x630000 [0052.273] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.273] GetProcessHeap () returned 0x630000 [0052.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.273] GetProcessHeap () returned 0x630000 [0052.273] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.273] GetProcessHeap () returned 0x630000 [0052.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.273] GetProcessHeap () returned 0x630000 [0052.273] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.273] GetProcessHeap () returned 0x630000 [0052.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.273] GetProcessHeap () returned 0x630000 [0052.273] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0052.273] GetProcessHeap () returned 0x630000 [0052.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0052.273] GetProcessHeap () returned 0x630000 [0052.273] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.273] GetProcessHeap () returned 0x630000 [0052.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.274] GetProcessHeap () returned 0x630000 [0052.274] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.274] GetProcessHeap () returned 0x630000 [0052.274] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.274] GetProcessHeap () returned 0x630000 [0052.274] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.274] GetProcessHeap () returned 0x630000 [0052.274] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.274] GetProcessHeap () returned 0x630000 [0052.274] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.274] GetProcessHeap () returned 0x630000 [0052.274] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.274] GetProcessHeap () returned 0x630000 [0052.274] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0052.274] GetProcessHeap () returned 0x630000 [0052.274] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0052.274] GetProcessHeap () returned 0x630000 [0052.274] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.274] GetProcessHeap () returned 0x630000 [0052.274] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.274] GetProcessHeap () returned 0x630000 [0052.274] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.274] GetProcessHeap () returned 0x630000 [0052.274] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.274] GetProcessHeap () returned 0x630000 [0052.274] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.274] GetProcessHeap () returned 0x630000 [0052.274] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.274] GetProcessHeap () returned 0x630000 [0052.274] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0052.274] GetProcessHeap () returned 0x630000 [0052.274] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0052.274] GetProcessHeap () returned 0x630000 [0052.274] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.274] GetProcessHeap () returned 0x630000 [0052.274] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.274] GetProcessHeap () returned 0x630000 [0052.274] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.274] GetProcessHeap () returned 0x630000 [0052.275] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.275] GetProcessHeap () returned 0x630000 [0052.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.275] GetProcessHeap () returned 0x630000 [0052.275] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.275] GetProcessHeap () returned 0x630000 [0052.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0052.275] GetProcessHeap () returned 0x630000 [0052.275] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0052.275] GetProcessHeap () returned 0x630000 [0052.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.275] GetProcessHeap () returned 0x630000 [0052.275] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.275] GetProcessHeap () returned 0x630000 [0052.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.275] GetProcessHeap () returned 0x630000 [0052.275] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.275] GetProcessHeap () returned 0x630000 [0052.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.275] GetProcessHeap () returned 0x630000 [0052.275] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.275] GetProcessHeap () returned 0x630000 [0052.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0052.275] GetProcessHeap () returned 0x630000 [0052.275] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0052.275] GetProcessHeap () returned 0x630000 [0052.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.275] GetProcessHeap () returned 0x630000 [0052.275] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.275] GetProcessHeap () returned 0x630000 [0052.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0052.275] GetProcessHeap () returned 0x630000 [0052.275] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0052.275] GetProcessHeap () returned 0x630000 [0052.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.275] GetProcessHeap () returned 0x630000 [0052.275] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.276] GetProcessHeap () returned 0x630000 [0052.276] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.276] GetProcessHeap () returned 0x630000 [0052.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.276] GetProcessHeap () returned 0x630000 [0052.276] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0052.276] GetProcessHeap () returned 0x630000 [0052.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0052.276] GetProcessHeap () returned 0x630000 [0052.276] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.276] GetProcessHeap () returned 0x630000 [0052.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.276] GetProcessHeap () returned 0x630000 [0052.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0052.276] GetProcessHeap () returned 0x630000 [0052.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0052.276] GetProcessHeap () returned 0x630000 [0052.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0052.276] GetProcessHeap () returned 0x630000 [0052.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0052.276] GetProcessHeap () returned 0x630000 [0052.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0052.276] GetProcessHeap () returned 0x630000 [0052.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0052.276] GetProcessHeap () returned 0x630000 [0052.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0052.276] GetProcessHeap () returned 0x630000 [0052.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0052.276] GetProcessHeap () returned 0x630000 [0052.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0052.276] GetProcessHeap () returned 0x630000 [0052.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.276] GetProcessHeap () returned 0x630000 [0052.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0052.276] WriteFile (in: hFile=0x230, lpBuffer=0x6551c0*, nNumberOfBytesToWrite=0x38d, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6551c0*, lpNumberOfBytesWritten=0x243d864*=0x38d, lpOverlapped=0x0) returned 1 [0052.280] GetProcessHeap () returned 0x630000 [0052.280] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6551c0, Size=0x30) returned 0x6551c0 [0052.280] GetProcessHeap () returned 0x630000 [0052.280] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0052.280] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.280] GetProcessHeap () returned 0x630000 [0052.280] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa40) returned 0x6551f8 [0052.280] ReadFile (in: hFile=0x230, lpBuffer=0x6551f8, nNumberOfBytesToRead=0xa40, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x6551f8*, lpNumberOfBytesRead=0x243d7e8*=0xa40, lpOverlapped=0x0) returned 1 [0052.281] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.281] WriteFile (in: hFile=0x230, lpBuffer=0x6551f8*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x6551f8*, lpNumberOfBytesWritten=0x243d7e4*=0xa40, lpOverlapped=0x0) returned 1 [0052.282] GetProcessHeap () returned 0x630000 [0052.282] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6551f8 | out: hHeap=0x630000) returned 1 [0052.282] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0052.282] WriteFile (in: hFile=0x230, lpBuffer=0x6551c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6551c0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0052.283] CloseHandle (hObject=0x230) returned 1 [0052.284] GetProcessHeap () returned 0x630000 [0052.284] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0052.284] GetProcessHeap () returned 0x630000 [0052.284] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b2a0 | out: hHeap=0x630000) returned 1 [0052.284] GetProcessHeap () returned 0x630000 [0052.284] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0052.284] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\logo.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\logo.png") returned="C:\\Windows10Upgrade\\resources\\ux\\logo.png" [0052.284] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\logo.png", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\logo.png.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\logo.png.happythreechoose" [0052.284] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\logo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\logo.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\logo.png.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\logo.png.happythreechoose"), dwFlags=0x1) returned 1 [0052.285] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\logo.png" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0052.285] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0052.285] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html" [0052.285] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\decryption info.html")) returned 0x20 [0052.285] GetProcessHeap () returned 0x630000 [0052.285] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0052.285] FindNextFileW (in: hFindFile=0x6486d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1ed, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="marketing.png", cAlternateFileName="MARKET~1.PNG")) returned 1 [0052.285] lstrcmpiW (lpString1="marketing.png", lpString2=".") returned 1 [0052.285] lstrcmpiW (lpString1="marketing.png", lpString2="..") returned 1 [0052.285] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="marketing.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\marketing.png") returned="C:\\Windows10Upgrade\\resources\\ux\\marketing.png" [0052.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="marketing.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0052.285] GetProcessHeap () returned 0x630000 [0052.285] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x64c9f0 [0052.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="marketing.png", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="marketing.png", lpUsedDefaultChar=0x0) returned 14 [0052.285] lstrlenA (lpString="marketing.png") returned 13 [0052.285] lstrlenA (lpString=".happythreechoose") returned 17 [0052.285] lstrcmpiW (lpString1="marketing.png", lpString2="Decryption INFO.html") returned 1 [0052.285] lstrcmpiW (lpString1="marketing.png", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0052.285] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0052.285] lstrcmpiW (lpString1="marketing.png", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0052.285] GetProcessHeap () returned 0x630000 [0052.285] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0052.285] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\marketing.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\marketing.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0052.286] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=493) returned 1 [0052.286] GetProcessHeap () returned 0x630000 [0052.286] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x65b0c0 [0052.286] GetProcessHeap () returned 0x630000 [0052.286] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0052.286] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\marketing.png") returned 46 [0052.286] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0052.286] GetProcessHeap () returned 0x630000 [0052.286] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0052.286] GetProcessHeap () returned 0x630000 [0052.286] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x383) returned 0x6551f8 [0052.286] lstrlenA (lpString="rsa_encrypt") returned 11 [0052.286] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0052.287] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0052.287] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0052.287] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0052.287] GetProcessHeap () returned 0x630000 [0052.287] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0052.287] lstrlenA (lpString="010001") returned 6 [0052.287] GetProcessHeap () returned 0x630000 [0052.287] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a298 [0052.287] GetProcessHeap () returned 0x630000 [0052.287] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0052.287] GetProcessHeap () returned 0x630000 [0052.287] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ebb0 [0052.287] GetProcessHeap () returned 0x630000 [0052.287] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0052.287] GetProcessHeap () returned 0x630000 [0052.287] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dfe0 [0052.287] GetProcessHeap () returned 0x630000 [0052.287] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657670 [0052.287] GetProcessHeap () returned 0x630000 [0052.287] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0052.287] GetProcessHeap () returned 0x630000 [0052.287] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0052.287] GetProcessHeap () returned 0x630000 [0052.287] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.287] GetProcessHeap () returned 0x630000 [0052.287] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0052.287] GetProcessHeap () returned 0x630000 [0052.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0052.288] GetProcessHeap () returned 0x630000 [0052.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x6570f8 [0052.288] GetProcessHeap () returned 0x630000 [0052.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0052.288] GetProcessHeap () returned 0x630000 [0052.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0052.288] GetProcessHeap () returned 0x630000 [0052.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e610 [0052.288] GetProcessHeap () returned 0x630000 [0052.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0052.288] GetProcessHeap () returned 0x630000 [0052.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0052.288] GetProcessHeap () returned 0x630000 [0052.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0052.288] GetProcessHeap () returned 0x630000 [0052.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.288] GetProcessHeap () returned 0x630000 [0052.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65da90 [0052.288] GetProcessHeap () returned 0x630000 [0052.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0052.288] GetProcessHeap () returned 0x630000 [0052.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.288] GetProcessHeap () returned 0x630000 [0052.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0052.288] GetProcessHeap () returned 0x630000 [0052.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0052.288] GetProcessHeap () returned 0x630000 [0052.289] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e460 [0052.289] GetProcessHeap () returned 0x630000 [0052.289] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65da90 | out: hHeap=0x630000) returned 1 [0052.289] GetProcessHeap () returned 0x630000 [0052.289] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0052.289] GetProcessHeap () returned 0x630000 [0052.289] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e460 | out: hHeap=0x630000) returned 1 [0052.289] GetProcessHeap () returned 0x630000 [0052.289] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.289] GetProcessHeap () returned 0x630000 [0052.289] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.289] GetProcessHeap () returned 0x630000 [0052.289] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.289] GetProcessHeap () returned 0x630000 [0052.289] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.289] GetProcessHeap () returned 0x630000 [0052.289] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0052.289] GetProcessHeap () returned 0x630000 [0052.289] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0052.289] GetProcessHeap () returned 0x630000 [0052.289] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.289] GetProcessHeap () returned 0x630000 [0052.289] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.289] GetProcessHeap () returned 0x630000 [0052.289] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0052.289] GetProcessHeap () returned 0x630000 [0052.289] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0052.289] GetProcessHeap () returned 0x630000 [0052.289] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.289] GetProcessHeap () returned 0x630000 [0052.289] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.289] GetProcessHeap () returned 0x630000 [0052.289] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.289] GetProcessHeap () returned 0x630000 [0052.289] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.289] GetProcessHeap () returned 0x630000 [0052.290] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.290] GetProcessHeap () returned 0x630000 [0052.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.290] GetProcessHeap () returned 0x630000 [0052.290] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.290] GetProcessHeap () returned 0x630000 [0052.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.290] GetProcessHeap () returned 0x630000 [0052.290] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.290] GetProcessHeap () returned 0x630000 [0052.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.290] GetProcessHeap () returned 0x630000 [0052.290] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0052.290] GetProcessHeap () returned 0x630000 [0052.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0052.290] GetProcessHeap () returned 0x630000 [0052.290] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.290] GetProcessHeap () returned 0x630000 [0052.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.290] GetProcessHeap () returned 0x630000 [0052.290] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0052.290] GetProcessHeap () returned 0x630000 [0052.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0052.290] GetProcessHeap () returned 0x630000 [0052.290] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.290] GetProcessHeap () returned 0x630000 [0052.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.290] GetProcessHeap () returned 0x630000 [0052.290] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.290] GetProcessHeap () returned 0x630000 [0052.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.290] GetProcessHeap () returned 0x630000 [0052.290] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0052.290] GetProcessHeap () returned 0x630000 [0052.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0052.291] GetProcessHeap () returned 0x630000 [0052.291] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.291] GetProcessHeap () returned 0x630000 [0052.291] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.291] GetProcessHeap () returned 0x630000 [0052.291] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0052.291] GetProcessHeap () returned 0x630000 [0052.291] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0052.291] GetProcessHeap () returned 0x630000 [0052.291] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0052.291] GetProcessHeap () returned 0x630000 [0052.291] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0052.291] GetProcessHeap () returned 0x630000 [0052.291] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.291] GetProcessHeap () returned 0x630000 [0052.291] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.291] GetProcessHeap () returned 0x630000 [0052.291] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.291] GetProcessHeap () returned 0x630000 [0052.291] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.291] GetProcessHeap () returned 0x630000 [0052.291] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.291] GetProcessHeap () returned 0x630000 [0052.291] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.291] GetProcessHeap () returned 0x630000 [0052.291] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.291] GetProcessHeap () returned 0x630000 [0052.291] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.291] GetProcessHeap () returned 0x630000 [0052.291] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0052.291] GetProcessHeap () returned 0x630000 [0052.291] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0052.291] GetProcessHeap () returned 0x630000 [0052.291] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0052.291] GetProcessHeap () returned 0x630000 [0052.291] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0052.291] GetProcessHeap () returned 0x630000 [0052.291] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0052.292] GetProcessHeap () returned 0x630000 [0052.292] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0052.292] GetProcessHeap () returned 0x630000 [0052.292] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.292] GetProcessHeap () returned 0x630000 [0052.292] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.292] GetProcessHeap () returned 0x630000 [0052.292] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.292] GetProcessHeap () returned 0x630000 [0052.292] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.292] GetProcessHeap () returned 0x630000 [0052.292] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.292] GetProcessHeap () returned 0x630000 [0052.292] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.292] GetProcessHeap () returned 0x630000 [0052.292] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.292] GetProcessHeap () returned 0x630000 [0052.292] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.292] GetProcessHeap () returned 0x630000 [0052.292] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0052.292] GetProcessHeap () returned 0x630000 [0052.292] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0052.292] GetProcessHeap () returned 0x630000 [0052.292] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.292] GetProcessHeap () returned 0x630000 [0052.292] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.292] GetProcessHeap () returned 0x630000 [0052.292] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.292] GetProcessHeap () returned 0x630000 [0052.292] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.292] GetProcessHeap () returned 0x630000 [0052.292] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.292] GetProcessHeap () returned 0x630000 [0052.292] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.292] GetProcessHeap () returned 0x630000 [0052.292] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.292] GetProcessHeap () returned 0x630000 [0052.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.293] GetProcessHeap () returned 0x630000 [0052.293] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.293] GetProcessHeap () returned 0x630000 [0052.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.293] GetProcessHeap () returned 0x630000 [0052.293] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.293] GetProcessHeap () returned 0x630000 [0052.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.293] GetProcessHeap () returned 0x630000 [0052.293] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.293] GetProcessHeap () returned 0x630000 [0052.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.293] GetProcessHeap () returned 0x630000 [0052.293] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.293] GetProcessHeap () returned 0x630000 [0052.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.293] GetProcessHeap () returned 0x630000 [0052.293] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0052.293] GetProcessHeap () returned 0x630000 [0052.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.293] GetProcessHeap () returned 0x630000 [0052.293] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.293] GetProcessHeap () returned 0x630000 [0052.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.293] GetProcessHeap () returned 0x630000 [0052.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0052.293] GetProcessHeap () returned 0x630000 [0052.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0052.293] GetProcessHeap () returned 0x630000 [0052.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0052.293] GetProcessHeap () returned 0x630000 [0052.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0052.293] GetProcessHeap () returned 0x630000 [0052.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0052.294] GetProcessHeap () returned 0x630000 [0052.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0052.294] GetProcessHeap () returned 0x630000 [0052.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0052.294] GetProcessHeap () returned 0x630000 [0052.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0052.294] GetProcessHeap () returned 0x630000 [0052.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0052.294] GetProcessHeap () returned 0x630000 [0052.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.294] GetProcessHeap () returned 0x630000 [0052.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0052.294] WriteFile (in: hFile=0x230, lpBuffer=0x6551f8*, nNumberOfBytesToWrite=0x383, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6551f8*, lpNumberOfBytesWritten=0x243d864*=0x383, lpOverlapped=0x0) returned 1 [0052.298] GetProcessHeap () returned 0x630000 [0052.298] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6551f8, Size=0x30) returned 0x6551f8 [0052.298] GetProcessHeap () returned 0x630000 [0052.298] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0052.298] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.298] GetProcessHeap () returned 0x630000 [0052.298] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1f0) returned 0x64cc78 [0052.298] ReadFile (in: hFile=0x230, lpBuffer=0x64cc78, nNumberOfBytesToRead=0x1f0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x64cc78*, lpNumberOfBytesRead=0x243d7e8*=0x1f0, lpOverlapped=0x0) returned 1 [0052.298] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.298] WriteFile (in: hFile=0x230, lpBuffer=0x64cc78*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x64cc78*, lpNumberOfBytesWritten=0x243d7e4*=0x1f0, lpOverlapped=0x0) returned 1 [0052.299] GetProcessHeap () returned 0x630000 [0052.299] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0052.299] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0052.299] WriteFile (in: hFile=0x230, lpBuffer=0x6551f8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6551f8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0052.300] CloseHandle (hObject=0x230) returned 1 [0052.301] GetProcessHeap () returned 0x630000 [0052.301] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0052.301] GetProcessHeap () returned 0x630000 [0052.301] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b0c0 | out: hHeap=0x630000) returned 1 [0052.301] GetProcessHeap () returned 0x630000 [0052.301] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0052.301] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\marketing.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\marketing.png") returned="C:\\Windows10Upgrade\\resources\\ux\\marketing.png" [0052.302] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\marketing.png", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\marketing.png.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\marketing.png.happythreechoose" [0052.302] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\marketing.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\marketing.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\marketing.png.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\marketing.png.happythreechoose"), dwFlags=0x1) returned 1 [0052.302] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\marketing.png" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0052.302] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0052.302] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html" [0052.302] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\decryption info.html")) returned 0x20 [0052.302] GetProcessHeap () returned 0x630000 [0052.302] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0052.303] FindNextFileW (in: hFindFile=0x6486d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea60a72c, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.WinJS", cAlternateFileName="MICROS~1.WIN")) returned 1 [0052.303] lstrcmpiW (lpString1="Microsoft.WinJS", lpString2=".") returned 1 [0052.303] lstrcmpiW (lpString1="Microsoft.WinJS", lpString2="..") returned 1 [0052.303] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="Microsoft.WinJS" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS" [0052.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Microsoft.WinJS", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0052.303] GetProcessHeap () returned 0x630000 [0052.303] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x64c9f0 [0052.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Microsoft.WinJS", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft.WinJS", lpUsedDefaultChar=0x0) returned 16 [0052.303] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0052.303] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0052.303] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0052.303] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0052.303] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0052.303] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0052.303] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0052.303] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0052.303] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0052.303] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0052.303] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0052.304] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0052.304] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0052.304] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0052.304] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0052.304] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0052.304] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0052.304] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0052.304] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0052.304] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0052.304] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0052.304] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0052.304] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0052.304] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0052.304] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0052.304] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0052.304] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0052.304] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0052.304] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0052.304] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0052.304] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0052.304] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0052.304] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0052.304] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0052.304] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0052.304] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0052.304] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0052.304] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0052.304] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0052.305] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0052.305] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0052.305] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0052.305] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0052.305] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS", lpString2="\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\" [0052.305] GetProcessHeap () returned 0x630000 [0052.305] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a338 [0052.305] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\") returned 49 [0052.305] GetProcessHeap () returned 0x630000 [0052.305] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x64) returned 0x65d320 [0052.305] lstrcpyW (in: lpString1=0x65d320, lpString2="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\" [0052.305] GetProcessHeap () returned 0x630000 [0052.305] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0052.305] FindNextFileW (in: hFindFile=0x6486d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea627c0d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea627c0d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x97e0d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetworkIssueFAQ.mht", cAlternateFileName="NETWOR~1.MHT")) returned 1 [0052.305] lstrcmpiW (lpString1="NetworkIssueFAQ.mht", lpString2=".") returned 1 [0052.305] lstrcmpiW (lpString1="NetworkIssueFAQ.mht", lpString2="..") returned 1 [0052.305] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="NetworkIssueFAQ.mht" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht") returned="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht" [0052.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetworkIssueFAQ.mht", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0052.305] GetProcessHeap () returned 0x630000 [0052.305] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x645cd8 [0052.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetworkIssueFAQ.mht", cchWideChar=-1, lpMultiByteStr=0x645cd8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetworkIssueFAQ.mht", lpUsedDefaultChar=0x0) returned 20 [0052.305] lstrlenA (lpString="NetworkIssueFAQ.mht") returned 19 [0052.305] lstrlenA (lpString=".happythreechoose") returned 17 [0052.305] lstrlenA (lpString=".happythreechoose") returned 17 [0052.305] lstrlenA (lpString="NetworkIssueFAQ.mht") returned 19 [0052.305] lstrcmpiA (lpString1="tworkIssueFAQ.mht", lpString2=".happythreechoose") returned 1 [0052.305] lstrcmpiW (lpString1="NetworkIssueFAQ.mht", lpString2="Decryption INFO.html") returned 1 [0052.305] lstrcmpiW (lpString1="NetworkIssueFAQ.mht", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0052.305] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0052.305] lstrcmpiW (lpString1="NetworkIssueFAQ.mht", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0052.305] GetProcessHeap () returned 0x630000 [0052.306] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0052.306] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht" (normalized: "c:\\windows10upgrade\\resources\\ux\\networkissuefaq.mht"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0052.306] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=622093) returned 1 [0052.306] GetProcessHeap () returned 0x630000 [0052.306] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x65b1b0 [0052.306] GetProcessHeap () returned 0x630000 [0052.306] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0052.307] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht") returned 52 [0052.307] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0052.307] GetProcessHeap () returned 0x630000 [0052.307] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0052.307] GetProcessHeap () returned 0x630000 [0052.307] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x655230 [0052.307] lstrlenA (lpString="rsa_encrypt") returned 11 [0052.307] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0052.307] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0052.307] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0052.307] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0052.307] GetProcessHeap () returned 0x630000 [0052.307] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0052.307] lstrlenA (lpString="010001") returned 6 [0052.307] GetProcessHeap () returned 0x630000 [0052.307] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a348 [0052.308] GetProcessHeap () returned 0x630000 [0052.308] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0052.308] GetProcessHeap () returned 0x630000 [0052.308] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e340 [0052.308] GetProcessHeap () returned 0x630000 [0052.308] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0052.308] GetProcessHeap () returned 0x630000 [0052.308] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65eb20 [0052.308] GetProcessHeap () returned 0x630000 [0052.308] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657328 [0052.308] GetProcessHeap () returned 0x630000 [0052.308] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0052.308] GetProcessHeap () returned 0x630000 [0052.308] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0052.308] GetProcessHeap () returned 0x630000 [0052.308] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.308] GetProcessHeap () returned 0x630000 [0052.308] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0052.308] GetProcessHeap () returned 0x630000 [0052.308] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0052.308] GetProcessHeap () returned 0x630000 [0052.308] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x6570f8 [0052.308] GetProcessHeap () returned 0x630000 [0052.308] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.308] GetProcessHeap () returned 0x630000 [0052.308] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0052.308] GetProcessHeap () returned 0x630000 [0052.308] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0052.308] GetProcessHeap () returned 0x630000 [0052.308] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0052.308] GetProcessHeap () returned 0x630000 [0052.308] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0052.308] GetProcessHeap () returned 0x630000 [0052.308] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0052.308] GetProcessHeap () returned 0x630000 [0052.308] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.308] GetProcessHeap () returned 0x630000 [0052.308] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0052.309] GetProcessHeap () returned 0x630000 [0052.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.309] GetProcessHeap () returned 0x630000 [0052.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.309] GetProcessHeap () returned 0x630000 [0052.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.309] GetProcessHeap () returned 0x630000 [0052.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.309] GetProcessHeap () returned 0x630000 [0052.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ea90 [0052.309] GetProcessHeap () returned 0x630000 [0052.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0052.309] GetProcessHeap () returned 0x630000 [0052.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0052.309] GetProcessHeap () returned 0x630000 [0052.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea90 | out: hHeap=0x630000) returned 1 [0052.309] GetProcessHeap () returned 0x630000 [0052.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.309] GetProcessHeap () returned 0x630000 [0052.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.309] GetProcessHeap () returned 0x630000 [0052.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0052.309] GetProcessHeap () returned 0x630000 [0052.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0052.309] GetProcessHeap () returned 0x630000 [0052.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.309] GetProcessHeap () returned 0x630000 [0052.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.309] GetProcessHeap () returned 0x630000 [0052.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.309] GetProcessHeap () returned 0x630000 [0052.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.309] GetProcessHeap () returned 0x630000 [0052.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0052.309] GetProcessHeap () returned 0x630000 [0052.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0052.309] GetProcessHeap () returned 0x630000 [0052.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0052.309] GetProcessHeap () returned 0x630000 [0052.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0052.310] GetProcessHeap () returned 0x630000 [0052.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.310] GetProcessHeap () returned 0x630000 [0052.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.310] GetProcessHeap () returned 0x630000 [0052.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0052.310] GetProcessHeap () returned 0x630000 [0052.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0052.310] GetProcessHeap () returned 0x630000 [0052.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.310] GetProcessHeap () returned 0x630000 [0052.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.310] GetProcessHeap () returned 0x630000 [0052.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.310] GetProcessHeap () returned 0x630000 [0052.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.310] GetProcessHeap () returned 0x630000 [0052.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.310] GetProcessHeap () returned 0x630000 [0052.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.310] GetProcessHeap () returned 0x630000 [0052.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.310] GetProcessHeap () returned 0x630000 [0052.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.310] GetProcessHeap () returned 0x630000 [0052.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0052.310] GetProcessHeap () returned 0x630000 [0052.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0052.310] GetProcessHeap () returned 0x630000 [0052.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.310] GetProcessHeap () returned 0x630000 [0052.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.310] GetProcessHeap () returned 0x630000 [0052.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0052.310] GetProcessHeap () returned 0x630000 [0052.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0052.311] GetProcessHeap () returned 0x630000 [0052.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.311] GetProcessHeap () returned 0x630000 [0052.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.311] GetProcessHeap () returned 0x630000 [0052.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.311] GetProcessHeap () returned 0x630000 [0052.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.311] GetProcessHeap () returned 0x630000 [0052.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.311] GetProcessHeap () returned 0x630000 [0052.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.311] GetProcessHeap () returned 0x630000 [0052.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.311] GetProcessHeap () returned 0x630000 [0052.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.311] GetProcessHeap () returned 0x630000 [0052.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.311] GetProcessHeap () returned 0x630000 [0052.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.311] GetProcessHeap () returned 0x630000 [0052.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.311] GetProcessHeap () returned 0x630000 [0052.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.311] GetProcessHeap () returned 0x630000 [0052.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.311] GetProcessHeap () returned 0x630000 [0052.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.311] GetProcessHeap () returned 0x630000 [0052.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0052.311] GetProcessHeap () returned 0x630000 [0052.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0052.311] GetProcessHeap () returned 0x630000 [0052.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.311] GetProcessHeap () returned 0x630000 [0052.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.311] GetProcessHeap () returned 0x630000 [0052.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0052.312] GetProcessHeap () returned 0x630000 [0052.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0052.312] GetProcessHeap () returned 0x630000 [0052.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.312] GetProcessHeap () returned 0x630000 [0052.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.312] GetProcessHeap () returned 0x630000 [0052.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.312] GetProcessHeap () returned 0x630000 [0052.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.312] GetProcessHeap () returned 0x630000 [0052.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.312] GetProcessHeap () returned 0x630000 [0052.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.312] GetProcessHeap () returned 0x630000 [0052.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.312] GetProcessHeap () returned 0x630000 [0052.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.312] GetProcessHeap () returned 0x630000 [0052.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.312] GetProcessHeap () returned 0x630000 [0052.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.312] GetProcessHeap () returned 0x630000 [0052.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.312] GetProcessHeap () returned 0x630000 [0052.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.312] GetProcessHeap () returned 0x630000 [0052.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.312] GetProcessHeap () returned 0x630000 [0052.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.312] GetProcessHeap () returned 0x630000 [0052.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.312] GetProcessHeap () returned 0x630000 [0052.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.312] GetProcessHeap () returned 0x630000 [0052.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.312] GetProcessHeap () returned 0x630000 [0052.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.313] GetProcessHeap () returned 0x630000 [0052.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0052.313] GetProcessHeap () returned 0x630000 [0052.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0052.313] GetProcessHeap () returned 0x630000 [0052.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0052.313] GetProcessHeap () returned 0x630000 [0052.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0052.313] GetProcessHeap () returned 0x630000 [0052.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.313] GetProcessHeap () returned 0x630000 [0052.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.313] GetProcessHeap () returned 0x630000 [0052.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.313] GetProcessHeap () returned 0x630000 [0052.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.313] GetProcessHeap () returned 0x630000 [0052.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.313] GetProcessHeap () returned 0x630000 [0052.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.313] GetProcessHeap () returned 0x630000 [0052.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0052.313] GetProcessHeap () returned 0x630000 [0052.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0052.313] GetProcessHeap () returned 0x630000 [0052.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.313] GetProcessHeap () returned 0x630000 [0052.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.313] GetProcessHeap () returned 0x630000 [0052.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0052.313] GetProcessHeap () returned 0x630000 [0052.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0052.313] GetProcessHeap () returned 0x630000 [0052.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0052.313] GetProcessHeap () returned 0x630000 [0052.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0052.313] GetProcessHeap () returned 0x630000 [0052.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0052.314] GetProcessHeap () returned 0x630000 [0052.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0052.314] GetProcessHeap () returned 0x630000 [0052.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0052.314] GetProcessHeap () returned 0x630000 [0052.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0052.314] GetProcessHeap () returned 0x630000 [0052.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0052.314] GetProcessHeap () returned 0x630000 [0052.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.314] GetProcessHeap () returned 0x630000 [0052.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0052.314] WriteFile (in: hFile=0x230, lpBuffer=0x655230*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x655230*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0052.318] GetProcessHeap () returned 0x630000 [0052.318] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x655230, Size=0x30) returned 0x655230 [0052.318] GetProcessHeap () returned 0x630000 [0052.318] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0052.318] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.318] GetProcessHeap () returned 0x630000 [0052.318] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x97e0d) returned 0x1f33020 [0052.330] ReadFile (in: hFile=0x230, lpBuffer=0x1f33020, nNumberOfBytesToRead=0x97e0d, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x1f33020*, lpNumberOfBytesRead=0x243d7e8*=0x97e0d, lpOverlapped=0x0) returned 1 [0052.338] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.338] WriteFile (in: hFile=0x230, lpBuffer=0x1f33020*, nNumberOfBytesToWrite=0x97e0d, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x1f33020*, lpNumberOfBytesWritten=0x243d7e4*=0x97e0d, lpOverlapped=0x0) returned 1 [0052.470] GetProcessHeap () returned 0x630000 [0052.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x1f33020 | out: hHeap=0x630000) returned 1 [0052.473] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0052.473] WriteFile (in: hFile=0x230, lpBuffer=0x655230*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x655230*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0052.474] CloseHandle (hObject=0x230) returned 1 [0052.485] GetProcessHeap () returned 0x630000 [0052.485] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0052.485] GetProcessHeap () returned 0x630000 [0052.485] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b1b0 | out: hHeap=0x630000) returned 1 [0052.485] GetProcessHeap () returned 0x630000 [0052.485] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0052.486] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht") returned="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht" [0052.486] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht.happythreechoose" [0052.486] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht" (normalized: "c:\\windows10upgrade\\resources\\ux\\networkissuefaq.mht"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\networkissuefaq.mht.happythreechoose"), dwFlags=0x1) returned 1 [0052.486] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0052.486] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0052.486] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html" [0052.486] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\decryption info.html")) returned 0x20 [0052.486] GetProcessHeap () returned 0x630000 [0052.486] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645cd8 | out: hHeap=0x630000) returned 1 [0052.487] FindNextFileW (in: hFindFile=0x6486d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea631830, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea631830, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x875, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NoNetworkConnection.png", cAlternateFileName="NONETW~1.PNG")) returned 1 [0052.487] lstrcmpiW (lpString1="NoNetworkConnection.png", lpString2=".") returned 1 [0052.487] lstrcmpiW (lpString1="NoNetworkConnection.png", lpString2="..") returned 1 [0052.487] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="NoNetworkConnection.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png") returned="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png" [0052.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NoNetworkConnection.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0052.487] GetProcessHeap () returned 0x630000 [0052.487] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18) returned 0x645f58 [0052.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NoNetworkConnection.png", cchWideChar=-1, lpMultiByteStr=0x645f58, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NoNetworkConnection.png", lpUsedDefaultChar=0x0) returned 24 [0052.487] lstrlenA (lpString="NoNetworkConnection.png") returned 23 [0052.487] lstrlenA (lpString=".happythreechoose") returned 17 [0052.487] lstrlenA (lpString=".happythreechoose") returned 17 [0052.487] lstrlenA (lpString="NoNetworkConnection.png") returned 23 [0052.487] lstrcmpiA (lpString1="orkConnection.png", lpString2=".happythreechoose") returned 1 [0052.487] lstrcmpiW (lpString1="NoNetworkConnection.png", lpString2="Decryption INFO.html") returned 1 [0052.487] lstrcmpiW (lpString1="NoNetworkConnection.png", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0052.487] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0052.487] lstrcmpiW (lpString1="NoNetworkConnection.png", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0052.487] GetProcessHeap () returned 0x630000 [0052.487] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0052.487] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnection.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0052.487] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=2165) returned 1 [0052.487] GetProcessHeap () returned 0x630000 [0052.487] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x65b318 [0052.488] GetProcessHeap () returned 0x630000 [0052.488] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0052.488] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png") returned 56 [0052.488] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0052.488] GetProcessHeap () returned 0x630000 [0052.488] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0052.488] GetProcessHeap () returned 0x630000 [0052.488] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38b) returned 0x655268 [0052.488] lstrlenA (lpString="rsa_encrypt") returned 11 [0052.488] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0052.488] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0052.488] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0052.488] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0052.488] GetProcessHeap () returned 0x630000 [0052.488] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0052.489] lstrlenA (lpString="010001") returned 6 [0052.489] GetProcessHeap () returned 0x630000 [0052.489] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a348 [0052.489] GetProcessHeap () returned 0x630000 [0052.489] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0052.489] GetProcessHeap () returned 0x630000 [0052.489] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e8e0 [0052.489] GetProcessHeap () returned 0x630000 [0052.489] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0052.489] GetProcessHeap () returned 0x630000 [0052.489] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e4f0 [0052.489] GetProcessHeap () returned 0x630000 [0052.489] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657788 [0052.489] GetProcessHeap () returned 0x630000 [0052.489] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0052.489] GetProcessHeap () returned 0x630000 [0052.489] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0052.489] GetProcessHeap () returned 0x630000 [0052.489] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.489] GetProcessHeap () returned 0x630000 [0052.489] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0052.489] GetProcessHeap () returned 0x630000 [0052.489] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0052.489] GetProcessHeap () returned 0x630000 [0052.489] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x6570f8 [0052.489] GetProcessHeap () returned 0x630000 [0052.489] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.489] GetProcessHeap () returned 0x630000 [0052.489] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0052.489] GetProcessHeap () returned 0x630000 [0052.489] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0052.489] GetProcessHeap () returned 0x630000 [0052.489] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0052.489] GetProcessHeap () returned 0x630000 [0052.489] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0052.489] GetProcessHeap () returned 0x630000 [0052.490] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0052.490] GetProcessHeap () returned 0x630000 [0052.490] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.490] GetProcessHeap () returned 0x630000 [0052.490] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0052.490] GetProcessHeap () returned 0x630000 [0052.490] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.490] GetProcessHeap () returned 0x630000 [0052.490] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.490] GetProcessHeap () returned 0x630000 [0052.490] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.490] GetProcessHeap () returned 0x630000 [0052.490] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.490] GetProcessHeap () returned 0x630000 [0052.490] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e730 [0052.490] GetProcessHeap () returned 0x630000 [0052.490] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0052.490] GetProcessHeap () returned 0x630000 [0052.490] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0052.490] GetProcessHeap () returned 0x630000 [0052.490] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0052.490] GetProcessHeap () returned 0x630000 [0052.490] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.490] GetProcessHeap () returned 0x630000 [0052.490] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.490] GetProcessHeap () returned 0x630000 [0052.490] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0052.490] GetProcessHeap () returned 0x630000 [0052.490] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0052.490] GetProcessHeap () returned 0x630000 [0052.490] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.490] GetProcessHeap () returned 0x630000 [0052.490] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.490] GetProcessHeap () returned 0x630000 [0052.490] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.490] GetProcessHeap () returned 0x630000 [0052.490] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.490] GetProcessHeap () returned 0x630000 [0052.490] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0052.491] GetProcessHeap () returned 0x630000 [0052.491] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0052.491] GetProcessHeap () returned 0x630000 [0052.491] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.491] GetProcessHeap () returned 0x630000 [0052.491] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.491] GetProcessHeap () returned 0x630000 [0052.491] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.491] GetProcessHeap () returned 0x630000 [0052.491] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.491] GetProcessHeap () returned 0x630000 [0052.491] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.491] GetProcessHeap () returned 0x630000 [0052.491] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.491] GetProcessHeap () returned 0x630000 [0052.491] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.491] GetProcessHeap () returned 0x630000 [0052.491] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.491] GetProcessHeap () returned 0x630000 [0052.491] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.491] GetProcessHeap () returned 0x630000 [0052.492] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.492] GetProcessHeap () returned 0x630000 [0052.492] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0052.492] GetProcessHeap () returned 0x630000 [0052.492] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0052.492] GetProcessHeap () returned 0x630000 [0052.492] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.492] GetProcessHeap () returned 0x630000 [0052.492] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.492] GetProcessHeap () returned 0x630000 [0052.492] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.492] GetProcessHeap () returned 0x630000 [0052.492] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.492] GetProcessHeap () returned 0x630000 [0052.492] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.492] GetProcessHeap () returned 0x630000 [0052.492] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.492] GetProcessHeap () returned 0x630000 [0052.492] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.492] GetProcessHeap () returned 0x630000 [0052.492] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.492] GetProcessHeap () returned 0x630000 [0052.492] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0052.492] GetProcessHeap () returned 0x630000 [0052.492] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0052.492] GetProcessHeap () returned 0x630000 [0052.492] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0052.492] GetProcessHeap () returned 0x630000 [0052.492] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0052.492] GetProcessHeap () returned 0x630000 [0052.492] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.492] GetProcessHeap () returned 0x630000 [0052.492] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.492] GetProcessHeap () returned 0x630000 [0052.492] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.492] GetProcessHeap () returned 0x630000 [0052.492] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.493] GetProcessHeap () returned 0x630000 [0052.493] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0052.493] GetProcessHeap () returned 0x630000 [0052.493] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0052.493] GetProcessHeap () returned 0x630000 [0052.493] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.493] GetProcessHeap () returned 0x630000 [0052.493] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.493] GetProcessHeap () returned 0x630000 [0052.493] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.493] GetProcessHeap () returned 0x630000 [0052.493] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.493] GetProcessHeap () returned 0x630000 [0052.493] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0052.493] GetProcessHeap () returned 0x630000 [0052.493] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0052.493] GetProcessHeap () returned 0x630000 [0052.493] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.493] GetProcessHeap () returned 0x630000 [0052.493] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.493] GetProcessHeap () returned 0x630000 [0052.493] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.493] GetProcessHeap () returned 0x630000 [0052.493] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.493] GetProcessHeap () returned 0x630000 [0052.493] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0052.493] GetProcessHeap () returned 0x630000 [0052.493] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0052.493] GetProcessHeap () returned 0x630000 [0052.493] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.493] GetProcessHeap () returned 0x630000 [0052.493] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.493] GetProcessHeap () returned 0x630000 [0052.493] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.493] GetProcessHeap () returned 0x630000 [0052.493] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.493] GetProcessHeap () returned 0x630000 [0052.493] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0052.493] GetProcessHeap () returned 0x630000 [0052.494] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0052.494] GetProcessHeap () returned 0x630000 [0052.494] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.494] GetProcessHeap () returned 0x630000 [0052.494] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.494] GetProcessHeap () returned 0x630000 [0052.494] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.494] GetProcessHeap () returned 0x630000 [0052.494] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.494] GetProcessHeap () returned 0x630000 [0052.494] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.494] GetProcessHeap () returned 0x630000 [0052.494] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.494] GetProcessHeap () returned 0x630000 [0052.494] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.494] GetProcessHeap () returned 0x630000 [0052.494] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.494] GetProcessHeap () returned 0x630000 [0052.494] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.494] GetProcessHeap () returned 0x630000 [0052.494] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.494] GetProcessHeap () returned 0x630000 [0052.494] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0052.494] GetProcessHeap () returned 0x630000 [0052.494] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0052.494] GetProcessHeap () returned 0x630000 [0052.494] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0052.494] GetProcessHeap () returned 0x630000 [0052.494] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0052.494] GetProcessHeap () returned 0x630000 [0052.494] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.494] GetProcessHeap () returned 0x630000 [0052.494] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.494] GetProcessHeap () returned 0x630000 [0052.494] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0052.494] GetProcessHeap () returned 0x630000 [0052.494] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0052.495] GetProcessHeap () returned 0x630000 [0052.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0052.495] GetProcessHeap () returned 0x630000 [0052.495] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0052.495] GetProcessHeap () returned 0x630000 [0052.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.495] GetProcessHeap () returned 0x630000 [0052.495] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.495] GetProcessHeap () returned 0x630000 [0052.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.495] GetProcessHeap () returned 0x630000 [0052.495] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.495] GetProcessHeap () returned 0x630000 [0052.495] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0052.495] GetProcessHeap () returned 0x630000 [0052.495] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0052.495] GetProcessHeap () returned 0x630000 [0052.495] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0052.495] GetProcessHeap () returned 0x630000 [0052.495] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0052.495] GetProcessHeap () returned 0x630000 [0052.495] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0052.495] GetProcessHeap () returned 0x630000 [0052.495] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0052.495] GetProcessHeap () returned 0x630000 [0052.495] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0052.495] GetProcessHeap () returned 0x630000 [0052.495] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0052.495] GetProcessHeap () returned 0x630000 [0052.495] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0052.495] GetProcessHeap () returned 0x630000 [0052.495] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.495] GetProcessHeap () returned 0x630000 [0052.495] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0052.495] WriteFile (in: hFile=0x230, lpBuffer=0x655268*, nNumberOfBytesToWrite=0x38b, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x655268*, lpNumberOfBytesWritten=0x243d864*=0x38b, lpOverlapped=0x0) returned 1 [0052.500] GetProcessHeap () returned 0x630000 [0052.501] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x655268, Size=0x30) returned 0x655268 [0052.501] GetProcessHeap () returned 0x630000 [0052.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0052.501] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.501] GetProcessHeap () returned 0x630000 [0052.501] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x880) returned 0x6552a0 [0052.501] ReadFile (in: hFile=0x230, lpBuffer=0x6552a0, nNumberOfBytesToRead=0x880, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x6552a0*, lpNumberOfBytesRead=0x243d7e8*=0x880, lpOverlapped=0x0) returned 1 [0052.501] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.501] WriteFile (in: hFile=0x230, lpBuffer=0x6552a0*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x6552a0*, lpNumberOfBytesWritten=0x243d7e4*=0x880, lpOverlapped=0x0) returned 1 [0052.502] GetProcessHeap () returned 0x630000 [0052.502] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6552a0 | out: hHeap=0x630000) returned 1 [0052.502] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0052.502] WriteFile (in: hFile=0x230, lpBuffer=0x655268*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x655268*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0052.503] CloseHandle (hObject=0x230) returned 1 [0052.504] GetProcessHeap () returned 0x630000 [0052.504] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0052.504] GetProcessHeap () returned 0x630000 [0052.504] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b318 | out: hHeap=0x630000) returned 1 [0052.504] GetProcessHeap () returned 0x630000 [0052.504] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0052.504] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png") returned="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png" [0052.504] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png.happythreechoose" [0052.504] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnection.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnection.png.happythreechoose"), dwFlags=0x1) returned 1 [0052.505] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0052.505] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0052.505] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html" [0052.505] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\decryption info.html")) returned 0x20 [0052.505] GetProcessHeap () returned 0x630000 [0052.505] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645f58 | out: hHeap=0x630000) returned 1 [0052.505] FindNextFileW (in: hFindFile=0x6486d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea631830, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea631830, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x8a4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NoNetworkConnectionHoverOver.png", cAlternateFileName="NONETW~2.PNG")) returned 1 [0052.505] lstrcmpiW (lpString1="NoNetworkConnectionHoverOver.png", lpString2=".") returned 1 [0052.505] lstrcmpiW (lpString1="NoNetworkConnectionHoverOver.png", lpString2="..") returned 1 [0052.505] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="NoNetworkConnectionHoverOver.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png") returned="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png" [0052.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NoNetworkConnectionHoverOver.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0052.505] GetProcessHeap () returned 0x630000 [0052.505] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x21) returned 0x6449f0 [0052.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NoNetworkConnectionHoverOver.png", cchWideChar=-1, lpMultiByteStr=0x6449f0, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NoNetworkConnectionHoverOver.png", lpUsedDefaultChar=0x0) returned 33 [0052.505] lstrlenA (lpString="NoNetworkConnectionHoverOver.png") returned 32 [0052.505] lstrlenA (lpString=".happythreechoose") returned 17 [0052.505] lstrlenA (lpString=".happythreechoose") returned 17 [0052.505] lstrlenA (lpString="NoNetworkConnectionHoverOver.png") returned 32 [0052.505] lstrcmpiA (lpString1="tionHoverOver.png", lpString2=".happythreechoose") returned 1 [0052.505] lstrcmpiW (lpString1="NoNetworkConnectionHoverOver.png", lpString2="Decryption INFO.html") returned 1 [0052.505] lstrcmpiW (lpString1="NoNetworkConnectionHoverOver.png", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0052.505] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0052.506] lstrcmpiW (lpString1="NoNetworkConnectionHoverOver.png", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0052.506] GetProcessHeap () returned 0x630000 [0052.506] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0052.506] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnectionhoverover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0052.506] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=2212) returned 1 [0052.506] GetProcessHeap () returned 0x630000 [0052.506] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x65b390 [0052.506] GetProcessHeap () returned 0x630000 [0052.506] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0052.506] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png") returned 65 [0052.506] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0052.506] GetProcessHeap () returned 0x630000 [0052.506] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0052.506] GetProcessHeap () returned 0x630000 [0052.506] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38c) returned 0x6552a0 [0052.506] lstrlenA (lpString="rsa_encrypt") returned 11 [0052.507] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0052.507] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0052.507] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0052.507] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0052.507] GetProcessHeap () returned 0x630000 [0052.507] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0052.507] lstrlenA (lpString="010001") returned 6 [0052.507] GetProcessHeap () returned 0x630000 [0052.507] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a298 [0052.507] GetProcessHeap () returned 0x630000 [0052.507] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0052.507] GetProcessHeap () returned 0x630000 [0052.507] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e190 [0052.507] GetProcessHeap () returned 0x630000 [0052.507] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0052.507] GetProcessHeap () returned 0x630000 [0052.507] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e4f0 [0052.508] GetProcessHeap () returned 0x630000 [0052.508] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656950 [0052.508] GetProcessHeap () returned 0x630000 [0052.508] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0052.508] GetProcessHeap () returned 0x630000 [0052.508] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0052.508] GetProcessHeap () returned 0x630000 [0052.508] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.508] GetProcessHeap () returned 0x630000 [0052.508] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0052.508] GetProcessHeap () returned 0x630000 [0052.508] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0052.508] GetProcessHeap () returned 0x630000 [0052.508] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657670 [0052.508] GetProcessHeap () returned 0x630000 [0052.508] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.508] GetProcessHeap () returned 0x630000 [0052.508] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0052.508] GetProcessHeap () returned 0x630000 [0052.508] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0052.508] GetProcessHeap () returned 0x630000 [0052.508] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0052.508] GetProcessHeap () returned 0x630000 [0052.508] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0052.508] GetProcessHeap () returned 0x630000 [0052.508] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0052.508] GetProcessHeap () returned 0x630000 [0052.508] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0052.508] GetProcessHeap () returned 0x630000 [0052.508] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0052.508] GetProcessHeap () returned 0x630000 [0052.508] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.508] GetProcessHeap () returned 0x630000 [0052.508] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0052.508] GetProcessHeap () returned 0x630000 [0052.508] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.508] GetProcessHeap () returned 0x630000 [0052.508] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.508] GetProcessHeap () returned 0x630000 [0052.508] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65dda0 [0052.509] GetProcessHeap () returned 0x630000 [0052.509] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0052.509] GetProcessHeap () returned 0x630000 [0052.509] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0052.509] GetProcessHeap () returned 0x630000 [0052.509] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0052.509] GetProcessHeap () returned 0x630000 [0052.509] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.509] GetProcessHeap () returned 0x630000 [0052.509] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.509] GetProcessHeap () returned 0x630000 [0052.509] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.509] GetProcessHeap () returned 0x630000 [0052.509] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.509] GetProcessHeap () returned 0x630000 [0052.509] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.509] GetProcessHeap () returned 0x630000 [0052.509] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.509] GetProcessHeap () returned 0x630000 [0052.509] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.509] GetProcessHeap () returned 0x630000 [0052.509] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.509] GetProcessHeap () returned 0x630000 [0052.509] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.509] GetProcessHeap () returned 0x630000 [0052.509] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.509] GetProcessHeap () returned 0x630000 [0052.509] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.509] GetProcessHeap () returned 0x630000 [0052.509] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.509] GetProcessHeap () returned 0x630000 [0052.509] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.509] GetProcessHeap () returned 0x630000 [0052.509] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.509] GetProcessHeap () returned 0x630000 [0052.509] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0052.509] GetProcessHeap () returned 0x630000 [0052.509] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0052.509] GetProcessHeap () returned 0x630000 [0052.510] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.510] GetProcessHeap () returned 0x630000 [0052.510] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.510] GetProcessHeap () returned 0x630000 [0052.510] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.510] GetProcessHeap () returned 0x630000 [0052.510] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.510] GetProcessHeap () returned 0x630000 [0052.510] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.510] GetProcessHeap () returned 0x630000 [0052.510] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.510] GetProcessHeap () returned 0x630000 [0052.510] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0052.510] GetProcessHeap () returned 0x630000 [0052.510] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0052.510] GetProcessHeap () returned 0x630000 [0052.510] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.510] GetProcessHeap () returned 0x630000 [0052.510] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.510] GetProcessHeap () returned 0x630000 [0052.510] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.510] GetProcessHeap () returned 0x630000 [0052.510] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.510] GetProcessHeap () returned 0x630000 [0052.510] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0052.510] GetProcessHeap () returned 0x630000 [0052.510] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0052.510] GetProcessHeap () returned 0x630000 [0052.510] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0052.510] GetProcessHeap () returned 0x630000 [0052.510] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0052.510] GetProcessHeap () returned 0x630000 [0052.510] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.510] GetProcessHeap () returned 0x630000 [0052.510] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.510] GetProcessHeap () returned 0x630000 [0052.510] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.511] GetProcessHeap () returned 0x630000 [0052.511] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.511] GetProcessHeap () returned 0x630000 [0052.511] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0052.511] GetProcessHeap () returned 0x630000 [0052.511] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0052.511] GetProcessHeap () returned 0x630000 [0052.511] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0052.511] GetProcessHeap () returned 0x630000 [0052.511] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0052.511] GetProcessHeap () returned 0x630000 [0052.511] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0052.511] GetProcessHeap () returned 0x630000 [0052.511] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0052.511] GetProcessHeap () returned 0x630000 [0052.511] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0052.511] GetProcessHeap () returned 0x630000 [0052.511] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0052.511] GetProcessHeap () returned 0x630000 [0052.511] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.511] GetProcessHeap () returned 0x630000 [0052.511] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.511] GetProcessHeap () returned 0x630000 [0052.511] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.511] GetProcessHeap () returned 0x630000 [0052.511] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.511] GetProcessHeap () returned 0x630000 [0052.511] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.511] GetProcessHeap () returned 0x630000 [0052.511] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.511] GetProcessHeap () returned 0x630000 [0052.511] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.511] GetProcessHeap () returned 0x630000 [0052.511] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.511] GetProcessHeap () returned 0x630000 [0052.511] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.511] GetProcessHeap () returned 0x630000 [0052.511] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.511] GetProcessHeap () returned 0x630000 [0052.512] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0052.512] GetProcessHeap () returned 0x630000 [0052.512] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0052.512] GetProcessHeap () returned 0x630000 [0052.512] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.512] GetProcessHeap () returned 0x630000 [0052.512] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.512] GetProcessHeap () returned 0x630000 [0052.512] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0052.512] GetProcessHeap () returned 0x630000 [0052.512] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0052.512] GetProcessHeap () returned 0x630000 [0052.512] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.512] GetProcessHeap () returned 0x630000 [0052.512] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.512] GetProcessHeap () returned 0x630000 [0052.512] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.512] GetProcessHeap () returned 0x630000 [0052.512] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.512] GetProcessHeap () returned 0x630000 [0052.512] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.512] GetProcessHeap () returned 0x630000 [0052.512] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.512] GetProcessHeap () returned 0x630000 [0052.512] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.512] GetProcessHeap () returned 0x630000 [0052.512] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.512] GetProcessHeap () returned 0x630000 [0052.512] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.512] GetProcessHeap () returned 0x630000 [0052.512] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.512] GetProcessHeap () returned 0x630000 [0052.512] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0052.512] GetProcessHeap () returned 0x630000 [0052.512] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0052.512] GetProcessHeap () returned 0x630000 [0052.512] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0052.512] GetProcessHeap () returned 0x630000 [0052.512] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0052.513] GetProcessHeap () returned 0x630000 [0052.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.513] GetProcessHeap () returned 0x630000 [0052.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.513] GetProcessHeap () returned 0x630000 [0052.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0052.513] GetProcessHeap () returned 0x630000 [0052.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0052.513] GetProcessHeap () returned 0x630000 [0052.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.513] GetProcessHeap () returned 0x630000 [0052.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.513] GetProcessHeap () returned 0x630000 [0052.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.513] GetProcessHeap () returned 0x630000 [0052.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.513] GetProcessHeap () returned 0x630000 [0052.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0052.513] GetProcessHeap () returned 0x630000 [0052.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0052.513] GetProcessHeap () returned 0x630000 [0052.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0052.513] GetProcessHeap () returned 0x630000 [0052.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0052.513] GetProcessHeap () returned 0x630000 [0052.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0052.513] GetProcessHeap () returned 0x630000 [0052.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0052.513] GetProcessHeap () returned 0x630000 [0052.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0052.513] GetProcessHeap () returned 0x630000 [0052.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0052.513] GetProcessHeap () returned 0x630000 [0052.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0052.513] GetProcessHeap () returned 0x630000 [0052.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.513] GetProcessHeap () returned 0x630000 [0052.514] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0052.514] WriteFile (in: hFile=0x230, lpBuffer=0x6552a0*, nNumberOfBytesToWrite=0x38c, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6552a0*, lpNumberOfBytesWritten=0x243d864*=0x38c, lpOverlapped=0x0) returned 1 [0052.519] GetProcessHeap () returned 0x630000 [0052.519] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6552a0, Size=0x30) returned 0x6552a0 [0052.519] GetProcessHeap () returned 0x630000 [0052.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0052.519] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.519] GetProcessHeap () returned 0x630000 [0052.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8b0) returned 0x6552d8 [0052.519] ReadFile (in: hFile=0x230, lpBuffer=0x6552d8, nNumberOfBytesToRead=0x8b0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x6552d8*, lpNumberOfBytesRead=0x243d7e8*=0x8b0, lpOverlapped=0x0) returned 1 [0052.519] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.519] WriteFile (in: hFile=0x230, lpBuffer=0x6552d8*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x6552d8*, lpNumberOfBytesWritten=0x243d7e4*=0x8b0, lpOverlapped=0x0) returned 1 [0052.520] GetProcessHeap () returned 0x630000 [0052.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6552d8 | out: hHeap=0x630000) returned 1 [0052.520] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0052.520] WriteFile (in: hFile=0x230, lpBuffer=0x6552a0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6552a0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0052.521] CloseHandle (hObject=0x230) returned 1 [0052.523] GetProcessHeap () returned 0x630000 [0052.523] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0052.523] GetProcessHeap () returned 0x630000 [0052.523] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b390 | out: hHeap=0x630000) returned 1 [0052.523] GetProcessHeap () returned 0x630000 [0052.523] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0052.523] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png") returned="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png" [0052.523] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png.happythreechoose" [0052.523] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnectionhoverover.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnectionhoverover.png.happythreechoose"), dwFlags=0x1) returned 1 [0052.524] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0052.524] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0052.524] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html" [0052.524] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\decryption info.html")) returned 0x20 [0052.524] GetProcessHeap () returned 0x630000 [0052.524] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6449f0 | out: hHeap=0x630000) returned 1 [0052.524] FindNextFileW (in: hFindFile=0x6486d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea63c947, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x71e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pass.png", cAlternateFileName="")) returned 1 [0052.524] lstrcmpiW (lpString1="pass.png", lpString2=".") returned 1 [0052.524] lstrcmpiW (lpString1="pass.png", lpString2="..") returned 1 [0052.524] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="pass.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\pass.png") returned="C:\\Windows10Upgrade\\resources\\ux\\pass.png" [0052.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pass.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0052.524] GetProcessHeap () returned 0x630000 [0052.524] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9) returned 0x64c9f0 [0052.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pass.png", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pass.png", lpUsedDefaultChar=0x0) returned 9 [0052.524] lstrlenA (lpString="pass.png") returned 8 [0052.524] lstrlenA (lpString=".happythreechoose") returned 17 [0052.524] lstrcmpiW (lpString1="pass.png", lpString2="Decryption INFO.html") returned 1 [0052.524] lstrcmpiW (lpString1="pass.png", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0052.524] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0052.524] lstrcmpiW (lpString1="pass.png", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0052.524] GetProcessHeap () returned 0x630000 [0052.524] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0052.524] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\pass.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\pass.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0052.525] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=1822) returned 1 [0052.525] GetProcessHeap () returned 0x630000 [0052.525] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x65b228 [0052.525] GetProcessHeap () returned 0x630000 [0052.525] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0052.525] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\pass.png") returned 41 [0052.525] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0052.525] GetProcessHeap () returned 0x630000 [0052.525] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0052.525] GetProcessHeap () returned 0x630000 [0052.525] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x382) returned 0x6552d8 [0052.525] lstrlenA (lpString="rsa_encrypt") returned 11 [0052.525] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0052.526] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0052.526] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0052.526] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0052.526] GetProcessHeap () returned 0x630000 [0052.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0052.526] lstrlenA (lpString="010001") returned 6 [0052.526] GetProcessHeap () returned 0x630000 [0052.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0052.526] GetProcessHeap () returned 0x630000 [0052.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0052.526] GetProcessHeap () returned 0x630000 [0052.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e2b0 [0052.526] GetProcessHeap () returned 0x630000 [0052.526] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0052.526] GetProcessHeap () returned 0x630000 [0052.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e970 [0052.526] GetProcessHeap () returned 0x630000 [0052.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657558 [0052.526] GetProcessHeap () returned 0x630000 [0052.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3f8 [0052.526] GetProcessHeap () returned 0x630000 [0052.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0052.526] GetProcessHeap () returned 0x630000 [0052.526] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.526] GetProcessHeap () returned 0x630000 [0052.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0052.526] GetProcessHeap () returned 0x630000 [0052.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0052.526] GetProcessHeap () returned 0x630000 [0052.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656ec8 [0052.526] GetProcessHeap () returned 0x630000 [0052.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.526] GetProcessHeap () returned 0x630000 [0052.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0052.526] GetProcessHeap () returned 0x630000 [0052.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e850 [0052.526] GetProcessHeap () returned 0x630000 [0052.527] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0052.527] GetProcessHeap () returned 0x630000 [0052.527] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0052.527] GetProcessHeap () returned 0x630000 [0052.527] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0052.527] GetProcessHeap () returned 0x630000 [0052.527] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0052.527] GetProcessHeap () returned 0x630000 [0052.527] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65da60 [0052.527] GetProcessHeap () returned 0x630000 [0052.527] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.527] GetProcessHeap () returned 0x630000 [0052.527] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0052.527] GetProcessHeap () returned 0x630000 [0052.527] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.527] GetProcessHeap () returned 0x630000 [0052.527] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.527] GetProcessHeap () returned 0x630000 [0052.527] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ec40 [0052.527] GetProcessHeap () returned 0x630000 [0052.527] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65da60 | out: hHeap=0x630000) returned 1 [0052.527] GetProcessHeap () returned 0x630000 [0052.527] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0052.527] GetProcessHeap () returned 0x630000 [0052.527] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ec40 | out: hHeap=0x630000) returned 1 [0052.527] GetProcessHeap () returned 0x630000 [0052.527] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.527] GetProcessHeap () returned 0x630000 [0052.527] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.527] GetProcessHeap () returned 0x630000 [0052.527] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.527] GetProcessHeap () returned 0x630000 [0052.527] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.527] GetProcessHeap () returned 0x630000 [0052.527] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.527] GetProcessHeap () returned 0x630000 [0052.527] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.527] GetProcessHeap () returned 0x630000 [0052.527] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0052.527] GetProcessHeap () returned 0x630000 [0052.528] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0052.528] GetProcessHeap () returned 0x630000 [0052.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0052.528] GetProcessHeap () returned 0x630000 [0052.528] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0052.528] GetProcessHeap () returned 0x630000 [0052.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.528] GetProcessHeap () returned 0x630000 [0052.528] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.528] GetProcessHeap () returned 0x630000 [0052.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.528] GetProcessHeap () returned 0x630000 [0052.528] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.528] GetProcessHeap () returned 0x630000 [0052.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.528] GetProcessHeap () returned 0x630000 [0052.528] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.528] GetProcessHeap () returned 0x630000 [0052.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0052.528] GetProcessHeap () returned 0x630000 [0052.528] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0052.528] GetProcessHeap () returned 0x630000 [0052.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.528] GetProcessHeap () returned 0x630000 [0052.528] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.528] GetProcessHeap () returned 0x630000 [0052.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.528] GetProcessHeap () returned 0x630000 [0052.528] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.528] GetProcessHeap () returned 0x630000 [0052.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0052.528] GetProcessHeap () returned 0x630000 [0052.528] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0052.528] GetProcessHeap () returned 0x630000 [0052.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.528] GetProcessHeap () returned 0x630000 [0052.528] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.529] GetProcessHeap () returned 0x630000 [0052.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.529] GetProcessHeap () returned 0x630000 [0052.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.529] GetProcessHeap () returned 0x630000 [0052.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0052.529] GetProcessHeap () returned 0x630000 [0052.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0052.529] GetProcessHeap () returned 0x630000 [0052.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.529] GetProcessHeap () returned 0x630000 [0052.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.529] GetProcessHeap () returned 0x630000 [0052.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.529] GetProcessHeap () returned 0x630000 [0052.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.529] GetProcessHeap () returned 0x630000 [0052.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0052.529] GetProcessHeap () returned 0x630000 [0052.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0052.529] GetProcessHeap () returned 0x630000 [0052.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.529] GetProcessHeap () returned 0x630000 [0052.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.529] GetProcessHeap () returned 0x630000 [0052.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.529] GetProcessHeap () returned 0x630000 [0052.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.529] GetProcessHeap () returned 0x630000 [0052.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.529] GetProcessHeap () returned 0x630000 [0052.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.529] GetProcessHeap () returned 0x630000 [0052.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0052.529] GetProcessHeap () returned 0x630000 [0052.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0052.529] GetProcessHeap () returned 0x630000 [0052.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0052.530] GetProcessHeap () returned 0x630000 [0052.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0052.530] GetProcessHeap () returned 0x630000 [0052.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.530] GetProcessHeap () returned 0x630000 [0052.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.530] GetProcessHeap () returned 0x630000 [0052.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0052.530] GetProcessHeap () returned 0x630000 [0052.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0052.530] GetProcessHeap () returned 0x630000 [0052.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0052.530] GetProcessHeap () returned 0x630000 [0052.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0052.530] GetProcessHeap () returned 0x630000 [0052.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.530] GetProcessHeap () returned 0x630000 [0052.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.530] GetProcessHeap () returned 0x630000 [0052.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0052.530] GetProcessHeap () returned 0x630000 [0052.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0052.530] GetProcessHeap () returned 0x630000 [0052.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.530] GetProcessHeap () returned 0x630000 [0052.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.530] GetProcessHeap () returned 0x630000 [0052.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0052.530] GetProcessHeap () returned 0x630000 [0052.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0052.530] GetProcessHeap () returned 0x630000 [0052.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.530] GetProcessHeap () returned 0x630000 [0052.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.530] GetProcessHeap () returned 0x630000 [0052.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.530] GetProcessHeap () returned 0x630000 [0052.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.531] GetProcessHeap () returned 0x630000 [0052.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0052.531] GetProcessHeap () returned 0x630000 [0052.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0052.531] GetProcessHeap () returned 0x630000 [0052.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0052.531] GetProcessHeap () returned 0x630000 [0052.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0052.531] GetProcessHeap () returned 0x630000 [0052.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0052.531] GetProcessHeap () returned 0x630000 [0052.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0052.531] GetProcessHeap () returned 0x630000 [0052.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.531] GetProcessHeap () returned 0x630000 [0052.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.531] GetProcessHeap () returned 0x630000 [0052.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0052.531] GetProcessHeap () returned 0x630000 [0052.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0052.531] GetProcessHeap () returned 0x630000 [0052.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0052.531] GetProcessHeap () returned 0x630000 [0052.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0052.531] GetProcessHeap () returned 0x630000 [0052.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.531] GetProcessHeap () returned 0x630000 [0052.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.531] GetProcessHeap () returned 0x630000 [0052.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.531] GetProcessHeap () returned 0x630000 [0052.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.531] GetProcessHeap () returned 0x630000 [0052.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.531] GetProcessHeap () returned 0x630000 [0052.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.531] GetProcessHeap () returned 0x630000 [0052.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0052.531] GetProcessHeap () returned 0x630000 [0052.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0052.532] GetProcessHeap () returned 0x630000 [0052.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0052.532] GetProcessHeap () returned 0x630000 [0052.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0052.532] GetProcessHeap () returned 0x630000 [0052.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0052.532] GetProcessHeap () returned 0x630000 [0052.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0052.532] GetProcessHeap () returned 0x630000 [0052.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0052.532] GetProcessHeap () returned 0x630000 [0052.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e2b0 | out: hHeap=0x630000) returned 1 [0052.532] GetProcessHeap () returned 0x630000 [0052.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0052.532] GetProcessHeap () returned 0x630000 [0052.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0052.532] GetProcessHeap () returned 0x630000 [0052.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0052.532] WriteFile (in: hFile=0x230, lpBuffer=0x6552d8*, nNumberOfBytesToWrite=0x382, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6552d8*, lpNumberOfBytesWritten=0x243d864*=0x382, lpOverlapped=0x0) returned 1 [0052.546] GetProcessHeap () returned 0x630000 [0052.546] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6552d8, Size=0x30) returned 0x6552d8 [0052.546] GetProcessHeap () returned 0x630000 [0052.547] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0052.547] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.547] GetProcessHeap () returned 0x630000 [0052.547] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x720) returned 0x655310 [0052.547] ReadFile (in: hFile=0x230, lpBuffer=0x655310, nNumberOfBytesToRead=0x720, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x655310*, lpNumberOfBytesRead=0x243d7e8*=0x720, lpOverlapped=0x0) returned 1 [0052.547] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.547] WriteFile (in: hFile=0x230, lpBuffer=0x655310*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x655310*, lpNumberOfBytesWritten=0x243d7e4*=0x720, lpOverlapped=0x0) returned 1 [0052.548] GetProcessHeap () returned 0x630000 [0052.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655310 | out: hHeap=0x630000) returned 1 [0052.548] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0052.548] WriteFile (in: hFile=0x230, lpBuffer=0x6552d8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6552d8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0052.549] CloseHandle (hObject=0x230) returned 1 [0052.550] GetProcessHeap () returned 0x630000 [0052.550] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0052.550] GetProcessHeap () returned 0x630000 [0052.550] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b228 | out: hHeap=0x630000) returned 1 [0052.550] GetProcessHeap () returned 0x630000 [0052.550] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0052.550] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\pass.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\pass.png") returned="C:\\Windows10Upgrade\\resources\\ux\\pass.png" [0052.550] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\pass.png", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\pass.png.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\pass.png.happythreechoose" [0052.551] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\pass.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\pass.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\pass.png.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\pass.png.happythreechoose"), dwFlags=0x1) returned 1 [0052.551] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\pass.png" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0052.551] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0052.551] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html" [0052.551] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\decryption info.html")) returned 0x20 [0052.551] GetProcessHeap () returned 0x630000 [0052.551] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0052.551] FindNextFileW (in: hFindFile=0x6486d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea63c947, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x71e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pass.png", cAlternateFileName="")) returned 0 [0052.552] FindClose (in: hFindFile=0x6486d0 | out: hFindFile=0x6486d0) returned 1 [0052.552] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\" [0052.552] GetProcessHeap () returned 0x630000 [0052.552] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65d320 | out: hHeap=0x630000) returned 1 [0052.552] GetProcessHeap () returned 0x630000 [0052.552] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.552] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\") returned 49 [0052.552] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\", lpString2="*" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\*") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\*" [0052.552] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea6143a6, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648810 [0052.552] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0052.552] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea6143a6, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.552] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0052.552] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0052.552] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6143a6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea6143a6, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0052.552] lstrcmpiW (lpString1="css", lpString2=".") returned 1 [0052.552] lstrcmpiW (lpString1="css", lpString2="..") returned 1 [0052.552] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\", lpString2="css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css" [0052.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="css", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0052.552] GetProcessHeap () returned 0x630000 [0052.552] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4) returned 0x65a348 [0052.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="css", cchWideChar=-1, lpMultiByteStr=0x65a348, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="css", lpUsedDefaultChar=0x0) returned 4 [0052.552] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0052.552] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0052.552] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0052.552] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0052.552] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0052.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0052.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0052.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0052.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0052.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0052.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0052.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0052.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0052.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0052.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0052.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0052.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0052.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0052.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0052.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0052.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0052.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0052.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0052.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0052.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0052.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0052.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0052.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0052.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0052.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0052.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0052.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0052.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0052.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0052.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0052.553] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0052.554] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0052.554] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0052.554] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0052.554] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0052.554] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0052.554] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0052.554] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0052.554] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css", lpString2="\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\" [0052.554] GetProcessHeap () returned 0x630000 [0052.554] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a3f8 [0052.554] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\") returned 53 [0052.554] GetProcessHeap () returned 0x630000 [0052.554] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6c) returned 0x65b318 [0052.554] lstrcpyW (in: lpString1=0x65b318, lpString2="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\" [0052.554] GetProcessHeap () returned 0x630000 [0052.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.554] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea61ff59, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0052.554] lstrcmpiW (lpString1="js", lpString2=".") returned 1 [0052.554] lstrcmpiW (lpString1="js", lpString2="..") returned 1 [0052.554] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\", lpString2="js" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js" [0052.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="js", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0052.554] GetProcessHeap () returned 0x630000 [0052.554] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3) returned 0x65a338 [0052.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="js", cchWideChar=-1, lpMultiByteStr=0x65a338, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="js", lpUsedDefaultChar=0x0) returned 3 [0052.554] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0052.554] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0052.554] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0052.554] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0052.554] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0052.554] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0052.554] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0052.554] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0052.554] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0052.554] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0052.554] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0052.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0052.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0052.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0052.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0052.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0052.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0052.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0052.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0052.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0052.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0052.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0052.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0052.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0052.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0052.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0052.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0052.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0052.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0052.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0052.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0052.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0052.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0052.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0052.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0052.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0052.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0052.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0052.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0052.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0052.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0052.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0052.555] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0052.555] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js", lpString2="\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\" [0052.555] GetProcessHeap () returned 0x630000 [0052.556] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a3b8 [0052.556] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\") returned 52 [0052.556] GetProcessHeap () returned 0x630000 [0052.556] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6a) returned 0x65b1b0 [0052.556] lstrcpyW (in: lpString1=0x65b1b0, lpString2="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\" [0052.556] GetProcessHeap () returned 0x630000 [0052.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.556] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea61ff59, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0052.556] FindClose (in: hFindFile=0x648810 | out: hFindFile=0x648810) returned 1 [0052.556] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\" [0052.556] GetProcessHeap () returned 0x630000 [0052.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b1b0 | out: hHeap=0x630000) returned 1 [0052.556] GetProcessHeap () returned 0x630000 [0052.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0052.556] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\") returned 52 [0052.556] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\", lpString2="*" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\*") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\*" [0052.556] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea61ff59, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6486d0 [0052.557] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0052.557] FindNextFileW (in: hFindFile=0x6486d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea61ff59, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.557] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0052.557] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0052.557] FindNextFileW (in: hFindFile=0x6486d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea61ff59, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1395c6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="base.js", cAlternateFileName="")) returned 1 [0052.557] lstrcmpiW (lpString1="base.js", lpString2=".") returned 1 [0052.557] lstrcmpiW (lpString1="base.js", lpString2="..") returned 1 [0052.557] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\", lpString2="base.js" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js" [0052.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="base.js", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0052.557] GetProcessHeap () returned 0x630000 [0052.557] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a268 [0052.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="base.js", cchWideChar=-1, lpMultiByteStr=0x65a268, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="base.js", lpUsedDefaultChar=0x0) returned 8 [0052.557] lstrlenA (lpString="base.js") returned 7 [0052.557] lstrlenA (lpString=".happythreechoose") returned 17 [0052.557] lstrcmpiW (lpString1="base.js", lpString2="Decryption INFO.html") returned -1 [0052.557] lstrcmpiW (lpString1="base.js", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0052.557] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0052.557] lstrcmpiW (lpString1="base.js", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0052.557] GetProcessHeap () returned 0x630000 [0052.557] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0052.557] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\base.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0052.558] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=1283526) returned 1 [0052.558] GetProcessHeap () returned 0x630000 [0052.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x65b138 [0052.558] GetProcessHeap () returned 0x630000 [0052.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0052.558] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js") returned 59 [0052.558] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0052.558] GetProcessHeap () returned 0x630000 [0052.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0052.558] GetProcessHeap () returned 0x630000 [0052.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38a) returned 0x655310 [0052.558] lstrlenA (lpString="rsa_encrypt") returned 11 [0052.558] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0052.559] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0052.559] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0052.559] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0052.559] GetProcessHeap () returned 0x630000 [0052.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0052.559] lstrlenA (lpString="010001") returned 6 [0052.559] GetProcessHeap () returned 0x630000 [0052.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0052.559] GetProcessHeap () returned 0x630000 [0052.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0052.559] GetProcessHeap () returned 0x630000 [0052.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dec0 [0052.559] GetProcessHeap () returned 0x630000 [0052.559] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0052.559] GetProcessHeap () returned 0x630000 [0052.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65df50 [0052.559] GetProcessHeap () returned 0x630000 [0052.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656950 [0052.559] GetProcessHeap () returned 0x630000 [0052.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a348 [0052.559] GetProcessHeap () returned 0x630000 [0052.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0052.559] GetProcessHeap () returned 0x630000 [0052.559] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.559] GetProcessHeap () returned 0x630000 [0052.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0052.559] GetProcessHeap () returned 0x630000 [0052.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0052.559] GetProcessHeap () returned 0x630000 [0052.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656b80 [0052.559] GetProcessHeap () returned 0x630000 [0052.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.559] GetProcessHeap () returned 0x630000 [0052.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0052.560] GetProcessHeap () returned 0x630000 [0052.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e100 [0052.560] GetProcessHeap () returned 0x630000 [0052.560] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0052.560] GetProcessHeap () returned 0x630000 [0052.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0052.560] GetProcessHeap () returned 0x630000 [0052.560] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0052.560] GetProcessHeap () returned 0x630000 [0052.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.560] GetProcessHeap () returned 0x630000 [0052.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0052.560] GetProcessHeap () returned 0x630000 [0052.560] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.560] GetProcessHeap () returned 0x630000 [0052.560] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.560] GetProcessHeap () returned 0x630000 [0052.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0052.560] GetProcessHeap () returned 0x630000 [0052.560] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0052.560] GetProcessHeap () returned 0x630000 [0052.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e850 [0052.560] GetProcessHeap () returned 0x630000 [0052.560] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0052.560] GetProcessHeap () returned 0x630000 [0052.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0052.560] GetProcessHeap () returned 0x630000 [0052.560] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0052.560] GetProcessHeap () returned 0x630000 [0052.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.560] GetProcessHeap () returned 0x630000 [0052.560] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.560] GetProcessHeap () returned 0x630000 [0052.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0052.560] GetProcessHeap () returned 0x630000 [0052.560] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0052.560] GetProcessHeap () returned 0x630000 [0052.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.560] GetProcessHeap () returned 0x630000 [0052.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.561] GetProcessHeap () returned 0x630000 [0052.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0052.561] GetProcessHeap () returned 0x630000 [0052.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0052.561] GetProcessHeap () returned 0x630000 [0052.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.561] GetProcessHeap () returned 0x630000 [0052.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.561] GetProcessHeap () returned 0x630000 [0052.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.561] GetProcessHeap () returned 0x630000 [0052.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.561] GetProcessHeap () returned 0x630000 [0052.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.561] GetProcessHeap () returned 0x630000 [0052.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.561] GetProcessHeap () returned 0x630000 [0052.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.561] GetProcessHeap () returned 0x630000 [0052.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.561] GetProcessHeap () returned 0x630000 [0052.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.561] GetProcessHeap () returned 0x630000 [0052.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.561] GetProcessHeap () returned 0x630000 [0052.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.561] GetProcessHeap () returned 0x630000 [0052.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.561] GetProcessHeap () returned 0x630000 [0052.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.561] GetProcessHeap () returned 0x630000 [0052.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.561] GetProcessHeap () returned 0x630000 [0052.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.561] GetProcessHeap () returned 0x630000 [0052.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.562] GetProcessHeap () returned 0x630000 [0052.562] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0052.562] GetProcessHeap () returned 0x630000 [0052.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0052.562] GetProcessHeap () returned 0x630000 [0052.562] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.562] GetProcessHeap () returned 0x630000 [0052.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.562] GetProcessHeap () returned 0x630000 [0052.562] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.562] GetProcessHeap () returned 0x630000 [0052.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.562] GetProcessHeap () returned 0x630000 [0052.562] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0052.562] GetProcessHeap () returned 0x630000 [0052.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0052.562] GetProcessHeap () returned 0x630000 [0052.562] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.562] GetProcessHeap () returned 0x630000 [0052.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.562] GetProcessHeap () returned 0x630000 [0052.562] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0052.562] GetProcessHeap () returned 0x630000 [0052.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0052.562] GetProcessHeap () returned 0x630000 [0052.562] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.562] GetProcessHeap () returned 0x630000 [0052.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.562] GetProcessHeap () returned 0x630000 [0052.562] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.562] GetProcessHeap () returned 0x630000 [0052.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.562] GetProcessHeap () returned 0x630000 [0052.562] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.562] GetProcessHeap () returned 0x630000 [0052.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.562] GetProcessHeap () returned 0x630000 [0052.563] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.563] GetProcessHeap () returned 0x630000 [0052.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.563] GetProcessHeap () returned 0x630000 [0052.563] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.563] GetProcessHeap () returned 0x630000 [0052.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.563] GetProcessHeap () returned 0x630000 [0052.563] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.563] GetProcessHeap () returned 0x630000 [0052.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.563] GetProcessHeap () returned 0x630000 [0052.563] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0052.563] GetProcessHeap () returned 0x630000 [0052.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0052.563] GetProcessHeap () returned 0x630000 [0052.563] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.563] GetProcessHeap () returned 0x630000 [0052.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.563] GetProcessHeap () returned 0x630000 [0052.563] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.563] GetProcessHeap () returned 0x630000 [0052.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.563] GetProcessHeap () returned 0x630000 [0052.563] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.563] GetProcessHeap () returned 0x630000 [0052.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.563] GetProcessHeap () returned 0x630000 [0052.563] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.563] GetProcessHeap () returned 0x630000 [0052.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.563] GetProcessHeap () returned 0x630000 [0052.563] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.563] GetProcessHeap () returned 0x630000 [0052.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.563] GetProcessHeap () returned 0x630000 [0052.563] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0052.563] GetProcessHeap () returned 0x630000 [0052.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0052.564] GetProcessHeap () returned 0x630000 [0052.564] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.564] GetProcessHeap () returned 0x630000 [0052.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.564] GetProcessHeap () returned 0x630000 [0052.564] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.564] GetProcessHeap () returned 0x630000 [0052.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.564] GetProcessHeap () returned 0x630000 [0052.564] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.564] GetProcessHeap () returned 0x630000 [0052.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.564] GetProcessHeap () returned 0x630000 [0052.564] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.564] GetProcessHeap () returned 0x630000 [0052.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.564] GetProcessHeap () returned 0x630000 [0052.564] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0052.564] GetProcessHeap () returned 0x630000 [0052.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0052.564] GetProcessHeap () returned 0x630000 [0052.564] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.564] GetProcessHeap () returned 0x630000 [0052.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.564] GetProcessHeap () returned 0x630000 [0052.564] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0052.564] GetProcessHeap () returned 0x630000 [0052.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0052.564] GetProcessHeap () returned 0x630000 [0052.564] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.564] GetProcessHeap () returned 0x630000 [0052.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.564] GetProcessHeap () returned 0x630000 [0052.564] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.564] GetProcessHeap () returned 0x630000 [0052.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.564] GetProcessHeap () returned 0x630000 [0052.564] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.565] GetProcessHeap () returned 0x630000 [0052.565] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.565] GetProcessHeap () returned 0x630000 [0052.565] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0052.565] GetProcessHeap () returned 0x630000 [0052.565] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0052.565] GetProcessHeap () returned 0x630000 [0052.565] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0052.565] GetProcessHeap () returned 0x630000 [0052.565] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0052.565] GetProcessHeap () returned 0x630000 [0052.565] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0052.565] GetProcessHeap () returned 0x630000 [0052.565] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0052.565] GetProcessHeap () returned 0x630000 [0052.565] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0052.565] GetProcessHeap () returned 0x630000 [0052.565] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0052.565] GetProcessHeap () returned 0x630000 [0052.565] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0052.565] GetProcessHeap () returned 0x630000 [0052.565] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.565] GetProcessHeap () returned 0x630000 [0052.565] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0052.565] WriteFile (in: hFile=0x230, lpBuffer=0x655310*, nNumberOfBytesToWrite=0x38a, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x655310*, lpNumberOfBytesWritten=0x243d864*=0x38a, lpOverlapped=0x0) returned 1 [0052.570] GetProcessHeap () returned 0x630000 [0052.570] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x655310, Size=0x30) returned 0x655310 [0052.570] GetProcessHeap () returned 0x630000 [0052.570] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0052.570] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.570] GetProcessHeap () returned 0x630000 [0052.570] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1395d0) returned 0x2449020 [0052.594] ReadFile (in: hFile=0x230, lpBuffer=0x2449020, nNumberOfBytesToRead=0x1395d0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x2449020*, lpNumberOfBytesRead=0x243d7e8*=0x1395d0, lpOverlapped=0x0) returned 1 [0052.611] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.611] WriteFile (in: hFile=0x230, lpBuffer=0x2449020*, nNumberOfBytesToWrite=0x1395d0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x2449020*, lpNumberOfBytesWritten=0x243d7e4*=0x1395d0, lpOverlapped=0x0) returned 1 [0052.755] GetProcessHeap () returned 0x630000 [0052.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x2449020 | out: hHeap=0x630000) returned 1 [0052.763] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0052.763] WriteFile (in: hFile=0x230, lpBuffer=0x655310*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x655310*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0052.765] CloseHandle (hObject=0x230) returned 1 [0052.787] GetProcessHeap () returned 0x630000 [0052.787] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0052.787] GetProcessHeap () returned 0x630000 [0052.787] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b138 | out: hHeap=0x630000) returned 1 [0052.787] GetProcessHeap () returned 0x630000 [0052.787] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0052.787] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js" [0052.787] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js.happythreechoose" [0052.787] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\base.js"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\base.js.happythreechoose"), dwFlags=0x1) returned 1 [0052.800] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js") returned 1 [0052.800] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\") returned="" [0052.800] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\Decryption INFO.html" [0052.800] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\decryption info.html")) returned 0xffffffff [0052.800] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0052.800] GetProcessHeap () returned 0x630000 [0052.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x65b390 [0052.800] GetProcessHeap () returned 0x630000 [0052.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0052.809] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.810] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.810] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.810] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.810] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.810] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.810] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.810] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.811] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.811] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.811] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.811] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.811] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.811] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.811] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.811] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.811] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.811] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.811] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.812] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.812] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.812] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.812] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.812] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.812] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.812] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.812] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.812] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.812] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.812] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.812] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.812] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.813] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.813] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.813] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.813] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.813] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.817] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.817] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.817] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.817] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.817] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.817] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.817] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.817] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.817] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.817] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.817] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.817] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.817] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.818] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.818] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.818] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.818] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.818] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.818] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.818] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.818] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.818] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.818] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.818] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.818] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.819] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.819] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.819] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.819] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.819] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.819] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.819] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.819] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.819] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.820] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.820] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.820] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.820] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.820] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.820] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.820] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.820] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.820] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.820] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.820] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.820] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.820] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.820] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.821] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.821] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.821] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.821] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.821] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.821] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.821] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.821] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.821] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.821] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.821] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.821] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.821] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.822] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.822] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.822] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.822] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.822] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.822] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.822] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.822] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.822] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.822] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.822] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.822] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.822] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.823] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.823] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.823] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.823] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.823] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.823] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.823] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.823] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.823] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.823] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.823] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.823] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.823] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.824] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.824] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.824] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.824] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.824] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.824] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.824] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.824] GetProcessHeap () returned 0x630000 [0052.824] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b390 | out: hHeap=0x630000) returned 1 [0052.824] GetProcessHeap () returned 0x630000 [0052.824] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0052.824] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0052.824] GetProcessHeap () returned 0x630000 [0052.824] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x65b048 [0052.824] GetProcessHeap () returned 0x630000 [0052.824] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0052.831] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.831] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.831] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.832] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.832] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.832] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.832] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.832] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.832] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.832] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.832] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.832] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.832] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.832] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.832] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.832] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.833] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.833] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.833] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.833] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.833] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.833] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.833] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.833] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.833] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.833] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.833] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.833] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.834] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.834] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.834] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.834] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.834] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.834] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.834] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.834] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.834] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.834] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.834] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.834] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.840] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.840] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.840] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.840] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.840] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.840] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.841] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.841] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.841] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.841] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.841] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.841] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.841] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.841] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.841] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.841] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.841] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.841] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.841] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.842] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.842] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.842] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.842] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.842] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.842] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.842] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.842] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.842] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.842] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.842] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.842] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.843] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.843] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.843] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.843] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.843] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.843] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.843] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.843] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.843] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.843] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.843] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.844] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.844] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.844] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.844] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.844] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.844] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.844] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.844] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.844] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.844] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.844] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.844] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.845] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.845] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.845] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.845] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.845] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.845] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.845] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.845] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.845] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.845] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.845] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.845] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.845] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0052.847] GetProcessHeap () returned 0x630000 [0052.847] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b048 | out: hHeap=0x630000) returned 1 [0052.847] GetProcessHeap () returned 0x630000 [0052.847] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0052.847] CloseHandle (hObject=0x230) returned 1 [0052.848] GetProcessHeap () returned 0x630000 [0052.848] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.848] FindNextFileW (in: hFindFile=0x6486d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea61ff59, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x2e7dba, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ui.js", cAlternateFileName="")) returned 1 [0052.848] lstrcmpiW (lpString1="ui.js", lpString2=".") returned 1 [0052.848] lstrcmpiW (lpString1="ui.js", lpString2="..") returned 1 [0052.848] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\", lpString2="ui.js" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js" [0052.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ui.js", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0052.848] GetProcessHeap () returned 0x630000 [0052.848] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6) returned 0x65a2a8 [0052.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ui.js", cchWideChar=-1, lpMultiByteStr=0x65a2a8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ui.js", lpUsedDefaultChar=0x0) returned 6 [0052.848] lstrlenA (lpString="ui.js") returned 5 [0052.848] lstrlenA (lpString=".happythreechoose") returned 17 [0052.848] lstrcmpiW (lpString1="ui.js", lpString2="Decryption INFO.html") returned 1 [0052.848] lstrcmpiW (lpString1="ui.js", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0052.848] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0052.848] lstrcmpiW (lpString1="ui.js", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0052.848] GetProcessHeap () returned 0x630000 [0052.848] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0052.848] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\ui.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0052.848] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=3046842) returned 1 [0052.849] GetProcessHeap () returned 0x630000 [0052.849] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x65b138 [0052.849] GetProcessHeap () returned 0x630000 [0052.849] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0052.849] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js") returned 57 [0052.849] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0052.849] GetProcessHeap () returned 0x630000 [0052.849] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0052.849] GetProcessHeap () returned 0x630000 [0052.849] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x655348 [0052.849] lstrlenA (lpString="rsa_encrypt") returned 11 [0052.849] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0052.849] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0052.850] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0052.850] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0052.850] GetProcessHeap () returned 0x630000 [0052.850] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0052.850] lstrlenA (lpString="010001") returned 6 [0052.850] GetProcessHeap () returned 0x630000 [0052.850] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0052.850] GetProcessHeap () returned 0x630000 [0052.850] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0052.850] GetProcessHeap () returned 0x630000 [0052.850] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e610 [0052.850] GetProcessHeap () returned 0x630000 [0052.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0052.850] GetProcessHeap () returned 0x630000 [0052.850] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e730 [0052.850] GetProcessHeap () returned 0x630000 [0052.850] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656ec8 [0052.850] GetProcessHeap () returned 0x630000 [0052.850] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2b8 [0052.850] GetProcessHeap () returned 0x630000 [0052.850] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0052.850] GetProcessHeap () returned 0x630000 [0052.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0052.850] GetProcessHeap () returned 0x630000 [0052.850] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0052.851] GetProcessHeap () returned 0x630000 [0052.851] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0052.851] GetProcessHeap () returned 0x630000 [0052.851] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656c98 [0052.851] GetProcessHeap () returned 0x630000 [0052.851] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.851] GetProcessHeap () returned 0x630000 [0052.851] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0052.851] GetProcessHeap () returned 0x630000 [0052.851] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0052.851] GetProcessHeap () returned 0x630000 [0052.851] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0052.851] GetProcessHeap () returned 0x630000 [0052.851] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0052.851] GetProcessHeap () returned 0x630000 [0052.851] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0052.851] GetProcessHeap () returned 0x630000 [0052.851] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.851] GetProcessHeap () returned 0x630000 [0052.851] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0052.851] GetProcessHeap () returned 0x630000 [0052.851] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.851] GetProcessHeap () returned 0x630000 [0052.851] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.851] GetProcessHeap () returned 0x630000 [0052.851] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.851] GetProcessHeap () returned 0x630000 [0052.851] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.851] GetProcessHeap () returned 0x630000 [0052.851] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ea90 [0052.851] GetProcessHeap () returned 0x630000 [0052.851] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0052.851] GetProcessHeap () returned 0x630000 [0052.851] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0052.851] GetProcessHeap () returned 0x630000 [0052.851] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea90 | out: hHeap=0x630000) returned 1 [0052.851] GetProcessHeap () returned 0x630000 [0052.851] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.851] GetProcessHeap () returned 0x630000 [0052.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.852] GetProcessHeap () returned 0x630000 [0052.852] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0052.852] GetProcessHeap () returned 0x630000 [0052.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0052.852] GetProcessHeap () returned 0x630000 [0052.852] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.852] GetProcessHeap () returned 0x630000 [0052.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.852] GetProcessHeap () returned 0x630000 [0052.852] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.852] GetProcessHeap () returned 0x630000 [0052.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.852] GetProcessHeap () returned 0x630000 [0052.852] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.852] GetProcessHeap () returned 0x630000 [0052.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.852] GetProcessHeap () returned 0x630000 [0052.852] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.852] GetProcessHeap () returned 0x630000 [0052.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.852] GetProcessHeap () returned 0x630000 [0052.852] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.852] GetProcessHeap () returned 0x630000 [0052.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.852] GetProcessHeap () returned 0x630000 [0052.852] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.852] GetProcessHeap () returned 0x630000 [0052.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.852] GetProcessHeap () returned 0x630000 [0052.852] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.852] GetProcessHeap () returned 0x630000 [0052.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.852] GetProcessHeap () returned 0x630000 [0052.852] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.852] GetProcessHeap () returned 0x630000 [0052.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.853] GetProcessHeap () returned 0x630000 [0052.853] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0052.853] GetProcessHeap () returned 0x630000 [0052.853] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0052.853] GetProcessHeap () returned 0x630000 [0052.853] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.853] GetProcessHeap () returned 0x630000 [0052.853] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.853] GetProcessHeap () returned 0x630000 [0052.853] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.853] GetProcessHeap () returned 0x630000 [0052.853] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.853] GetProcessHeap () returned 0x630000 [0052.853] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.853] GetProcessHeap () returned 0x630000 [0052.853] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.853] GetProcessHeap () returned 0x630000 [0052.853] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.853] GetProcessHeap () returned 0x630000 [0052.853] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.853] GetProcessHeap () returned 0x630000 [0052.853] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.853] GetProcessHeap () returned 0x630000 [0052.853] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.853] GetProcessHeap () returned 0x630000 [0052.853] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.853] GetProcessHeap () returned 0x630000 [0052.853] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.853] GetProcessHeap () returned 0x630000 [0052.853] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.853] GetProcessHeap () returned 0x630000 [0052.853] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.853] GetProcessHeap () returned 0x630000 [0052.853] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.853] GetProcessHeap () returned 0x630000 [0052.853] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.854] GetProcessHeap () returned 0x630000 [0052.854] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0052.854] GetProcessHeap () returned 0x630000 [0052.854] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0052.854] GetProcessHeap () returned 0x630000 [0052.854] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.854] GetProcessHeap () returned 0x630000 [0052.854] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.854] GetProcessHeap () returned 0x630000 [0052.854] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.854] GetProcessHeap () returned 0x630000 [0052.854] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.854] GetProcessHeap () returned 0x630000 [0052.854] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.854] GetProcessHeap () returned 0x630000 [0052.854] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.854] GetProcessHeap () returned 0x630000 [0052.854] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.854] GetProcessHeap () returned 0x630000 [0052.854] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.854] GetProcessHeap () returned 0x630000 [0052.854] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.854] GetProcessHeap () returned 0x630000 [0052.854] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.854] GetProcessHeap () returned 0x630000 [0052.854] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0052.854] GetProcessHeap () returned 0x630000 [0052.854] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0052.854] GetProcessHeap () returned 0x630000 [0052.854] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.854] GetProcessHeap () returned 0x630000 [0052.854] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.854] GetProcessHeap () returned 0x630000 [0052.854] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0052.854] GetProcessHeap () returned 0x630000 [0052.854] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0052.854] GetProcessHeap () returned 0x630000 [0052.855] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0052.855] GetProcessHeap () returned 0x630000 [0052.855] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0052.855] GetProcessHeap () returned 0x630000 [0052.855] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0052.855] GetProcessHeap () returned 0x630000 [0052.855] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0052.855] GetProcessHeap () returned 0x630000 [0052.855] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.855] GetProcessHeap () returned 0x630000 [0052.855] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.855] GetProcessHeap () returned 0x630000 [0052.855] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0052.855] GetProcessHeap () returned 0x630000 [0052.855] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0052.855] GetProcessHeap () returned 0x630000 [0052.855] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.855] GetProcessHeap () returned 0x630000 [0052.855] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.855] GetProcessHeap () returned 0x630000 [0052.855] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0052.855] GetProcessHeap () returned 0x630000 [0052.855] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0052.855] GetProcessHeap () returned 0x630000 [0052.855] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0052.855] GetProcessHeap () returned 0x630000 [0052.855] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0052.855] GetProcessHeap () returned 0x630000 [0052.855] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.855] GetProcessHeap () returned 0x630000 [0052.855] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.855] GetProcessHeap () returned 0x630000 [0052.855] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0052.855] GetProcessHeap () returned 0x630000 [0052.855] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0052.855] GetProcessHeap () returned 0x630000 [0052.855] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0052.856] GetProcessHeap () returned 0x630000 [0052.856] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0052.856] GetProcessHeap () returned 0x630000 [0052.856] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0052.856] GetProcessHeap () returned 0x630000 [0052.856] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0052.856] GetProcessHeap () returned 0x630000 [0052.856] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.856] GetProcessHeap () returned 0x630000 [0052.856] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.856] GetProcessHeap () returned 0x630000 [0052.856] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0052.856] GetProcessHeap () returned 0x630000 [0052.856] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0052.856] GetProcessHeap () returned 0x630000 [0052.856] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0052.856] GetProcessHeap () returned 0x630000 [0052.856] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0052.856] GetProcessHeap () returned 0x630000 [0052.856] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0052.856] GetProcessHeap () returned 0x630000 [0052.856] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0052.856] GetProcessHeap () returned 0x630000 [0052.856] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0052.856] GetProcessHeap () returned 0x630000 [0052.856] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0052.856] GetProcessHeap () returned 0x630000 [0052.856] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0052.856] GetProcessHeap () returned 0x630000 [0052.856] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0052.856] GetProcessHeap () returned 0x630000 [0052.856] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0052.856] GetProcessHeap () returned 0x630000 [0052.856] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0052.856] GetProcessHeap () returned 0x630000 [0052.856] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0052.857] WriteFile (in: hFile=0x230, lpBuffer=0x655348*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x655348*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0052.864] GetProcessHeap () returned 0x630000 [0052.864] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x655348, Size=0x30) returned 0x655348 [0052.864] GetProcessHeap () returned 0x630000 [0052.864] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0052.864] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.864] GetProcessHeap () returned 0x630000 [0052.864] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2e7dba) returned 0x2446020 [0052.936] ReadFile (in: hFile=0x230, lpBuffer=0x2446020, nNumberOfBytesToRead=0x2e7dba, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x2446020*, lpNumberOfBytesRead=0x243d7e8*=0x2e7dba, lpOverlapped=0x0) returned 1 [0052.993] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0052.993] WriteFile (in: hFile=0x230, lpBuffer=0x2446020*, nNumberOfBytesToWrite=0x2e7dba, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x2446020*, lpNumberOfBytesWritten=0x243d7e4*=0x2e7dba, lpOverlapped=0x0) returned 1 [0053.234] GetProcessHeap () returned 0x630000 [0053.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x2446020 | out: hHeap=0x630000) returned 1 [0053.248] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0053.248] WriteFile (in: hFile=0x230, lpBuffer=0x655348*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x655348*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0053.250] CloseHandle (hObject=0x230) returned 1 [0053.351] GetProcessHeap () returned 0x630000 [0053.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0053.351] GetProcessHeap () returned 0x630000 [0053.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b138 | out: hHeap=0x630000) returned 1 [0053.351] GetProcessHeap () returned 0x630000 [0053.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0053.352] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js" [0053.352] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js.happythreechoose" [0053.352] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\ui.js"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\ui.js.happythreechoose"), dwFlags=0x1) returned 1 [0053.587] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js") returned 1 [0053.587] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\") returned="" [0053.587] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\Decryption INFO.html" [0053.587] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\decryption info.html")) returned 0x20 [0053.587] GetProcessHeap () returned 0x630000 [0053.587] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0053.587] FindNextFileW (in: hFindFile=0x6486d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea61ff59, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x2e7dba, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ui.js", cAlternateFileName="")) returned 0 [0053.587] FindClose (in: hFindFile=0x6486d0 | out: hFindFile=0x6486d0) returned 1 [0053.587] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\" [0053.587] GetProcessHeap () returned 0x630000 [0053.587] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b318 | out: hHeap=0x630000) returned 1 [0053.587] GetProcessHeap () returned 0x630000 [0053.587] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0053.587] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\") returned 53 [0053.587] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\", lpString2="*" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\*") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\*" [0053.587] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6143a6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea6143a6, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648a90 [0053.587] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0053.588] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6143a6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea6143a6, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.588] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0053.588] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0053.588] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x9ff9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="oobe-desktop.css", cAlternateFileName="OOBE-D~1.CSS")) returned 1 [0053.588] lstrcmpiW (lpString1="oobe-desktop.css", lpString2=".") returned 1 [0053.588] lstrcmpiW (lpString1="oobe-desktop.css", lpString2="..") returned 1 [0053.588] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\", lpString2="oobe-desktop.css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css" [0053.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oobe-desktop.css", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0053.588] GetProcessHeap () returned 0x630000 [0053.588] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11) returned 0x645e78 [0053.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oobe-desktop.css", cchWideChar=-1, lpMultiByteStr=0x645e78, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oobe-desktop.css", lpUsedDefaultChar=0x0) returned 17 [0053.588] lstrlenA (lpString="oobe-desktop.css") returned 16 [0053.588] lstrlenA (lpString=".happythreechoose") returned 17 [0053.588] lstrcmpiW (lpString1="oobe-desktop.css", lpString2="Decryption INFO.html") returned 1 [0053.588] lstrcmpiW (lpString1="oobe-desktop.css", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0053.588] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0053.588] lstrcmpiW (lpString1="oobe-desktop.css", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0053.588] GetProcessHeap () returned 0x630000 [0053.588] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0053.588] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\oobe-desktop.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0053.589] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=40953) returned 1 [0053.589] GetProcessHeap () returned 0x630000 [0053.589] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x65b1b0 [0053.589] GetProcessHeap () returned 0x630000 [0053.589] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0053.589] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css") returned 69 [0053.589] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0053.589] GetProcessHeap () returned 0x630000 [0053.589] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0053.589] GetProcessHeap () returned 0x630000 [0053.589] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x387) returned 0x655380 [0053.589] lstrlenA (lpString="rsa_encrypt") returned 11 [0053.589] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0053.590] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0053.590] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0053.590] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0053.590] GetProcessHeap () returned 0x630000 [0053.590] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0053.590] lstrlenA (lpString="010001") returned 6 [0053.590] GetProcessHeap () returned 0x630000 [0053.590] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0053.590] GetProcessHeap () returned 0x630000 [0053.590] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0053.590] GetProcessHeap () returned 0x630000 [0053.590] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e850 [0053.590] GetProcessHeap () returned 0x630000 [0053.590] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0053.590] GetProcessHeap () returned 0x630000 [0053.590] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e730 [0053.590] GetProcessHeap () returned 0x630000 [0053.590] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656c98 [0053.590] GetProcessHeap () returned 0x630000 [0053.590] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a398 [0053.590] GetProcessHeap () returned 0x630000 [0053.590] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0053.590] GetProcessHeap () returned 0x630000 [0053.590] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0053.590] GetProcessHeap () returned 0x630000 [0053.590] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0053.591] GetProcessHeap () returned 0x630000 [0053.591] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0053.591] GetProcessHeap () returned 0x630000 [0053.591] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656fe0 [0053.591] GetProcessHeap () returned 0x630000 [0053.591] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0053.591] GetProcessHeap () returned 0x630000 [0053.591] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0053.591] GetProcessHeap () returned 0x630000 [0053.591] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e7c0 [0053.591] GetProcessHeap () returned 0x630000 [0053.591] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0053.591] GetProcessHeap () returned 0x630000 [0053.591] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0053.591] GetProcessHeap () returned 0x630000 [0053.591] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e7c0 | out: hHeap=0x630000) returned 1 [0053.591] GetProcessHeap () returned 0x630000 [0053.591] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0053.591] GetProcessHeap () returned 0x630000 [0053.591] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0053.591] GetProcessHeap () returned 0x630000 [0053.591] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0053.591] GetProcessHeap () returned 0x630000 [0053.591] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0053.591] GetProcessHeap () returned 0x630000 [0053.591] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0053.591] GetProcessHeap () returned 0x630000 [0053.591] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0053.591] GetProcessHeap () returned 0x630000 [0053.591] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e4f0 [0053.591] GetProcessHeap () returned 0x630000 [0053.591] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0053.591] GetProcessHeap () returned 0x630000 [0053.591] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0053.591] GetProcessHeap () returned 0x630000 [0053.591] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0053.591] GetProcessHeap () returned 0x630000 [0053.591] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0053.591] GetProcessHeap () returned 0x630000 [0053.591] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0053.592] GetProcessHeap () returned 0x630000 [0053.592] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0053.592] GetProcessHeap () returned 0x630000 [0053.592] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0053.592] GetProcessHeap () returned 0x630000 [0053.592] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0053.592] GetProcessHeap () returned 0x630000 [0053.592] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0053.592] GetProcessHeap () returned 0x630000 [0053.592] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0053.592] GetProcessHeap () returned 0x630000 [0053.592] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0053.592] GetProcessHeap () returned 0x630000 [0053.592] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0053.592] GetProcessHeap () returned 0x630000 [0053.592] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0053.592] GetProcessHeap () returned 0x630000 [0053.592] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0053.592] GetProcessHeap () returned 0x630000 [0053.592] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0053.592] GetProcessHeap () returned 0x630000 [0053.592] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0053.592] GetProcessHeap () returned 0x630000 [0053.592] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0053.592] GetProcessHeap () returned 0x630000 [0053.592] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0053.592] GetProcessHeap () returned 0x630000 [0053.592] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0053.592] GetProcessHeap () returned 0x630000 [0053.592] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0053.592] GetProcessHeap () returned 0x630000 [0053.592] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0053.592] GetProcessHeap () returned 0x630000 [0053.592] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0053.592] GetProcessHeap () returned 0x630000 [0053.592] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0053.592] GetProcessHeap () returned 0x630000 [0053.592] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0053.593] GetProcessHeap () returned 0x630000 [0053.593] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0053.593] GetProcessHeap () returned 0x630000 [0053.593] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0053.593] GetProcessHeap () returned 0x630000 [0053.593] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0053.593] GetProcessHeap () returned 0x630000 [0053.593] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0053.593] GetProcessHeap () returned 0x630000 [0053.593] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0053.593] GetProcessHeap () returned 0x630000 [0053.593] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0053.593] GetProcessHeap () returned 0x630000 [0053.593] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0053.593] GetProcessHeap () returned 0x630000 [0053.593] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0053.593] GetProcessHeap () returned 0x630000 [0053.593] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0053.593] GetProcessHeap () returned 0x630000 [0053.593] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0053.593] GetProcessHeap () returned 0x630000 [0053.593] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0053.593] GetProcessHeap () returned 0x630000 [0053.593] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0053.593] GetProcessHeap () returned 0x630000 [0053.593] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0053.593] GetProcessHeap () returned 0x630000 [0053.593] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0053.593] GetProcessHeap () returned 0x630000 [0053.593] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0053.593] GetProcessHeap () returned 0x630000 [0053.593] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0053.593] GetProcessHeap () returned 0x630000 [0053.593] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0053.593] GetProcessHeap () returned 0x630000 [0053.593] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0053.593] GetProcessHeap () returned 0x630000 [0053.593] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0053.593] GetProcessHeap () returned 0x630000 [0053.594] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0053.594] GetProcessHeap () returned 0x630000 [0053.594] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0053.594] GetProcessHeap () returned 0x630000 [0053.594] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0053.594] GetProcessHeap () returned 0x630000 [0053.594] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0053.594] GetProcessHeap () returned 0x630000 [0053.594] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0053.594] GetProcessHeap () returned 0x630000 [0053.594] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0053.594] GetProcessHeap () returned 0x630000 [0053.594] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0053.594] GetProcessHeap () returned 0x630000 [0053.594] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0053.594] GetProcessHeap () returned 0x630000 [0053.594] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0053.594] GetProcessHeap () returned 0x630000 [0053.594] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0053.594] GetProcessHeap () returned 0x630000 [0053.594] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0053.594] GetProcessHeap () returned 0x630000 [0053.594] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0053.594] GetProcessHeap () returned 0x630000 [0053.594] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0053.594] GetProcessHeap () returned 0x630000 [0053.594] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0053.594] GetProcessHeap () returned 0x630000 [0053.594] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0053.594] GetProcessHeap () returned 0x630000 [0053.594] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0053.594] GetProcessHeap () returned 0x630000 [0053.594] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0053.594] GetProcessHeap () returned 0x630000 [0053.594] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0053.594] GetProcessHeap () returned 0x630000 [0053.594] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0053.595] GetProcessHeap () returned 0x630000 [0053.595] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0053.595] GetProcessHeap () returned 0x630000 [0053.595] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0053.595] GetProcessHeap () returned 0x630000 [0053.595] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0053.595] GetProcessHeap () returned 0x630000 [0053.595] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0053.595] GetProcessHeap () returned 0x630000 [0053.595] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0053.595] GetProcessHeap () returned 0x630000 [0053.595] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0053.595] GetProcessHeap () returned 0x630000 [0053.595] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0053.595] GetProcessHeap () returned 0x630000 [0053.595] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0053.595] GetProcessHeap () returned 0x630000 [0053.595] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0053.595] GetProcessHeap () returned 0x630000 [0053.595] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0053.595] GetProcessHeap () returned 0x630000 [0053.595] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0053.595] GetProcessHeap () returned 0x630000 [0053.595] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0053.595] GetProcessHeap () returned 0x630000 [0053.595] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0053.595] GetProcessHeap () returned 0x630000 [0053.595] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0053.595] GetProcessHeap () returned 0x630000 [0053.595] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0053.595] GetProcessHeap () returned 0x630000 [0053.595] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0053.595] GetProcessHeap () returned 0x630000 [0053.595] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0053.595] GetProcessHeap () returned 0x630000 [0053.595] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0053.595] GetProcessHeap () returned 0x630000 [0053.595] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0053.595] GetProcessHeap () returned 0x630000 [0053.596] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0053.596] GetProcessHeap () returned 0x630000 [0053.596] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0053.596] GetProcessHeap () returned 0x630000 [0053.596] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0053.596] GetProcessHeap () returned 0x630000 [0053.596] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0053.596] GetProcessHeap () returned 0x630000 [0053.596] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0053.596] GetProcessHeap () returned 0x630000 [0053.596] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0053.596] GetProcessHeap () returned 0x630000 [0053.596] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0053.596] GetProcessHeap () returned 0x630000 [0053.596] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0053.596] GetProcessHeap () returned 0x630000 [0053.596] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0053.596] GetProcessHeap () returned 0x630000 [0053.596] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0053.596] GetProcessHeap () returned 0x630000 [0053.596] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0053.596] GetProcessHeap () returned 0x630000 [0053.596] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0053.596] GetProcessHeap () returned 0x630000 [0053.596] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0053.596] GetProcessHeap () returned 0x630000 [0053.596] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0053.596] GetProcessHeap () returned 0x630000 [0053.596] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0053.596] WriteFile (in: hFile=0x230, lpBuffer=0x655380*, nNumberOfBytesToWrite=0x387, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x655380*, lpNumberOfBytesWritten=0x243d864*=0x387, lpOverlapped=0x0) returned 1 [0053.614] GetProcessHeap () returned 0x630000 [0053.614] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x655380, Size=0x30) returned 0x655380 [0053.614] GetProcessHeap () returned 0x630000 [0053.614] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0053.614] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0053.614] GetProcessHeap () returned 0x630000 [0053.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa000) returned 0x65ed80 [0053.616] ReadFile (in: hFile=0x230, lpBuffer=0x65ed80, nNumberOfBytesToRead=0xa000, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesRead=0x243d7e8*=0xa000, lpOverlapped=0x0) returned 1 [0053.617] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0053.617] WriteFile (in: hFile=0x230, lpBuffer=0x65ed80*, nNumberOfBytesToWrite=0xa000, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesWritten=0x243d7e4*=0xa000, lpOverlapped=0x0) returned 1 [0053.618] GetProcessHeap () returned 0x630000 [0053.618] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ed80 | out: hHeap=0x630000) returned 1 [0053.620] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0053.620] WriteFile (in: hFile=0x230, lpBuffer=0x655380*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x655380*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0053.621] CloseHandle (hObject=0x230) returned 1 [0053.623] GetProcessHeap () returned 0x630000 [0053.623] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0053.623] GetProcessHeap () returned 0x630000 [0053.623] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b1b0 | out: hHeap=0x630000) returned 1 [0053.623] GetProcessHeap () returned 0x630000 [0053.623] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0053.623] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css" [0053.623] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css.happythreechoose" [0053.623] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\oobe-desktop.css"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\oobe-desktop.css.happythreechoose"), dwFlags=0x1) returned 1 [0053.624] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css") returned 1 [0053.624] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\") returned="" [0053.624] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\Decryption INFO.html" [0053.624] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\decryption info.html")) returned 0xffffffff [0053.624] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0053.626] GetProcessHeap () returned 0x630000 [0053.627] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x65b318 [0053.627] GetProcessHeap () returned 0x630000 [0053.627] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0053.634] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.635] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.635] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.635] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.635] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.636] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.636] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.636] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.636] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.636] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.636] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.636] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.636] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.636] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.636] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.636] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.636] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.636] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.637] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.637] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.637] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.637] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.637] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.637] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.637] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.637] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.637] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.637] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.637] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.637] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.637] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.638] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.638] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.638] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.638] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.638] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.638] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.639] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.639] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.639] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.639] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.639] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.639] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.639] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.639] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.639] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.639] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.639] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.640] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.640] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.640] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.640] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.640] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.640] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.640] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.640] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.640] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.640] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.640] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.640] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.640] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.640] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.641] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.641] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.641] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.641] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.641] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.641] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.641] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.641] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.641] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.641] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.641] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.641] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.641] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.642] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.642] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.642] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.642] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.642] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.642] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.642] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.642] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.642] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.642] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.642] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.642] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.642] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.643] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.643] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.643] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.643] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.643] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.643] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.643] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.643] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.643] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.643] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.643] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.643] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.643] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.644] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.644] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.644] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.644] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.644] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.644] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.644] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.644] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.644] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.644] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.644] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.644] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.644] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.644] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.645] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.645] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.645] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.645] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.645] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.645] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.645] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.645] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.645] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.645] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.645] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.645] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.645] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.645] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.646] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.646] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.646] GetProcessHeap () returned 0x630000 [0053.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b318 | out: hHeap=0x630000) returned 1 [0053.646] GetProcessHeap () returned 0x630000 [0053.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0053.646] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0053.646] GetProcessHeap () returned 0x630000 [0053.646] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x65b0c0 [0053.646] GetProcessHeap () returned 0x630000 [0053.646] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0053.654] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.654] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.654] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.655] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.655] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.655] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.655] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.655] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.655] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.655] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.655] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.655] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.655] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.655] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.655] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.655] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.655] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.656] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.656] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.656] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.656] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.656] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.656] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.656] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.656] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.656] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.656] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.656] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.656] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.657] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.657] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.657] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.657] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.657] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.657] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.657] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.657] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.657] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.657] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.657] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.657] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.657] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.657] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.658] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.658] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.658] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.658] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.658] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.658] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.658] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.658] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.658] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.658] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.658] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.658] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.658] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.658] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.659] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.659] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.659] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.659] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.659] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.659] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.659] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.659] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.659] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.659] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.659] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.659] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.659] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.660] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.660] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.660] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.660] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.660] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.660] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.660] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.660] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.660] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.660] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.661] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.661] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.661] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.661] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.661] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.661] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.661] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.661] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.661] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.661] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.661] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.661] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.661] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.661] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.662] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.662] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.662] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.662] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.662] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.662] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.662] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.662] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.662] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.662] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.662] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.662] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.662] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.679] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.679] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.679] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.679] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.679] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.680] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.680] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.680] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.680] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.680] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.680] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0053.681] GetProcessHeap () returned 0x630000 [0053.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b0c0 | out: hHeap=0x630000) returned 1 [0053.681] GetProcessHeap () returned 0x630000 [0053.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0053.681] CloseHandle (hObject=0x230) returned 1 [0053.681] GetProcessHeap () returned 0x630000 [0053.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645e78 | out: hHeap=0x630000) returned 1 [0053.681] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6143a6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x41b67, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ui-dark.css", cAlternateFileName="")) returned 1 [0053.681] lstrcmpiW (lpString1="ui-dark.css", lpString2=".") returned 1 [0053.681] lstrcmpiW (lpString1="ui-dark.css", lpString2="..") returned 1 [0053.681] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\", lpString2="ui-dark.css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css" [0053.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ui-dark.css", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0053.681] GetProcessHeap () returned 0x630000 [0053.681] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64ca20 [0053.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ui-dark.css", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ui-dark.css", lpUsedDefaultChar=0x0) returned 12 [0053.681] lstrlenA (lpString="ui-dark.css") returned 11 [0053.681] lstrlenA (lpString=".happythreechoose") returned 17 [0053.681] lstrcmpiW (lpString1="ui-dark.css", lpString2="Decryption INFO.html") returned 1 [0053.681] lstrcmpiW (lpString1="ui-dark.css", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0053.682] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0053.682] lstrcmpiW (lpString1="ui-dark.css", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0053.682] GetProcessHeap () returned 0x630000 [0053.682] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0053.682] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\ui-dark.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0053.682] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=269159) returned 1 [0053.682] GetProcessHeap () returned 0x630000 [0053.682] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x65b0c0 [0053.682] GetProcessHeap () returned 0x630000 [0053.682] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0053.682] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css") returned 64 [0053.682] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0053.682] GetProcessHeap () returned 0x630000 [0053.682] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0053.682] GetProcessHeap () returned 0x630000 [0053.682] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x389) returned 0x6553b8 [0053.682] lstrlenA (lpString="rsa_encrypt") returned 11 [0053.682] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0053.683] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0053.683] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0053.683] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0053.683] GetProcessHeap () returned 0x630000 [0053.683] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0053.683] lstrlenA (lpString="010001") returned 6 [0053.683] GetProcessHeap () returned 0x630000 [0053.683] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3c8 [0053.683] GetProcessHeap () returned 0x630000 [0053.683] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0053.683] GetProcessHeap () returned 0x630000 [0053.683] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e8e0 [0053.683] GetProcessHeap () returned 0x630000 [0053.683] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0053.683] GetProcessHeap () returned 0x630000 [0053.683] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e460 [0053.683] GetProcessHeap () returned 0x630000 [0053.683] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656a68 [0053.684] GetProcessHeap () returned 0x630000 [0053.684] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0053.684] GetProcessHeap () returned 0x630000 [0053.684] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0053.684] GetProcessHeap () returned 0x630000 [0053.684] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0053.684] GetProcessHeap () returned 0x630000 [0053.684] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0053.684] GetProcessHeap () returned 0x630000 [0053.684] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0053.684] GetProcessHeap () returned 0x630000 [0053.684] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656950 [0053.684] GetProcessHeap () returned 0x630000 [0053.684] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0053.684] GetProcessHeap () returned 0x630000 [0053.684] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0053.684] GetProcessHeap () returned 0x630000 [0053.684] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ebb0 [0053.684] GetProcessHeap () returned 0x630000 [0053.684] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0053.684] GetProcessHeap () returned 0x630000 [0053.684] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0053.684] GetProcessHeap () returned 0x630000 [0053.684] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0053.684] GetProcessHeap () returned 0x630000 [0053.684] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0053.684] GetProcessHeap () returned 0x630000 [0053.684] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65d9a0 [0053.684] GetProcessHeap () returned 0x630000 [0053.684] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0053.684] GetProcessHeap () returned 0x630000 [0053.684] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0053.684] GetProcessHeap () returned 0x630000 [0053.684] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0053.684] GetProcessHeap () returned 0x630000 [0053.684] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0053.684] GetProcessHeap () returned 0x630000 [0053.684] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65dda0 [0053.684] GetProcessHeap () returned 0x630000 [0053.685] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65d9a0 | out: hHeap=0x630000) returned 1 [0053.685] GetProcessHeap () returned 0x630000 [0053.685] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0053.685] GetProcessHeap () returned 0x630000 [0053.685] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0053.685] GetProcessHeap () returned 0x630000 [0053.685] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0053.685] GetProcessHeap () returned 0x630000 [0053.685] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0053.685] GetProcessHeap () returned 0x630000 [0053.685] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0053.685] GetProcessHeap () returned 0x630000 [0053.685] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0053.685] GetProcessHeap () returned 0x630000 [0053.685] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0053.685] GetProcessHeap () returned 0x630000 [0053.685] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0053.685] GetProcessHeap () returned 0x630000 [0053.685] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0053.685] GetProcessHeap () returned 0x630000 [0053.685] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0053.685] GetProcessHeap () returned 0x630000 [0053.685] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0053.685] GetProcessHeap () returned 0x630000 [0053.685] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0053.685] GetProcessHeap () returned 0x630000 [0053.685] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0053.685] GetProcessHeap () returned 0x630000 [0053.685] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0053.685] GetProcessHeap () returned 0x630000 [0053.685] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0053.685] GetProcessHeap () returned 0x630000 [0053.685] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0053.685] GetProcessHeap () returned 0x630000 [0053.685] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0053.685] GetProcessHeap () returned 0x630000 [0053.685] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0053.685] GetProcessHeap () returned 0x630000 [0053.685] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0053.686] GetProcessHeap () returned 0x630000 [0053.686] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0053.686] GetProcessHeap () returned 0x630000 [0053.686] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0053.686] GetProcessHeap () returned 0x630000 [0053.686] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0053.686] GetProcessHeap () returned 0x630000 [0053.686] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0053.686] GetProcessHeap () returned 0x630000 [0053.686] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0053.686] GetProcessHeap () returned 0x630000 [0053.686] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0053.686] GetProcessHeap () returned 0x630000 [0053.686] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0053.686] GetProcessHeap () returned 0x630000 [0053.686] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0053.686] GetProcessHeap () returned 0x630000 [0053.686] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0053.686] GetProcessHeap () returned 0x630000 [0053.686] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0053.686] GetProcessHeap () returned 0x630000 [0053.686] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0053.686] GetProcessHeap () returned 0x630000 [0053.686] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0053.686] GetProcessHeap () returned 0x630000 [0053.686] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0053.686] GetProcessHeap () returned 0x630000 [0053.686] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0053.686] GetProcessHeap () returned 0x630000 [0053.686] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0053.686] GetProcessHeap () returned 0x630000 [0053.686] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0053.686] GetProcessHeap () returned 0x630000 [0053.686] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0053.686] GetProcessHeap () returned 0x630000 [0053.686] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0053.686] GetProcessHeap () returned 0x630000 [0053.686] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0053.687] GetProcessHeap () returned 0x630000 [0053.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0053.687] GetProcessHeap () returned 0x630000 [0053.687] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0053.687] GetProcessHeap () returned 0x630000 [0053.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0053.687] GetProcessHeap () returned 0x630000 [0053.687] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0053.687] GetProcessHeap () returned 0x630000 [0053.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0053.687] GetProcessHeap () returned 0x630000 [0053.687] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0053.687] GetProcessHeap () returned 0x630000 [0053.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0053.687] GetProcessHeap () returned 0x630000 [0053.687] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0053.687] GetProcessHeap () returned 0x630000 [0053.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0053.687] GetProcessHeap () returned 0x630000 [0053.687] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0053.687] GetProcessHeap () returned 0x630000 [0053.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0053.687] GetProcessHeap () returned 0x630000 [0053.687] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0053.687] GetProcessHeap () returned 0x630000 [0053.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0053.687] GetProcessHeap () returned 0x630000 [0053.687] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0053.687] GetProcessHeap () returned 0x630000 [0053.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0053.687] GetProcessHeap () returned 0x630000 [0053.687] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0053.687] GetProcessHeap () returned 0x630000 [0053.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0053.687] GetProcessHeap () returned 0x630000 [0053.687] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0053.687] GetProcessHeap () returned 0x630000 [0053.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0053.688] GetProcessHeap () returned 0x630000 [0053.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0053.688] GetProcessHeap () returned 0x630000 [0053.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0053.688] GetProcessHeap () returned 0x630000 [0053.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0053.688] GetProcessHeap () returned 0x630000 [0053.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0053.688] GetProcessHeap () returned 0x630000 [0053.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0053.688] GetProcessHeap () returned 0x630000 [0053.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0053.688] GetProcessHeap () returned 0x630000 [0053.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0053.688] GetProcessHeap () returned 0x630000 [0053.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0053.688] GetProcessHeap () returned 0x630000 [0053.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0053.688] GetProcessHeap () returned 0x630000 [0053.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0053.688] GetProcessHeap () returned 0x630000 [0053.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0053.688] GetProcessHeap () returned 0x630000 [0053.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0053.688] GetProcessHeap () returned 0x630000 [0053.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0053.688] GetProcessHeap () returned 0x630000 [0053.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0053.688] GetProcessHeap () returned 0x630000 [0053.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0053.688] GetProcessHeap () returned 0x630000 [0053.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0053.688] GetProcessHeap () returned 0x630000 [0053.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0053.688] GetProcessHeap () returned 0x630000 [0053.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0053.688] GetProcessHeap () returned 0x630000 [0053.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0053.688] GetProcessHeap () returned 0x630000 [0053.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0053.689] GetProcessHeap () returned 0x630000 [0053.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0053.689] GetProcessHeap () returned 0x630000 [0053.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0053.689] GetProcessHeap () returned 0x630000 [0053.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0053.689] GetProcessHeap () returned 0x630000 [0053.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0053.689] GetProcessHeap () returned 0x630000 [0053.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0053.689] GetProcessHeap () returned 0x630000 [0053.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0053.689] GetProcessHeap () returned 0x630000 [0053.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0053.689] GetProcessHeap () returned 0x630000 [0053.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0053.689] GetProcessHeap () returned 0x630000 [0053.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0053.689] GetProcessHeap () returned 0x630000 [0053.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0053.689] GetProcessHeap () returned 0x630000 [0053.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0053.689] GetProcessHeap () returned 0x630000 [0053.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0053.689] GetProcessHeap () returned 0x630000 [0053.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e460 | out: hHeap=0x630000) returned 1 [0053.689] GetProcessHeap () returned 0x630000 [0053.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0053.689] GetProcessHeap () returned 0x630000 [0053.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0053.689] GetProcessHeap () returned 0x630000 [0053.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0053.689] GetProcessHeap () returned 0x630000 [0053.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0053.689] GetProcessHeap () returned 0x630000 [0053.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0053.689] WriteFile (in: hFile=0x230, lpBuffer=0x6553b8*, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6553b8*, lpNumberOfBytesWritten=0x243d864*=0x389, lpOverlapped=0x0) returned 1 [0053.854] GetProcessHeap () returned 0x630000 [0053.854] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6553b8, Size=0x30) returned 0x6553b8 [0053.854] GetProcessHeap () returned 0x630000 [0053.854] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0053.854] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0053.854] GetProcessHeap () returned 0x630000 [0053.854] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x41b70) returned 0x65ed80 [0053.860] ReadFile (in: hFile=0x230, lpBuffer=0x65ed80, nNumberOfBytesToRead=0x41b70, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesRead=0x243d7e8*=0x41b70, lpOverlapped=0x0) returned 1 [0053.893] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0053.893] WriteFile (in: hFile=0x230, lpBuffer=0x65ed80*, nNumberOfBytesToWrite=0x41b70, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesWritten=0x243d7e4*=0x41b70, lpOverlapped=0x0) returned 1 [0053.970] GetProcessHeap () returned 0x630000 [0053.970] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ed80 | out: hHeap=0x630000) returned 1 [0053.970] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0053.970] WriteFile (in: hFile=0x230, lpBuffer=0x6553b8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6553b8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0053.971] CloseHandle (hObject=0x230) returned 1 [0053.987] GetProcessHeap () returned 0x630000 [0053.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0053.987] GetProcessHeap () returned 0x630000 [0053.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b0c0 | out: hHeap=0x630000) returned 1 [0053.987] GetProcessHeap () returned 0x630000 [0053.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0053.987] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css" [0053.987] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css.happythreechoose" [0053.988] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\ui-dark.css"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\ui-dark.css.happythreechoose"), dwFlags=0x1) returned 1 [0054.024] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css") returned 1 [0054.024] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\") returned="" [0054.024] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\Decryption INFO.html" [0054.024] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\decryption info.html")) returned 0x20 [0054.024] GetProcessHeap () returned 0x630000 [0054.024] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0054.024] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6143a6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x41b67, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ui-dark.css", cAlternateFileName="")) returned 0 [0054.024] FindClose (in: hFindFile=0x648a90 | out: hFindFile=0x648a90) returned 1 [0054.024] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0054.024] GetProcessHeap () returned 0x630000 [0054.024] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6561f8 | out: hHeap=0x630000) returned 1 [0054.024] GetProcessHeap () returned 0x630000 [0054.024] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0054.024] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned 38 [0054.024] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="*" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\*") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\*" [0054.024] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3c4d9e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea5f6eb5, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648a90 [0054.027] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0054.027] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3c4d9e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea5f6eb5, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.028] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0054.028] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0054.028] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c6124, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c6124, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1af6d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_ar-sa.htm", cAlternateFileName="EULA_A~1.HTM")) returned 1 [0054.028] lstrcmpiW (lpString1="EULA_ar-sa.htm", lpString2=".") returned 1 [0054.028] lstrcmpiW (lpString1="EULA_ar-sa.htm", lpString2="..") returned 1 [0054.028] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_ar-sa.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm" [0054.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_ar-sa.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0054.028] GetProcessHeap () returned 0x630000 [0054.028] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0054.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_ar-sa.htm", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_ar-sa.htm", lpUsedDefaultChar=0x0) returned 15 [0054.028] lstrlenA (lpString="EULA_ar-sa.htm") returned 14 [0054.028] lstrlenA (lpString=".happythreechoose") returned 17 [0054.028] lstrcmpiW (lpString1="EULA_ar-sa.htm", lpString2="Decryption INFO.html") returned 1 [0054.028] lstrcmpiW (lpString1="EULA_ar-sa.htm", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0054.028] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0054.029] lstrcmpiW (lpString1="EULA_ar-sa.htm", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0054.029] GetProcessHeap () returned 0x630000 [0054.029] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f10 [0054.029] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ar-sa.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0054.029] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=110445) returned 1 [0054.029] GetProcessHeap () returned 0x630000 [0054.029] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x65b228 [0054.029] GetProcessHeap () returned 0x630000 [0054.029] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0054.029] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm") returned 52 [0054.029] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0054.029] GetProcessHeap () returned 0x630000 [0054.029] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0054.029] GetProcessHeap () returned 0x630000 [0054.029] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x65d4d0 [0054.029] lstrlenA (lpString="rsa_encrypt") returned 11 [0054.029] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0054.030] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0054.030] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0054.030] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0054.030] GetProcessHeap () returned 0x630000 [0054.030] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0054.030] lstrlenA (lpString="010001") returned 6 [0054.030] GetProcessHeap () returned 0x630000 [0054.030] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0054.030] GetProcessHeap () returned 0x630000 [0054.030] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0054.030] GetProcessHeap () returned 0x630000 [0054.030] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0054.030] GetProcessHeap () returned 0x630000 [0054.030] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0054.030] GetProcessHeap () returned 0x630000 [0054.030] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e4f0 [0054.030] GetProcessHeap () returned 0x630000 [0054.030] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656db0 [0054.030] GetProcessHeap () returned 0x630000 [0054.031] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3f8 [0054.031] GetProcessHeap () returned 0x630000 [0054.031] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0054.031] GetProcessHeap () returned 0x630000 [0054.031] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.031] GetProcessHeap () returned 0x630000 [0054.031] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0054.031] GetProcessHeap () returned 0x630000 [0054.031] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0054.031] GetProcessHeap () returned 0x630000 [0054.031] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657328 [0054.031] GetProcessHeap () returned 0x630000 [0054.031] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.031] GetProcessHeap () returned 0x630000 [0054.031] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0054.031] GetProcessHeap () returned 0x630000 [0054.031] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e7c0 [0054.031] GetProcessHeap () returned 0x630000 [0054.031] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0054.031] GetProcessHeap () returned 0x630000 [0054.031] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0054.031] GetProcessHeap () returned 0x630000 [0054.031] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e7c0 | out: hHeap=0x630000) returned 1 [0054.031] GetProcessHeap () returned 0x630000 [0054.031] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0054.031] GetProcessHeap () returned 0x630000 [0054.031] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65a510 [0054.031] GetProcessHeap () returned 0x630000 [0054.031] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.031] GetProcessHeap () returned 0x630000 [0054.031] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0054.031] GetProcessHeap () returned 0x630000 [0054.031] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0054.031] GetProcessHeap () returned 0x630000 [0054.031] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0054.031] GetProcessHeap () returned 0x630000 [0054.031] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e610 [0054.031] GetProcessHeap () returned 0x630000 [0054.031] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a510 | out: hHeap=0x630000) returned 1 [0054.031] GetProcessHeap () returned 0x630000 [0054.031] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0054.032] GetProcessHeap () returned 0x630000 [0054.032] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0054.032] GetProcessHeap () returned 0x630000 [0054.032] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.032] GetProcessHeap () returned 0x630000 [0054.032] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.032] GetProcessHeap () returned 0x630000 [0054.032] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0054.032] GetProcessHeap () returned 0x630000 [0054.032] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0054.032] GetProcessHeap () returned 0x630000 [0054.032] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.032] GetProcessHeap () returned 0x630000 [0054.032] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.032] GetProcessHeap () returned 0x630000 [0054.032] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.032] GetProcessHeap () returned 0x630000 [0054.032] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.032] GetProcessHeap () returned 0x630000 [0054.032] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.032] GetProcessHeap () returned 0x630000 [0054.032] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.032] GetProcessHeap () returned 0x630000 [0054.032] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.032] GetProcessHeap () returned 0x630000 [0054.032] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.032] GetProcessHeap () returned 0x630000 [0054.032] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.032] GetProcessHeap () returned 0x630000 [0054.032] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.032] GetProcessHeap () returned 0x630000 [0054.032] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.032] GetProcessHeap () returned 0x630000 [0054.032] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.032] GetProcessHeap () returned 0x630000 [0054.032] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.032] GetProcessHeap () returned 0x630000 [0054.032] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.032] GetProcessHeap () returned 0x630000 [0054.033] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.033] GetProcessHeap () returned 0x630000 [0054.033] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.033] GetProcessHeap () returned 0x630000 [0054.033] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.033] GetProcessHeap () returned 0x630000 [0054.033] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.033] GetProcessHeap () returned 0x630000 [0054.033] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0054.033] GetProcessHeap () returned 0x630000 [0054.033] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0054.033] GetProcessHeap () returned 0x630000 [0054.033] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.033] GetProcessHeap () returned 0x630000 [0054.033] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.033] GetProcessHeap () returned 0x630000 [0054.033] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.033] GetProcessHeap () returned 0x630000 [0054.033] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.033] GetProcessHeap () returned 0x630000 [0054.033] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0054.033] GetProcessHeap () returned 0x630000 [0054.033] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0054.033] GetProcessHeap () returned 0x630000 [0054.033] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.033] GetProcessHeap () returned 0x630000 [0054.033] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.033] GetProcessHeap () returned 0x630000 [0054.033] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.033] GetProcessHeap () returned 0x630000 [0054.033] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.033] GetProcessHeap () returned 0x630000 [0054.033] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.033] GetProcessHeap () returned 0x630000 [0054.033] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.033] GetProcessHeap () returned 0x630000 [0054.033] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.033] GetProcessHeap () returned 0x630000 [0054.033] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.034] GetProcessHeap () returned 0x630000 [0054.034] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.034] GetProcessHeap () returned 0x630000 [0054.034] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.034] GetProcessHeap () returned 0x630000 [0054.034] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.034] GetProcessHeap () returned 0x630000 [0054.034] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.034] GetProcessHeap () returned 0x630000 [0054.034] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.034] GetProcessHeap () returned 0x630000 [0054.034] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.034] GetProcessHeap () returned 0x630000 [0054.034] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0054.034] GetProcessHeap () returned 0x630000 [0054.034] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0054.034] GetProcessHeap () returned 0x630000 [0054.034] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.034] GetProcessHeap () returned 0x630000 [0054.034] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.034] GetProcessHeap () returned 0x630000 [0054.034] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0054.034] GetProcessHeap () returned 0x630000 [0054.034] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0054.034] GetProcessHeap () returned 0x630000 [0054.034] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.034] GetProcessHeap () returned 0x630000 [0054.034] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.034] GetProcessHeap () returned 0x630000 [0054.034] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.034] GetProcessHeap () returned 0x630000 [0054.034] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.034] GetProcessHeap () returned 0x630000 [0054.034] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.034] GetProcessHeap () returned 0x630000 [0054.034] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.034] GetProcessHeap () returned 0x630000 [0054.034] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.035] GetProcessHeap () returned 0x630000 [0054.035] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.035] GetProcessHeap () returned 0x630000 [0054.035] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0054.035] GetProcessHeap () returned 0x630000 [0054.035] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0054.035] GetProcessHeap () returned 0x630000 [0054.035] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.035] GetProcessHeap () returned 0x630000 [0054.035] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.035] GetProcessHeap () returned 0x630000 [0054.035] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.035] GetProcessHeap () returned 0x630000 [0054.035] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.035] GetProcessHeap () returned 0x630000 [0054.035] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0054.035] GetProcessHeap () returned 0x630000 [0054.035] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0054.035] GetProcessHeap () returned 0x630000 [0054.035] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.035] GetProcessHeap () returned 0x630000 [0054.035] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.035] GetProcessHeap () returned 0x630000 [0054.035] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.035] GetProcessHeap () returned 0x630000 [0054.035] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.035] GetProcessHeap () returned 0x630000 [0054.035] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0054.035] GetProcessHeap () returned 0x630000 [0054.035] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0054.035] GetProcessHeap () returned 0x630000 [0054.035] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.035] GetProcessHeap () returned 0x630000 [0054.035] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.035] GetProcessHeap () returned 0x630000 [0054.035] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.035] GetProcessHeap () returned 0x630000 [0054.035] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.035] GetProcessHeap () returned 0x630000 [0054.035] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.036] GetProcessHeap () returned 0x630000 [0054.036] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.036] GetProcessHeap () returned 0x630000 [0054.036] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0054.036] GetProcessHeap () returned 0x630000 [0054.036] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0054.036] GetProcessHeap () returned 0x630000 [0054.036] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0054.036] GetProcessHeap () returned 0x630000 [0054.036] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0054.036] GetProcessHeap () returned 0x630000 [0054.036] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0054.036] GetProcessHeap () returned 0x630000 [0054.036] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0054.036] GetProcessHeap () returned 0x630000 [0054.036] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0054.036] GetProcessHeap () returned 0x630000 [0054.036] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0054.036] GetProcessHeap () returned 0x630000 [0054.036] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0054.036] GetProcessHeap () returned 0x630000 [0054.036] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0054.036] GetProcessHeap () returned 0x630000 [0054.036] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0054.036] GetProcessHeap () returned 0x630000 [0054.036] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0054.036] GetProcessHeap () returned 0x630000 [0054.036] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0054.036] GetProcessHeap () returned 0x630000 [0054.036] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.036] GetProcessHeap () returned 0x630000 [0054.036] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0054.036] WriteFile (in: hFile=0x230, lpBuffer=0x65d4d0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65d4d0*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0054.042] GetProcessHeap () returned 0x630000 [0054.042] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65d4d0, Size=0x30) returned 0x65d4d0 [0054.042] GetProcessHeap () returned 0x630000 [0054.042] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0054.042] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0054.042] GetProcessHeap () returned 0x630000 [0054.042] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1af6d) returned 0x65ed80 [0054.042] ReadFile (in: hFile=0x230, lpBuffer=0x65ed80, nNumberOfBytesToRead=0x1af6d, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesRead=0x243d7e8*=0x1af6d, lpOverlapped=0x0) returned 1 [0054.043] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0054.043] WriteFile (in: hFile=0x230, lpBuffer=0x65ed80*, nNumberOfBytesToWrite=0x1af6d, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesWritten=0x243d7e4*=0x1af6d, lpOverlapped=0x0) returned 1 [0054.051] GetProcessHeap () returned 0x630000 [0054.051] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ed80 | out: hHeap=0x630000) returned 1 [0054.051] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0054.051] WriteFile (in: hFile=0x230, lpBuffer=0x65d4d0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65d4d0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0054.052] CloseHandle (hObject=0x230) returned 1 [0054.055] GetProcessHeap () returned 0x630000 [0054.055] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f10 | out: hHeap=0x630000) returned 1 [0054.055] GetProcessHeap () returned 0x630000 [0054.055] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b228 | out: hHeap=0x630000) returned 1 [0054.055] GetProcessHeap () returned 0x630000 [0054.055] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0054.055] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm" [0054.055] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm.happythreechoose" [0054.055] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ar-sa.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ar-sa.htm.happythreechoose"), dwFlags=0x1) returned 1 [0054.056] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0054.056] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0054.056] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" [0054.056] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\decryption info.html")) returned 0xffffffff [0054.056] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0054.057] GetProcessHeap () returned 0x630000 [0054.057] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x65b2a0 [0054.057] GetProcessHeap () returned 0x630000 [0054.057] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0054.064] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.065] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.065] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.065] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.065] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.065] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.065] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.065] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.065] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.065] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.065] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.065] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.065] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.066] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.066] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.066] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.066] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.066] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.066] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.066] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.066] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.066] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.066] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.066] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.066] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.066] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.067] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.067] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.067] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.067] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.067] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.067] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.067] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.067] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.067] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.067] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.067] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.068] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.068] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.068] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.068] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.068] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.068] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.068] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.069] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.069] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.069] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.069] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.069] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.069] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.069] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.069] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.069] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.069] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.069] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.070] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.070] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.070] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.070] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.070] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.070] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.070] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.070] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.070] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.070] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.070] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.070] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.070] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.071] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.071] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.071] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.071] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.071] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.071] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.071] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.071] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.071] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.071] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.071] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.071] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.071] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.071] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.072] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.072] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.072] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.072] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.072] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.072] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.072] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.072] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.072] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.072] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.072] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.072] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.072] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.072] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.073] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.073] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.073] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.073] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.073] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.073] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.073] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.073] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.073] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.073] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.073] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.073] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.073] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.073] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.074] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.074] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.074] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.074] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.074] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.074] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.074] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.074] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.074] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.074] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.074] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.074] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.074] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.074] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.075] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.075] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.075] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.075] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.075] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.075] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.075] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.075] GetProcessHeap () returned 0x630000 [0054.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b2a0 | out: hHeap=0x630000) returned 1 [0054.075] GetProcessHeap () returned 0x630000 [0054.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0054.075] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0054.075] GetProcessHeap () returned 0x630000 [0054.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x65b2a0 [0054.075] GetProcessHeap () returned 0x630000 [0054.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0054.082] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.082] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.082] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.082] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.083] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.083] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.083] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.083] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.083] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.083] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.083] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.083] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.083] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.083] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.083] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.083] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.083] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.083] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.084] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.084] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.084] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.084] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.084] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.084] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.084] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.084] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.084] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.084] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.084] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.084] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.085] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.085] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.085] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.085] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.085] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.085] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.085] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.085] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.085] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.085] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.085] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.086] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.086] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.086] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.086] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.086] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.086] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.086] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.086] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.086] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.086] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.086] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.086] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.086] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.086] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.087] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.087] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.087] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.087] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.087] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.087] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.087] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.087] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.087] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.087] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.087] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.087] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.087] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.087] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.088] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.088] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.088] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.088] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.088] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.088] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.088] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.088] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.088] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.088] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.088] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.089] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.089] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.089] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.089] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.089] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.089] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.089] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.089] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.089] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.089] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.089] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.089] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.089] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.089] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.090] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.090] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.090] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.090] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.090] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.090] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.090] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.090] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.090] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.090] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.090] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.090] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.090] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.090] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.091] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.091] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.091] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.091] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.091] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.091] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.091] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.091] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.091] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.091] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0054.092] GetProcessHeap () returned 0x630000 [0054.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b2a0 | out: hHeap=0x630000) returned 1 [0054.092] GetProcessHeap () returned 0x630000 [0054.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0054.092] CloseHandle (hObject=0x230) returned 1 [0054.092] GetProcessHeap () returned 0x630000 [0054.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0054.092] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c74ab, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c74ab, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x3de0d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_bg-bg.htm", cAlternateFileName="EULA_B~1.HTM")) returned 1 [0054.092] lstrcmpiW (lpString1="EULA_bg-bg.htm", lpString2=".") returned 1 [0054.092] lstrcmpiW (lpString1="EULA_bg-bg.htm", lpString2="..") returned 1 [0054.093] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_bg-bg.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm" [0054.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_bg-bg.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0054.093] GetProcessHeap () returned 0x630000 [0054.093] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64ca20 [0054.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_bg-bg.htm", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_bg-bg.htm", lpUsedDefaultChar=0x0) returned 15 [0054.093] lstrlenA (lpString="EULA_bg-bg.htm") returned 14 [0054.093] lstrlenA (lpString=".happythreechoose") returned 17 [0054.093] lstrcmpiW (lpString1="EULA_bg-bg.htm", lpString2="Decryption INFO.html") returned 1 [0054.093] lstrcmpiW (lpString1="EULA_bg-bg.htm", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0054.093] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0054.093] lstrcmpiW (lpString1="EULA_bg-bg.htm", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0054.093] GetProcessHeap () returned 0x630000 [0054.093] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0054.093] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_bg-bg.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0054.093] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=253453) returned 1 [0054.093] GetProcessHeap () returned 0x630000 [0054.093] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x65b228 [0054.093] GetProcessHeap () returned 0x630000 [0054.093] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0054.093] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm") returned 52 [0054.093] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0054.094] GetProcessHeap () returned 0x630000 [0054.094] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0054.094] GetProcessHeap () returned 0x630000 [0054.094] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x383) returned 0x65d508 [0054.094] lstrlenA (lpString="rsa_encrypt") returned 11 [0054.094] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0054.094] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0054.094] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0054.094] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0054.094] GetProcessHeap () returned 0x630000 [0054.094] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0054.094] lstrlenA (lpString="010001") returned 6 [0054.094] GetProcessHeap () returned 0x630000 [0054.094] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a378 [0054.095] GetProcessHeap () returned 0x630000 [0054.095] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0054.095] GetProcessHeap () returned 0x630000 [0054.095] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e580 [0054.095] GetProcessHeap () returned 0x630000 [0054.095] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0054.095] GetProcessHeap () returned 0x630000 [0054.095] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ecd0 [0054.095] GetProcessHeap () returned 0x630000 [0054.095] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657210 [0054.095] GetProcessHeap () returned 0x630000 [0054.095] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0054.095] GetProcessHeap () returned 0x630000 [0054.095] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0054.095] GetProcessHeap () returned 0x630000 [0054.095] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.095] GetProcessHeap () returned 0x630000 [0054.095] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0054.095] GetProcessHeap () returned 0x630000 [0054.095] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0054.095] GetProcessHeap () returned 0x630000 [0054.095] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656a68 [0054.095] GetProcessHeap () returned 0x630000 [0054.095] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.095] GetProcessHeap () returned 0x630000 [0054.095] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0054.095] GetProcessHeap () returned 0x630000 [0054.095] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dec0 [0054.095] GetProcessHeap () returned 0x630000 [0054.095] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0054.095] GetProcessHeap () returned 0x630000 [0054.095] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0054.095] GetProcessHeap () returned 0x630000 [0054.095] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0054.095] GetProcessHeap () returned 0x630000 [0054.095] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0054.095] GetProcessHeap () returned 0x630000 [0054.095] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65a5e8 [0054.095] GetProcessHeap () returned 0x630000 [0054.096] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.096] GetProcessHeap () returned 0x630000 [0054.096] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0054.096] GetProcessHeap () returned 0x630000 [0054.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.096] GetProcessHeap () returned 0x630000 [0054.096] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.096] GetProcessHeap () returned 0x630000 [0054.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e730 [0054.096] GetProcessHeap () returned 0x630000 [0054.096] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a5e8 | out: hHeap=0x630000) returned 1 [0054.096] GetProcessHeap () returned 0x630000 [0054.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0054.096] GetProcessHeap () returned 0x630000 [0054.096] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0054.096] GetProcessHeap () returned 0x630000 [0054.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.096] GetProcessHeap () returned 0x630000 [0054.096] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.096] GetProcessHeap () returned 0x630000 [0054.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.096] GetProcessHeap () returned 0x630000 [0054.096] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.096] GetProcessHeap () returned 0x630000 [0054.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.096] GetProcessHeap () returned 0x630000 [0054.096] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.096] GetProcessHeap () returned 0x630000 [0054.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.096] GetProcessHeap () returned 0x630000 [0054.096] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.096] GetProcessHeap () returned 0x630000 [0054.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.096] GetProcessHeap () returned 0x630000 [0054.096] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.096] GetProcessHeap () returned 0x630000 [0054.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.096] GetProcessHeap () returned 0x630000 [0054.096] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.096] GetProcessHeap () returned 0x630000 [0054.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.096] GetProcessHeap () returned 0x630000 [0054.097] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.097] GetProcessHeap () returned 0x630000 [0054.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.097] GetProcessHeap () returned 0x630000 [0054.097] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.097] GetProcessHeap () returned 0x630000 [0054.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.097] GetProcessHeap () returned 0x630000 [0054.097] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.097] GetProcessHeap () returned 0x630000 [0054.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0054.097] GetProcessHeap () returned 0x630000 [0054.097] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0054.097] GetProcessHeap () returned 0x630000 [0054.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.097] GetProcessHeap () returned 0x630000 [0054.097] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.097] GetProcessHeap () returned 0x630000 [0054.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0054.097] GetProcessHeap () returned 0x630000 [0054.097] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0054.097] GetProcessHeap () returned 0x630000 [0054.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.097] GetProcessHeap () returned 0x630000 [0054.097] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.097] GetProcessHeap () returned 0x630000 [0054.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.097] GetProcessHeap () returned 0x630000 [0054.097] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.097] GetProcessHeap () returned 0x630000 [0054.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.097] GetProcessHeap () returned 0x630000 [0054.097] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.097] GetProcessHeap () returned 0x630000 [0054.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.097] GetProcessHeap () returned 0x630000 [0054.097] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.097] GetProcessHeap () returned 0x630000 [0054.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.098] GetProcessHeap () returned 0x630000 [0054.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.098] GetProcessHeap () returned 0x630000 [0054.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0054.098] GetProcessHeap () returned 0x630000 [0054.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0054.098] GetProcessHeap () returned 0x630000 [0054.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.098] GetProcessHeap () returned 0x630000 [0054.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.098] GetProcessHeap () returned 0x630000 [0054.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.098] GetProcessHeap () returned 0x630000 [0054.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.098] GetProcessHeap () returned 0x630000 [0054.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.098] GetProcessHeap () returned 0x630000 [0054.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.098] GetProcessHeap () returned 0x630000 [0054.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0054.098] GetProcessHeap () returned 0x630000 [0054.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0054.098] GetProcessHeap () returned 0x630000 [0054.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.098] GetProcessHeap () returned 0x630000 [0054.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.098] GetProcessHeap () returned 0x630000 [0054.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.098] GetProcessHeap () returned 0x630000 [0054.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.098] GetProcessHeap () returned 0x630000 [0054.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.098] GetProcessHeap () returned 0x630000 [0054.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.098] GetProcessHeap () returned 0x630000 [0054.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.099] GetProcessHeap () returned 0x630000 [0054.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.099] GetProcessHeap () returned 0x630000 [0054.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.099] GetProcessHeap () returned 0x630000 [0054.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.099] GetProcessHeap () returned 0x630000 [0054.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.099] GetProcessHeap () returned 0x630000 [0054.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.099] GetProcessHeap () returned 0x630000 [0054.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.099] GetProcessHeap () returned 0x630000 [0054.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.099] GetProcessHeap () returned 0x630000 [0054.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0054.099] GetProcessHeap () returned 0x630000 [0054.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0054.099] GetProcessHeap () returned 0x630000 [0054.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.099] GetProcessHeap () returned 0x630000 [0054.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.099] GetProcessHeap () returned 0x630000 [0054.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.099] GetProcessHeap () returned 0x630000 [0054.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.099] GetProcessHeap () returned 0x630000 [0054.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0054.099] GetProcessHeap () returned 0x630000 [0054.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0054.099] GetProcessHeap () returned 0x630000 [0054.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.099] GetProcessHeap () returned 0x630000 [0054.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.099] GetProcessHeap () returned 0x630000 [0054.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.099] GetProcessHeap () returned 0x630000 [0054.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.099] GetProcessHeap () returned 0x630000 [0054.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0054.100] GetProcessHeap () returned 0x630000 [0054.100] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0054.100] GetProcessHeap () returned 0x630000 [0054.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.100] GetProcessHeap () returned 0x630000 [0054.100] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.100] GetProcessHeap () returned 0x630000 [0054.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.100] GetProcessHeap () returned 0x630000 [0054.100] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.100] GetProcessHeap () returned 0x630000 [0054.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.100] GetProcessHeap () returned 0x630000 [0054.100] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.100] GetProcessHeap () returned 0x630000 [0054.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0054.100] GetProcessHeap () returned 0x630000 [0054.100] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0054.100] GetProcessHeap () returned 0x630000 [0054.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0054.102] GetProcessHeap () returned 0x630000 [0054.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0054.102] GetProcessHeap () returned 0x630000 [0054.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0054.102] GetProcessHeap () returned 0x630000 [0054.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0054.103] GetProcessHeap () returned 0x630000 [0054.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0054.103] GetProcessHeap () returned 0x630000 [0054.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0054.103] GetProcessHeap () returned 0x630000 [0054.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0054.103] GetProcessHeap () returned 0x630000 [0054.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ecd0 | out: hHeap=0x630000) returned 1 [0054.103] GetProcessHeap () returned 0x630000 [0054.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0054.103] GetProcessHeap () returned 0x630000 [0054.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0054.103] GetProcessHeap () returned 0x630000 [0054.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0054.103] GetProcessHeap () returned 0x630000 [0054.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0054.103] GetProcessHeap () returned 0x630000 [0054.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0054.103] WriteFile (in: hFile=0x230, lpBuffer=0x65d508*, nNumberOfBytesToWrite=0x383, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65d508*, lpNumberOfBytesWritten=0x243d864*=0x383, lpOverlapped=0x0) returned 1 [0054.109] GetProcessHeap () returned 0x630000 [0054.109] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65d508, Size=0x30) returned 0x65d508 [0054.109] GetProcessHeap () returned 0x630000 [0054.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0054.109] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0054.109] GetProcessHeap () returned 0x630000 [0054.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3de10) returned 0x65ed80 [0054.109] ReadFile (in: hFile=0x230, lpBuffer=0x65ed80, nNumberOfBytesToRead=0x3de10, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesRead=0x243d7e8*=0x3de10, lpOverlapped=0x0) returned 1 [0054.113] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0054.113] WriteFile (in: hFile=0x230, lpBuffer=0x65ed80*, nNumberOfBytesToWrite=0x3de10, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesWritten=0x243d7e4*=0x3de10, lpOverlapped=0x0) returned 1 [0054.120] GetProcessHeap () returned 0x630000 [0054.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ed80 | out: hHeap=0x630000) returned 1 [0054.122] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0054.122] WriteFile (in: hFile=0x230, lpBuffer=0x65d508*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65d508*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0054.123] CloseHandle (hObject=0x230) returned 1 [0054.129] GetProcessHeap () returned 0x630000 [0054.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0054.129] GetProcessHeap () returned 0x630000 [0054.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b228 | out: hHeap=0x630000) returned 1 [0054.129] GetProcessHeap () returned 0x630000 [0054.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0054.129] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm" [0054.129] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm.happythreechoose" [0054.129] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_bg-bg.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_bg-bg.htm.happythreechoose"), dwFlags=0x1) returned 1 [0054.130] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0054.130] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0054.130] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" [0054.130] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\decryption info.html")) returned 0x20 [0054.130] GetProcessHeap () returned 0x630000 [0054.130] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0054.130] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c882e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c882e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x14573, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_cs-cz.htm", cAlternateFileName="EULA_C~1.HTM")) returned 1 [0054.130] lstrcmpiW (lpString1="EULA_cs-cz.htm", lpString2=".") returned 1 [0054.130] lstrcmpiW (lpString1="EULA_cs-cz.htm", lpString2="..") returned 1 [0054.130] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_cs-cz.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm" [0054.130] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_cs-cz.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0054.130] GetProcessHeap () returned 0x630000 [0054.130] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0054.130] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_cs-cz.htm", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_cs-cz.htm", lpUsedDefaultChar=0x0) returned 15 [0054.130] lstrlenA (lpString="EULA_cs-cz.htm") returned 14 [0054.130] lstrlenA (lpString=".happythreechoose") returned 17 [0054.130] lstrcmpiW (lpString1="EULA_cs-cz.htm", lpString2="Decryption INFO.html") returned 1 [0054.130] lstrcmpiW (lpString1="EULA_cs-cz.htm", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0054.130] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0054.130] lstrcmpiW (lpString1="EULA_cs-cz.htm", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0054.130] GetProcessHeap () returned 0x630000 [0054.130] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0054.130] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_cs-cz.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0054.131] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=83315) returned 1 [0054.131] GetProcessHeap () returned 0x630000 [0054.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x65b1b0 [0054.131] GetProcessHeap () returned 0x630000 [0054.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0054.131] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm") returned 52 [0054.131] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0054.131] GetProcessHeap () returned 0x630000 [0054.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0054.131] GetProcessHeap () returned 0x630000 [0054.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38d) returned 0x65d540 [0054.131] lstrlenA (lpString="rsa_encrypt") returned 11 [0054.131] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0054.132] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0054.132] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0054.132] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0054.132] GetProcessHeap () returned 0x630000 [0054.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0054.132] lstrlenA (lpString="010001") returned 6 [0054.132] GetProcessHeap () returned 0x630000 [0054.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a348 [0054.132] GetProcessHeap () returned 0x630000 [0054.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0054.132] GetProcessHeap () returned 0x630000 [0054.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ecd0 [0054.132] GetProcessHeap () returned 0x630000 [0054.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0054.132] GetProcessHeap () returned 0x630000 [0054.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e580 [0054.132] GetProcessHeap () returned 0x630000 [0054.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656950 [0054.132] GetProcessHeap () returned 0x630000 [0054.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0054.133] GetProcessHeap () returned 0x630000 [0054.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0054.133] GetProcessHeap () returned 0x630000 [0054.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.133] GetProcessHeap () returned 0x630000 [0054.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0054.133] GetProcessHeap () returned 0x630000 [0054.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0054.133] GetProcessHeap () returned 0x630000 [0054.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657558 [0054.133] GetProcessHeap () returned 0x630000 [0054.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.133] GetProcessHeap () returned 0x630000 [0054.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0054.133] GetProcessHeap () returned 0x630000 [0054.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea00 [0054.133] GetProcessHeap () returned 0x630000 [0054.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0054.133] GetProcessHeap () returned 0x630000 [0054.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0054.133] GetProcessHeap () returned 0x630000 [0054.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0054.133] GetProcessHeap () returned 0x630000 [0054.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.133] GetProcessHeap () returned 0x630000 [0054.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65a888 [0054.133] GetProcessHeap () returned 0x630000 [0054.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.133] GetProcessHeap () returned 0x630000 [0054.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.133] GetProcessHeap () returned 0x630000 [0054.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.133] GetProcessHeap () returned 0x630000 [0054.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.133] GetProcessHeap () returned 0x630000 [0054.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e100 [0054.133] GetProcessHeap () returned 0x630000 [0054.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a888 | out: hHeap=0x630000) returned 1 [0054.133] GetProcessHeap () returned 0x630000 [0054.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0054.134] GetProcessHeap () returned 0x630000 [0054.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0054.134] GetProcessHeap () returned 0x630000 [0054.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.134] GetProcessHeap () returned 0x630000 [0054.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.134] GetProcessHeap () returned 0x630000 [0054.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.134] GetProcessHeap () returned 0x630000 [0054.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.134] GetProcessHeap () returned 0x630000 [0054.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.134] GetProcessHeap () returned 0x630000 [0054.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.134] GetProcessHeap () returned 0x630000 [0054.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0054.134] GetProcessHeap () returned 0x630000 [0054.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0054.134] GetProcessHeap () returned 0x630000 [0054.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.134] GetProcessHeap () returned 0x630000 [0054.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.134] GetProcessHeap () returned 0x630000 [0054.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.134] GetProcessHeap () returned 0x630000 [0054.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.134] GetProcessHeap () returned 0x630000 [0054.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.134] GetProcessHeap () returned 0x630000 [0054.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.134] GetProcessHeap () returned 0x630000 [0054.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.134] GetProcessHeap () returned 0x630000 [0054.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.134] GetProcessHeap () returned 0x630000 [0054.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0054.134] GetProcessHeap () returned 0x630000 [0054.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0054.135] GetProcessHeap () returned 0x630000 [0054.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.135] GetProcessHeap () returned 0x630000 [0054.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.135] GetProcessHeap () returned 0x630000 [0054.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0054.135] GetProcessHeap () returned 0x630000 [0054.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0054.135] GetProcessHeap () returned 0x630000 [0054.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.135] GetProcessHeap () returned 0x630000 [0054.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.135] GetProcessHeap () returned 0x630000 [0054.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.135] GetProcessHeap () returned 0x630000 [0054.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.135] GetProcessHeap () returned 0x630000 [0054.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.135] GetProcessHeap () returned 0x630000 [0054.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.135] GetProcessHeap () returned 0x630000 [0054.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.135] GetProcessHeap () returned 0x630000 [0054.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.135] GetProcessHeap () returned 0x630000 [0054.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.135] GetProcessHeap () returned 0x630000 [0054.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.135] GetProcessHeap () returned 0x630000 [0054.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0054.135] GetProcessHeap () returned 0x630000 [0054.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0054.135] GetProcessHeap () returned 0x630000 [0054.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0054.135] GetProcessHeap () returned 0x630000 [0054.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0054.135] GetProcessHeap () returned 0x630000 [0054.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.136] GetProcessHeap () returned 0x630000 [0054.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.136] GetProcessHeap () returned 0x630000 [0054.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.136] GetProcessHeap () returned 0x630000 [0054.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.136] GetProcessHeap () returned 0x630000 [0054.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.136] GetProcessHeap () returned 0x630000 [0054.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.136] GetProcessHeap () returned 0x630000 [0054.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.136] GetProcessHeap () returned 0x630000 [0054.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.136] GetProcessHeap () returned 0x630000 [0054.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0054.136] GetProcessHeap () returned 0x630000 [0054.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0054.136] GetProcessHeap () returned 0x630000 [0054.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.136] GetProcessHeap () returned 0x630000 [0054.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.136] GetProcessHeap () returned 0x630000 [0054.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0054.136] GetProcessHeap () returned 0x630000 [0054.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0054.136] GetProcessHeap () returned 0x630000 [0054.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.136] GetProcessHeap () returned 0x630000 [0054.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.136] GetProcessHeap () returned 0x630000 [0054.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.136] GetProcessHeap () returned 0x630000 [0054.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.136] GetProcessHeap () returned 0x630000 [0054.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.137] GetProcessHeap () returned 0x630000 [0054.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.137] GetProcessHeap () returned 0x630000 [0054.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.137] GetProcessHeap () returned 0x630000 [0054.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.137] GetProcessHeap () returned 0x630000 [0054.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.137] GetProcessHeap () returned 0x630000 [0054.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.137] GetProcessHeap () returned 0x630000 [0054.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.137] GetProcessHeap () returned 0x630000 [0054.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.137] GetProcessHeap () returned 0x630000 [0054.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.137] GetProcessHeap () returned 0x630000 [0054.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.137] GetProcessHeap () returned 0x630000 [0054.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.137] GetProcessHeap () returned 0x630000 [0054.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.137] GetProcessHeap () returned 0x630000 [0054.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0054.137] GetProcessHeap () returned 0x630000 [0054.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0054.137] GetProcessHeap () returned 0x630000 [0054.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.137] GetProcessHeap () returned 0x630000 [0054.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.137] GetProcessHeap () returned 0x630000 [0054.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.137] GetProcessHeap () returned 0x630000 [0054.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.137] GetProcessHeap () returned 0x630000 [0054.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.137] GetProcessHeap () returned 0x630000 [0054.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.137] GetProcessHeap () returned 0x630000 [0054.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.138] GetProcessHeap () returned 0x630000 [0054.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.138] GetProcessHeap () returned 0x630000 [0054.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.138] GetProcessHeap () returned 0x630000 [0054.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.138] GetProcessHeap () returned 0x630000 [0054.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.138] GetProcessHeap () returned 0x630000 [0054.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.138] GetProcessHeap () returned 0x630000 [0054.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0054.138] GetProcessHeap () returned 0x630000 [0054.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0054.138] GetProcessHeap () returned 0x630000 [0054.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0054.138] GetProcessHeap () returned 0x630000 [0054.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0054.138] GetProcessHeap () returned 0x630000 [0054.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0054.138] GetProcessHeap () returned 0x630000 [0054.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0054.138] GetProcessHeap () returned 0x630000 [0054.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0054.138] GetProcessHeap () returned 0x630000 [0054.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0054.138] GetProcessHeap () returned 0x630000 [0054.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0054.138] GetProcessHeap () returned 0x630000 [0054.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ecd0 | out: hHeap=0x630000) returned 1 [0054.138] GetProcessHeap () returned 0x630000 [0054.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0054.138] GetProcessHeap () returned 0x630000 [0054.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.138] GetProcessHeap () returned 0x630000 [0054.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0054.139] WriteFile (in: hFile=0x230, lpBuffer=0x65d540*, nNumberOfBytesToWrite=0x38d, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65d540*, lpNumberOfBytesWritten=0x243d864*=0x38d, lpOverlapped=0x0) returned 1 [0054.143] GetProcessHeap () returned 0x630000 [0054.143] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65d540, Size=0x30) returned 0x65d540 [0054.143] GetProcessHeap () returned 0x630000 [0054.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0054.143] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0054.143] GetProcessHeap () returned 0x630000 [0054.143] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14580) returned 0x65ed80 [0054.145] ReadFile (in: hFile=0x230, lpBuffer=0x65ed80, nNumberOfBytesToRead=0x14580, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesRead=0x243d7e8*=0x14580, lpOverlapped=0x0) returned 1 [0054.148] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0054.148] WriteFile (in: hFile=0x230, lpBuffer=0x65ed80*, nNumberOfBytesToWrite=0x14580, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesWritten=0x243d7e4*=0x14580, lpOverlapped=0x0) returned 1 [0054.152] GetProcessHeap () returned 0x630000 [0054.152] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ed80 | out: hHeap=0x630000) returned 1 [0054.152] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0054.153] WriteFile (in: hFile=0x230, lpBuffer=0x65d540*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65d540*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0054.154] CloseHandle (hObject=0x230) returned 1 [0054.156] GetProcessHeap () returned 0x630000 [0054.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0054.156] GetProcessHeap () returned 0x630000 [0054.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b1b0 | out: hHeap=0x630000) returned 1 [0054.156] GetProcessHeap () returned 0x630000 [0054.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0054.156] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm" [0054.156] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm.happythreechoose" [0054.156] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_cs-cz.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_cs-cz.htm.happythreechoose"), dwFlags=0x1) returned 1 [0054.157] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0054.157] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0054.157] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" [0054.157] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\decryption info.html")) returned 0x20 [0054.157] GetProcessHeap () returned 0x630000 [0054.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0054.157] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3caf18, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3caf18, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xfe95, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_da-dk.htm", cAlternateFileName="EULA_D~1.HTM")) returned 1 [0054.157] lstrcmpiW (lpString1="EULA_da-dk.htm", lpString2=".") returned 1 [0054.157] lstrcmpiW (lpString1="EULA_da-dk.htm", lpString2="..") returned 1 [0054.158] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_da-dk.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm" [0054.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_da-dk.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0054.158] GetProcessHeap () returned 0x630000 [0054.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0054.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_da-dk.htm", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_da-dk.htm", lpUsedDefaultChar=0x0) returned 15 [0054.158] lstrlenA (lpString="EULA_da-dk.htm") returned 14 [0054.158] lstrlenA (lpString=".happythreechoose") returned 17 [0054.158] lstrcmpiW (lpString1="EULA_da-dk.htm", lpString2="Decryption INFO.html") returned 1 [0054.158] lstrcmpiW (lpString1="EULA_da-dk.htm", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0054.158] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0054.158] lstrcmpiW (lpString1="EULA_da-dk.htm", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0054.158] GetProcessHeap () returned 0x630000 [0054.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0054.158] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_da-dk.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0054.159] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=65173) returned 1 [0054.159] GetProcessHeap () returned 0x630000 [0054.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x65b138 [0054.159] GetProcessHeap () returned 0x630000 [0054.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0054.159] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm") returned 52 [0054.159] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0054.159] GetProcessHeap () returned 0x630000 [0054.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0054.159] GetProcessHeap () returned 0x630000 [0054.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x65d578 [0054.159] lstrlenA (lpString="rsa_encrypt") returned 11 [0054.159] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0054.160] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0054.160] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0054.160] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0054.160] GetProcessHeap () returned 0x630000 [0054.160] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0054.160] lstrlenA (lpString="010001") returned 6 [0054.160] GetProcessHeap () returned 0x630000 [0054.160] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0054.160] GetProcessHeap () returned 0x630000 [0054.160] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0054.160] GetProcessHeap () returned 0x630000 [0054.160] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ebb0 [0054.160] GetProcessHeap () returned 0x630000 [0054.160] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0054.160] GetProcessHeap () returned 0x630000 [0054.160] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e580 [0054.160] GetProcessHeap () returned 0x630000 [0054.160] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656b80 [0054.160] GetProcessHeap () returned 0x630000 [0054.160] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a398 [0054.160] GetProcessHeap () returned 0x630000 [0054.160] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0054.160] GetProcessHeap () returned 0x630000 [0054.160] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0054.160] GetProcessHeap () returned 0x630000 [0054.160] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0054.160] GetProcessHeap () returned 0x630000 [0054.160] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0054.160] GetProcessHeap () returned 0x630000 [0054.161] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656c98 [0054.161] GetProcessHeap () returned 0x630000 [0054.161] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.161] GetProcessHeap () returned 0x630000 [0054.161] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0054.161] GetProcessHeap () returned 0x630000 [0054.161] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0054.161] GetProcessHeap () returned 0x630000 [0054.161] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0054.161] GetProcessHeap () returned 0x630000 [0054.161] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0054.161] GetProcessHeap () returned 0x630000 [0054.161] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0054.161] GetProcessHeap () returned 0x630000 [0054.161] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.161] GetProcessHeap () returned 0x630000 [0054.161] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65a750 [0054.161] GetProcessHeap () returned 0x630000 [0054.161] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.161] GetProcessHeap () returned 0x630000 [0054.161] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.161] GetProcessHeap () returned 0x630000 [0054.161] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.161] GetProcessHeap () returned 0x630000 [0054.161] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.161] GetProcessHeap () returned 0x630000 [0054.161] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e100 [0054.161] GetProcessHeap () returned 0x630000 [0054.161] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a750 | out: hHeap=0x630000) returned 1 [0054.161] GetProcessHeap () returned 0x630000 [0054.161] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0054.161] GetProcessHeap () returned 0x630000 [0054.161] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0054.161] GetProcessHeap () returned 0x630000 [0054.161] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.161] GetProcessHeap () returned 0x630000 [0054.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.162] GetProcessHeap () returned 0x630000 [0054.162] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.162] GetProcessHeap () returned 0x630000 [0054.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.162] GetProcessHeap () returned 0x630000 [0054.162] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0054.162] GetProcessHeap () returned 0x630000 [0054.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0054.162] GetProcessHeap () returned 0x630000 [0054.162] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0054.162] GetProcessHeap () returned 0x630000 [0054.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0054.162] GetProcessHeap () returned 0x630000 [0054.162] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.162] GetProcessHeap () returned 0x630000 [0054.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.162] GetProcessHeap () returned 0x630000 [0054.162] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0054.162] GetProcessHeap () returned 0x630000 [0054.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0054.162] GetProcessHeap () returned 0x630000 [0054.162] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0054.162] GetProcessHeap () returned 0x630000 [0054.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0054.162] GetProcessHeap () returned 0x630000 [0054.162] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.162] GetProcessHeap () returned 0x630000 [0054.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.162] GetProcessHeap () returned 0x630000 [0054.162] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0054.162] GetProcessHeap () returned 0x630000 [0054.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0054.162] GetProcessHeap () returned 0x630000 [0054.162] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.162] GetProcessHeap () returned 0x630000 [0054.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.172] GetProcessHeap () returned 0x630000 [0054.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0054.172] GetProcessHeap () returned 0x630000 [0054.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0054.172] GetProcessHeap () returned 0x630000 [0054.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.172] GetProcessHeap () returned 0x630000 [0054.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.172] GetProcessHeap () returned 0x630000 [0054.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.172] GetProcessHeap () returned 0x630000 [0054.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.172] GetProcessHeap () returned 0x630000 [0054.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.172] GetProcessHeap () returned 0x630000 [0054.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.172] GetProcessHeap () returned 0x630000 [0054.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0054.172] GetProcessHeap () returned 0x630000 [0054.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0054.172] GetProcessHeap () returned 0x630000 [0054.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0054.172] GetProcessHeap () returned 0x630000 [0054.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0054.173] GetProcessHeap () returned 0x630000 [0054.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.173] GetProcessHeap () returned 0x630000 [0054.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.173] GetProcessHeap () returned 0x630000 [0054.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0054.173] GetProcessHeap () returned 0x630000 [0054.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0054.173] GetProcessHeap () returned 0x630000 [0054.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0054.173] GetProcessHeap () returned 0x630000 [0054.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0054.173] GetProcessHeap () returned 0x630000 [0054.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.175] GetProcessHeap () returned 0x630000 [0054.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.175] GetProcessHeap () returned 0x630000 [0054.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.175] GetProcessHeap () returned 0x630000 [0054.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.175] GetProcessHeap () returned 0x630000 [0054.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.175] GetProcessHeap () returned 0x630000 [0054.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.175] GetProcessHeap () returned 0x630000 [0054.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.175] GetProcessHeap () returned 0x630000 [0054.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.175] GetProcessHeap () returned 0x630000 [0054.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.175] GetProcessHeap () returned 0x630000 [0054.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.175] GetProcessHeap () returned 0x630000 [0054.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.175] GetProcessHeap () returned 0x630000 [0054.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.175] GetProcessHeap () returned 0x630000 [0054.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.175] GetProcessHeap () returned 0x630000 [0054.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.175] GetProcessHeap () returned 0x630000 [0054.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.175] GetProcessHeap () returned 0x630000 [0054.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.175] GetProcessHeap () returned 0x630000 [0054.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.175] GetProcessHeap () returned 0x630000 [0054.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.176] GetProcessHeap () returned 0x630000 [0054.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.176] GetProcessHeap () returned 0x630000 [0054.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.176] GetProcessHeap () returned 0x630000 [0054.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0054.176] GetProcessHeap () returned 0x630000 [0054.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0054.176] GetProcessHeap () returned 0x630000 [0054.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.176] GetProcessHeap () returned 0x630000 [0054.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.176] GetProcessHeap () returned 0x630000 [0054.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.176] GetProcessHeap () returned 0x630000 [0054.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.176] GetProcessHeap () returned 0x630000 [0054.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.176] GetProcessHeap () returned 0x630000 [0054.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.176] GetProcessHeap () returned 0x630000 [0054.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0054.176] GetProcessHeap () returned 0x630000 [0054.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0054.176] GetProcessHeap () returned 0x630000 [0054.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.176] GetProcessHeap () returned 0x630000 [0054.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.176] GetProcessHeap () returned 0x630000 [0054.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.176] GetProcessHeap () returned 0x630000 [0054.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.176] GetProcessHeap () returned 0x630000 [0054.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0054.176] GetProcessHeap () returned 0x630000 [0054.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0054.176] GetProcessHeap () returned 0x630000 [0054.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.177] GetProcessHeap () returned 0x630000 [0054.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.177] GetProcessHeap () returned 0x630000 [0054.177] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0054.177] GetProcessHeap () returned 0x630000 [0054.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0054.177] GetProcessHeap () returned 0x630000 [0054.177] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.177] GetProcessHeap () returned 0x630000 [0054.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.177] GetProcessHeap () returned 0x630000 [0054.177] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.177] GetProcessHeap () returned 0x630000 [0054.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.177] GetProcessHeap () returned 0x630000 [0054.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0054.177] GetProcessHeap () returned 0x630000 [0054.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0054.177] GetProcessHeap () returned 0x630000 [0054.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0054.177] GetProcessHeap () returned 0x630000 [0054.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0054.177] GetProcessHeap () returned 0x630000 [0054.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0054.177] GetProcessHeap () returned 0x630000 [0054.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0054.177] GetProcessHeap () returned 0x630000 [0054.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0054.177] GetProcessHeap () returned 0x630000 [0054.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0054.177] GetProcessHeap () returned 0x630000 [0054.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0054.177] GetProcessHeap () returned 0x630000 [0054.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.177] GetProcessHeap () returned 0x630000 [0054.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0054.178] WriteFile (in: hFile=0x230, lpBuffer=0x65d578*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65d578*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0054.181] GetProcessHeap () returned 0x630000 [0054.181] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65d578, Size=0x30) returned 0x65d578 [0054.181] GetProcessHeap () returned 0x630000 [0054.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0054.182] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0054.182] GetProcessHeap () returned 0x630000 [0054.182] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfe95) returned 0x65ed80 [0054.182] ReadFile (in: hFile=0x230, lpBuffer=0x65ed80, nNumberOfBytesToRead=0xfe95, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesRead=0x243d7e8*=0xfe95, lpOverlapped=0x0) returned 1 [0054.183] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0054.183] WriteFile (in: hFile=0x230, lpBuffer=0x65ed80*, nNumberOfBytesToWrite=0xfe95, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesWritten=0x243d7e4*=0xfe95, lpOverlapped=0x0) returned 1 [0054.215] GetProcessHeap () returned 0x630000 [0054.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ed80 | out: hHeap=0x630000) returned 1 [0054.216] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0054.216] WriteFile (in: hFile=0x230, lpBuffer=0x65d578*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65d578*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0054.217] CloseHandle (hObject=0x230) returned 1 [0054.220] GetProcessHeap () returned 0x630000 [0054.220] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0054.220] GetProcessHeap () returned 0x630000 [0054.220] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b138 | out: hHeap=0x630000) returned 1 [0054.220] GetProcessHeap () returned 0x630000 [0054.220] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0054.220] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm" [0054.220] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm.happythreechoose" [0054.220] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_da-dk.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_da-dk.htm.happythreechoose"), dwFlags=0x1) returned 1 [0054.220] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0054.220] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0054.220] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" [0054.221] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\decryption info.html")) returned 0x20 [0054.221] GetProcessHeap () returned 0x630000 [0054.221] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0054.221] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3d10e9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3d10e9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1133d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_de-de.htm", cAlternateFileName="EULA_D~2.HTM")) returned 1 [0054.221] lstrcmpiW (lpString1="EULA_de-de.htm", lpString2=".") returned 1 [0054.221] lstrcmpiW (lpString1="EULA_de-de.htm", lpString2="..") returned 1 [0054.221] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_de-de.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm" [0054.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_de-de.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0054.221] GetProcessHeap () returned 0x630000 [0054.221] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64ca20 [0054.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_de-de.htm", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_de-de.htm", lpUsedDefaultChar=0x0) returned 15 [0054.221] lstrlenA (lpString="EULA_de-de.htm") returned 14 [0054.221] lstrlenA (lpString=".happythreechoose") returned 17 [0054.221] lstrcmpiW (lpString1="EULA_de-de.htm", lpString2="Decryption INFO.html") returned 1 [0054.221] lstrcmpiW (lpString1="EULA_de-de.htm", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0054.221] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0054.221] lstrcmpiW (lpString1="EULA_de-de.htm", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0054.221] GetProcessHeap () returned 0x630000 [0054.221] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0054.221] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_de-de.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0054.221] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=70461) returned 1 [0054.222] GetProcessHeap () returned 0x630000 [0054.222] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x65b228 [0054.222] GetProcessHeap () returned 0x630000 [0054.222] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0054.222] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm") returned 52 [0054.222] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0054.222] GetProcessHeap () returned 0x630000 [0054.222] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0054.222] GetProcessHeap () returned 0x630000 [0054.222] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x383) returned 0x65d5b0 [0054.222] lstrlenA (lpString="rsa_encrypt") returned 11 [0054.222] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0054.222] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0054.222] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0054.223] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0054.223] GetProcessHeap () returned 0x630000 [0054.223] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0054.223] lstrlenA (lpString="010001") returned 6 [0054.223] GetProcessHeap () returned 0x630000 [0054.223] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0054.223] GetProcessHeap () returned 0x630000 [0054.223] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0054.223] GetProcessHeap () returned 0x630000 [0054.223] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0054.223] GetProcessHeap () returned 0x630000 [0054.223] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0054.223] GetProcessHeap () returned 0x630000 [0054.223] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65df50 [0054.223] GetProcessHeap () returned 0x630000 [0054.223] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x6570f8 [0054.223] GetProcessHeap () returned 0x630000 [0054.223] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2a8 [0054.223] GetProcessHeap () returned 0x630000 [0054.223] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0054.223] GetProcessHeap () returned 0x630000 [0054.223] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.223] GetProcessHeap () returned 0x630000 [0054.223] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0054.223] GetProcessHeap () returned 0x630000 [0054.223] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0054.223] GetProcessHeap () returned 0x630000 [0054.223] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657670 [0054.223] GetProcessHeap () returned 0x630000 [0054.223] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.223] GetProcessHeap () returned 0x630000 [0054.223] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0054.223] GetProcessHeap () returned 0x630000 [0054.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dfe0 [0054.224] GetProcessHeap () returned 0x630000 [0054.224] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0054.224] GetProcessHeap () returned 0x630000 [0054.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0054.224] GetProcessHeap () returned 0x630000 [0054.224] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0054.224] GetProcessHeap () returned 0x630000 [0054.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.224] GetProcessHeap () returned 0x630000 [0054.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65a528 [0054.224] GetProcessHeap () returned 0x630000 [0054.224] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.224] GetProcessHeap () returned 0x630000 [0054.224] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.224] GetProcessHeap () returned 0x630000 [0054.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0054.224] GetProcessHeap () returned 0x630000 [0054.224] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0054.224] GetProcessHeap () returned 0x630000 [0054.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e610 [0054.224] GetProcessHeap () returned 0x630000 [0054.224] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a528 | out: hHeap=0x630000) returned 1 [0054.224] GetProcessHeap () returned 0x630000 [0054.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0054.224] GetProcessHeap () returned 0x630000 [0054.224] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0054.224] GetProcessHeap () returned 0x630000 [0054.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.224] GetProcessHeap () returned 0x630000 [0054.224] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.224] GetProcessHeap () returned 0x630000 [0054.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.224] GetProcessHeap () returned 0x630000 [0054.224] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.224] GetProcessHeap () returned 0x630000 [0054.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.224] GetProcessHeap () returned 0x630000 [0054.224] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.224] GetProcessHeap () returned 0x630000 [0054.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.225] GetProcessHeap () returned 0x630000 [0054.225] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.225] GetProcessHeap () returned 0x630000 [0054.225] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0054.225] GetProcessHeap () returned 0x630000 [0054.225] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0054.225] GetProcessHeap () returned 0x630000 [0054.225] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0054.225] GetProcessHeap () returned 0x630000 [0054.225] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0054.225] GetProcessHeap () returned 0x630000 [0054.225] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.225] GetProcessHeap () returned 0x630000 [0054.225] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.225] GetProcessHeap () returned 0x630000 [0054.225] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.225] GetProcessHeap () returned 0x630000 [0054.225] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.225] GetProcessHeap () returned 0x630000 [0054.225] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.225] GetProcessHeap () returned 0x630000 [0054.225] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.225] GetProcessHeap () returned 0x630000 [0054.225] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.225] GetProcessHeap () returned 0x630000 [0054.225] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.225] GetProcessHeap () returned 0x630000 [0054.225] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0054.225] GetProcessHeap () returned 0x630000 [0054.225] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0054.225] GetProcessHeap () returned 0x630000 [0054.225] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0054.225] GetProcessHeap () returned 0x630000 [0054.225] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0054.225] GetProcessHeap () returned 0x630000 [0054.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0054.226] GetProcessHeap () returned 0x630000 [0054.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0054.226] GetProcessHeap () returned 0x630000 [0054.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.226] GetProcessHeap () returned 0x630000 [0054.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.226] GetProcessHeap () returned 0x630000 [0054.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.226] GetProcessHeap () returned 0x630000 [0054.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.226] GetProcessHeap () returned 0x630000 [0054.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.226] GetProcessHeap () returned 0x630000 [0054.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.226] GetProcessHeap () returned 0x630000 [0054.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.226] GetProcessHeap () returned 0x630000 [0054.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.226] GetProcessHeap () returned 0x630000 [0054.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.226] GetProcessHeap () returned 0x630000 [0054.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.226] GetProcessHeap () returned 0x630000 [0054.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0054.226] GetProcessHeap () returned 0x630000 [0054.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0054.226] GetProcessHeap () returned 0x630000 [0054.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.226] GetProcessHeap () returned 0x630000 [0054.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.226] GetProcessHeap () returned 0x630000 [0054.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.226] GetProcessHeap () returned 0x630000 [0054.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.226] GetProcessHeap () returned 0x630000 [0054.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.226] GetProcessHeap () returned 0x630000 [0054.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.227] GetProcessHeap () returned 0x630000 [0054.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.227] GetProcessHeap () returned 0x630000 [0054.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.227] GetProcessHeap () returned 0x630000 [0054.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0054.227] GetProcessHeap () returned 0x630000 [0054.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0054.227] GetProcessHeap () returned 0x630000 [0054.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0054.227] GetProcessHeap () returned 0x630000 [0054.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0054.227] GetProcessHeap () returned 0x630000 [0054.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.227] GetProcessHeap () returned 0x630000 [0054.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.227] GetProcessHeap () returned 0x630000 [0054.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.227] GetProcessHeap () returned 0x630000 [0054.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.227] GetProcessHeap () returned 0x630000 [0054.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.227] GetProcessHeap () returned 0x630000 [0054.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.227] GetProcessHeap () returned 0x630000 [0054.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.227] GetProcessHeap () returned 0x630000 [0054.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.227] GetProcessHeap () returned 0x630000 [0054.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.227] GetProcessHeap () returned 0x630000 [0054.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.227] GetProcessHeap () returned 0x630000 [0054.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.227] GetProcessHeap () returned 0x630000 [0054.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.227] GetProcessHeap () returned 0x630000 [0054.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.227] GetProcessHeap () returned 0x630000 [0054.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.228] GetProcessHeap () returned 0x630000 [0054.228] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.228] GetProcessHeap () returned 0x630000 [0054.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.228] GetProcessHeap () returned 0x630000 [0054.228] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0054.228] GetProcessHeap () returned 0x630000 [0054.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0054.228] GetProcessHeap () returned 0x630000 [0054.228] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.228] GetProcessHeap () returned 0x630000 [0054.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.228] GetProcessHeap () returned 0x630000 [0054.228] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.228] GetProcessHeap () returned 0x630000 [0054.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.228] GetProcessHeap () returned 0x630000 [0054.228] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.228] GetProcessHeap () returned 0x630000 [0054.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.228] GetProcessHeap () returned 0x630000 [0054.228] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.228] GetProcessHeap () returned 0x630000 [0054.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.228] GetProcessHeap () returned 0x630000 [0054.228] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.228] GetProcessHeap () returned 0x630000 [0054.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.228] GetProcessHeap () returned 0x630000 [0054.228] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.228] GetProcessHeap () returned 0x630000 [0054.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.228] GetProcessHeap () returned 0x630000 [0054.228] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.228] GetProcessHeap () returned 0x630000 [0054.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.228] GetProcessHeap () returned 0x630000 [0054.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0054.228] GetProcessHeap () returned 0x630000 [0054.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0054.229] GetProcessHeap () returned 0x630000 [0054.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0054.229] GetProcessHeap () returned 0x630000 [0054.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0054.229] GetProcessHeap () returned 0x630000 [0054.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0054.229] GetProcessHeap () returned 0x630000 [0054.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0054.229] GetProcessHeap () returned 0x630000 [0054.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0054.229] GetProcessHeap () returned 0x630000 [0054.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0054.229] GetProcessHeap () returned 0x630000 [0054.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0054.229] GetProcessHeap () returned 0x630000 [0054.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.229] GetProcessHeap () returned 0x630000 [0054.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0054.229] WriteFile (in: hFile=0x230, lpBuffer=0x65d5b0*, nNumberOfBytesToWrite=0x383, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65d5b0*, lpNumberOfBytesWritten=0x243d864*=0x383, lpOverlapped=0x0) returned 1 [0054.232] GetProcessHeap () returned 0x630000 [0054.232] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65d5b0, Size=0x30) returned 0x65d5b0 [0054.232] GetProcessHeap () returned 0x630000 [0054.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0054.232] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0054.232] GetProcessHeap () returned 0x630000 [0054.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11340) returned 0x65ed80 [0054.234] ReadFile (in: hFile=0x230, lpBuffer=0x65ed80, nNumberOfBytesToRead=0x11340, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesRead=0x243d7e8*=0x11340, lpOverlapped=0x0) returned 1 [0054.236] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0054.236] WriteFile (in: hFile=0x230, lpBuffer=0x65ed80*, nNumberOfBytesToWrite=0x11340, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesWritten=0x243d7e4*=0x11340, lpOverlapped=0x0) returned 1 [0054.270] GetProcessHeap () returned 0x630000 [0054.270] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ed80 | out: hHeap=0x630000) returned 1 [0054.270] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0054.270] WriteFile (in: hFile=0x230, lpBuffer=0x65d5b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65d5b0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0054.324] CloseHandle (hObject=0x230) returned 1 [0054.329] GetProcessHeap () returned 0x630000 [0054.329] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0054.329] GetProcessHeap () returned 0x630000 [0054.329] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b228 | out: hHeap=0x630000) returned 1 [0054.329] GetProcessHeap () returned 0x630000 [0054.330] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0054.330] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm" [0054.330] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm.happythreechoose" [0054.330] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_de-de.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_de-de.htm.happythreechoose"), dwFlags=0x1) returned 1 [0054.330] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0054.330] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0054.330] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" [0054.330] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\decryption info.html")) returned 0x20 [0054.331] GetProcessHeap () returned 0x630000 [0054.331] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0054.331] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3d2466, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3d2466, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x3a756, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_el-gr.htm", cAlternateFileName="EULA_E~1.HTM")) returned 1 [0054.331] lstrcmpiW (lpString1="EULA_el-gr.htm", lpString2=".") returned 1 [0054.331] lstrcmpiW (lpString1="EULA_el-gr.htm", lpString2="..") returned 1 [0054.331] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_el-gr.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm" [0054.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_el-gr.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0054.331] GetProcessHeap () returned 0x630000 [0054.331] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0054.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_el-gr.htm", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_el-gr.htm", lpUsedDefaultChar=0x0) returned 15 [0054.331] lstrlenA (lpString="EULA_el-gr.htm") returned 14 [0054.331] lstrlenA (lpString=".happythreechoose") returned 17 [0054.331] lstrcmpiW (lpString1="EULA_el-gr.htm", lpString2="Decryption INFO.html") returned 1 [0054.331] lstrcmpiW (lpString1="EULA_el-gr.htm", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0054.331] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0054.331] lstrcmpiW (lpString1="EULA_el-gr.htm", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0054.331] GetProcessHeap () returned 0x630000 [0054.331] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0054.331] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_el-gr.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0054.331] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=239446) returned 1 [0054.331] GetProcessHeap () returned 0x630000 [0054.331] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x65b390 [0054.332] GetProcessHeap () returned 0x630000 [0054.332] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0054.332] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm") returned 52 [0054.332] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0054.332] GetProcessHeap () returned 0x630000 [0054.332] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0054.332] GetProcessHeap () returned 0x630000 [0054.332] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x65d5e8 [0054.332] lstrlenA (lpString="rsa_encrypt") returned 11 [0054.332] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0054.332] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0054.332] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0054.332] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0054.332] GetProcessHeap () returned 0x630000 [0054.332] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0054.332] lstrlenA (lpString="010001") returned 6 [0054.333] GetProcessHeap () returned 0x630000 [0054.333] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2b8 [0054.333] GetProcessHeap () returned 0x630000 [0054.333] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0054.333] GetProcessHeap () returned 0x630000 [0054.333] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e6a0 [0054.333] GetProcessHeap () returned 0x630000 [0054.333] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0054.333] GetProcessHeap () returned 0x630000 [0054.333] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e100 [0054.333] GetProcessHeap () returned 0x630000 [0054.333] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656950 [0054.333] GetProcessHeap () returned 0x630000 [0054.333] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3f8 [0054.333] GetProcessHeap () returned 0x630000 [0054.333] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0054.333] GetProcessHeap () returned 0x630000 [0054.333] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.333] GetProcessHeap () returned 0x630000 [0054.333] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0054.333] GetProcessHeap () returned 0x630000 [0054.333] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0054.333] GetProcessHeap () returned 0x630000 [0054.333] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657788 [0054.333] GetProcessHeap () returned 0x630000 [0054.333] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0054.333] GetProcessHeap () returned 0x630000 [0054.333] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0054.333] GetProcessHeap () returned 0x630000 [0054.333] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ebb0 [0054.333] GetProcessHeap () returned 0x630000 [0054.333] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0054.333] GetProcessHeap () returned 0x630000 [0054.333] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0054.333] GetProcessHeap () returned 0x630000 [0054.333] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0054.333] GetProcessHeap () returned 0x630000 [0054.334] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.334] GetProcessHeap () returned 0x630000 [0054.334] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65a828 [0054.334] GetProcessHeap () returned 0x630000 [0054.334] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0054.334] GetProcessHeap () returned 0x630000 [0054.334] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.334] GetProcessHeap () returned 0x630000 [0054.334] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0054.334] GetProcessHeap () returned 0x630000 [0054.334] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0054.334] GetProcessHeap () returned 0x630000 [0054.334] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65eb20 [0054.334] GetProcessHeap () returned 0x630000 [0054.334] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a828 | out: hHeap=0x630000) returned 1 [0054.334] GetProcessHeap () returned 0x630000 [0054.334] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0054.334] GetProcessHeap () returned 0x630000 [0054.334] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0054.334] GetProcessHeap () returned 0x630000 [0054.334] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.334] GetProcessHeap () returned 0x630000 [0054.334] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.334] GetProcessHeap () returned 0x630000 [0054.334] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.334] GetProcessHeap () returned 0x630000 [0054.334] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.334] GetProcessHeap () returned 0x630000 [0054.334] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.334] GetProcessHeap () returned 0x630000 [0054.334] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.334] GetProcessHeap () returned 0x630000 [0054.334] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.334] GetProcessHeap () returned 0x630000 [0054.334] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.334] GetProcessHeap () returned 0x630000 [0054.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.335] GetProcessHeap () returned 0x630000 [0054.335] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.335] GetProcessHeap () returned 0x630000 [0054.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0054.335] GetProcessHeap () returned 0x630000 [0054.335] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0054.335] GetProcessHeap () returned 0x630000 [0054.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.335] GetProcessHeap () returned 0x630000 [0054.335] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.335] GetProcessHeap () returned 0x630000 [0054.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0054.335] GetProcessHeap () returned 0x630000 [0054.335] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0054.335] GetProcessHeap () returned 0x630000 [0054.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.335] GetProcessHeap () returned 0x630000 [0054.335] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.335] GetProcessHeap () returned 0x630000 [0054.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.335] GetProcessHeap () returned 0x630000 [0054.335] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.335] GetProcessHeap () returned 0x630000 [0054.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.335] GetProcessHeap () returned 0x630000 [0054.335] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.335] GetProcessHeap () returned 0x630000 [0054.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.335] GetProcessHeap () returned 0x630000 [0054.335] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.335] GetProcessHeap () returned 0x630000 [0054.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.336] GetProcessHeap () returned 0x630000 [0054.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.336] GetProcessHeap () returned 0x630000 [0054.336] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0054.336] GetProcessHeap () returned 0x630000 [0054.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0054.336] GetProcessHeap () returned 0x630000 [0054.336] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.336] GetProcessHeap () returned 0x630000 [0054.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.336] GetProcessHeap () returned 0x630000 [0054.336] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.336] GetProcessHeap () returned 0x630000 [0054.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.336] GetProcessHeap () returned 0x630000 [0054.336] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0054.336] GetProcessHeap () returned 0x630000 [0054.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0054.336] GetProcessHeap () returned 0x630000 [0054.336] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.336] GetProcessHeap () returned 0x630000 [0054.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.336] GetProcessHeap () returned 0x630000 [0054.336] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.336] GetProcessHeap () returned 0x630000 [0054.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.336] GetProcessHeap () returned 0x630000 [0054.336] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.336] GetProcessHeap () returned 0x630000 [0054.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.336] GetProcessHeap () returned 0x630000 [0054.336] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0054.336] GetProcessHeap () returned 0x630000 [0054.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0054.336] GetProcessHeap () returned 0x630000 [0054.336] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0054.336] GetProcessHeap () returned 0x630000 [0054.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0054.336] GetProcessHeap () returned 0x630000 [0054.337] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0054.337] GetProcessHeap () returned 0x630000 [0054.337] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0054.337] GetProcessHeap () returned 0x630000 [0054.337] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.337] GetProcessHeap () returned 0x630000 [0054.337] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.337] GetProcessHeap () returned 0x630000 [0054.337] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.337] GetProcessHeap () returned 0x630000 [0054.337] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.337] GetProcessHeap () returned 0x630000 [0054.337] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.337] GetProcessHeap () returned 0x630000 [0054.337] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.337] GetProcessHeap () returned 0x630000 [0054.337] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0054.337] GetProcessHeap () returned 0x630000 [0054.337] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0054.337] GetProcessHeap () returned 0x630000 [0054.337] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.337] GetProcessHeap () returned 0x630000 [0054.337] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.337] GetProcessHeap () returned 0x630000 [0054.337] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.337] GetProcessHeap () returned 0x630000 [0054.337] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.337] GetProcessHeap () returned 0x630000 [0054.337] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.337] GetProcessHeap () returned 0x630000 [0054.337] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.337] GetProcessHeap () returned 0x630000 [0054.337] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.337] GetProcessHeap () returned 0x630000 [0054.337] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.337] GetProcessHeap () returned 0x630000 [0054.337] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.337] GetProcessHeap () returned 0x630000 [0054.337] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.337] GetProcessHeap () returned 0x630000 [0054.338] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.338] GetProcessHeap () returned 0x630000 [0054.338] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.338] GetProcessHeap () returned 0x630000 [0054.338] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.338] GetProcessHeap () returned 0x630000 [0054.338] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.338] GetProcessHeap () returned 0x630000 [0054.338] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.338] GetProcessHeap () returned 0x630000 [0054.338] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.338] GetProcessHeap () returned 0x630000 [0054.338] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.338] GetProcessHeap () returned 0x630000 [0054.338] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.338] GetProcessHeap () returned 0x630000 [0054.338] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0054.338] GetProcessHeap () returned 0x630000 [0054.338] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0054.338] GetProcessHeap () returned 0x630000 [0054.338] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.338] GetProcessHeap () returned 0x630000 [0054.338] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.338] GetProcessHeap () returned 0x630000 [0054.338] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.338] GetProcessHeap () returned 0x630000 [0054.338] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.338] GetProcessHeap () returned 0x630000 [0054.338] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0054.338] GetProcessHeap () returned 0x630000 [0054.338] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0054.338] GetProcessHeap () returned 0x630000 [0054.338] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.338] GetProcessHeap () returned 0x630000 [0054.338] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.338] GetProcessHeap () returned 0x630000 [0054.338] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0054.338] GetProcessHeap () returned 0x630000 [0054.338] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0054.339] GetProcessHeap () returned 0x630000 [0054.339] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0054.339] GetProcessHeap () returned 0x630000 [0054.339] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0054.339] GetProcessHeap () returned 0x630000 [0054.339] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0054.339] GetProcessHeap () returned 0x630000 [0054.339] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0054.339] GetProcessHeap () returned 0x630000 [0054.339] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0054.339] GetProcessHeap () returned 0x630000 [0054.339] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e6a0 | out: hHeap=0x630000) returned 1 [0054.339] GetProcessHeap () returned 0x630000 [0054.339] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0054.339] GetProcessHeap () returned 0x630000 [0054.339] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0054.339] GetProcessHeap () returned 0x630000 [0054.339] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0054.339] WriteFile (in: hFile=0x230, lpBuffer=0x65d5e8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65d5e8*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0054.347] GetProcessHeap () returned 0x630000 [0054.347] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65d5e8, Size=0x30) returned 0x65d5e8 [0054.347] GetProcessHeap () returned 0x630000 [0054.347] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0054.347] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0054.347] GetProcessHeap () returned 0x630000 [0054.347] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3a756) returned 0x65ed80 [0054.351] ReadFile (in: hFile=0x230, lpBuffer=0x65ed80, nNumberOfBytesToRead=0x3a756, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesRead=0x243d7e8*=0x3a756, lpOverlapped=0x0) returned 1 [0054.354] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0054.354] WriteFile (in: hFile=0x230, lpBuffer=0x65ed80*, nNumberOfBytesToWrite=0x3a756, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesWritten=0x243d7e4*=0x3a756, lpOverlapped=0x0) returned 1 [0054.371] GetProcessHeap () returned 0x630000 [0054.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ed80 | out: hHeap=0x630000) returned 1 [0054.373] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0054.373] WriteFile (in: hFile=0x230, lpBuffer=0x65d5e8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65d5e8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0054.374] CloseHandle (hObject=0x230) returned 1 [0054.380] GetProcessHeap () returned 0x630000 [0054.380] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0054.380] GetProcessHeap () returned 0x630000 [0054.380] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b390 | out: hHeap=0x630000) returned 1 [0054.380] GetProcessHeap () returned 0x630000 [0054.380] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0054.380] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm" [0054.380] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm.happythreechoose" [0054.380] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_el-gr.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_el-gr.htm.happythreechoose"), dwFlags=0x1) returned 1 [0054.380] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0054.381] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0054.381] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" [0054.381] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\decryption info.html")) returned 0x20 [0054.381] GetProcessHeap () returned 0x630000 [0054.381] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0054.381] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3d5f05, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3d5f05, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xe4b5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_en-gb.htm", cAlternateFileName="EULA_E~2.HTM")) returned 1 [0054.381] lstrcmpiW (lpString1="EULA_en-gb.htm", lpString2=".") returned 1 [0054.381] lstrcmpiW (lpString1="EULA_en-gb.htm", lpString2="..") returned 1 [0054.381] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_en-gb.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm" [0054.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_en-gb.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0054.381] GetProcessHeap () returned 0x630000 [0054.381] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64ca20 [0054.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_en-gb.htm", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_en-gb.htm", lpUsedDefaultChar=0x0) returned 15 [0054.381] lstrlenA (lpString="EULA_en-gb.htm") returned 14 [0054.381] lstrlenA (lpString=".happythreechoose") returned 17 [0054.381] lstrcmpiW (lpString1="EULA_en-gb.htm", lpString2="Decryption INFO.html") returned 1 [0054.381] lstrcmpiW (lpString1="EULA_en-gb.htm", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0054.381] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0054.381] lstrcmpiW (lpString1="EULA_en-gb.htm", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0054.381] GetProcessHeap () returned 0x630000 [0054.381] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0054.381] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-gb.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0054.382] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=58549) returned 1 [0054.382] GetProcessHeap () returned 0x630000 [0054.382] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x65b390 [0054.382] GetProcessHeap () returned 0x630000 [0054.382] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0054.382] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm") returned 52 [0054.382] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0054.382] GetProcessHeap () returned 0x630000 [0054.382] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0054.382] GetProcessHeap () returned 0x630000 [0054.382] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x65d620 [0054.382] lstrlenA (lpString="rsa_encrypt") returned 11 [0054.382] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0054.383] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0054.383] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0054.383] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0054.383] GetProcessHeap () returned 0x630000 [0054.383] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0054.383] lstrlenA (lpString="010001") returned 6 [0054.383] GetProcessHeap () returned 0x630000 [0054.383] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0054.383] GetProcessHeap () returned 0x630000 [0054.383] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0054.383] GetProcessHeap () returned 0x630000 [0054.383] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e7c0 [0054.383] GetProcessHeap () returned 0x630000 [0054.383] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0054.383] GetProcessHeap () returned 0x630000 [0054.383] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e8e0 [0054.383] GetProcessHeap () returned 0x630000 [0054.383] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656fe0 [0054.383] GetProcessHeap () returned 0x630000 [0054.383] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a348 [0054.383] GetProcessHeap () returned 0x630000 [0054.383] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0054.383] GetProcessHeap () returned 0x630000 [0054.383] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.383] GetProcessHeap () returned 0x630000 [0054.383] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0054.383] GetProcessHeap () returned 0x630000 [0054.383] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0054.383] GetProcessHeap () returned 0x630000 [0054.383] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656950 [0054.383] GetProcessHeap () returned 0x630000 [0054.384] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.384] GetProcessHeap () returned 0x630000 [0054.384] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0054.384] GetProcessHeap () returned 0x630000 [0054.384] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65eb20 [0054.384] GetProcessHeap () returned 0x630000 [0054.384] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0054.384] GetProcessHeap () returned 0x630000 [0054.384] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0054.384] GetProcessHeap () returned 0x630000 [0054.384] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0054.384] GetProcessHeap () returned 0x630000 [0054.384] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.384] GetProcessHeap () returned 0x630000 [0054.384] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65a678 [0054.384] GetProcessHeap () returned 0x630000 [0054.384] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.384] GetProcessHeap () returned 0x630000 [0054.384] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.384] GetProcessHeap () returned 0x630000 [0054.384] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.384] GetProcessHeap () returned 0x630000 [0054.384] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.384] GetProcessHeap () returned 0x630000 [0054.384] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65eb20 [0054.384] GetProcessHeap () returned 0x630000 [0054.384] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a678 | out: hHeap=0x630000) returned 1 [0054.384] GetProcessHeap () returned 0x630000 [0054.384] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0054.384] GetProcessHeap () returned 0x630000 [0054.384] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0054.384] GetProcessHeap () returned 0x630000 [0054.384] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.384] GetProcessHeap () returned 0x630000 [0054.384] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.384] GetProcessHeap () returned 0x630000 [0054.384] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0054.384] GetProcessHeap () returned 0x630000 [0054.384] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0054.384] GetProcessHeap () returned 0x630000 [0054.385] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.385] GetProcessHeap () returned 0x630000 [0054.385] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.385] GetProcessHeap () returned 0x630000 [0054.385] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0054.385] GetProcessHeap () returned 0x630000 [0054.385] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0054.385] GetProcessHeap () returned 0x630000 [0054.385] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.385] GetProcessHeap () returned 0x630000 [0054.385] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.385] GetProcessHeap () returned 0x630000 [0054.385] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.385] GetProcessHeap () returned 0x630000 [0054.385] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.385] GetProcessHeap () returned 0x630000 [0054.385] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.385] GetProcessHeap () returned 0x630000 [0054.385] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.385] GetProcessHeap () returned 0x630000 [0054.385] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.385] GetProcessHeap () returned 0x630000 [0054.385] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.385] GetProcessHeap () returned 0x630000 [0054.385] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0054.385] GetProcessHeap () returned 0x630000 [0054.385] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0054.385] GetProcessHeap () returned 0x630000 [0054.385] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.385] GetProcessHeap () returned 0x630000 [0054.385] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.385] GetProcessHeap () returned 0x630000 [0054.385] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.385] GetProcessHeap () returned 0x630000 [0054.385] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.385] GetProcessHeap () returned 0x630000 [0054.385] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0054.385] GetProcessHeap () returned 0x630000 [0054.385] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0054.386] GetProcessHeap () returned 0x630000 [0054.386] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.386] GetProcessHeap () returned 0x630000 [0054.386] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.386] GetProcessHeap () returned 0x630000 [0054.386] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.386] GetProcessHeap () returned 0x630000 [0054.386] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.386] GetProcessHeap () returned 0x630000 [0054.386] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0054.386] GetProcessHeap () returned 0x630000 [0054.386] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0054.386] GetProcessHeap () returned 0x630000 [0054.386] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.386] GetProcessHeap () returned 0x630000 [0054.386] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.386] GetProcessHeap () returned 0x630000 [0054.386] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0054.386] GetProcessHeap () returned 0x630000 [0054.386] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0054.386] GetProcessHeap () returned 0x630000 [0054.386] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.386] GetProcessHeap () returned 0x630000 [0054.386] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.386] GetProcessHeap () returned 0x630000 [0054.386] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.386] GetProcessHeap () returned 0x630000 [0054.386] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.386] GetProcessHeap () returned 0x630000 [0054.386] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.386] GetProcessHeap () returned 0x630000 [0054.386] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.386] GetProcessHeap () returned 0x630000 [0054.386] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.386] GetProcessHeap () returned 0x630000 [0054.386] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.386] GetProcessHeap () returned 0x630000 [0054.386] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.387] GetProcessHeap () returned 0x630000 [0054.387] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.387] GetProcessHeap () returned 0x630000 [0054.387] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.387] GetProcessHeap () returned 0x630000 [0054.387] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.387] GetProcessHeap () returned 0x630000 [0054.387] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.387] GetProcessHeap () returned 0x630000 [0054.387] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.387] GetProcessHeap () returned 0x630000 [0054.387] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.387] GetProcessHeap () returned 0x630000 [0054.387] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.387] GetProcessHeap () returned 0x630000 [0054.387] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0054.387] GetProcessHeap () returned 0x630000 [0054.387] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0054.387] GetProcessHeap () returned 0x630000 [0054.387] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0054.387] GetProcessHeap () returned 0x630000 [0054.387] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0054.387] GetProcessHeap () returned 0x630000 [0054.387] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.387] GetProcessHeap () returned 0x630000 [0054.387] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.387] GetProcessHeap () returned 0x630000 [0054.387] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.387] GetProcessHeap () returned 0x630000 [0054.387] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.387] GetProcessHeap () returned 0x630000 [0054.387] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.387] GetProcessHeap () returned 0x630000 [0054.387] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.387] GetProcessHeap () returned 0x630000 [0054.387] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.387] GetProcessHeap () returned 0x630000 [0054.387] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.387] GetProcessHeap () returned 0x630000 [0054.387] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.388] GetProcessHeap () returned 0x630000 [0054.388] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.388] GetProcessHeap () returned 0x630000 [0054.388] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.388] GetProcessHeap () returned 0x630000 [0054.388] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.388] GetProcessHeap () returned 0x630000 [0054.388] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.388] GetProcessHeap () returned 0x630000 [0054.388] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.388] GetProcessHeap () returned 0x630000 [0054.388] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.388] GetProcessHeap () returned 0x630000 [0054.388] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.388] GetProcessHeap () returned 0x630000 [0054.388] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.388] GetProcessHeap () returned 0x630000 [0054.388] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.388] GetProcessHeap () returned 0x630000 [0054.388] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0054.388] GetProcessHeap () returned 0x630000 [0054.388] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0054.388] GetProcessHeap () returned 0x630000 [0054.388] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.388] GetProcessHeap () returned 0x630000 [0054.388] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.388] GetProcessHeap () returned 0x630000 [0054.388] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0054.388] GetProcessHeap () returned 0x630000 [0054.388] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0054.388] GetProcessHeap () returned 0x630000 [0054.388] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.388] GetProcessHeap () returned 0x630000 [0054.388] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.388] GetProcessHeap () returned 0x630000 [0054.388] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.388] GetProcessHeap () returned 0x630000 [0054.388] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.389] GetProcessHeap () returned 0x630000 [0054.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0054.389] GetProcessHeap () returned 0x630000 [0054.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0054.389] GetProcessHeap () returned 0x630000 [0054.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0054.389] GetProcessHeap () returned 0x630000 [0054.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0054.389] GetProcessHeap () returned 0x630000 [0054.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0054.389] GetProcessHeap () returned 0x630000 [0054.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0054.389] GetProcessHeap () returned 0x630000 [0054.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0054.389] GetProcessHeap () returned 0x630000 [0054.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e7c0 | out: hHeap=0x630000) returned 1 [0054.389] GetProcessHeap () returned 0x630000 [0054.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0054.389] GetProcessHeap () returned 0x630000 [0054.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.389] GetProcessHeap () returned 0x630000 [0054.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0054.389] WriteFile (in: hFile=0x230, lpBuffer=0x65d620*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65d620*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0054.393] GetProcessHeap () returned 0x630000 [0054.393] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65d620, Size=0x30) returned 0x65d620 [0054.393] GetProcessHeap () returned 0x630000 [0054.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0054.393] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0054.393] GetProcessHeap () returned 0x630000 [0054.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe4b5) returned 0x65ed80 [0054.396] ReadFile (in: hFile=0x230, lpBuffer=0x65ed80, nNumberOfBytesToRead=0xe4b5, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesRead=0x243d7e8*=0xe4b5, lpOverlapped=0x0) returned 1 [0054.397] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0054.397] WriteFile (in: hFile=0x230, lpBuffer=0x65ed80*, nNumberOfBytesToWrite=0xe4b5, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesWritten=0x243d7e4*=0xe4b5, lpOverlapped=0x0) returned 1 [0054.398] GetProcessHeap () returned 0x630000 [0054.398] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ed80 | out: hHeap=0x630000) returned 1 [0054.400] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0054.400] WriteFile (in: hFile=0x230, lpBuffer=0x65d620*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65d620*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0054.401] CloseHandle (hObject=0x230) returned 1 [0054.403] GetProcessHeap () returned 0x630000 [0054.403] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0054.403] GetProcessHeap () returned 0x630000 [0054.403] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b390 | out: hHeap=0x630000) returned 1 [0054.403] GetProcessHeap () returned 0x630000 [0054.403] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0054.403] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm" [0054.403] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm.happythreechoose" [0054.403] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-gb.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-gb.htm.happythreechoose"), dwFlags=0x1) returned 1 [0054.404] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0054.404] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0054.404] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" [0054.404] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\decryption info.html")) returned 0x20 [0054.404] GetProcessHeap () returned 0x630000 [0054.404] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0054.404] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3d997f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3d997f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xe4b5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_en-us.htm", cAlternateFileName="EULA_E~3.HTM")) returned 1 [0054.404] lstrcmpiW (lpString1="EULA_en-us.htm", lpString2=".") returned 1 [0054.404] lstrcmpiW (lpString1="EULA_en-us.htm", lpString2="..") returned 1 [0054.404] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_en-us.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm" [0054.404] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_en-us.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0054.404] GetProcessHeap () returned 0x630000 [0054.404] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64ca20 [0054.404] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_en-us.htm", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_en-us.htm", lpUsedDefaultChar=0x0) returned 15 [0054.404] lstrlenA (lpString="EULA_en-us.htm") returned 14 [0054.404] lstrlenA (lpString=".happythreechoose") returned 17 [0054.404] lstrcmpiW (lpString1="EULA_en-us.htm", lpString2="Decryption INFO.html") returned 1 [0054.404] lstrcmpiW (lpString1="EULA_en-us.htm", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0054.404] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0054.404] lstrcmpiW (lpString1="EULA_en-us.htm", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0054.404] GetProcessHeap () returned 0x630000 [0054.404] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651ec0 [0054.404] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-us.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0054.407] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=58549) returned 1 [0054.407] GetProcessHeap () returned 0x630000 [0054.407] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x65b0c0 [0054.407] GetProcessHeap () returned 0x630000 [0054.407] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0054.407] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm") returned 52 [0054.408] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0054.408] GetProcessHeap () returned 0x630000 [0054.408] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0054.408] GetProcessHeap () returned 0x630000 [0054.408] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x65d658 [0054.408] lstrlenA (lpString="rsa_encrypt") returned 11 [0054.408] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0054.408] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0054.408] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0054.408] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0054.408] GetProcessHeap () returned 0x630000 [0054.408] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0054.408] lstrlenA (lpString="010001") returned 6 [0054.408] GetProcessHeap () returned 0x630000 [0054.408] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3f8 [0054.409] GetProcessHeap () returned 0x630000 [0054.409] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0054.409] GetProcessHeap () returned 0x630000 [0054.409] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e580 [0054.409] GetProcessHeap () returned 0x630000 [0054.409] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0054.409] GetProcessHeap () returned 0x630000 [0054.409] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea00 [0054.409] GetProcessHeap () returned 0x630000 [0054.409] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656fe0 [0054.409] GetProcessHeap () returned 0x630000 [0054.409] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0054.409] GetProcessHeap () returned 0x630000 [0054.409] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0054.409] GetProcessHeap () returned 0x630000 [0054.409] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.409] GetProcessHeap () returned 0x630000 [0054.409] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0054.409] GetProcessHeap () returned 0x630000 [0054.409] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0054.409] GetProcessHeap () returned 0x630000 [0054.409] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657328 [0054.409] GetProcessHeap () returned 0x630000 [0054.409] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0054.409] GetProcessHeap () returned 0x630000 [0054.409] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0054.409] GetProcessHeap () returned 0x630000 [0054.409] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dec0 [0054.409] GetProcessHeap () returned 0x630000 [0054.409] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0054.409] GetProcessHeap () returned 0x630000 [0054.409] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0054.409] GetProcessHeap () returned 0x630000 [0054.409] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0054.409] GetProcessHeap () returned 0x630000 [0054.409] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.409] GetProcessHeap () returned 0x630000 [0054.409] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65a7e0 [0054.410] GetProcessHeap () returned 0x630000 [0054.410] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0054.410] GetProcessHeap () returned 0x630000 [0054.410] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.410] GetProcessHeap () returned 0x630000 [0054.410] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.410] GetProcessHeap () returned 0x630000 [0054.410] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.410] GetProcessHeap () returned 0x630000 [0054.410] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e7c0 [0054.410] GetProcessHeap () returned 0x630000 [0054.410] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a7e0 | out: hHeap=0x630000) returned 1 [0054.410] GetProcessHeap () returned 0x630000 [0054.410] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0054.410] GetProcessHeap () returned 0x630000 [0054.410] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e7c0 | out: hHeap=0x630000) returned 1 [0054.410] GetProcessHeap () returned 0x630000 [0054.410] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.410] GetProcessHeap () returned 0x630000 [0054.410] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.410] GetProcessHeap () returned 0x630000 [0054.410] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.410] GetProcessHeap () returned 0x630000 [0054.410] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.410] GetProcessHeap () returned 0x630000 [0054.410] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.410] GetProcessHeap () returned 0x630000 [0054.410] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.410] GetProcessHeap () returned 0x630000 [0054.410] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.410] GetProcessHeap () returned 0x630000 [0054.410] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.410] GetProcessHeap () returned 0x630000 [0054.410] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.410] GetProcessHeap () returned 0x630000 [0054.410] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.410] GetProcessHeap () returned 0x630000 [0054.411] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.411] GetProcessHeap () returned 0x630000 [0054.411] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.411] GetProcessHeap () returned 0x630000 [0054.411] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.411] GetProcessHeap () returned 0x630000 [0054.411] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.411] GetProcessHeap () returned 0x630000 [0054.411] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.411] GetProcessHeap () returned 0x630000 [0054.411] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.411] GetProcessHeap () returned 0x630000 [0054.411] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.411] GetProcessHeap () returned 0x630000 [0054.411] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.411] GetProcessHeap () returned 0x630000 [0054.411] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.411] GetProcessHeap () returned 0x630000 [0054.411] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.411] GetProcessHeap () returned 0x630000 [0054.411] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.411] GetProcessHeap () returned 0x630000 [0054.411] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.411] GetProcessHeap () returned 0x630000 [0054.411] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0054.411] GetProcessHeap () returned 0x630000 [0054.411] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0054.411] GetProcessHeap () returned 0x630000 [0054.411] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.411] GetProcessHeap () returned 0x630000 [0054.411] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.411] GetProcessHeap () returned 0x630000 [0054.411] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.411] GetProcessHeap () returned 0x630000 [0054.411] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.411] GetProcessHeap () returned 0x630000 [0054.411] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.412] GetProcessHeap () returned 0x630000 [0054.412] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.412] GetProcessHeap () returned 0x630000 [0054.412] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0054.412] GetProcessHeap () returned 0x630000 [0054.412] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0054.412] GetProcessHeap () returned 0x630000 [0054.412] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.412] GetProcessHeap () returned 0x630000 [0054.412] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.412] GetProcessHeap () returned 0x630000 [0054.412] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.412] GetProcessHeap () returned 0x630000 [0054.412] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.412] GetProcessHeap () returned 0x630000 [0054.412] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.412] GetProcessHeap () returned 0x630000 [0054.412] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.412] GetProcessHeap () returned 0x630000 [0054.412] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0054.412] GetProcessHeap () returned 0x630000 [0054.412] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0054.412] GetProcessHeap () returned 0x630000 [0054.412] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.412] GetProcessHeap () returned 0x630000 [0054.412] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.412] GetProcessHeap () returned 0x630000 [0054.412] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.412] GetProcessHeap () returned 0x630000 [0054.412] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.412] GetProcessHeap () returned 0x630000 [0054.412] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.412] GetProcessHeap () returned 0x630000 [0054.412] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.412] GetProcessHeap () returned 0x630000 [0054.412] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0054.412] GetProcessHeap () returned 0x630000 [0054.412] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0054.435] GetProcessHeap () returned 0x630000 [0054.435] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.436] GetProcessHeap () returned 0x630000 [0054.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.436] GetProcessHeap () returned 0x630000 [0054.436] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.436] GetProcessHeap () returned 0x630000 [0054.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.436] GetProcessHeap () returned 0x630000 [0054.436] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0054.436] GetProcessHeap () returned 0x630000 [0054.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0054.436] GetProcessHeap () returned 0x630000 [0054.436] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.436] GetProcessHeap () returned 0x630000 [0054.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.436] GetProcessHeap () returned 0x630000 [0054.436] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.436] GetProcessHeap () returned 0x630000 [0054.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.436] GetProcessHeap () returned 0x630000 [0054.436] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.436] GetProcessHeap () returned 0x630000 [0054.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.436] GetProcessHeap () returned 0x630000 [0054.436] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0054.436] GetProcessHeap () returned 0x630000 [0054.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0054.436] GetProcessHeap () returned 0x630000 [0054.436] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.436] GetProcessHeap () returned 0x630000 [0054.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.436] GetProcessHeap () returned 0x630000 [0054.436] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.436] GetProcessHeap () returned 0x630000 [0054.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.436] GetProcessHeap () returned 0x630000 [0054.436] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.436] GetProcessHeap () returned 0x630000 [0054.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.437] GetProcessHeap () returned 0x630000 [0054.437] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.437] GetProcessHeap () returned 0x630000 [0054.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.437] GetProcessHeap () returned 0x630000 [0054.437] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0054.437] GetProcessHeap () returned 0x630000 [0054.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0054.437] GetProcessHeap () returned 0x630000 [0054.437] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.437] GetProcessHeap () returned 0x630000 [0054.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.437] GetProcessHeap () returned 0x630000 [0054.437] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0054.437] GetProcessHeap () returned 0x630000 [0054.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0054.437] GetProcessHeap () returned 0x630000 [0054.437] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.437] GetProcessHeap () returned 0x630000 [0054.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.437] GetProcessHeap () returned 0x630000 [0054.437] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.437] GetProcessHeap () returned 0x630000 [0054.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.437] GetProcessHeap () returned 0x630000 [0054.437] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.437] GetProcessHeap () returned 0x630000 [0054.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.437] GetProcessHeap () returned 0x630000 [0054.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0054.437] GetProcessHeap () returned 0x630000 [0054.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0054.437] GetProcessHeap () returned 0x630000 [0054.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0054.437] GetProcessHeap () returned 0x630000 [0054.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0054.437] GetProcessHeap () returned 0x630000 [0054.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0054.438] GetProcessHeap () returned 0x630000 [0054.438] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0054.438] GetProcessHeap () returned 0x630000 [0054.438] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0054.438] GetProcessHeap () returned 0x630000 [0054.438] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0054.438] GetProcessHeap () returned 0x630000 [0054.438] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0054.438] GetProcessHeap () returned 0x630000 [0054.438] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.438] GetProcessHeap () returned 0x630000 [0054.438] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0054.438] WriteFile (in: hFile=0x230, lpBuffer=0x65d658*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65d658*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0054.441] GetProcessHeap () returned 0x630000 [0054.441] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65d658, Size=0x30) returned 0x65d658 [0054.441] GetProcessHeap () returned 0x630000 [0054.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0054.441] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0054.441] GetProcessHeap () returned 0x630000 [0054.441] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe4b5) returned 0x65ed80 [0054.443] ReadFile (in: hFile=0x230, lpBuffer=0x65ed80, nNumberOfBytesToRead=0xe4b5, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesRead=0x243d7e8*=0xe4b5, lpOverlapped=0x0) returned 1 [0054.445] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0054.445] WriteFile (in: hFile=0x230, lpBuffer=0x65ed80*, nNumberOfBytesToWrite=0xe4b5, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesWritten=0x243d7e4*=0xe4b5, lpOverlapped=0x0) returned 1 [0054.447] GetProcessHeap () returned 0x630000 [0054.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ed80 | out: hHeap=0x630000) returned 1 [0054.447] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0054.447] WriteFile (in: hFile=0x230, lpBuffer=0x65d658*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65d658*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0054.448] CloseHandle (hObject=0x230) returned 1 [0054.450] GetProcessHeap () returned 0x630000 [0054.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651ec0 | out: hHeap=0x630000) returned 1 [0054.450] GetProcessHeap () returned 0x630000 [0054.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b0c0 | out: hHeap=0x630000) returned 1 [0054.450] GetProcessHeap () returned 0x630000 [0054.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0054.451] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm" [0054.451] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm.happythreechoose" [0054.451] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-us.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-us.htm.happythreechoose"), dwFlags=0x1) returned 1 [0054.451] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0054.451] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0054.451] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" [0054.451] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\decryption info.html")) returned 0x20 [0054.451] GetProcessHeap () returned 0x630000 [0054.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0054.451] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3dad37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3dad37, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x110b8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_es-es.htm", cAlternateFileName="EULA_E~4.HTM")) returned 1 [0054.451] lstrcmpiW (lpString1="EULA_es-es.htm", lpString2=".") returned 1 [0054.452] lstrcmpiW (lpString1="EULA_es-es.htm", lpString2="..") returned 1 [0054.452] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_es-es.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm" [0054.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_es-es.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0054.452] GetProcessHeap () returned 0x630000 [0054.452] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0054.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_es-es.htm", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_es-es.htm", lpUsedDefaultChar=0x0) returned 15 [0054.452] lstrlenA (lpString="EULA_es-es.htm") returned 14 [0054.452] lstrlenA (lpString=".happythreechoose") returned 17 [0054.452] lstrcmpiW (lpString1="EULA_es-es.htm", lpString2="Decryption INFO.html") returned 1 [0054.452] lstrcmpiW (lpString1="EULA_es-es.htm", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0054.452] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0054.452] lstrcmpiW (lpString1="EULA_es-es.htm", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0054.452] GetProcessHeap () returned 0x630000 [0054.452] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651ec0 [0054.452] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-es.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0054.452] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=69816) returned 1 [0054.452] GetProcessHeap () returned 0x630000 [0054.452] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x65b228 [0054.452] GetProcessHeap () returned 0x630000 [0054.452] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0054.452] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm") returned 52 [0054.452] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0054.453] GetProcessHeap () returned 0x630000 [0054.453] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0054.453] GetProcessHeap () returned 0x630000 [0054.453] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x388) returned 0x65d690 [0054.453] lstrlenA (lpString="rsa_encrypt") returned 11 [0054.453] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0054.453] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0054.453] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0054.453] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0054.453] GetProcessHeap () returned 0x630000 [0054.453] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0054.453] lstrlenA (lpString="010001") returned 6 [0054.453] GetProcessHeap () returned 0x630000 [0054.453] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a398 [0054.453] GetProcessHeap () returned 0x630000 [0054.454] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0054.454] GetProcessHeap () returned 0x630000 [0054.454] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e580 [0054.454] GetProcessHeap () returned 0x630000 [0054.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0054.454] GetProcessHeap () returned 0x630000 [0054.454] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea00 [0054.454] GetProcessHeap () returned 0x630000 [0054.454] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656db0 [0054.454] GetProcessHeap () returned 0x630000 [0054.454] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3a8 [0054.454] GetProcessHeap () returned 0x630000 [0054.454] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0054.454] GetProcessHeap () returned 0x630000 [0054.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0054.454] GetProcessHeap () returned 0x630000 [0054.454] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0054.454] GetProcessHeap () returned 0x630000 [0054.454] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0054.454] GetProcessHeap () returned 0x630000 [0054.454] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657210 [0054.454] GetProcessHeap () returned 0x630000 [0054.454] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0054.454] GetProcessHeap () returned 0x630000 [0054.454] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0054.454] GetProcessHeap () returned 0x630000 [0054.454] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e970 [0054.454] GetProcessHeap () returned 0x630000 [0054.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0054.454] GetProcessHeap () returned 0x630000 [0054.454] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0054.454] GetProcessHeap () returned 0x630000 [0054.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0054.454] GetProcessHeap () returned 0x630000 [0054.454] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.454] GetProcessHeap () returned 0x630000 [0054.454] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65a570 [0054.454] GetProcessHeap () returned 0x630000 [0054.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0054.455] GetProcessHeap () returned 0x630000 [0054.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.455] GetProcessHeap () returned 0x630000 [0054.455] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.455] GetProcessHeap () returned 0x630000 [0054.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.455] GetProcessHeap () returned 0x630000 [0054.455] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ec40 [0054.455] GetProcessHeap () returned 0x630000 [0054.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a570 | out: hHeap=0x630000) returned 1 [0054.455] GetProcessHeap () returned 0x630000 [0054.455] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0054.455] GetProcessHeap () returned 0x630000 [0054.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ec40 | out: hHeap=0x630000) returned 1 [0054.455] GetProcessHeap () returned 0x630000 [0054.455] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.455] GetProcessHeap () returned 0x630000 [0054.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.455] GetProcessHeap () returned 0x630000 [0054.455] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0054.455] GetProcessHeap () returned 0x630000 [0054.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0054.455] GetProcessHeap () returned 0x630000 [0054.455] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.455] GetProcessHeap () returned 0x630000 [0054.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.455] GetProcessHeap () returned 0x630000 [0054.455] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.455] GetProcessHeap () returned 0x630000 [0054.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.455] GetProcessHeap () returned 0x630000 [0054.455] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0054.455] GetProcessHeap () returned 0x630000 [0054.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0054.455] GetProcessHeap () returned 0x630000 [0054.455] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.455] GetProcessHeap () returned 0x630000 [0054.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.455] GetProcessHeap () returned 0x630000 [0054.456] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.456] GetProcessHeap () returned 0x630000 [0054.456] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.456] GetProcessHeap () returned 0x630000 [0054.456] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.456] GetProcessHeap () returned 0x630000 [0054.456] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.456] GetProcessHeap () returned 0x630000 [0054.456] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.456] GetProcessHeap () returned 0x630000 [0054.456] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.456] GetProcessHeap () returned 0x630000 [0054.456] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.456] GetProcessHeap () returned 0x630000 [0054.456] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.456] GetProcessHeap () returned 0x630000 [0054.456] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.456] GetProcessHeap () returned 0x630000 [0054.456] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.456] GetProcessHeap () returned 0x630000 [0054.456] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.456] GetProcessHeap () returned 0x630000 [0054.456] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.456] GetProcessHeap () returned 0x630000 [0054.456] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0054.456] GetProcessHeap () returned 0x630000 [0054.456] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0054.456] GetProcessHeap () returned 0x630000 [0054.456] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.456] GetProcessHeap () returned 0x630000 [0054.456] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.456] GetProcessHeap () returned 0x630000 [0054.456] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0054.456] GetProcessHeap () returned 0x630000 [0054.456] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0054.456] GetProcessHeap () returned 0x630000 [0054.456] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.456] GetProcessHeap () returned 0x630000 [0054.457] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.457] GetProcessHeap () returned 0x630000 [0054.457] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.457] GetProcessHeap () returned 0x630000 [0054.457] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.457] GetProcessHeap () returned 0x630000 [0054.457] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.457] GetProcessHeap () returned 0x630000 [0054.457] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.457] GetProcessHeap () returned 0x630000 [0054.457] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.457] GetProcessHeap () returned 0x630000 [0054.457] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.457] GetProcessHeap () returned 0x630000 [0054.457] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0054.457] GetProcessHeap () returned 0x630000 [0054.457] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0054.457] GetProcessHeap () returned 0x630000 [0054.457] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.457] GetProcessHeap () returned 0x630000 [0054.457] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.457] GetProcessHeap () returned 0x630000 [0054.457] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.457] GetProcessHeap () returned 0x630000 [0054.457] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.457] GetProcessHeap () returned 0x630000 [0054.457] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.457] GetProcessHeap () returned 0x630000 [0054.457] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.457] GetProcessHeap () returned 0x630000 [0054.457] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.457] GetProcessHeap () returned 0x630000 [0054.457] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.457] GetProcessHeap () returned 0x630000 [0054.457] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.457] GetProcessHeap () returned 0x630000 [0054.457] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.457] GetProcessHeap () returned 0x630000 [0054.457] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.458] GetProcessHeap () returned 0x630000 [0054.458] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.458] GetProcessHeap () returned 0x630000 [0054.458] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0054.458] GetProcessHeap () returned 0x630000 [0054.458] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0054.458] GetProcessHeap () returned 0x630000 [0054.458] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.458] GetProcessHeap () returned 0x630000 [0054.458] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.458] GetProcessHeap () returned 0x630000 [0054.458] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.458] GetProcessHeap () returned 0x630000 [0054.458] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.458] GetProcessHeap () returned 0x630000 [0054.458] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0054.458] GetProcessHeap () returned 0x630000 [0054.458] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0054.458] GetProcessHeap () returned 0x630000 [0054.458] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0054.458] GetProcessHeap () returned 0x630000 [0054.458] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0054.458] GetProcessHeap () returned 0x630000 [0054.458] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.458] GetProcessHeap () returned 0x630000 [0054.458] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.458] GetProcessHeap () returned 0x630000 [0054.458] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0054.458] GetProcessHeap () returned 0x630000 [0054.458] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0054.458] GetProcessHeap () returned 0x630000 [0054.458] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0054.458] GetProcessHeap () returned 0x630000 [0054.458] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0054.458] GetProcessHeap () returned 0x630000 [0054.458] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.458] GetProcessHeap () returned 0x630000 [0054.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.459] GetProcessHeap () returned 0x630000 [0054.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0054.459] GetProcessHeap () returned 0x630000 [0054.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0054.459] GetProcessHeap () returned 0x630000 [0054.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.459] GetProcessHeap () returned 0x630000 [0054.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.459] GetProcessHeap () returned 0x630000 [0054.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0054.459] GetProcessHeap () returned 0x630000 [0054.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0054.459] GetProcessHeap () returned 0x630000 [0054.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.459] GetProcessHeap () returned 0x630000 [0054.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.459] GetProcessHeap () returned 0x630000 [0054.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.459] GetProcessHeap () returned 0x630000 [0054.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.459] GetProcessHeap () returned 0x630000 [0054.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.459] GetProcessHeap () returned 0x630000 [0054.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.459] GetProcessHeap () returned 0x630000 [0054.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0054.459] GetProcessHeap () returned 0x630000 [0054.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0054.459] GetProcessHeap () returned 0x630000 [0054.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0054.459] GetProcessHeap () returned 0x630000 [0054.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0054.459] GetProcessHeap () returned 0x630000 [0054.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0054.460] GetProcessHeap () returned 0x630000 [0054.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0054.460] GetProcessHeap () returned 0x630000 [0054.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0054.460] GetProcessHeap () returned 0x630000 [0054.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0054.460] GetProcessHeap () returned 0x630000 [0054.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0054.460] GetProcessHeap () returned 0x630000 [0054.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0054.460] GetProcessHeap () returned 0x630000 [0054.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0054.460] WriteFile (in: hFile=0x230, lpBuffer=0x65d690*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65d690*, lpNumberOfBytesWritten=0x243d864*=0x388, lpOverlapped=0x0) returned 1 [0054.464] GetProcessHeap () returned 0x630000 [0054.464] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65d690, Size=0x30) returned 0x65d690 [0054.464] GetProcessHeap () returned 0x630000 [0054.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0054.464] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0054.464] GetProcessHeap () returned 0x630000 [0054.464] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x110c0) returned 0x65ed80 [0054.464] ReadFile (in: hFile=0x230, lpBuffer=0x65ed80, nNumberOfBytesToRead=0x110c0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesRead=0x243d7e8*=0x110c0, lpOverlapped=0x0) returned 1 [0054.465] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0054.465] WriteFile (in: hFile=0x230, lpBuffer=0x65ed80*, nNumberOfBytesToWrite=0x110c0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesWritten=0x243d7e4*=0x110c0, lpOverlapped=0x0) returned 1 [0054.467] GetProcessHeap () returned 0x630000 [0054.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ed80 | out: hHeap=0x630000) returned 1 [0054.467] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0054.467] WriteFile (in: hFile=0x230, lpBuffer=0x65d690*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65d690*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0054.468] CloseHandle (hObject=0x230) returned 1 [0054.472] GetProcessHeap () returned 0x630000 [0054.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651ec0 | out: hHeap=0x630000) returned 1 [0054.472] GetProcessHeap () returned 0x630000 [0054.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b228 | out: hHeap=0x630000) returned 1 [0054.472] GetProcessHeap () returned 0x630000 [0054.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0054.472] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm" [0054.472] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm.happythreechoose" [0054.472] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-es.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-es.htm.happythreechoose"), dwFlags=0x1) returned 1 [0054.473] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0054.473] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0054.473] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" [0054.473] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\decryption info.html")) returned 0x20 [0054.473] GetProcessHeap () returned 0x630000 [0054.473] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0054.473] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3dc0bd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3dc0bd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x110b8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_es-mx.htm", cAlternateFileName="EU6344~1.HTM")) returned 1 [0054.473] lstrcmpiW (lpString1="EULA_es-mx.htm", lpString2=".") returned 1 [0054.473] lstrcmpiW (lpString1="EULA_es-mx.htm", lpString2="..") returned 1 [0054.473] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_es-mx.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm" [0054.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_es-mx.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0054.473] GetProcessHeap () returned 0x630000 [0054.473] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64ca20 [0054.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_es-mx.htm", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_es-mx.htm", lpUsedDefaultChar=0x0) returned 15 [0054.473] lstrlenA (lpString="EULA_es-mx.htm") returned 14 [0054.473] lstrlenA (lpString=".happythreechoose") returned 17 [0054.473] lstrcmpiW (lpString1="EULA_es-mx.htm", lpString2="Decryption INFO.html") returned 1 [0054.473] lstrcmpiW (lpString1="EULA_es-mx.htm", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0054.473] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0054.473] lstrcmpiW (lpString1="EULA_es-mx.htm", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0054.474] GetProcessHeap () returned 0x630000 [0054.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0054.474] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-mx.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0054.474] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=69816) returned 1 [0054.474] GetProcessHeap () returned 0x630000 [0054.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x65b2a0 [0054.474] GetProcessHeap () returned 0x630000 [0054.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0054.474] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm") returned 52 [0054.474] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0054.474] GetProcessHeap () returned 0x630000 [0054.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0054.474] GetProcessHeap () returned 0x630000 [0054.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x388) returned 0x65d6c8 [0054.474] lstrlenA (lpString="rsa_encrypt") returned 11 [0054.474] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0054.475] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0054.475] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0054.475] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0054.475] GetProcessHeap () returned 0x630000 [0054.475] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0054.475] lstrlenA (lpString="010001") returned 6 [0054.475] GetProcessHeap () returned 0x630000 [0054.475] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2b8 [0054.475] GetProcessHeap () returned 0x630000 [0054.475] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0054.475] GetProcessHeap () returned 0x630000 [0054.475] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0054.475] GetProcessHeap () returned 0x630000 [0054.476] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0054.476] GetProcessHeap () returned 0x630000 [0054.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65eb20 [0054.476] GetProcessHeap () returned 0x630000 [0054.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656c98 [0054.476] GetProcessHeap () returned 0x630000 [0054.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0054.476] GetProcessHeap () returned 0x630000 [0054.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0054.476] GetProcessHeap () returned 0x630000 [0054.476] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.476] GetProcessHeap () returned 0x630000 [0054.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0054.476] GetProcessHeap () returned 0x630000 [0054.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0054.476] GetProcessHeap () returned 0x630000 [0054.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656db0 [0054.476] GetProcessHeap () returned 0x630000 [0054.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.476] GetProcessHeap () returned 0x630000 [0054.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0054.476] GetProcessHeap () returned 0x630000 [0054.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e850 [0054.476] GetProcessHeap () returned 0x630000 [0054.476] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0054.476] GetProcessHeap () returned 0x630000 [0054.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0054.476] GetProcessHeap () returned 0x630000 [0054.476] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0054.476] GetProcessHeap () returned 0x630000 [0054.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.476] GetProcessHeap () returned 0x630000 [0054.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65a618 [0054.476] GetProcessHeap () returned 0x630000 [0054.476] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.476] GetProcessHeap () returned 0x630000 [0054.476] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.477] GetProcessHeap () returned 0x630000 [0054.477] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.477] GetProcessHeap () returned 0x630000 [0054.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.477] GetProcessHeap () returned 0x630000 [0054.477] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e2b0 [0054.477] GetProcessHeap () returned 0x630000 [0054.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a618 | out: hHeap=0x630000) returned 1 [0054.477] GetProcessHeap () returned 0x630000 [0054.477] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0054.477] GetProcessHeap () returned 0x630000 [0054.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e2b0 | out: hHeap=0x630000) returned 1 [0054.477] GetProcessHeap () returned 0x630000 [0054.477] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.477] GetProcessHeap () returned 0x630000 [0054.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.477] GetProcessHeap () returned 0x630000 [0054.477] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0054.477] GetProcessHeap () returned 0x630000 [0054.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0054.477] GetProcessHeap () returned 0x630000 [0054.477] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.477] GetProcessHeap () returned 0x630000 [0054.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.477] GetProcessHeap () returned 0x630000 [0054.477] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0054.477] GetProcessHeap () returned 0x630000 [0054.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0054.477] GetProcessHeap () returned 0x630000 [0054.477] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.477] GetProcessHeap () returned 0x630000 [0054.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.477] GetProcessHeap () returned 0x630000 [0054.477] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.478] GetProcessHeap () returned 0x630000 [0054.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.478] GetProcessHeap () returned 0x630000 [0054.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.478] GetProcessHeap () returned 0x630000 [0054.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.478] GetProcessHeap () returned 0x630000 [0054.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.478] GetProcessHeap () returned 0x630000 [0054.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.478] GetProcessHeap () returned 0x630000 [0054.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.478] GetProcessHeap () returned 0x630000 [0054.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.478] GetProcessHeap () returned 0x630000 [0054.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.478] GetProcessHeap () returned 0x630000 [0054.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.478] GetProcessHeap () returned 0x630000 [0054.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.478] GetProcessHeap () returned 0x630000 [0054.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.478] GetProcessHeap () returned 0x630000 [0054.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.478] GetProcessHeap () returned 0x630000 [0054.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.478] GetProcessHeap () returned 0x630000 [0054.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.478] GetProcessHeap () returned 0x630000 [0054.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.478] GetProcessHeap () returned 0x630000 [0054.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0054.478] GetProcessHeap () returned 0x630000 [0054.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0054.478] GetProcessHeap () returned 0x630000 [0054.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.478] GetProcessHeap () returned 0x630000 [0054.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.479] GetProcessHeap () returned 0x630000 [0054.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.479] GetProcessHeap () returned 0x630000 [0054.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.479] GetProcessHeap () returned 0x630000 [0054.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.479] GetProcessHeap () returned 0x630000 [0054.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.479] GetProcessHeap () returned 0x630000 [0054.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.479] GetProcessHeap () returned 0x630000 [0054.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.479] GetProcessHeap () returned 0x630000 [0054.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.479] GetProcessHeap () returned 0x630000 [0054.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.479] GetProcessHeap () returned 0x630000 [0054.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.479] GetProcessHeap () returned 0x630000 [0054.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.479] GetProcessHeap () returned 0x630000 [0054.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.479] GetProcessHeap () returned 0x630000 [0054.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.479] GetProcessHeap () returned 0x630000 [0054.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.479] GetProcessHeap () returned 0x630000 [0054.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.479] GetProcessHeap () returned 0x630000 [0054.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.479] GetProcessHeap () returned 0x630000 [0054.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.479] GetProcessHeap () returned 0x630000 [0054.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.479] GetProcessHeap () returned 0x630000 [0054.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.479] GetProcessHeap () returned 0x630000 [0054.480] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0054.480] GetProcessHeap () returned 0x630000 [0054.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0054.480] GetProcessHeap () returned 0x630000 [0054.480] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.480] GetProcessHeap () returned 0x630000 [0054.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.480] GetProcessHeap () returned 0x630000 [0054.480] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0054.480] GetProcessHeap () returned 0x630000 [0054.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0054.480] GetProcessHeap () returned 0x630000 [0054.480] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.480] GetProcessHeap () returned 0x630000 [0054.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.480] GetProcessHeap () returned 0x630000 [0054.480] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.480] GetProcessHeap () returned 0x630000 [0054.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.480] GetProcessHeap () returned 0x630000 [0054.480] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.480] GetProcessHeap () returned 0x630000 [0054.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.480] GetProcessHeap () returned 0x630000 [0054.480] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.480] GetProcessHeap () returned 0x630000 [0054.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.480] GetProcessHeap () returned 0x630000 [0054.480] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0054.480] GetProcessHeap () returned 0x630000 [0054.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0054.480] GetProcessHeap () returned 0x630000 [0054.480] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0054.480] GetProcessHeap () returned 0x630000 [0054.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0054.480] GetProcessHeap () returned 0x630000 [0054.480] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.480] GetProcessHeap () returned 0x630000 [0054.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.481] GetProcessHeap () returned 0x630000 [0054.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.481] GetProcessHeap () returned 0x630000 [0054.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.481] GetProcessHeap () returned 0x630000 [0054.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.481] GetProcessHeap () returned 0x630000 [0054.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.481] GetProcessHeap () returned 0x630000 [0054.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.481] GetProcessHeap () returned 0x630000 [0054.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.481] GetProcessHeap () returned 0x630000 [0054.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.481] GetProcessHeap () returned 0x630000 [0054.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.481] GetProcessHeap () returned 0x630000 [0054.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0054.481] GetProcessHeap () returned 0x630000 [0054.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0054.481] GetProcessHeap () returned 0x630000 [0054.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0054.481] GetProcessHeap () returned 0x630000 [0054.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0054.481] GetProcessHeap () returned 0x630000 [0054.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.481] GetProcessHeap () returned 0x630000 [0054.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.481] GetProcessHeap () returned 0x630000 [0054.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0054.481] GetProcessHeap () returned 0x630000 [0054.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0054.481] GetProcessHeap () returned 0x630000 [0054.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0054.481] GetProcessHeap () returned 0x630000 [0054.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0054.481] GetProcessHeap () returned 0x630000 [0054.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0054.482] GetProcessHeap () returned 0x630000 [0054.482] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0054.482] GetProcessHeap () returned 0x630000 [0054.482] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0054.482] GetProcessHeap () returned 0x630000 [0054.482] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0054.482] GetProcessHeap () returned 0x630000 [0054.482] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0054.482] GetProcessHeap () returned 0x630000 [0054.482] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0054.482] GetProcessHeap () returned 0x630000 [0054.482] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0054.482] WriteFile (in: hFile=0x230, lpBuffer=0x65d6c8*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65d6c8*, lpNumberOfBytesWritten=0x243d864*=0x388, lpOverlapped=0x0) returned 1 [0054.485] GetProcessHeap () returned 0x630000 [0054.485] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65d6c8, Size=0x30) returned 0x65d6c8 [0054.485] GetProcessHeap () returned 0x630000 [0054.485] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0054.485] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0054.485] GetProcessHeap () returned 0x630000 [0054.485] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x110c0) returned 0x65ed80 [0054.485] ReadFile (in: hFile=0x230, lpBuffer=0x65ed80, nNumberOfBytesToRead=0x110c0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesRead=0x243d7e8*=0x110c0, lpOverlapped=0x0) returned 1 [0054.486] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0054.486] WriteFile (in: hFile=0x230, lpBuffer=0x65ed80*, nNumberOfBytesToWrite=0x110c0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesWritten=0x243d7e4*=0x110c0, lpOverlapped=0x0) returned 1 [0054.508] GetProcessHeap () returned 0x630000 [0054.508] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ed80 | out: hHeap=0x630000) returned 1 [0054.510] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0054.510] WriteFile (in: hFile=0x230, lpBuffer=0x65d6c8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65d6c8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0054.511] CloseHandle (hObject=0x230) returned 1 [0054.513] GetProcessHeap () returned 0x630000 [0054.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0054.513] GetProcessHeap () returned 0x630000 [0054.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b2a0 | out: hHeap=0x630000) returned 1 [0054.513] GetProcessHeap () returned 0x630000 [0054.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0054.513] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm" [0054.513] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm.happythreechoose" [0054.513] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-mx.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-mx.htm.happythreechoose"), dwFlags=0x1) returned 1 [0054.514] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0054.514] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0054.514] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" [0054.514] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\decryption info.html")) returned 0x20 [0054.514] GetProcessHeap () returned 0x630000 [0054.514] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0054.514] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3dd45a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3dd45a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xf67d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_et-ee.htm", cAlternateFileName="EU56AC~1.HTM")) returned 1 [0054.514] lstrcmpiW (lpString1="EULA_et-ee.htm", lpString2=".") returned 1 [0054.514] lstrcmpiW (lpString1="EULA_et-ee.htm", lpString2="..") returned 1 [0054.514] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_et-ee.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm" [0054.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_et-ee.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0054.514] GetProcessHeap () returned 0x630000 [0054.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0054.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_et-ee.htm", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_et-ee.htm", lpUsedDefaultChar=0x0) returned 15 [0054.514] lstrlenA (lpString="EULA_et-ee.htm") returned 14 [0054.515] lstrlenA (lpString=".happythreechoose") returned 17 [0054.515] lstrcmpiW (lpString1="EULA_et-ee.htm", lpString2="Decryption INFO.html") returned 1 [0054.515] lstrcmpiW (lpString1="EULA_et-ee.htm", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0054.515] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0054.515] lstrcmpiW (lpString1="EULA_et-ee.htm", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0054.515] GetProcessHeap () returned 0x630000 [0054.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0054.515] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_et-ee.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0054.515] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=63101) returned 1 [0054.515] GetProcessHeap () returned 0x630000 [0054.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x65b228 [0054.515] GetProcessHeap () returned 0x630000 [0054.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0054.515] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm") returned 52 [0054.515] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0054.515] GetProcessHeap () returned 0x630000 [0054.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0054.515] GetProcessHeap () returned 0x630000 [0054.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x65d700 [0054.515] lstrlenA (lpString="rsa_encrypt") returned 11 [0054.515] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0054.516] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0054.516] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0054.516] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0054.516] GetProcessHeap () returned 0x630000 [0054.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0054.516] lstrlenA (lpString="010001") returned 6 [0054.516] GetProcessHeap () returned 0x630000 [0054.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3f8 [0054.516] GetProcessHeap () returned 0x630000 [0054.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0054.516] GetProcessHeap () returned 0x630000 [0054.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0054.516] GetProcessHeap () returned 0x630000 [0054.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0054.516] GetProcessHeap () returned 0x630000 [0054.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e460 [0054.516] GetProcessHeap () returned 0x630000 [0054.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656fe0 [0054.517] GetProcessHeap () returned 0x630000 [0054.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a298 [0054.517] GetProcessHeap () returned 0x630000 [0054.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0054.517] GetProcessHeap () returned 0x630000 [0054.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.517] GetProcessHeap () returned 0x630000 [0054.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0054.517] GetProcessHeap () returned 0x630000 [0054.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0054.517] GetProcessHeap () returned 0x630000 [0054.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656c98 [0054.517] GetProcessHeap () returned 0x630000 [0054.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0054.517] GetProcessHeap () returned 0x630000 [0054.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0054.517] GetProcessHeap () returned 0x630000 [0054.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dfe0 [0054.517] GetProcessHeap () returned 0x630000 [0054.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0054.517] GetProcessHeap () returned 0x630000 [0054.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0054.517] GetProcessHeap () returned 0x630000 [0054.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0054.517] GetProcessHeap () returned 0x630000 [0054.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0054.517] GetProcessHeap () returned 0x630000 [0054.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65a4f8 [0054.517] GetProcessHeap () returned 0x630000 [0054.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0054.517] GetProcessHeap () returned 0x630000 [0054.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0054.517] GetProcessHeap () returned 0x630000 [0054.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0054.517] GetProcessHeap () returned 0x630000 [0054.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0054.517] GetProcessHeap () returned 0x630000 [0054.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65dec0 [0054.517] GetProcessHeap () returned 0x630000 [0054.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a4f8 | out: hHeap=0x630000) returned 1 [0054.517] GetProcessHeap () returned 0x630000 [0054.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0054.518] GetProcessHeap () returned 0x630000 [0054.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0054.518] GetProcessHeap () returned 0x630000 [0054.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.518] GetProcessHeap () returned 0x630000 [0054.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.518] GetProcessHeap () returned 0x630000 [0054.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.518] GetProcessHeap () returned 0x630000 [0054.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.518] GetProcessHeap () returned 0x630000 [0054.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.518] GetProcessHeap () returned 0x630000 [0054.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.518] GetProcessHeap () returned 0x630000 [0054.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.518] GetProcessHeap () returned 0x630000 [0054.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.518] GetProcessHeap () returned 0x630000 [0054.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.518] GetProcessHeap () returned 0x630000 [0054.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.518] GetProcessHeap () returned 0x630000 [0054.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.518] GetProcessHeap () returned 0x630000 [0054.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.518] GetProcessHeap () returned 0x630000 [0054.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0054.518] GetProcessHeap () returned 0x630000 [0054.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0054.518] GetProcessHeap () returned 0x630000 [0054.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0054.518] GetProcessHeap () returned 0x630000 [0054.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0054.518] GetProcessHeap () returned 0x630000 [0054.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.518] GetProcessHeap () returned 0x630000 [0054.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.519] GetProcessHeap () returned 0x630000 [0054.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.519] GetProcessHeap () returned 0x630000 [0054.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.519] GetProcessHeap () returned 0x630000 [0054.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.519] GetProcessHeap () returned 0x630000 [0054.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.519] GetProcessHeap () returned 0x630000 [0054.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.519] GetProcessHeap () returned 0x630000 [0054.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.519] GetProcessHeap () returned 0x630000 [0054.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0054.519] GetProcessHeap () returned 0x630000 [0054.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0054.519] GetProcessHeap () returned 0x630000 [0054.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.519] GetProcessHeap () returned 0x630000 [0054.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.519] GetProcessHeap () returned 0x630000 [0054.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0054.519] GetProcessHeap () returned 0x630000 [0054.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0054.519] GetProcessHeap () returned 0x630000 [0054.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.519] GetProcessHeap () returned 0x630000 [0054.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.519] GetProcessHeap () returned 0x630000 [0054.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.519] GetProcessHeap () returned 0x630000 [0054.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.519] GetProcessHeap () returned 0x630000 [0054.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.519] GetProcessHeap () returned 0x630000 [0054.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.519] GetProcessHeap () returned 0x630000 [0054.520] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.520] GetProcessHeap () returned 0x630000 [0054.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.520] GetProcessHeap () returned 0x630000 [0054.520] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.520] GetProcessHeap () returned 0x630000 [0054.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.520] GetProcessHeap () returned 0x630000 [0054.520] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.520] GetProcessHeap () returned 0x630000 [0054.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.520] GetProcessHeap () returned 0x630000 [0054.520] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.520] GetProcessHeap () returned 0x630000 [0054.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.520] GetProcessHeap () returned 0x630000 [0054.520] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0054.520] GetProcessHeap () returned 0x630000 [0054.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0054.520] GetProcessHeap () returned 0x630000 [0054.520] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.520] GetProcessHeap () returned 0x630000 [0054.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.520] GetProcessHeap () returned 0x630000 [0054.520] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0054.520] GetProcessHeap () returned 0x630000 [0054.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0054.520] GetProcessHeap () returned 0x630000 [0054.520] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.520] GetProcessHeap () returned 0x630000 [0054.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.520] GetProcessHeap () returned 0x630000 [0054.520] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.520] GetProcessHeap () returned 0x630000 [0054.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.520] GetProcessHeap () returned 0x630000 [0054.520] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.520] GetProcessHeap () returned 0x630000 [0054.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.521] GetProcessHeap () returned 0x630000 [0054.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.521] GetProcessHeap () returned 0x630000 [0054.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.521] GetProcessHeap () returned 0x630000 [0054.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.521] GetProcessHeap () returned 0x630000 [0054.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.521] GetProcessHeap () returned 0x630000 [0054.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0054.521] GetProcessHeap () returned 0x630000 [0054.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0054.521] GetProcessHeap () returned 0x630000 [0054.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.521] GetProcessHeap () returned 0x630000 [0054.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.521] GetProcessHeap () returned 0x630000 [0054.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0054.521] GetProcessHeap () returned 0x630000 [0054.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0054.521] GetProcessHeap () returned 0x630000 [0054.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.521] GetProcessHeap () returned 0x630000 [0054.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.521] GetProcessHeap () returned 0x630000 [0054.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.521] GetProcessHeap () returned 0x630000 [0054.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.521] GetProcessHeap () returned 0x630000 [0054.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.521] GetProcessHeap () returned 0x630000 [0054.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.521] GetProcessHeap () returned 0x630000 [0054.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.521] GetProcessHeap () returned 0x630000 [0054.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.521] GetProcessHeap () returned 0x630000 [0054.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.521] GetProcessHeap () returned 0x630000 [0054.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.522] GetProcessHeap () returned 0x630000 [0054.522] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0054.522] GetProcessHeap () returned 0x630000 [0054.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0054.522] GetProcessHeap () returned 0x630000 [0054.522] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.522] GetProcessHeap () returned 0x630000 [0054.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.522] GetProcessHeap () returned 0x630000 [0054.522] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.522] GetProcessHeap () returned 0x630000 [0054.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.522] GetProcessHeap () returned 0x630000 [0054.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0054.522] GetProcessHeap () returned 0x630000 [0054.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0054.522] GetProcessHeap () returned 0x630000 [0054.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0054.522] GetProcessHeap () returned 0x630000 [0054.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0054.522] GetProcessHeap () returned 0x630000 [0054.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0054.522] GetProcessHeap () returned 0x630000 [0054.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e460 | out: hHeap=0x630000) returned 1 [0054.522] GetProcessHeap () returned 0x630000 [0054.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0054.522] GetProcessHeap () returned 0x630000 [0054.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0054.523] GetProcessHeap () returned 0x630000 [0054.523] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0054.523] GetProcessHeap () returned 0x630000 [0054.523] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.523] GetProcessHeap () returned 0x630000 [0054.523] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0054.523] WriteFile (in: hFile=0x230, lpBuffer=0x65d700*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65d700*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0054.530] GetProcessHeap () returned 0x630000 [0054.530] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65d700, Size=0x30) returned 0x65d700 [0054.530] GetProcessHeap () returned 0x630000 [0054.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0054.530] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0054.531] GetProcessHeap () returned 0x630000 [0054.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf67d) returned 0x65ed80 [0054.533] ReadFile (in: hFile=0x230, lpBuffer=0x65ed80, nNumberOfBytesToRead=0xf67d, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesRead=0x243d7e8*=0xf67d, lpOverlapped=0x0) returned 1 [0054.547] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0054.547] WriteFile (in: hFile=0x230, lpBuffer=0x65ed80*, nNumberOfBytesToWrite=0xf67d, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesWritten=0x243d7e4*=0xf67d, lpOverlapped=0x0) returned 1 [0054.555] GetProcessHeap () returned 0x630000 [0054.555] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ed80 | out: hHeap=0x630000) returned 1 [0054.555] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0054.555] WriteFile (in: hFile=0x230, lpBuffer=0x65d700*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65d700*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0054.556] CloseHandle (hObject=0x230) returned 1 [0054.559] GetProcessHeap () returned 0x630000 [0054.559] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0054.559] GetProcessHeap () returned 0x630000 [0054.559] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b228 | out: hHeap=0x630000) returned 1 [0054.559] GetProcessHeap () returned 0x630000 [0054.559] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0054.559] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm" [0054.559] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm.happythreechoose" [0054.559] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_et-ee.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_et-ee.htm.happythreechoose"), dwFlags=0x1) returned 1 [0054.559] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0054.560] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0054.560] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" [0054.560] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\decryption info.html")) returned 0x20 [0054.560] GetProcessHeap () returned 0x630000 [0054.560] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0054.560] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3dfb2b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3dfb2b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1145a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_fi-fi.htm", cAlternateFileName="EULA_F~1.HTM")) returned 1 [0054.560] lstrcmpiW (lpString1="EULA_fi-fi.htm", lpString2=".") returned 1 [0054.560] lstrcmpiW (lpString1="EULA_fi-fi.htm", lpString2="..") returned 1 [0054.560] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_fi-fi.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm" [0054.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_fi-fi.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0054.560] GetProcessHeap () returned 0x630000 [0054.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0054.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_fi-fi.htm", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_fi-fi.htm", lpUsedDefaultChar=0x0) returned 15 [0054.560] lstrlenA (lpString="EULA_fi-fi.htm") returned 14 [0054.560] lstrlenA (lpString=".happythreechoose") returned 17 [0054.560] lstrcmpiW (lpString1="EULA_fi-fi.htm", lpString2="Decryption INFO.html") returned 1 [0054.560] lstrcmpiW (lpString1="EULA_fi-fi.htm", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0054.560] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0054.560] lstrcmpiW (lpString1="EULA_fi-fi.htm", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0054.560] GetProcessHeap () returned 0x630000 [0054.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0054.560] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fi-fi.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0054.561] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=70746) returned 1 [0054.561] GetProcessHeap () returned 0x630000 [0054.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x65b138 [0054.561] GetProcessHeap () returned 0x630000 [0054.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0054.561] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm") returned 52 [0054.561] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0054.561] GetProcessHeap () returned 0x630000 [0054.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0054.561] GetProcessHeap () returned 0x630000 [0054.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x386) returned 0x65d738 [0054.561] lstrlenA (lpString="rsa_encrypt") returned 11 [0054.561] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0054.562] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0054.562] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0054.562] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0054.562] GetProcessHeap () returned 0x630000 [0054.562] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0054.562] lstrlenA (lpString="010001") returned 6 [0054.562] GetProcessHeap () returned 0x630000 [0054.562] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0054.562] GetProcessHeap () returned 0x630000 [0054.562] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0054.562] GetProcessHeap () returned 0x630000 [0054.562] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e970 [0054.562] GetProcessHeap () returned 0x630000 [0054.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0054.562] GetProcessHeap () returned 0x630000 [0054.562] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0054.563] GetProcessHeap () returned 0x630000 [0054.563] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657558 [0054.563] GetProcessHeap () returned 0x630000 [0054.563] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0054.563] GetProcessHeap () returned 0x630000 [0054.563] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0054.563] GetProcessHeap () returned 0x630000 [0054.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.563] GetProcessHeap () returned 0x630000 [0054.563] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0054.563] GetProcessHeap () returned 0x630000 [0054.563] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0054.563] GetProcessHeap () returned 0x630000 [0054.563] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656c98 [0054.563] GetProcessHeap () returned 0x630000 [0054.563] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0054.563] GetProcessHeap () returned 0x630000 [0054.563] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0054.563] GetProcessHeap () returned 0x630000 [0054.563] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ebb0 [0054.563] GetProcessHeap () returned 0x630000 [0054.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0054.563] GetProcessHeap () returned 0x630000 [0054.563] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0054.563] GetProcessHeap () returned 0x630000 [0054.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0054.563] GetProcessHeap () returned 0x630000 [0054.563] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.563] GetProcessHeap () returned 0x630000 [0054.563] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65a5d0 [0054.563] GetProcessHeap () returned 0x630000 [0054.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0054.563] GetProcessHeap () returned 0x630000 [0054.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.563] GetProcessHeap () returned 0x630000 [0054.563] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.563] GetProcessHeap () returned 0x630000 [0054.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.564] GetProcessHeap () returned 0x630000 [0054.564] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65df50 [0054.564] GetProcessHeap () returned 0x630000 [0054.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a5d0 | out: hHeap=0x630000) returned 1 [0054.564] GetProcessHeap () returned 0x630000 [0054.564] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0054.564] GetProcessHeap () returned 0x630000 [0054.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0054.564] GetProcessHeap () returned 0x630000 [0054.564] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.564] GetProcessHeap () returned 0x630000 [0054.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.564] GetProcessHeap () returned 0x630000 [0054.564] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.564] GetProcessHeap () returned 0x630000 [0054.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.564] GetProcessHeap () returned 0x630000 [0054.564] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.564] GetProcessHeap () returned 0x630000 [0054.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.564] GetProcessHeap () returned 0x630000 [0054.564] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.564] GetProcessHeap () returned 0x630000 [0054.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.564] GetProcessHeap () returned 0x630000 [0054.564] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0054.564] GetProcessHeap () returned 0x630000 [0054.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0054.564] GetProcessHeap () returned 0x630000 [0054.564] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.564] GetProcessHeap () returned 0x630000 [0054.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.564] GetProcessHeap () returned 0x630000 [0054.564] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.564] GetProcessHeap () returned 0x630000 [0054.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.565] GetProcessHeap () returned 0x630000 [0054.565] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0054.565] GetProcessHeap () returned 0x630000 [0054.565] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0054.565] GetProcessHeap () returned 0x630000 [0054.565] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0054.565] GetProcessHeap () returned 0x630000 [0054.565] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0054.565] GetProcessHeap () returned 0x630000 [0054.565] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.565] GetProcessHeap () returned 0x630000 [0054.565] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.565] GetProcessHeap () returned 0x630000 [0054.565] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.565] GetProcessHeap () returned 0x630000 [0054.565] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.565] GetProcessHeap () returned 0x630000 [0054.565] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.565] GetProcessHeap () returned 0x630000 [0054.565] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.565] GetProcessHeap () returned 0x630000 [0054.565] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0054.565] GetProcessHeap () returned 0x630000 [0054.565] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0054.565] GetProcessHeap () returned 0x630000 [0054.565] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0054.565] GetProcessHeap () returned 0x630000 [0054.565] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0054.565] GetProcessHeap () returned 0x630000 [0054.565] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0054.565] GetProcessHeap () returned 0x630000 [0054.565] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0054.565] GetProcessHeap () returned 0x630000 [0054.565] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.565] GetProcessHeap () returned 0x630000 [0054.565] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.565] GetProcessHeap () returned 0x630000 [0054.565] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.566] GetProcessHeap () returned 0x630000 [0054.566] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.566] GetProcessHeap () returned 0x630000 [0054.566] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0054.566] GetProcessHeap () returned 0x630000 [0054.566] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0054.566] GetProcessHeap () returned 0x630000 [0054.566] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.566] GetProcessHeap () returned 0x630000 [0054.566] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.566] GetProcessHeap () returned 0x630000 [0054.566] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.566] GetProcessHeap () returned 0x630000 [0054.566] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.566] GetProcessHeap () returned 0x630000 [0054.566] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0054.566] GetProcessHeap () returned 0x630000 [0054.566] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0054.566] GetProcessHeap () returned 0x630000 [0054.566] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.566] GetProcessHeap () returned 0x630000 [0054.566] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.566] GetProcessHeap () returned 0x630000 [0054.566] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.566] GetProcessHeap () returned 0x630000 [0054.566] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.566] GetProcessHeap () returned 0x630000 [0054.566] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.566] GetProcessHeap () returned 0x630000 [0054.566] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.566] GetProcessHeap () returned 0x630000 [0054.566] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0054.566] GetProcessHeap () returned 0x630000 [0054.566] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0054.567] GetProcessHeap () returned 0x630000 [0054.567] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0054.567] GetProcessHeap () returned 0x630000 [0054.567] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0054.567] GetProcessHeap () returned 0x630000 [0054.567] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.567] GetProcessHeap () returned 0x630000 [0054.567] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.567] GetProcessHeap () returned 0x630000 [0054.567] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.567] GetProcessHeap () returned 0x630000 [0054.567] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.567] GetProcessHeap () returned 0x630000 [0054.567] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.567] GetProcessHeap () returned 0x630000 [0054.567] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.567] GetProcessHeap () returned 0x630000 [0054.567] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.567] GetProcessHeap () returned 0x630000 [0054.567] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.567] GetProcessHeap () returned 0x630000 [0054.567] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.567] GetProcessHeap () returned 0x630000 [0054.567] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.567] GetProcessHeap () returned 0x630000 [0054.567] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0054.567] GetProcessHeap () returned 0x630000 [0054.567] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0054.567] GetProcessHeap () returned 0x630000 [0054.567] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.568] GetProcessHeap () returned 0x630000 [0054.568] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.568] GetProcessHeap () returned 0x630000 [0054.568] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0054.568] GetProcessHeap () returned 0x630000 [0054.568] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0054.568] GetProcessHeap () returned 0x630000 [0054.568] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.568] GetProcessHeap () returned 0x630000 [0054.568] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.568] GetProcessHeap () returned 0x630000 [0054.568] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0054.568] GetProcessHeap () returned 0x630000 [0054.568] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0054.568] GetProcessHeap () returned 0x630000 [0054.568] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0054.568] GetProcessHeap () returned 0x630000 [0054.568] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0054.568] GetProcessHeap () returned 0x630000 [0054.568] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.568] GetProcessHeap () returned 0x630000 [0054.568] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.568] GetProcessHeap () returned 0x630000 [0054.568] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.568] GetProcessHeap () returned 0x630000 [0054.568] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.568] GetProcessHeap () returned 0x630000 [0054.568] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.568] GetProcessHeap () returned 0x630000 [0054.568] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.568] GetProcessHeap () returned 0x630000 [0054.568] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.568] GetProcessHeap () returned 0x630000 [0054.568] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.568] GetProcessHeap () returned 0x630000 [0054.568] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0054.568] GetProcessHeap () returned 0x630000 [0054.569] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0054.569] GetProcessHeap () returned 0x630000 [0054.569] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0054.569] GetProcessHeap () returned 0x630000 [0054.569] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0054.569] GetProcessHeap () returned 0x630000 [0054.569] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0054.581] GetProcessHeap () returned 0x630000 [0054.581] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0054.581] GetProcessHeap () returned 0x630000 [0054.581] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0054.581] GetProcessHeap () returned 0x630000 [0054.581] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0054.581] GetProcessHeap () returned 0x630000 [0054.581] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0054.581] GetProcessHeap () returned 0x630000 [0054.581] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.581] GetProcessHeap () returned 0x630000 [0054.581] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0054.581] WriteFile (in: hFile=0x230, lpBuffer=0x65d738*, nNumberOfBytesToWrite=0x386, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65d738*, lpNumberOfBytesWritten=0x243d864*=0x386, lpOverlapped=0x0) returned 1 [0054.590] GetProcessHeap () returned 0x630000 [0054.590] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65d738, Size=0x30) returned 0x65d738 [0054.590] GetProcessHeap () returned 0x630000 [0054.590] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0054.590] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0054.590] GetProcessHeap () returned 0x630000 [0054.590] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11460) returned 0x65ed80 [0054.591] ReadFile (in: hFile=0x230, lpBuffer=0x65ed80, nNumberOfBytesToRead=0x11460, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesRead=0x243d7e8*=0x11460, lpOverlapped=0x0) returned 1 [0054.592] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0054.592] WriteFile (in: hFile=0x230, lpBuffer=0x65ed80*, nNumberOfBytesToWrite=0x11460, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesWritten=0x243d7e4*=0x11460, lpOverlapped=0x0) returned 1 [0054.593] GetProcessHeap () returned 0x630000 [0054.593] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ed80 | out: hHeap=0x630000) returned 1 [0054.595] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0054.595] WriteFile (in: hFile=0x230, lpBuffer=0x65d738*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65d738*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0054.596] CloseHandle (hObject=0x230) returned 1 [0054.598] GetProcessHeap () returned 0x630000 [0054.598] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0054.598] GetProcessHeap () returned 0x630000 [0054.598] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b138 | out: hHeap=0x630000) returned 1 [0054.598] GetProcessHeap () returned 0x630000 [0054.598] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0054.598] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm" [0054.598] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm.happythreechoose" [0054.598] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fi-fi.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fi-fi.htm.happythreechoose"), dwFlags=0x1) returned 1 [0054.599] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0054.599] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0054.599] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" [0054.599] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\decryption info.html")) returned 0x20 [0054.599] GetProcessHeap () returned 0x630000 [0054.599] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0054.600] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3e0ee6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3e0ee6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x10f0a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_fr-ca.htm", cAlternateFileName="EULA_F~2.HTM")) returned 1 [0054.600] lstrcmpiW (lpString1="EULA_fr-ca.htm", lpString2=".") returned 1 [0054.600] lstrcmpiW (lpString1="EULA_fr-ca.htm", lpString2="..") returned 1 [0054.600] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_fr-ca.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm" [0054.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_fr-ca.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0054.600] GetProcessHeap () returned 0x630000 [0054.600] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64ca20 [0054.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_fr-ca.htm", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_fr-ca.htm", lpUsedDefaultChar=0x0) returned 15 [0054.600] lstrlenA (lpString="EULA_fr-ca.htm") returned 14 [0054.600] lstrlenA (lpString=".happythreechoose") returned 17 [0054.600] lstrcmpiW (lpString1="EULA_fr-ca.htm", lpString2="Decryption INFO.html") returned 1 [0054.600] lstrcmpiW (lpString1="EULA_fr-ca.htm", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0054.600] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0054.600] lstrcmpiW (lpString1="EULA_fr-ca.htm", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0054.600] GetProcessHeap () returned 0x630000 [0054.600] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0054.600] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-ca.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0054.602] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=69386) returned 1 [0054.602] GetProcessHeap () returned 0x630000 [0054.602] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x65b0c0 [0054.603] GetProcessHeap () returned 0x630000 [0054.603] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0054.603] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm") returned 52 [0054.603] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0054.603] GetProcessHeap () returned 0x630000 [0054.603] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0054.603] GetProcessHeap () returned 0x630000 [0054.603] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x386) returned 0x65d770 [0054.603] lstrlenA (lpString="rsa_encrypt") returned 11 [0054.603] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0054.603] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0054.603] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0054.603] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0054.603] GetProcessHeap () returned 0x630000 [0054.603] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0054.604] lstrlenA (lpString="010001") returned 6 [0054.604] GetProcessHeap () returned 0x630000 [0054.604] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2a8 [0054.604] GetProcessHeap () returned 0x630000 [0054.604] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0054.604] GetProcessHeap () returned 0x630000 [0054.604] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ebb0 [0054.604] GetProcessHeap () returned 0x630000 [0054.604] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0054.604] GetProcessHeap () returned 0x630000 [0054.604] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0054.604] GetProcessHeap () returned 0x630000 [0054.604] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656db0 [0054.604] GetProcessHeap () returned 0x630000 [0054.604] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2b8 [0054.604] GetProcessHeap () returned 0x630000 [0054.604] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0054.604] GetProcessHeap () returned 0x630000 [0054.604] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0054.604] GetProcessHeap () returned 0x630000 [0054.604] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0054.604] GetProcessHeap () returned 0x630000 [0054.604] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0054.604] GetProcessHeap () returned 0x630000 [0054.604] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x6570f8 [0054.604] GetProcessHeap () returned 0x630000 [0054.604] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0054.604] GetProcessHeap () returned 0x630000 [0054.604] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0054.604] GetProcessHeap () returned 0x630000 [0054.604] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e4f0 [0054.604] GetProcessHeap () returned 0x630000 [0054.604] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0054.604] GetProcessHeap () returned 0x630000 [0054.604] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0054.604] GetProcessHeap () returned 0x630000 [0054.604] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0054.605] GetProcessHeap () returned 0x630000 [0054.605] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.605] GetProcessHeap () returned 0x630000 [0054.605] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65a858 [0054.605] GetProcessHeap () returned 0x630000 [0054.605] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0054.605] GetProcessHeap () returned 0x630000 [0054.605] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.605] GetProcessHeap () returned 0x630000 [0054.605] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.605] GetProcessHeap () returned 0x630000 [0054.605] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.605] GetProcessHeap () returned 0x630000 [0054.605] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e610 [0054.605] GetProcessHeap () returned 0x630000 [0054.605] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a858 | out: hHeap=0x630000) returned 1 [0054.605] GetProcessHeap () returned 0x630000 [0054.605] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0054.605] GetProcessHeap () returned 0x630000 [0054.605] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0054.605] GetProcessHeap () returned 0x630000 [0054.605] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0054.605] GetProcessHeap () returned 0x630000 [0054.605] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0054.605] GetProcessHeap () returned 0x630000 [0054.605] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0054.605] GetProcessHeap () returned 0x630000 [0054.605] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0054.605] GetProcessHeap () returned 0x630000 [0054.605] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0054.605] GetProcessHeap () returned 0x630000 [0054.605] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0054.605] GetProcessHeap () returned 0x630000 [0054.605] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.605] GetProcessHeap () returned 0x630000 [0054.605] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.605] GetProcessHeap () returned 0x630000 [0054.606] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.606] GetProcessHeap () returned 0x630000 [0054.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.606] GetProcessHeap () returned 0x630000 [0054.606] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.606] GetProcessHeap () returned 0x630000 [0054.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.606] GetProcessHeap () returned 0x630000 [0054.606] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.606] GetProcessHeap () returned 0x630000 [0054.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.606] GetProcessHeap () returned 0x630000 [0054.606] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.606] GetProcessHeap () returned 0x630000 [0054.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.606] GetProcessHeap () returned 0x630000 [0054.606] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0054.606] GetProcessHeap () returned 0x630000 [0054.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0054.606] GetProcessHeap () returned 0x630000 [0054.606] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.606] GetProcessHeap () returned 0x630000 [0054.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.606] GetProcessHeap () returned 0x630000 [0054.606] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.606] GetProcessHeap () returned 0x630000 [0054.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.606] GetProcessHeap () returned 0x630000 [0054.606] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.606] GetProcessHeap () returned 0x630000 [0054.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.606] GetProcessHeap () returned 0x630000 [0054.606] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.606] GetProcessHeap () returned 0x630000 [0054.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.606] GetProcessHeap () returned 0x630000 [0054.606] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0054.606] GetProcessHeap () returned 0x630000 [0054.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0054.607] GetProcessHeap () returned 0x630000 [0054.607] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0054.607] GetProcessHeap () returned 0x630000 [0054.607] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0054.607] GetProcessHeap () returned 0x630000 [0054.607] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.607] GetProcessHeap () returned 0x630000 [0054.607] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.607] GetProcessHeap () returned 0x630000 [0054.607] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.607] GetProcessHeap () returned 0x630000 [0054.607] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.607] GetProcessHeap () returned 0x630000 [0054.607] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.607] GetProcessHeap () returned 0x630000 [0054.607] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.607] GetProcessHeap () returned 0x630000 [0054.607] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.607] GetProcessHeap () returned 0x630000 [0054.607] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.607] GetProcessHeap () returned 0x630000 [0054.607] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.607] GetProcessHeap () returned 0x630000 [0054.607] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.607] GetProcessHeap () returned 0x630000 [0054.607] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0054.607] GetProcessHeap () returned 0x630000 [0054.607] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0054.607] GetProcessHeap () returned 0x630000 [0054.607] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.607] GetProcessHeap () returned 0x630000 [0054.607] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.607] GetProcessHeap () returned 0x630000 [0054.607] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.607] GetProcessHeap () returned 0x630000 [0054.607] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.607] GetProcessHeap () returned 0x630000 [0054.607] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0054.608] GetProcessHeap () returned 0x630000 [0054.608] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0054.608] GetProcessHeap () returned 0x630000 [0054.608] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.608] GetProcessHeap () returned 0x630000 [0054.608] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.608] GetProcessHeap () returned 0x630000 [0054.608] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.608] GetProcessHeap () returned 0x630000 [0054.608] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.608] GetProcessHeap () returned 0x630000 [0054.608] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.608] GetProcessHeap () returned 0x630000 [0054.608] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.608] GetProcessHeap () returned 0x630000 [0054.608] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.608] GetProcessHeap () returned 0x630000 [0054.608] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.608] GetProcessHeap () returned 0x630000 [0054.608] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.608] GetProcessHeap () returned 0x630000 [0054.608] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.608] GetProcessHeap () returned 0x630000 [0054.608] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.608] GetProcessHeap () returned 0x630000 [0054.608] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.608] GetProcessHeap () returned 0x630000 [0054.608] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.608] GetProcessHeap () returned 0x630000 [0054.608] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.608] GetProcessHeap () returned 0x630000 [0054.608] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.608] GetProcessHeap () returned 0x630000 [0054.608] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.608] GetProcessHeap () returned 0x630000 [0054.608] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0054.608] GetProcessHeap () returned 0x630000 [0054.608] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0054.609] GetProcessHeap () returned 0x630000 [0054.609] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0054.609] GetProcessHeap () returned 0x630000 [0054.609] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0054.609] GetProcessHeap () returned 0x630000 [0054.609] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.609] GetProcessHeap () returned 0x630000 [0054.609] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.609] GetProcessHeap () returned 0x630000 [0054.609] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0054.609] GetProcessHeap () returned 0x630000 [0054.609] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0054.609] GetProcessHeap () returned 0x630000 [0054.609] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0054.609] GetProcessHeap () returned 0x630000 [0054.609] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0054.609] GetProcessHeap () returned 0x630000 [0054.609] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.609] GetProcessHeap () returned 0x630000 [0054.609] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.609] GetProcessHeap () returned 0x630000 [0054.609] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.609] GetProcessHeap () returned 0x630000 [0054.609] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.609] GetProcessHeap () returned 0x630000 [0054.609] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0054.609] GetProcessHeap () returned 0x630000 [0054.609] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0054.609] GetProcessHeap () returned 0x630000 [0054.609] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0054.609] GetProcessHeap () returned 0x630000 [0054.609] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0054.609] GetProcessHeap () returned 0x630000 [0054.609] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0054.609] GetProcessHeap () returned 0x630000 [0054.609] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0054.610] GetProcessHeap () returned 0x630000 [0054.610] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0054.610] GetProcessHeap () returned 0x630000 [0054.610] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0054.610] GetProcessHeap () returned 0x630000 [0054.610] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0054.610] GetProcessHeap () returned 0x630000 [0054.610] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0054.610] GetProcessHeap () returned 0x630000 [0054.610] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0054.610] GetProcessHeap () returned 0x630000 [0054.610] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0054.610] GetProcessHeap () returned 0x630000 [0054.610] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0054.610] GetProcessHeap () returned 0x630000 [0054.610] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.610] GetProcessHeap () returned 0x630000 [0054.610] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0054.610] WriteFile (in: hFile=0x230, lpBuffer=0x65d770*, nNumberOfBytesToWrite=0x386, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65d770*, lpNumberOfBytesWritten=0x243d864*=0x386, lpOverlapped=0x0) returned 1 [0054.627] GetProcessHeap () returned 0x630000 [0054.627] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65d770, Size=0x30) returned 0x65d770 [0054.627] GetProcessHeap () returned 0x630000 [0054.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0054.627] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0054.627] GetProcessHeap () returned 0x630000 [0054.628] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10f10) returned 0x65ed80 [0054.630] ReadFile (in: hFile=0x230, lpBuffer=0x65ed80, nNumberOfBytesToRead=0x10f10, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesRead=0x243d7e8*=0x10f10, lpOverlapped=0x0) returned 1 [0054.632] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0054.632] WriteFile (in: hFile=0x230, lpBuffer=0x65ed80*, nNumberOfBytesToWrite=0x10f10, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesWritten=0x243d7e4*=0x10f10, lpOverlapped=0x0) returned 1 [0054.690] GetProcessHeap () returned 0x630000 [0054.690] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ed80 | out: hHeap=0x630000) returned 1 [0054.690] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0054.690] WriteFile (in: hFile=0x230, lpBuffer=0x65d770*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65d770*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0054.691] CloseHandle (hObject=0x230) returned 1 [0054.695] GetProcessHeap () returned 0x630000 [0054.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0054.695] GetProcessHeap () returned 0x630000 [0054.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b0c0 | out: hHeap=0x630000) returned 1 [0054.695] GetProcessHeap () returned 0x630000 [0054.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0054.695] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm" [0054.695] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm.happythreechoose" [0054.695] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-ca.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-ca.htm.happythreechoose"), dwFlags=0x1) returned 1 [0054.695] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0054.696] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0054.696] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" [0054.696] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\decryption info.html")) returned 0x20 [0054.696] GetProcessHeap () returned 0x630000 [0054.696] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0054.696] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3e2266, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3e2266, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x10f0a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_fr-fr.htm", cAlternateFileName="EULA_F~3.HTM")) returned 1 [0054.696] lstrcmpiW (lpString1="EULA_fr-fr.htm", lpString2=".") returned 1 [0054.696] lstrcmpiW (lpString1="EULA_fr-fr.htm", lpString2="..") returned 1 [0054.696] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_fr-fr.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm" [0054.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_fr-fr.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0054.696] GetProcessHeap () returned 0x630000 [0054.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0054.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_fr-fr.htm", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_fr-fr.htm", lpUsedDefaultChar=0x0) returned 15 [0054.696] lstrlenA (lpString="EULA_fr-fr.htm") returned 14 [0054.696] lstrlenA (lpString=".happythreechoose") returned 17 [0054.696] lstrcmpiW (lpString1="EULA_fr-fr.htm", lpString2="Decryption INFO.html") returned 1 [0054.696] lstrcmpiW (lpString1="EULA_fr-fr.htm", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0054.696] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0054.696] lstrcmpiW (lpString1="EULA_fr-fr.htm", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0054.696] GetProcessHeap () returned 0x630000 [0054.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0054.696] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-fr.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0054.697] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=69386) returned 1 [0054.697] GetProcessHeap () returned 0x630000 [0054.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x65b0c0 [0054.697] GetProcessHeap () returned 0x630000 [0054.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0054.697] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm") returned 52 [0054.697] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0054.697] GetProcessHeap () returned 0x630000 [0054.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0054.697] GetProcessHeap () returned 0x630000 [0054.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x386) returned 0x65d7a8 [0054.697] lstrlenA (lpString="rsa_encrypt") returned 11 [0054.697] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0054.697] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0054.697] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0054.698] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0054.698] GetProcessHeap () returned 0x630000 [0054.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0054.698] lstrlenA (lpString="010001") returned 6 [0054.698] GetProcessHeap () returned 0x630000 [0054.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0054.698] GetProcessHeap () returned 0x630000 [0054.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0054.698] GetProcessHeap () returned 0x630000 [0054.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ecd0 [0054.698] GetProcessHeap () returned 0x630000 [0054.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0054.698] GetProcessHeap () returned 0x630000 [0054.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea00 [0054.698] GetProcessHeap () returned 0x630000 [0054.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656950 [0054.698] GetProcessHeap () returned 0x630000 [0054.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a348 [0054.698] GetProcessHeap () returned 0x630000 [0054.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0054.698] GetProcessHeap () returned 0x630000 [0054.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.698] GetProcessHeap () returned 0x630000 [0054.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0054.698] GetProcessHeap () returned 0x630000 [0054.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0054.698] GetProcessHeap () returned 0x630000 [0054.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656b80 [0054.698] GetProcessHeap () returned 0x630000 [0054.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0054.698] GetProcessHeap () returned 0x630000 [0054.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0054.698] GetProcessHeap () returned 0x630000 [0054.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0054.698] GetProcessHeap () returned 0x630000 [0054.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0054.699] GetProcessHeap () returned 0x630000 [0054.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0054.699] GetProcessHeap () returned 0x630000 [0054.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0054.699] GetProcessHeap () returned 0x630000 [0054.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.699] GetProcessHeap () returned 0x630000 [0054.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65a738 [0054.699] GetProcessHeap () returned 0x630000 [0054.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0054.699] GetProcessHeap () returned 0x630000 [0054.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.699] GetProcessHeap () returned 0x630000 [0054.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0054.699] GetProcessHeap () returned 0x630000 [0054.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0054.699] GetProcessHeap () returned 0x630000 [0054.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ebb0 [0054.699] GetProcessHeap () returned 0x630000 [0054.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a738 | out: hHeap=0x630000) returned 1 [0054.699] GetProcessHeap () returned 0x630000 [0054.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0054.699] GetProcessHeap () returned 0x630000 [0054.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0054.699] GetProcessHeap () returned 0x630000 [0054.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.699] GetProcessHeap () returned 0x630000 [0054.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.699] GetProcessHeap () returned 0x630000 [0054.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.699] GetProcessHeap () returned 0x630000 [0054.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.699] GetProcessHeap () returned 0x630000 [0054.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.699] GetProcessHeap () returned 0x630000 [0054.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.699] GetProcessHeap () returned 0x630000 [0054.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0054.699] GetProcessHeap () returned 0x630000 [0054.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0054.700] GetProcessHeap () returned 0x630000 [0054.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.700] GetProcessHeap () returned 0x630000 [0054.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.700] GetProcessHeap () returned 0x630000 [0054.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.700] GetProcessHeap () returned 0x630000 [0054.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.700] GetProcessHeap () returned 0x630000 [0054.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0054.700] GetProcessHeap () returned 0x630000 [0054.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0054.700] GetProcessHeap () returned 0x630000 [0054.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.700] GetProcessHeap () returned 0x630000 [0054.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.700] GetProcessHeap () returned 0x630000 [0054.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.700] GetProcessHeap () returned 0x630000 [0054.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.700] GetProcessHeap () returned 0x630000 [0054.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.700] GetProcessHeap () returned 0x630000 [0054.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.700] GetProcessHeap () returned 0x630000 [0054.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0054.700] GetProcessHeap () returned 0x630000 [0054.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0054.700] GetProcessHeap () returned 0x630000 [0054.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0054.700] GetProcessHeap () returned 0x630000 [0054.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0054.700] GetProcessHeap () returned 0x630000 [0054.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0054.701] GetProcessHeap () returned 0x630000 [0054.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0054.701] GetProcessHeap () returned 0x630000 [0054.701] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.701] GetProcessHeap () returned 0x630000 [0054.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.701] GetProcessHeap () returned 0x630000 [0054.701] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0054.701] GetProcessHeap () returned 0x630000 [0054.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0054.701] GetProcessHeap () returned 0x630000 [0054.701] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.701] GetProcessHeap () returned 0x630000 [0054.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.701] GetProcessHeap () returned 0x630000 [0054.701] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.701] GetProcessHeap () returned 0x630000 [0054.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.701] GetProcessHeap () returned 0x630000 [0054.701] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.701] GetProcessHeap () returned 0x630000 [0054.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.701] GetProcessHeap () returned 0x630000 [0054.701] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.701] GetProcessHeap () returned 0x630000 [0054.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.701] GetProcessHeap () returned 0x630000 [0054.701] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.701] GetProcessHeap () returned 0x630000 [0054.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.701] GetProcessHeap () returned 0x630000 [0054.701] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.702] GetProcessHeap () returned 0x630000 [0054.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.702] GetProcessHeap () returned 0x630000 [0054.702] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.702] GetProcessHeap () returned 0x630000 [0054.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.702] GetProcessHeap () returned 0x630000 [0054.702] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.702] GetProcessHeap () returned 0x630000 [0054.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.702] GetProcessHeap () returned 0x630000 [0054.702] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.702] GetProcessHeap () returned 0x630000 [0054.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.702] GetProcessHeap () returned 0x630000 [0054.702] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.702] GetProcessHeap () returned 0x630000 [0054.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.702] GetProcessHeap () returned 0x630000 [0054.702] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.702] GetProcessHeap () returned 0x630000 [0054.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.702] GetProcessHeap () returned 0x630000 [0054.702] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0054.702] GetProcessHeap () returned 0x630000 [0054.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0054.702] GetProcessHeap () returned 0x630000 [0054.702] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.702] GetProcessHeap () returned 0x630000 [0054.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.702] GetProcessHeap () returned 0x630000 [0054.702] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.702] GetProcessHeap () returned 0x630000 [0054.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.702] GetProcessHeap () returned 0x630000 [0054.703] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0054.703] GetProcessHeap () returned 0x630000 [0054.703] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0054.703] GetProcessHeap () returned 0x630000 [0054.703] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.703] GetProcessHeap () returned 0x630000 [0054.703] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.703] GetProcessHeap () returned 0x630000 [0054.703] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.703] GetProcessHeap () returned 0x630000 [0054.703] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.703] GetProcessHeap () returned 0x630000 [0054.703] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.703] GetProcessHeap () returned 0x630000 [0054.703] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.703] GetProcessHeap () returned 0x630000 [0054.703] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.703] GetProcessHeap () returned 0x630000 [0054.703] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.703] GetProcessHeap () returned 0x630000 [0054.703] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.703] GetProcessHeap () returned 0x630000 [0054.703] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.703] GetProcessHeap () returned 0x630000 [0054.703] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.703] GetProcessHeap () returned 0x630000 [0054.703] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.703] GetProcessHeap () returned 0x630000 [0054.703] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.703] GetProcessHeap () returned 0x630000 [0054.703] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.703] GetProcessHeap () returned 0x630000 [0054.703] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0054.703] GetProcessHeap () returned 0x630000 [0054.703] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0054.703] GetProcessHeap () returned 0x630000 [0054.703] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.703] GetProcessHeap () returned 0x630000 [0054.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.704] GetProcessHeap () returned 0x630000 [0054.704] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0054.704] GetProcessHeap () returned 0x630000 [0054.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0054.704] GetProcessHeap () returned 0x630000 [0054.704] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.704] GetProcessHeap () returned 0x630000 [0054.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.704] GetProcessHeap () returned 0x630000 [0054.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0054.704] GetProcessHeap () returned 0x630000 [0054.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0054.704] GetProcessHeap () returned 0x630000 [0054.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0054.704] GetProcessHeap () returned 0x630000 [0054.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0054.704] GetProcessHeap () returned 0x630000 [0054.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0054.704] GetProcessHeap () returned 0x630000 [0054.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0054.704] GetProcessHeap () returned 0x630000 [0054.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0054.704] GetProcessHeap () returned 0x630000 [0054.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ecd0 | out: hHeap=0x630000) returned 1 [0054.704] GetProcessHeap () returned 0x630000 [0054.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0054.704] GetProcessHeap () returned 0x630000 [0054.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.704] GetProcessHeap () returned 0x630000 [0054.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0054.704] WriteFile (in: hFile=0x230, lpBuffer=0x65d7a8*, nNumberOfBytesToWrite=0x386, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65d7a8*, lpNumberOfBytesWritten=0x243d864*=0x386, lpOverlapped=0x0) returned 1 [0054.770] GetProcessHeap () returned 0x630000 [0054.770] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65d7a8, Size=0x30) returned 0x65d7a8 [0054.770] GetProcessHeap () returned 0x630000 [0054.770] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0054.770] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0054.770] GetProcessHeap () returned 0x630000 [0054.770] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10f10) returned 0x65ed80 [0054.771] ReadFile (in: hFile=0x230, lpBuffer=0x65ed80, nNumberOfBytesToRead=0x10f10, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesRead=0x243d7e8*=0x10f10, lpOverlapped=0x0) returned 1 [0054.787] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0054.787] WriteFile (in: hFile=0x230, lpBuffer=0x65ed80*, nNumberOfBytesToWrite=0x10f10, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesWritten=0x243d7e4*=0x10f10, lpOverlapped=0x0) returned 1 [0054.790] GetProcessHeap () returned 0x630000 [0054.790] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ed80 | out: hHeap=0x630000) returned 1 [0054.791] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0054.791] WriteFile (in: hFile=0x230, lpBuffer=0x65d7a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65d7a8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0054.792] CloseHandle (hObject=0x230) returned 1 [0054.795] GetProcessHeap () returned 0x630000 [0054.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0054.795] GetProcessHeap () returned 0x630000 [0054.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b0c0 | out: hHeap=0x630000) returned 1 [0054.795] GetProcessHeap () returned 0x630000 [0054.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0054.795] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm" [0054.795] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm.happythreechoose" [0054.795] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-fr.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-fr.htm.happythreechoose"), dwFlags=0x1) returned 1 [0054.796] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0054.796] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0054.796] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" [0054.796] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\decryption info.html")) returned 0x20 [0054.796] GetProcessHeap () returned 0x630000 [0054.796] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0054.796] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3e35dd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3e35dd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xd3187, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_he-il.htm", cAlternateFileName="EULA_H~1.HTM")) returned 1 [0054.796] lstrcmpiW (lpString1="EULA_he-il.htm", lpString2=".") returned 1 [0054.796] lstrcmpiW (lpString1="EULA_he-il.htm", lpString2="..") returned 1 [0054.796] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_he-il.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm" [0054.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_he-il.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0054.796] GetProcessHeap () returned 0x630000 [0054.796] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0054.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_he-il.htm", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_he-il.htm", lpUsedDefaultChar=0x0) returned 15 [0054.796] lstrlenA (lpString="EULA_he-il.htm") returned 14 [0054.796] lstrlenA (lpString=".happythreechoose") returned 17 [0054.796] lstrcmpiW (lpString1="EULA_he-il.htm", lpString2="Decryption INFO.html") returned 1 [0054.796] lstrcmpiW (lpString1="EULA_he-il.htm", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0054.796] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0054.796] lstrcmpiW (lpString1="EULA_he-il.htm", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0054.796] GetProcessHeap () returned 0x630000 [0054.796] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0054.796] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_he-il.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0054.797] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=864647) returned 1 [0054.797] GetProcessHeap () returned 0x630000 [0054.797] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655aa8 [0054.797] GetProcessHeap () returned 0x630000 [0054.797] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0054.797] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm") returned 52 [0054.797] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0054.797] GetProcessHeap () returned 0x630000 [0054.797] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0054.797] GetProcessHeap () returned 0x630000 [0054.797] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x65d7e0 [0054.797] lstrlenA (lpString="rsa_encrypt") returned 11 [0054.797] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0054.798] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0054.798] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0054.798] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0054.798] GetProcessHeap () returned 0x630000 [0054.798] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0054.798] lstrlenA (lpString="010001") returned 6 [0054.798] GetProcessHeap () returned 0x630000 [0054.798] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3f8 [0054.798] GetProcessHeap () returned 0x630000 [0054.798] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0054.798] GetProcessHeap () returned 0x630000 [0054.798] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0054.798] GetProcessHeap () returned 0x630000 [0054.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0054.798] GetProcessHeap () returned 0x630000 [0054.798] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e7c0 [0054.798] GetProcessHeap () returned 0x630000 [0054.798] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x6570f8 [0054.798] GetProcessHeap () returned 0x630000 [0054.798] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0054.798] GetProcessHeap () returned 0x630000 [0054.798] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0054.798] GetProcessHeap () returned 0x630000 [0054.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.799] GetProcessHeap () returned 0x630000 [0054.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0054.799] GetProcessHeap () returned 0x630000 [0054.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0054.799] GetProcessHeap () returned 0x630000 [0054.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657328 [0054.799] GetProcessHeap () returned 0x630000 [0054.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0054.799] GetProcessHeap () returned 0x630000 [0054.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0054.799] GetProcessHeap () returned 0x630000 [0054.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0054.799] GetProcessHeap () returned 0x630000 [0054.799] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0054.799] GetProcessHeap () returned 0x630000 [0054.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0054.799] GetProcessHeap () returned 0x630000 [0054.799] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0054.799] GetProcessHeap () returned 0x630000 [0054.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.799] GetProcessHeap () returned 0x630000 [0054.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x655d00 [0054.799] GetProcessHeap () returned 0x630000 [0054.799] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0054.799] GetProcessHeap () returned 0x630000 [0054.799] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.799] GetProcessHeap () returned 0x630000 [0054.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.799] GetProcessHeap () returned 0x630000 [0054.799] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.799] GetProcessHeap () returned 0x630000 [0054.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e100 [0054.799] GetProcessHeap () returned 0x630000 [0054.799] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655d00 | out: hHeap=0x630000) returned 1 [0054.799] GetProcessHeap () returned 0x630000 [0054.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0054.799] GetProcessHeap () returned 0x630000 [0054.799] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0054.799] GetProcessHeap () returned 0x630000 [0054.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0054.800] GetProcessHeap () returned 0x630000 [0054.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0054.800] GetProcessHeap () returned 0x630000 [0054.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.800] GetProcessHeap () returned 0x630000 [0054.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.800] GetProcessHeap () returned 0x630000 [0054.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0054.800] GetProcessHeap () returned 0x630000 [0054.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0054.800] GetProcessHeap () returned 0x630000 [0054.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.800] GetProcessHeap () returned 0x630000 [0054.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.800] GetProcessHeap () returned 0x630000 [0054.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0054.800] GetProcessHeap () returned 0x630000 [0054.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0054.800] GetProcessHeap () returned 0x630000 [0054.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.800] GetProcessHeap () returned 0x630000 [0054.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.800] GetProcessHeap () returned 0x630000 [0054.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.800] GetProcessHeap () returned 0x630000 [0054.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.800] GetProcessHeap () returned 0x630000 [0054.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.800] GetProcessHeap () returned 0x630000 [0054.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.800] GetProcessHeap () returned 0x630000 [0054.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.800] GetProcessHeap () returned 0x630000 [0054.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.800] GetProcessHeap () returned 0x630000 [0054.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.800] GetProcessHeap () returned 0x630000 [0054.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.801] GetProcessHeap () returned 0x630000 [0054.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.801] GetProcessHeap () returned 0x630000 [0054.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.801] GetProcessHeap () returned 0x630000 [0054.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.801] GetProcessHeap () returned 0x630000 [0054.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.801] GetProcessHeap () returned 0x630000 [0054.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.801] GetProcessHeap () returned 0x630000 [0054.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.801] GetProcessHeap () returned 0x630000 [0054.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.801] GetProcessHeap () returned 0x630000 [0054.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.801] GetProcessHeap () returned 0x630000 [0054.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.801] GetProcessHeap () returned 0x630000 [0054.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.801] GetProcessHeap () returned 0x630000 [0054.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.801] GetProcessHeap () returned 0x630000 [0054.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.801] GetProcessHeap () returned 0x630000 [0054.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.801] GetProcessHeap () returned 0x630000 [0054.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.801] GetProcessHeap () returned 0x630000 [0054.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0054.801] GetProcessHeap () returned 0x630000 [0054.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0054.801] GetProcessHeap () returned 0x630000 [0054.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.801] GetProcessHeap () returned 0x630000 [0054.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.802] GetProcessHeap () returned 0x630000 [0054.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.802] GetProcessHeap () returned 0x630000 [0054.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.802] GetProcessHeap () returned 0x630000 [0054.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.802] GetProcessHeap () returned 0x630000 [0054.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.802] GetProcessHeap () returned 0x630000 [0054.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.802] GetProcessHeap () returned 0x630000 [0054.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.802] GetProcessHeap () returned 0x630000 [0054.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.802] GetProcessHeap () returned 0x630000 [0054.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.802] GetProcessHeap () returned 0x630000 [0054.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.802] GetProcessHeap () returned 0x630000 [0054.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.802] GetProcessHeap () returned 0x630000 [0054.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0054.802] GetProcessHeap () returned 0x630000 [0054.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0054.802] GetProcessHeap () returned 0x630000 [0054.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.802] GetProcessHeap () returned 0x630000 [0054.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.802] GetProcessHeap () returned 0x630000 [0054.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0054.802] GetProcessHeap () returned 0x630000 [0054.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0054.802] GetProcessHeap () returned 0x630000 [0054.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.802] GetProcessHeap () returned 0x630000 [0054.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.802] GetProcessHeap () returned 0x630000 [0054.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.803] GetProcessHeap () returned 0x630000 [0054.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.803] GetProcessHeap () returned 0x630000 [0054.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.803] GetProcessHeap () returned 0x630000 [0054.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.803] GetProcessHeap () returned 0x630000 [0054.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.803] GetProcessHeap () returned 0x630000 [0054.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.803] GetProcessHeap () returned 0x630000 [0054.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.803] GetProcessHeap () returned 0x630000 [0054.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.803] GetProcessHeap () returned 0x630000 [0054.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0054.803] GetProcessHeap () returned 0x630000 [0054.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0054.803] GetProcessHeap () returned 0x630000 [0054.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.803] GetProcessHeap () returned 0x630000 [0054.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.803] GetProcessHeap () returned 0x630000 [0054.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.803] GetProcessHeap () returned 0x630000 [0054.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.804] GetProcessHeap () returned 0x630000 [0054.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.804] GetProcessHeap () returned 0x630000 [0054.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.804] GetProcessHeap () returned 0x630000 [0054.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0054.804] GetProcessHeap () returned 0x630000 [0054.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0054.804] GetProcessHeap () returned 0x630000 [0054.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.804] GetProcessHeap () returned 0x630000 [0054.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.804] GetProcessHeap () returned 0x630000 [0054.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.804] GetProcessHeap () returned 0x630000 [0054.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.804] GetProcessHeap () returned 0x630000 [0054.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.804] GetProcessHeap () returned 0x630000 [0054.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.804] GetProcessHeap () returned 0x630000 [0054.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.804] GetProcessHeap () returned 0x630000 [0054.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.804] GetProcessHeap () returned 0x630000 [0054.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0054.804] GetProcessHeap () returned 0x630000 [0054.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0054.804] GetProcessHeap () returned 0x630000 [0054.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0054.804] GetProcessHeap () returned 0x630000 [0054.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0054.804] GetProcessHeap () returned 0x630000 [0054.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0054.804] GetProcessHeap () returned 0x630000 [0054.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e7c0 | out: hHeap=0x630000) returned 1 [0054.805] GetProcessHeap () returned 0x630000 [0054.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0054.805] GetProcessHeap () returned 0x630000 [0054.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0054.805] GetProcessHeap () returned 0x630000 [0054.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0054.805] GetProcessHeap () returned 0x630000 [0054.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.805] GetProcessHeap () returned 0x630000 [0054.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0054.805] WriteFile (in: hFile=0x230, lpBuffer=0x65d7e0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65d7e0*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0054.808] GetProcessHeap () returned 0x630000 [0054.808] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65d7e0, Size=0x30) returned 0x65d7e0 [0054.808] GetProcessHeap () returned 0x630000 [0054.808] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0054.808] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0054.808] GetProcessHeap () returned 0x630000 [0054.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd3187) returned 0x244f020 [0054.824] ReadFile (in: hFile=0x230, lpBuffer=0x244f020, nNumberOfBytesToRead=0xd3187, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x244f020*, lpNumberOfBytesRead=0x243d7e8*=0xd3187, lpOverlapped=0x0) returned 1 [0054.834] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0054.842] WriteFile (in: hFile=0x230, lpBuffer=0x244f020*, nNumberOfBytesToWrite=0xd3187, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x244f020*, lpNumberOfBytesWritten=0x243d7e4*=0xd3187, lpOverlapped=0x0) returned 1 [0054.853] GetProcessHeap () returned 0x630000 [0054.853] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x244f020 | out: hHeap=0x630000) returned 1 [0054.858] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0054.858] WriteFile (in: hFile=0x230, lpBuffer=0x65d7e0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65d7e0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0054.897] CloseHandle (hObject=0x230) returned 1 [0054.914] GetProcessHeap () returned 0x630000 [0054.914] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0054.914] GetProcessHeap () returned 0x630000 [0054.914] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655aa8 | out: hHeap=0x630000) returned 1 [0054.914] GetProcessHeap () returned 0x630000 [0054.914] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0054.914] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm" [0054.914] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm.happythreechoose" [0054.914] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_he-il.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_he-il.htm.happythreechoose"), dwFlags=0x1) returned 1 [0054.915] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0054.915] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0054.915] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" [0054.915] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\decryption info.html")) returned 0x20 [0054.915] GetProcessHeap () returned 0x630000 [0054.915] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0054.915] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3e977f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3e977f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xfd68, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_hr-hr.htm", cAlternateFileName="EULA_H~2.HTM")) returned 1 [0054.915] lstrcmpiW (lpString1="EULA_hr-hr.htm", lpString2=".") returned 1 [0054.915] lstrcmpiW (lpString1="EULA_hr-hr.htm", lpString2="..") returned 1 [0054.915] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_hr-hr.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm" [0054.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_hr-hr.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0054.915] GetProcessHeap () returned 0x630000 [0054.915] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0054.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_hr-hr.htm", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_hr-hr.htm", lpUsedDefaultChar=0x0) returned 15 [0054.915] lstrlenA (lpString="EULA_hr-hr.htm") returned 14 [0054.915] lstrlenA (lpString=".happythreechoose") returned 17 [0054.915] lstrcmpiW (lpString1="EULA_hr-hr.htm", lpString2="Decryption INFO.html") returned 1 [0054.915] lstrcmpiW (lpString1="EULA_hr-hr.htm", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0054.916] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0054.916] lstrcmpiW (lpString1="EULA_hr-hr.htm", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0054.916] GetProcessHeap () returned 0x630000 [0054.916] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0054.916] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hr-hr.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0054.917] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=64872) returned 1 [0054.917] GetProcessHeap () returned 0x630000 [0054.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655670 [0054.917] GetProcessHeap () returned 0x630000 [0054.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0054.917] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm") returned 52 [0054.917] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0054.917] GetProcessHeap () returned 0x630000 [0054.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0054.917] GetProcessHeap () returned 0x630000 [0054.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x65d818 [0054.917] lstrlenA (lpString="rsa_encrypt") returned 11 [0054.917] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x65dba0) returned 1 [0054.918] CryptGenRandom (in: hProv=0x65dba0, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0054.918] CryptReleaseContext (hProv=0x65dba0, dwFlags=0x0) returned 1 [0054.918] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0054.918] GetProcessHeap () returned 0x630000 [0054.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x65dba0 [0054.918] lstrlenA (lpString="010001") returned 6 [0054.918] GetProcessHeap () returned 0x630000 [0054.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a298 [0054.918] GetProcessHeap () returned 0x630000 [0054.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0054.918] GetProcessHeap () returned 0x630000 [0054.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0054.918] GetProcessHeap () returned 0x630000 [0054.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0054.918] GetProcessHeap () returned 0x630000 [0054.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e730 [0054.918] GetProcessHeap () returned 0x630000 [0054.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657788 [0054.918] GetProcessHeap () returned 0x630000 [0054.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2a8 [0054.918] GetProcessHeap () returned 0x630000 [0054.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0054.918] GetProcessHeap () returned 0x630000 [0054.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.918] GetProcessHeap () returned 0x630000 [0054.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0054.918] GetProcessHeap () returned 0x630000 [0054.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0054.919] GetProcessHeap () returned 0x630000 [0054.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656ec8 [0054.919] GetProcessHeap () returned 0x630000 [0054.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.919] GetProcessHeap () returned 0x630000 [0054.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0054.919] GetProcessHeap () returned 0x630000 [0054.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dfe0 [0054.919] GetProcessHeap () returned 0x630000 [0054.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0054.919] GetProcessHeap () returned 0x630000 [0054.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0054.919] GetProcessHeap () returned 0x630000 [0054.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0054.919] GetProcessHeap () returned 0x630000 [0054.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.919] GetProcessHeap () returned 0x630000 [0054.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x655ce8 [0054.919] GetProcessHeap () returned 0x630000 [0054.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.919] GetProcessHeap () returned 0x630000 [0054.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.919] GetProcessHeap () returned 0x630000 [0054.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0054.919] GetProcessHeap () returned 0x630000 [0054.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0054.919] GetProcessHeap () returned 0x630000 [0054.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65dec0 [0054.919] GetProcessHeap () returned 0x630000 [0054.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655ce8 | out: hHeap=0x630000) returned 1 [0054.919] GetProcessHeap () returned 0x630000 [0054.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0054.919] GetProcessHeap () returned 0x630000 [0054.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0054.919] GetProcessHeap () returned 0x630000 [0054.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.919] GetProcessHeap () returned 0x630000 [0054.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.920] GetProcessHeap () returned 0x630000 [0054.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.920] GetProcessHeap () returned 0x630000 [0054.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.920] GetProcessHeap () returned 0x630000 [0054.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.920] GetProcessHeap () returned 0x630000 [0054.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.920] GetProcessHeap () returned 0x630000 [0054.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0054.920] GetProcessHeap () returned 0x630000 [0054.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0054.920] GetProcessHeap () returned 0x630000 [0054.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.920] GetProcessHeap () returned 0x630000 [0054.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.920] GetProcessHeap () returned 0x630000 [0054.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.920] GetProcessHeap () returned 0x630000 [0054.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.920] GetProcessHeap () returned 0x630000 [0054.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.920] GetProcessHeap () returned 0x630000 [0054.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.920] GetProcessHeap () returned 0x630000 [0054.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0054.920] GetProcessHeap () returned 0x630000 [0054.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0054.920] GetProcessHeap () returned 0x630000 [0054.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.920] GetProcessHeap () returned 0x630000 [0054.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.920] GetProcessHeap () returned 0x630000 [0054.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.920] GetProcessHeap () returned 0x630000 [0054.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.920] GetProcessHeap () returned 0x630000 [0054.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.921] GetProcessHeap () returned 0x630000 [0054.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.921] GetProcessHeap () returned 0x630000 [0054.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0054.921] GetProcessHeap () returned 0x630000 [0054.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0054.921] GetProcessHeap () returned 0x630000 [0054.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.921] GetProcessHeap () returned 0x630000 [0054.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.921] GetProcessHeap () returned 0x630000 [0054.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.921] GetProcessHeap () returned 0x630000 [0054.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.921] GetProcessHeap () returned 0x630000 [0054.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0054.921] GetProcessHeap () returned 0x630000 [0054.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0054.921] GetProcessHeap () returned 0x630000 [0054.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.921] GetProcessHeap () returned 0x630000 [0054.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.921] GetProcessHeap () returned 0x630000 [0054.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.921] GetProcessHeap () returned 0x630000 [0054.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.921] GetProcessHeap () returned 0x630000 [0054.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.921] GetProcessHeap () returned 0x630000 [0054.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.921] GetProcessHeap () returned 0x630000 [0054.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0054.921] GetProcessHeap () returned 0x630000 [0054.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0054.921] GetProcessHeap () returned 0x630000 [0054.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.921] GetProcessHeap () returned 0x630000 [0054.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.922] GetProcessHeap () returned 0x630000 [0054.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.922] GetProcessHeap () returned 0x630000 [0054.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.922] GetProcessHeap () returned 0x630000 [0054.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.922] GetProcessHeap () returned 0x630000 [0054.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.922] GetProcessHeap () returned 0x630000 [0054.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0054.922] GetProcessHeap () returned 0x630000 [0054.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0054.923] GetProcessHeap () returned 0x630000 [0054.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.923] GetProcessHeap () returned 0x630000 [0054.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.923] GetProcessHeap () returned 0x630000 [0054.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.923] GetProcessHeap () returned 0x630000 [0054.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.923] GetProcessHeap () returned 0x630000 [0054.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.923] GetProcessHeap () returned 0x630000 [0054.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.923] GetProcessHeap () returned 0x630000 [0054.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.923] GetProcessHeap () returned 0x630000 [0054.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.923] GetProcessHeap () returned 0x630000 [0054.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.923] GetProcessHeap () returned 0x630000 [0054.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.923] GetProcessHeap () returned 0x630000 [0054.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.923] GetProcessHeap () returned 0x630000 [0054.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.923] GetProcessHeap () returned 0x630000 [0054.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.923] GetProcessHeap () returned 0x630000 [0054.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.923] GetProcessHeap () returned 0x630000 [0054.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.923] GetProcessHeap () returned 0x630000 [0054.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.923] GetProcessHeap () returned 0x630000 [0054.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0054.923] GetProcessHeap () returned 0x630000 [0054.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0054.923] GetProcessHeap () returned 0x630000 [0054.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0054.924] GetProcessHeap () returned 0x630000 [0054.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0054.924] GetProcessHeap () returned 0x630000 [0054.924] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.924] GetProcessHeap () returned 0x630000 [0054.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.924] GetProcessHeap () returned 0x630000 [0054.924] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.924] GetProcessHeap () returned 0x630000 [0054.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.924] GetProcessHeap () returned 0x630000 [0054.924] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.924] GetProcessHeap () returned 0x630000 [0054.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.924] GetProcessHeap () returned 0x630000 [0054.924] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.924] GetProcessHeap () returned 0x630000 [0054.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.924] GetProcessHeap () returned 0x630000 [0054.924] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0054.924] GetProcessHeap () returned 0x630000 [0054.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0054.924] GetProcessHeap () returned 0x630000 [0054.924] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.924] GetProcessHeap () returned 0x630000 [0054.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.924] GetProcessHeap () returned 0x630000 [0054.924] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0054.924] GetProcessHeap () returned 0x630000 [0054.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0054.924] GetProcessHeap () returned 0x630000 [0054.924] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.924] GetProcessHeap () returned 0x630000 [0054.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.924] GetProcessHeap () returned 0x630000 [0054.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0054.924] GetProcessHeap () returned 0x630000 [0054.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0054.924] GetProcessHeap () returned 0x630000 [0054.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0054.925] GetProcessHeap () returned 0x630000 [0054.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0054.925] GetProcessHeap () returned 0x630000 [0054.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0054.925] GetProcessHeap () returned 0x630000 [0054.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0054.925] GetProcessHeap () returned 0x630000 [0054.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0054.925] GetProcessHeap () returned 0x630000 [0054.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0054.925] GetProcessHeap () returned 0x630000 [0054.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0054.925] GetProcessHeap () returned 0x630000 [0054.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.925] GetProcessHeap () returned 0x630000 [0054.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dba0 | out: hHeap=0x630000) returned 1 [0054.925] WriteFile (in: hFile=0x230, lpBuffer=0x65d818*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65d818*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0054.935] GetProcessHeap () returned 0x630000 [0054.935] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65d818, Size=0x30) returned 0x65d818 [0054.935] GetProcessHeap () returned 0x630000 [0054.935] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0054.935] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0054.935] GetProcessHeap () returned 0x630000 [0054.935] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfd68) returned 0x65ed80 [0054.937] ReadFile (in: hFile=0x230, lpBuffer=0x65ed80, nNumberOfBytesToRead=0xfd68, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesRead=0x243d7e8*=0xfd68, lpOverlapped=0x0) returned 1 [0054.939] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0054.939] WriteFile (in: hFile=0x230, lpBuffer=0x65ed80*, nNumberOfBytesToWrite=0xfd68, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesWritten=0x243d7e4*=0xfd68, lpOverlapped=0x0) returned 1 [0054.946] GetProcessHeap () returned 0x630000 [0054.946] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ed80 | out: hHeap=0x630000) returned 1 [0054.946] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0054.946] WriteFile (in: hFile=0x230, lpBuffer=0x65d818*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65d818*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0054.947] CloseHandle (hObject=0x230) returned 1 [0054.950] GetProcessHeap () returned 0x630000 [0054.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0054.950] GetProcessHeap () returned 0x630000 [0054.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655670 | out: hHeap=0x630000) returned 1 [0054.950] GetProcessHeap () returned 0x630000 [0054.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0054.950] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm" [0054.950] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm.happythreechoose" [0054.950] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hr-hr.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hr-hr.htm.happythreechoose"), dwFlags=0x1) returned 1 [0054.951] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0054.951] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0054.951] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" [0054.951] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\decryption info.html")) returned 0x20 [0054.951] GetProcessHeap () returned 0x630000 [0054.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0054.951] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ebeab, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ebeab, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x14a5a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_hu-hu.htm", cAlternateFileName="EULA_H~3.HTM")) returned 1 [0054.951] lstrcmpiW (lpString1="EULA_hu-hu.htm", lpString2=".") returned 1 [0054.951] lstrcmpiW (lpString1="EULA_hu-hu.htm", lpString2="..") returned 1 [0054.951] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_hu-hu.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm" [0054.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_hu-hu.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0054.951] GetProcessHeap () returned 0x630000 [0054.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0054.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_hu-hu.htm", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_hu-hu.htm", lpUsedDefaultChar=0x0) returned 15 [0054.951] lstrlenA (lpString="EULA_hu-hu.htm") returned 14 [0054.951] lstrlenA (lpString=".happythreechoose") returned 17 [0054.951] lstrcmpiW (lpString1="EULA_hu-hu.htm", lpString2="Decryption INFO.html") returned 1 [0054.951] lstrcmpiW (lpString1="EULA_hu-hu.htm", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0054.951] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0054.951] lstrcmpiW (lpString1="EULA_hu-hu.htm", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0054.951] GetProcessHeap () returned 0x630000 [0054.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0054.951] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hu-hu.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0054.952] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=84570) returned 1 [0054.952] GetProcessHeap () returned 0x630000 [0054.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655418 [0054.952] GetProcessHeap () returned 0x630000 [0054.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0054.952] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm") returned 52 [0054.952] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0054.952] GetProcessHeap () returned 0x630000 [0054.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0054.952] GetProcessHeap () returned 0x630000 [0054.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x386) returned 0x65d850 [0054.952] lstrlenA (lpString="rsa_encrypt") returned 11 [0054.952] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0054.953] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0054.953] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0054.953] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0054.954] GetProcessHeap () returned 0x630000 [0054.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0054.954] lstrlenA (lpString="010001") returned 6 [0054.954] GetProcessHeap () returned 0x630000 [0054.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0054.954] GetProcessHeap () returned 0x630000 [0054.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0054.954] GetProcessHeap () returned 0x630000 [0054.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0054.954] GetProcessHeap () returned 0x630000 [0054.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0054.954] GetProcessHeap () returned 0x630000 [0054.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e6a0 [0054.954] GetProcessHeap () returned 0x630000 [0054.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656b80 [0054.954] GetProcessHeap () returned 0x630000 [0054.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0054.954] GetProcessHeap () returned 0x630000 [0054.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0054.955] GetProcessHeap () returned 0x630000 [0054.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.955] GetProcessHeap () returned 0x630000 [0054.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0054.955] GetProcessHeap () returned 0x630000 [0054.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0054.955] GetProcessHeap () returned 0x630000 [0054.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656fe0 [0054.955] GetProcessHeap () returned 0x630000 [0054.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0054.955] GetProcessHeap () returned 0x630000 [0054.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0054.955] GetProcessHeap () returned 0x630000 [0054.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e3d0 [0054.955] GetProcessHeap () returned 0x630000 [0054.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0054.955] GetProcessHeap () returned 0x630000 [0054.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0054.955] GetProcessHeap () returned 0x630000 [0054.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0054.955] GetProcessHeap () returned 0x630000 [0054.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.955] GetProcessHeap () returned 0x630000 [0054.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x655da8 [0054.955] GetProcessHeap () returned 0x630000 [0054.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0054.955] GetProcessHeap () returned 0x630000 [0054.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.955] GetProcessHeap () returned 0x630000 [0054.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0054.955] GetProcessHeap () returned 0x630000 [0054.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0054.955] GetProcessHeap () returned 0x630000 [0054.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e730 [0054.955] GetProcessHeap () returned 0x630000 [0054.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655da8 | out: hHeap=0x630000) returned 1 [0054.955] GetProcessHeap () returned 0x630000 [0054.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0054.955] GetProcessHeap () returned 0x630000 [0054.956] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0054.956] GetProcessHeap () returned 0x630000 [0054.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0054.956] GetProcessHeap () returned 0x630000 [0054.956] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0054.956] GetProcessHeap () returned 0x630000 [0054.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.956] GetProcessHeap () returned 0x630000 [0054.956] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.956] GetProcessHeap () returned 0x630000 [0054.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.956] GetProcessHeap () returned 0x630000 [0054.956] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.956] GetProcessHeap () returned 0x630000 [0054.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.956] GetProcessHeap () returned 0x630000 [0054.956] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.956] GetProcessHeap () returned 0x630000 [0054.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.956] GetProcessHeap () returned 0x630000 [0054.956] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.956] GetProcessHeap () returned 0x630000 [0054.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.956] GetProcessHeap () returned 0x630000 [0054.956] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.956] GetProcessHeap () returned 0x630000 [0054.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.956] GetProcessHeap () returned 0x630000 [0054.956] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.956] GetProcessHeap () returned 0x630000 [0054.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0054.956] GetProcessHeap () returned 0x630000 [0054.956] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0054.956] GetProcessHeap () returned 0x630000 [0054.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.956] GetProcessHeap () returned 0x630000 [0054.956] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.956] GetProcessHeap () returned 0x630000 [0054.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0054.956] GetProcessHeap () returned 0x630000 [0054.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0054.957] GetProcessHeap () returned 0x630000 [0054.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.957] GetProcessHeap () returned 0x630000 [0054.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.957] GetProcessHeap () returned 0x630000 [0054.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.957] GetProcessHeap () returned 0x630000 [0054.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.957] GetProcessHeap () returned 0x630000 [0054.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.957] GetProcessHeap () returned 0x630000 [0054.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.957] GetProcessHeap () returned 0x630000 [0054.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.957] GetProcessHeap () returned 0x630000 [0054.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.957] GetProcessHeap () returned 0x630000 [0054.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0054.957] GetProcessHeap () returned 0x630000 [0054.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0054.957] GetProcessHeap () returned 0x630000 [0054.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.957] GetProcessHeap () returned 0x630000 [0054.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.957] GetProcessHeap () returned 0x630000 [0054.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.957] GetProcessHeap () returned 0x630000 [0054.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.957] GetProcessHeap () returned 0x630000 [0054.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0054.957] GetProcessHeap () returned 0x630000 [0054.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0054.957] GetProcessHeap () returned 0x630000 [0054.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.957] GetProcessHeap () returned 0x630000 [0054.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.957] GetProcessHeap () returned 0x630000 [0054.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0054.958] GetProcessHeap () returned 0x630000 [0054.958] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0054.958] GetProcessHeap () returned 0x630000 [0054.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0054.958] GetProcessHeap () returned 0x630000 [0054.958] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0054.958] GetProcessHeap () returned 0x630000 [0054.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.958] GetProcessHeap () returned 0x630000 [0054.958] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.958] GetProcessHeap () returned 0x630000 [0054.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.958] GetProcessHeap () returned 0x630000 [0054.958] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.958] GetProcessHeap () returned 0x630000 [0054.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.958] GetProcessHeap () returned 0x630000 [0054.958] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.958] GetProcessHeap () returned 0x630000 [0054.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.958] GetProcessHeap () returned 0x630000 [0054.958] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.958] GetProcessHeap () returned 0x630000 [0054.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.958] GetProcessHeap () returned 0x630000 [0054.958] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.958] GetProcessHeap () returned 0x630000 [0054.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.958] GetProcessHeap () returned 0x630000 [0054.958] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.958] GetProcessHeap () returned 0x630000 [0054.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.958] GetProcessHeap () returned 0x630000 [0054.958] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.958] GetProcessHeap () returned 0x630000 [0054.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0054.958] GetProcessHeap () returned 0x630000 [0054.958] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.959] GetProcessHeap () returned 0x630000 [0054.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0054.959] GetProcessHeap () returned 0x630000 [0054.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0054.959] GetProcessHeap () returned 0x630000 [0054.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.959] GetProcessHeap () returned 0x630000 [0054.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.959] GetProcessHeap () returned 0x630000 [0054.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.959] GetProcessHeap () returned 0x630000 [0054.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.959] GetProcessHeap () returned 0x630000 [0054.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0054.959] GetProcessHeap () returned 0x630000 [0054.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0054.959] GetProcessHeap () returned 0x630000 [0054.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0054.959] GetProcessHeap () returned 0x630000 [0054.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0054.959] GetProcessHeap () returned 0x630000 [0054.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.959] GetProcessHeap () returned 0x630000 [0054.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.959] GetProcessHeap () returned 0x630000 [0054.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.959] GetProcessHeap () returned 0x630000 [0054.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.959] GetProcessHeap () returned 0x630000 [0054.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.959] GetProcessHeap () returned 0x630000 [0054.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.959] GetProcessHeap () returned 0x630000 [0054.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0054.959] GetProcessHeap () returned 0x630000 [0054.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0054.959] GetProcessHeap () returned 0x630000 [0054.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0054.959] GetProcessHeap () returned 0x630000 [0054.960] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0054.960] GetProcessHeap () returned 0x630000 [0054.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0054.960] GetProcessHeap () returned 0x630000 [0054.960] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0054.960] GetProcessHeap () returned 0x630000 [0054.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.960] GetProcessHeap () returned 0x630000 [0054.960] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.960] GetProcessHeap () returned 0x630000 [0054.960] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0054.960] GetProcessHeap () returned 0x630000 [0054.960] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0054.960] GetProcessHeap () returned 0x630000 [0054.960] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0054.960] GetProcessHeap () returned 0x630000 [0054.960] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0054.960] GetProcessHeap () returned 0x630000 [0054.960] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0054.960] GetProcessHeap () returned 0x630000 [0054.960] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e6a0 | out: hHeap=0x630000) returned 1 [0054.960] GetProcessHeap () returned 0x630000 [0054.960] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0054.960] GetProcessHeap () returned 0x630000 [0054.960] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0054.960] GetProcessHeap () returned 0x630000 [0054.960] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0054.960] GetProcessHeap () returned 0x630000 [0054.960] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.960] GetProcessHeap () returned 0x630000 [0054.960] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0054.960] WriteFile (in: hFile=0x230, lpBuffer=0x65d850*, nNumberOfBytesToWrite=0x386, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65d850*, lpNumberOfBytesWritten=0x243d864*=0x386, lpOverlapped=0x0) returned 1 [0054.964] GetProcessHeap () returned 0x630000 [0054.964] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65d850, Size=0x30) returned 0x65d850 [0054.964] GetProcessHeap () returned 0x630000 [0054.964] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0054.964] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0054.964] GetProcessHeap () returned 0x630000 [0054.964] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14a60) returned 0x65ed80 [0054.964] ReadFile (in: hFile=0x230, lpBuffer=0x65ed80, nNumberOfBytesToRead=0x14a60, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesRead=0x243d7e8*=0x14a60, lpOverlapped=0x0) returned 1 [0054.966] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0054.966] WriteFile (in: hFile=0x230, lpBuffer=0x65ed80*, nNumberOfBytesToWrite=0x14a60, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesWritten=0x243d7e4*=0x14a60, lpOverlapped=0x0) returned 1 [0054.967] GetProcessHeap () returned 0x630000 [0054.967] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ed80 | out: hHeap=0x630000) returned 1 [0054.967] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0054.967] WriteFile (in: hFile=0x230, lpBuffer=0x65d850*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65d850*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0054.968] CloseHandle (hObject=0x230) returned 1 [0054.971] GetProcessHeap () returned 0x630000 [0054.971] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0054.972] GetProcessHeap () returned 0x630000 [0054.972] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655418 | out: hHeap=0x630000) returned 1 [0054.972] GetProcessHeap () returned 0x630000 [0054.972] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0054.972] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm" [0054.972] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm.happythreechoose" [0054.972] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hu-hu.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hu-hu.htm.happythreechoose"), dwFlags=0x1) returned 1 [0054.972] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0054.972] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0054.972] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" [0054.973] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\decryption info.html")) returned 0x20 [0054.973] GetProcessHeap () returned 0x630000 [0054.973] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0054.973] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ed234, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ed234, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x10f6d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_it-it.htm", cAlternateFileName="EULA_I~1.HTM")) returned 1 [0054.973] lstrcmpiW (lpString1="EULA_it-it.htm", lpString2=".") returned 1 [0054.973] lstrcmpiW (lpString1="EULA_it-it.htm", lpString2="..") returned 1 [0054.973] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_it-it.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm" [0054.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_it-it.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0054.973] GetProcessHeap () returned 0x630000 [0054.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0054.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_it-it.htm", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_it-it.htm", lpUsedDefaultChar=0x0) returned 15 [0054.973] lstrlenA (lpString="EULA_it-it.htm") returned 14 [0054.973] lstrlenA (lpString=".happythreechoose") returned 17 [0054.973] lstrcmpiW (lpString1="EULA_it-it.htm", lpString2="Decryption INFO.html") returned 1 [0054.973] lstrcmpiW (lpString1="EULA_it-it.htm", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0054.973] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0054.973] lstrcmpiW (lpString1="EULA_it-it.htm", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0054.973] GetProcessHeap () returned 0x630000 [0054.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0054.973] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_it-it.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0054.973] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=69485) returned 1 [0054.974] GetProcessHeap () returned 0x630000 [0054.974] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655580 [0054.974] GetProcessHeap () returned 0x630000 [0054.974] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0054.974] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm") returned 52 [0054.974] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0054.974] GetProcessHeap () returned 0x630000 [0054.974] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0054.974] GetProcessHeap () returned 0x630000 [0054.974] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x383) returned 0x65d888 [0054.974] lstrlenA (lpString="rsa_encrypt") returned 11 [0054.974] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0054.974] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0054.975] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0054.975] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0054.975] GetProcessHeap () returned 0x630000 [0054.975] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0054.975] lstrlenA (lpString="010001") returned 6 [0054.975] GetProcessHeap () returned 0x630000 [0054.975] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3f8 [0054.975] GetProcessHeap () returned 0x630000 [0054.975] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0054.975] GetProcessHeap () returned 0x630000 [0054.975] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0054.975] GetProcessHeap () returned 0x630000 [0054.975] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0054.975] GetProcessHeap () returned 0x630000 [0054.975] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ec40 [0054.975] GetProcessHeap () returned 0x630000 [0054.975] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656ec8 [0054.975] GetProcessHeap () returned 0x630000 [0054.975] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2a8 [0054.975] GetProcessHeap () returned 0x630000 [0054.975] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0054.975] GetProcessHeap () returned 0x630000 [0054.975] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.975] GetProcessHeap () returned 0x630000 [0054.975] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0054.975] GetProcessHeap () returned 0x630000 [0054.975] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0054.975] GetProcessHeap () returned 0x630000 [0054.975] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656b80 [0054.975] GetProcessHeap () returned 0x630000 [0054.975] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0054.975] GetProcessHeap () returned 0x630000 [0054.975] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0054.975] GetProcessHeap () returned 0x630000 [0054.975] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e970 [0054.975] GetProcessHeap () returned 0x630000 [0054.975] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0054.975] GetProcessHeap () returned 0x630000 [0054.976] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0054.976] GetProcessHeap () returned 0x630000 [0054.976] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0054.976] GetProcessHeap () returned 0x630000 [0054.976] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.976] GetProcessHeap () returned 0x630000 [0054.976] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x655d60 [0054.976] GetProcessHeap () returned 0x630000 [0054.976] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0054.976] GetProcessHeap () returned 0x630000 [0054.976] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.976] GetProcessHeap () returned 0x630000 [0054.976] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.976] GetProcessHeap () returned 0x630000 [0054.976] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.976] GetProcessHeap () returned 0x630000 [0054.976] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e3d0 [0054.976] GetProcessHeap () returned 0x630000 [0054.976] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655d60 | out: hHeap=0x630000) returned 1 [0054.976] GetProcessHeap () returned 0x630000 [0054.976] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0054.976] GetProcessHeap () returned 0x630000 [0054.976] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0054.976] GetProcessHeap () returned 0x630000 [0054.976] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.976] GetProcessHeap () returned 0x630000 [0054.976] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.976] GetProcessHeap () returned 0x630000 [0054.976] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0054.976] GetProcessHeap () returned 0x630000 [0054.976] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0054.976] GetProcessHeap () returned 0x630000 [0054.976] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.976] GetProcessHeap () returned 0x630000 [0054.976] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.976] GetProcessHeap () returned 0x630000 [0054.976] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.976] GetProcessHeap () returned 0x630000 [0054.976] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.977] GetProcessHeap () returned 0x630000 [0054.977] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.977] GetProcessHeap () returned 0x630000 [0054.977] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.977] GetProcessHeap () returned 0x630000 [0054.977] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.977] GetProcessHeap () returned 0x630000 [0054.977] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.977] GetProcessHeap () returned 0x630000 [0054.977] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.977] GetProcessHeap () returned 0x630000 [0054.977] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.977] GetProcessHeap () returned 0x630000 [0054.977] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.977] GetProcessHeap () returned 0x630000 [0054.977] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.977] GetProcessHeap () returned 0x630000 [0054.977] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.977] GetProcessHeap () returned 0x630000 [0054.977] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.977] GetProcessHeap () returned 0x630000 [0054.977] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.977] GetProcessHeap () returned 0x630000 [0054.977] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.977] GetProcessHeap () returned 0x630000 [0054.977] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.977] GetProcessHeap () returned 0x630000 [0054.977] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.977] GetProcessHeap () returned 0x630000 [0054.977] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0054.977] GetProcessHeap () returned 0x630000 [0054.977] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0054.977] GetProcessHeap () returned 0x630000 [0054.977] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0054.977] GetProcessHeap () returned 0x630000 [0054.977] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0054.977] GetProcessHeap () returned 0x630000 [0054.977] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.978] GetProcessHeap () returned 0x630000 [0054.978] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.978] GetProcessHeap () returned 0x630000 [0054.978] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0054.978] GetProcessHeap () returned 0x630000 [0054.978] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0054.978] GetProcessHeap () returned 0x630000 [0054.978] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0054.978] GetProcessHeap () returned 0x630000 [0054.978] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0054.978] GetProcessHeap () returned 0x630000 [0054.978] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.978] GetProcessHeap () returned 0x630000 [0054.978] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.978] GetProcessHeap () returned 0x630000 [0054.978] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.978] GetProcessHeap () returned 0x630000 [0054.978] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.978] GetProcessHeap () returned 0x630000 [0054.978] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.978] GetProcessHeap () returned 0x630000 [0054.978] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.978] GetProcessHeap () returned 0x630000 [0054.978] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0054.978] GetProcessHeap () returned 0x630000 [0054.978] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0054.978] GetProcessHeap () returned 0x630000 [0054.978] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.978] GetProcessHeap () returned 0x630000 [0054.978] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.978] GetProcessHeap () returned 0x630000 [0054.978] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.978] GetProcessHeap () returned 0x630000 [0054.978] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.978] GetProcessHeap () returned 0x630000 [0054.978] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.978] GetProcessHeap () returned 0x630000 [0054.978] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.979] GetProcessHeap () returned 0x630000 [0054.979] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.979] GetProcessHeap () returned 0x630000 [0054.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.979] GetProcessHeap () returned 0x630000 [0054.979] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0054.979] GetProcessHeap () returned 0x630000 [0054.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0054.979] GetProcessHeap () returned 0x630000 [0054.979] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0054.979] GetProcessHeap () returned 0x630000 [0054.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0054.979] GetProcessHeap () returned 0x630000 [0054.979] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0054.979] GetProcessHeap () returned 0x630000 [0054.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0054.979] GetProcessHeap () returned 0x630000 [0054.979] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0054.979] GetProcessHeap () returned 0x630000 [0054.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0054.979] GetProcessHeap () returned 0x630000 [0054.979] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.979] GetProcessHeap () returned 0x630000 [0054.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.979] GetProcessHeap () returned 0x630000 [0054.979] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.979] GetProcessHeap () returned 0x630000 [0054.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.979] GetProcessHeap () returned 0x630000 [0054.979] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.979] GetProcessHeap () returned 0x630000 [0054.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.979] GetProcessHeap () returned 0x630000 [0054.979] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.979] GetProcessHeap () returned 0x630000 [0054.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.979] GetProcessHeap () returned 0x630000 [0054.980] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0054.980] GetProcessHeap () returned 0x630000 [0054.980] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0054.980] GetProcessHeap () returned 0x630000 [0054.980] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0054.980] GetProcessHeap () returned 0x630000 [0054.980] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0054.980] GetProcessHeap () returned 0x630000 [0054.980] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.980] GetProcessHeap () returned 0x630000 [0054.980] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.980] GetProcessHeap () returned 0x630000 [0054.980] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.980] GetProcessHeap () returned 0x630000 [0054.980] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.980] GetProcessHeap () returned 0x630000 [0054.980] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0054.980] GetProcessHeap () returned 0x630000 [0054.980] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0054.980] GetProcessHeap () returned 0x630000 [0054.980] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0054.980] GetProcessHeap () returned 0x630000 [0054.980] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0054.980] GetProcessHeap () returned 0x630000 [0054.980] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0054.980] GetProcessHeap () returned 0x630000 [0054.980] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0054.980] GetProcessHeap () returned 0x630000 [0054.980] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0054.980] GetProcessHeap () returned 0x630000 [0054.980] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0054.980] GetProcessHeap () returned 0x630000 [0054.980] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0054.980] GetProcessHeap () returned 0x630000 [0054.980] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0054.980] GetProcessHeap () returned 0x630000 [0054.980] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0054.980] GetProcessHeap () returned 0x630000 [0054.980] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0054.981] GetProcessHeap () returned 0x630000 [0054.981] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0054.981] GetProcessHeap () returned 0x630000 [0054.981] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0054.981] GetProcessHeap () returned 0x630000 [0054.981] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0054.981] GetProcessHeap () returned 0x630000 [0054.981] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ec40 | out: hHeap=0x630000) returned 1 [0054.981] GetProcessHeap () returned 0x630000 [0054.981] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0054.981] GetProcessHeap () returned 0x630000 [0054.981] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0054.981] GetProcessHeap () returned 0x630000 [0054.981] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0054.981] GetProcessHeap () returned 0x630000 [0054.981] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0054.981] GetProcessHeap () returned 0x630000 [0054.981] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0054.981] WriteFile (in: hFile=0x230, lpBuffer=0x65d888*, nNumberOfBytesToWrite=0x383, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65d888*, lpNumberOfBytesWritten=0x243d864*=0x383, lpOverlapped=0x0) returned 1 [0054.991] GetProcessHeap () returned 0x630000 [0054.991] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65d888, Size=0x30) returned 0x65d888 [0054.991] GetProcessHeap () returned 0x630000 [0054.991] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0054.991] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0054.991] GetProcessHeap () returned 0x630000 [0054.991] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10f70) returned 0x65ed80 [0054.991] ReadFile (in: hFile=0x230, lpBuffer=0x65ed80, nNumberOfBytesToRead=0x10f70, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesRead=0x243d7e8*=0x10f70, lpOverlapped=0x0) returned 1 [0054.992] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0054.992] WriteFile (in: hFile=0x230, lpBuffer=0x65ed80*, nNumberOfBytesToWrite=0x10f70, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesWritten=0x243d7e4*=0x10f70, lpOverlapped=0x0) returned 1 [0054.993] GetProcessHeap () returned 0x630000 [0054.993] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ed80 | out: hHeap=0x630000) returned 1 [0054.995] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0054.995] WriteFile (in: hFile=0x230, lpBuffer=0x65d888*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65d888*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0054.996] CloseHandle (hObject=0x230) returned 1 [0054.998] GetProcessHeap () returned 0x630000 [0054.998] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0054.998] GetProcessHeap () returned 0x630000 [0054.998] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655580 | out: hHeap=0x630000) returned 1 [0054.998] GetProcessHeap () returned 0x630000 [0054.998] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0054.998] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm" [0054.998] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm.happythreechoose" [0054.999] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_it-it.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_it-it.htm.happythreechoose"), dwFlags=0x1) returned 1 [0054.999] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0054.999] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0054.999] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" [0054.999] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\decryption info.html")) returned 0x20 [0054.999] GetProcessHeap () returned 0x630000 [0054.999] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0054.999] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ef94a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ef94a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x3354e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_ja-jp.htm", cAlternateFileName="EULA_J~1.HTM")) returned 1 [0054.999] lstrcmpiW (lpString1="EULA_ja-jp.htm", lpString2=".") returned 1 [0055.000] lstrcmpiW (lpString1="EULA_ja-jp.htm", lpString2="..") returned 1 [0055.000] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_ja-jp.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm" [0055.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_ja-jp.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0055.000] GetProcessHeap () returned 0x630000 [0055.000] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64ca20 [0055.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_ja-jp.htm", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_ja-jp.htm", lpUsedDefaultChar=0x0) returned 15 [0055.000] lstrlenA (lpString="EULA_ja-jp.htm") returned 14 [0055.000] lstrlenA (lpString=".happythreechoose") returned 17 [0055.000] lstrcmpiW (lpString1="EULA_ja-jp.htm", lpString2="Decryption INFO.html") returned 1 [0055.000] lstrcmpiW (lpString1="EULA_ja-jp.htm", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0055.000] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0055.000] lstrcmpiW (lpString1="EULA_ja-jp.htm", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0055.000] GetProcessHeap () returned 0x630000 [0055.000] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0055.000] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ja-jp.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0055.000] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=210254) returned 1 [0055.000] GetProcessHeap () returned 0x630000 [0055.000] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655418 [0055.000] GetProcessHeap () returned 0x630000 [0055.000] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0055.000] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm") returned 52 [0055.000] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.001] GetProcessHeap () returned 0x630000 [0055.001] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0055.001] GetProcessHeap () returned 0x630000 [0055.001] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x65acd0 [0055.001] lstrlenA (lpString="rsa_encrypt") returned 11 [0055.001] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0055.001] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0055.001] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0055.001] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0055.001] GetProcessHeap () returned 0x630000 [0055.001] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0055.001] lstrlenA (lpString="010001") returned 6 [0055.001] GetProcessHeap () returned 0x630000 [0055.001] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2a8 [0055.001] GetProcessHeap () returned 0x630000 [0055.002] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0055.002] GetProcessHeap () returned 0x630000 [0055.002] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e100 [0055.002] GetProcessHeap () returned 0x630000 [0055.002] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0055.002] GetProcessHeap () returned 0x630000 [0055.002] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0055.002] GetProcessHeap () returned 0x630000 [0055.002] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657788 [0055.002] GetProcessHeap () returned 0x630000 [0055.002] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a348 [0055.002] GetProcessHeap () returned 0x630000 [0055.002] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0055.002] GetProcessHeap () returned 0x630000 [0055.002] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.002] GetProcessHeap () returned 0x630000 [0055.002] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0055.002] GetProcessHeap () returned 0x630000 [0055.002] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0055.002] GetProcessHeap () returned 0x630000 [0055.002] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656b80 [0055.002] GetProcessHeap () returned 0x630000 [0055.002] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.002] GetProcessHeap () returned 0x630000 [0055.002] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0055.002] GetProcessHeap () returned 0x630000 [0055.002] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ecd0 [0055.002] GetProcessHeap () returned 0x630000 [0055.002] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0055.002] GetProcessHeap () returned 0x630000 [0055.002] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0055.002] GetProcessHeap () returned 0x630000 [0055.002] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ecd0 | out: hHeap=0x630000) returned 1 [0055.002] GetProcessHeap () returned 0x630000 [0055.002] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.002] GetProcessHeap () returned 0x630000 [0055.002] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x655f58 [0055.002] GetProcessHeap () returned 0x630000 [0055.002] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.003] GetProcessHeap () returned 0x630000 [0055.003] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.003] GetProcessHeap () returned 0x630000 [0055.003] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.003] GetProcessHeap () returned 0x630000 [0055.003] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.003] GetProcessHeap () returned 0x630000 [0055.003] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65dda0 [0055.003] GetProcessHeap () returned 0x630000 [0055.003] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655f58 | out: hHeap=0x630000) returned 1 [0055.003] GetProcessHeap () returned 0x630000 [0055.003] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0055.003] GetProcessHeap () returned 0x630000 [0055.003] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0055.003] GetProcessHeap () returned 0x630000 [0055.003] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.003] GetProcessHeap () returned 0x630000 [0055.003] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.003] GetProcessHeap () returned 0x630000 [0055.003] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.003] GetProcessHeap () returned 0x630000 [0055.003] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.003] GetProcessHeap () returned 0x630000 [0055.003] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0055.003] GetProcessHeap () returned 0x630000 [0055.003] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0055.003] GetProcessHeap () returned 0x630000 [0055.003] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0055.003] GetProcessHeap () returned 0x630000 [0055.003] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.003] GetProcessHeap () returned 0x630000 [0055.003] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.003] GetProcessHeap () returned 0x630000 [0055.003] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.003] GetProcessHeap () returned 0x630000 [0055.003] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.003] GetProcessHeap () returned 0x630000 [0055.003] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.003] GetProcessHeap () returned 0x630000 [0055.003] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0055.004] GetProcessHeap () returned 0x630000 [0055.004] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.004] GetProcessHeap () returned 0x630000 [0055.004] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.004] GetProcessHeap () returned 0x630000 [0055.004] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.004] GetProcessHeap () returned 0x630000 [0055.004] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.004] GetProcessHeap () returned 0x630000 [0055.004] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.004] GetProcessHeap () returned 0x630000 [0055.004] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.004] GetProcessHeap () returned 0x630000 [0055.004] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.004] GetProcessHeap () returned 0x630000 [0055.004] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.004] GetProcessHeap () returned 0x630000 [0055.004] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.004] GetProcessHeap () returned 0x630000 [0055.004] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.004] GetProcessHeap () returned 0x630000 [0055.004] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.004] GetProcessHeap () returned 0x630000 [0055.004] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.004] GetProcessHeap () returned 0x630000 [0055.004] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.004] GetProcessHeap () returned 0x630000 [0055.004] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.004] GetProcessHeap () returned 0x630000 [0055.004] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.004] GetProcessHeap () returned 0x630000 [0055.004] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.004] GetProcessHeap () returned 0x630000 [0055.004] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.004] GetProcessHeap () returned 0x630000 [0055.004] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.004] GetProcessHeap () returned 0x630000 [0055.004] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.005] GetProcessHeap () returned 0x630000 [0055.005] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0055.005] GetProcessHeap () returned 0x630000 [0055.005] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0055.005] GetProcessHeap () returned 0x630000 [0055.005] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.005] GetProcessHeap () returned 0x630000 [0055.005] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.005] GetProcessHeap () returned 0x630000 [0055.005] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.005] GetProcessHeap () returned 0x630000 [0055.005] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.005] GetProcessHeap () returned 0x630000 [0055.005] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0055.005] GetProcessHeap () returned 0x630000 [0055.005] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.005] GetProcessHeap () returned 0x630000 [0055.005] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.005] GetProcessHeap () returned 0x630000 [0055.005] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.005] GetProcessHeap () returned 0x630000 [0055.005] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0055.005] GetProcessHeap () returned 0x630000 [0055.005] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.005] GetProcessHeap () returned 0x630000 [0055.005] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0055.005] GetProcessHeap () returned 0x630000 [0055.005] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0055.005] GetProcessHeap () returned 0x630000 [0055.005] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0055.005] GetProcessHeap () returned 0x630000 [0055.005] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.005] GetProcessHeap () returned 0x630000 [0055.005] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.005] GetProcessHeap () returned 0x630000 [0055.005] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.005] GetProcessHeap () returned 0x630000 [0055.006] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.006] GetProcessHeap () returned 0x630000 [0055.006] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.006] GetProcessHeap () returned 0x630000 [0055.006] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.006] GetProcessHeap () returned 0x630000 [0055.006] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.006] GetProcessHeap () returned 0x630000 [0055.006] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.006] GetProcessHeap () returned 0x630000 [0055.006] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.006] GetProcessHeap () returned 0x630000 [0055.006] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.006] GetProcessHeap () returned 0x630000 [0055.006] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.006] GetProcessHeap () returned 0x630000 [0055.006] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.006] GetProcessHeap () returned 0x630000 [0055.006] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.006] GetProcessHeap () returned 0x630000 [0055.006] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.006] GetProcessHeap () returned 0x630000 [0055.006] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.006] GetProcessHeap () returned 0x630000 [0055.006] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.006] GetProcessHeap () returned 0x630000 [0055.006] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.006] GetProcessHeap () returned 0x630000 [0055.006] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.006] GetProcessHeap () returned 0x630000 [0055.006] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.006] GetProcessHeap () returned 0x630000 [0055.006] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.006] GetProcessHeap () returned 0x630000 [0055.006] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.006] GetProcessHeap () returned 0x630000 [0055.006] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.006] GetProcessHeap () returned 0x630000 [0055.007] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.007] GetProcessHeap () returned 0x630000 [0055.007] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0055.007] GetProcessHeap () returned 0x630000 [0055.007] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0055.007] GetProcessHeap () returned 0x630000 [0055.007] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.007] GetProcessHeap () returned 0x630000 [0055.007] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.007] GetProcessHeap () returned 0x630000 [0055.007] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0055.007] GetProcessHeap () returned 0x630000 [0055.007] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0055.007] GetProcessHeap () returned 0x630000 [0055.007] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.007] GetProcessHeap () returned 0x630000 [0055.007] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.007] GetProcessHeap () returned 0x630000 [0055.007] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0055.007] GetProcessHeap () returned 0x630000 [0055.007] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0055.007] GetProcessHeap () returned 0x630000 [0055.007] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.007] GetProcessHeap () returned 0x630000 [0055.007] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.007] GetProcessHeap () returned 0x630000 [0055.007] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0055.007] GetProcessHeap () returned 0x630000 [0055.007] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0055.007] GetProcessHeap () returned 0x630000 [0055.007] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0055.007] GetProcessHeap () returned 0x630000 [0055.007] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0055.007] GetProcessHeap () returned 0x630000 [0055.007] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0055.007] GetProcessHeap () returned 0x630000 [0055.007] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0055.008] GetProcessHeap () returned 0x630000 [0055.008] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0055.008] GetProcessHeap () returned 0x630000 [0055.008] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0055.008] GetProcessHeap () returned 0x630000 [0055.008] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0055.008] GetProcessHeap () returned 0x630000 [0055.008] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.008] GetProcessHeap () returned 0x630000 [0055.008] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0055.008] WriteFile (in: hFile=0x230, lpBuffer=0x65acd0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65acd0*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0055.104] GetProcessHeap () returned 0x630000 [0055.104] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65acd0, Size=0x30) returned 0x65acd0 [0055.104] GetProcessHeap () returned 0x630000 [0055.104] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0055.104] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.104] GetProcessHeap () returned 0x630000 [0055.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3354e) returned 0x65ed80 [0055.108] ReadFile (in: hFile=0x230, lpBuffer=0x65ed80, nNumberOfBytesToRead=0x3354e, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesRead=0x243d7e8*=0x3354e, lpOverlapped=0x0) returned 1 [0055.111] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.111] WriteFile (in: hFile=0x230, lpBuffer=0x65ed80*, nNumberOfBytesToWrite=0x3354e, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesWritten=0x243d7e4*=0x3354e, lpOverlapped=0x0) returned 1 [0055.113] GetProcessHeap () returned 0x630000 [0055.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ed80 | out: hHeap=0x630000) returned 1 [0055.113] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.113] WriteFile (in: hFile=0x230, lpBuffer=0x65acd0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65acd0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0055.114] CloseHandle (hObject=0x230) returned 1 [0055.119] GetProcessHeap () returned 0x630000 [0055.119] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0055.119] GetProcessHeap () returned 0x630000 [0055.119] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655418 | out: hHeap=0x630000) returned 1 [0055.119] GetProcessHeap () returned 0x630000 [0055.119] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0055.119] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm" [0055.119] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm.happythreechoose" [0055.119] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ja-jp.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ja-jp.htm.happythreechoose"), dwFlags=0x1) returned 1 [0055.120] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0055.120] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0055.120] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" [0055.120] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\decryption info.html")) returned 0x20 [0055.120] GetProcessHeap () returned 0x630000 [0055.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0055.120] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3f205a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3f205a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x9ace3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_ko-kr.htm", cAlternateFileName="EULA_K~1.HTM")) returned 1 [0055.120] lstrcmpiW (lpString1="EULA_ko-kr.htm", lpString2=".") returned 1 [0055.120] lstrcmpiW (lpString1="EULA_ko-kr.htm", lpString2="..") returned 1 [0055.120] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_ko-kr.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm" [0055.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_ko-kr.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0055.121] GetProcessHeap () returned 0x630000 [0055.121] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0055.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_ko-kr.htm", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_ko-kr.htm", lpUsedDefaultChar=0x0) returned 15 [0055.121] lstrlenA (lpString="EULA_ko-kr.htm") returned 14 [0055.121] lstrlenA (lpString=".happythreechoose") returned 17 [0055.121] lstrcmpiW (lpString1="EULA_ko-kr.htm", lpString2="Decryption INFO.html") returned 1 [0055.121] lstrcmpiW (lpString1="EULA_ko-kr.htm", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0055.121] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0055.121] lstrcmpiW (lpString1="EULA_ko-kr.htm", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0055.121] GetProcessHeap () returned 0x630000 [0055.121] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0055.121] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ko-kr.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0055.122] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=634083) returned 1 [0055.122] GetProcessHeap () returned 0x630000 [0055.122] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655418 [0055.122] GetProcessHeap () returned 0x630000 [0055.122] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0055.122] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm") returned 52 [0055.122] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.122] GetProcessHeap () returned 0x630000 [0055.122] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0055.122] GetProcessHeap () returned 0x630000 [0055.122] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x65ad08 [0055.122] lstrlenA (lpString="rsa_encrypt") returned 11 [0055.122] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0055.123] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0055.123] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0055.123] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0055.123] GetProcessHeap () returned 0x630000 [0055.123] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0055.123] lstrlenA (lpString="010001") returned 6 [0055.123] GetProcessHeap () returned 0x630000 [0055.123] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3f8 [0055.123] GetProcessHeap () returned 0x630000 [0055.123] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0055.123] GetProcessHeap () returned 0x630000 [0055.123] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e850 [0055.123] GetProcessHeap () returned 0x630000 [0055.123] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0055.123] GetProcessHeap () returned 0x630000 [0055.123] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dec0 [0055.123] GetProcessHeap () returned 0x630000 [0055.123] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657440 [0055.123] GetProcessHeap () returned 0x630000 [0055.123] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2a8 [0055.123] GetProcessHeap () returned 0x630000 [0055.124] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0055.124] GetProcessHeap () returned 0x630000 [0055.124] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.124] GetProcessHeap () returned 0x630000 [0055.124] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0055.124] GetProcessHeap () returned 0x630000 [0055.124] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0055.124] GetProcessHeap () returned 0x630000 [0055.124] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656a68 [0055.124] GetProcessHeap () returned 0x630000 [0055.124] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0055.124] GetProcessHeap () returned 0x630000 [0055.124] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0055.124] GetProcessHeap () returned 0x630000 [0055.124] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e460 [0055.124] GetProcessHeap () returned 0x630000 [0055.124] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0055.124] GetProcessHeap () returned 0x630000 [0055.124] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0055.124] GetProcessHeap () returned 0x630000 [0055.124] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e460 | out: hHeap=0x630000) returned 1 [0055.124] GetProcessHeap () returned 0x630000 [0055.124] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.124] GetProcessHeap () returned 0x630000 [0055.124] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x655d48 [0055.124] GetProcessHeap () returned 0x630000 [0055.124] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.124] GetProcessHeap () returned 0x630000 [0055.124] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.124] GetProcessHeap () returned 0x630000 [0055.124] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0055.124] GetProcessHeap () returned 0x630000 [0055.124] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.124] GetProcessHeap () returned 0x630000 [0055.124] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e100 [0055.124] GetProcessHeap () returned 0x630000 [0055.124] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655d48 | out: hHeap=0x630000) returned 1 [0055.124] GetProcessHeap () returned 0x630000 [0055.124] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0055.124] GetProcessHeap () returned 0x630000 [0055.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0055.125] GetProcessHeap () returned 0x630000 [0055.125] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.125] GetProcessHeap () returned 0x630000 [0055.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.125] GetProcessHeap () returned 0x630000 [0055.125] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.125] GetProcessHeap () returned 0x630000 [0055.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.125] GetProcessHeap () returned 0x630000 [0055.125] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.125] GetProcessHeap () returned 0x630000 [0055.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.125] GetProcessHeap () returned 0x630000 [0055.125] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.125] GetProcessHeap () returned 0x630000 [0055.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.125] GetProcessHeap () returned 0x630000 [0055.125] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.125] GetProcessHeap () returned 0x630000 [0055.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.125] GetProcessHeap () returned 0x630000 [0055.125] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.125] GetProcessHeap () returned 0x630000 [0055.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.125] GetProcessHeap () returned 0x630000 [0055.125] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0055.125] GetProcessHeap () returned 0x630000 [0055.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.125] GetProcessHeap () returned 0x630000 [0055.125] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.125] GetProcessHeap () returned 0x630000 [0055.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.125] GetProcessHeap () returned 0x630000 [0055.125] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0055.125] GetProcessHeap () returned 0x630000 [0055.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.126] GetProcessHeap () returned 0x630000 [0055.126] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0055.126] GetProcessHeap () returned 0x630000 [0055.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0055.126] GetProcessHeap () returned 0x630000 [0055.126] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.126] GetProcessHeap () returned 0x630000 [0055.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.126] GetProcessHeap () returned 0x630000 [0055.126] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.126] GetProcessHeap () returned 0x630000 [0055.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.126] GetProcessHeap () returned 0x630000 [0055.126] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.126] GetProcessHeap () returned 0x630000 [0055.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.126] GetProcessHeap () returned 0x630000 [0055.126] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0055.126] GetProcessHeap () returned 0x630000 [0055.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.126] GetProcessHeap () returned 0x630000 [0055.126] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.126] GetProcessHeap () returned 0x630000 [0055.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.126] GetProcessHeap () returned 0x630000 [0055.126] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.126] GetProcessHeap () returned 0x630000 [0055.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.126] GetProcessHeap () returned 0x630000 [0055.126] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.126] GetProcessHeap () returned 0x630000 [0055.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.126] GetProcessHeap () returned 0x630000 [0055.126] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.126] GetProcessHeap () returned 0x630000 [0055.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.127] GetProcessHeap () returned 0x630000 [0055.127] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.127] GetProcessHeap () returned 0x630000 [0055.127] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.127] GetProcessHeap () returned 0x630000 [0055.127] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.127] GetProcessHeap () returned 0x630000 [0055.127] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.127] GetProcessHeap () returned 0x630000 [0055.127] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.127] GetProcessHeap () returned 0x630000 [0055.127] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.127] GetProcessHeap () returned 0x630000 [0055.127] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.127] GetProcessHeap () returned 0x630000 [0055.127] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.127] GetProcessHeap () returned 0x630000 [0055.127] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.127] GetProcessHeap () returned 0x630000 [0055.127] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.127] GetProcessHeap () returned 0x630000 [0055.127] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.127] GetProcessHeap () returned 0x630000 [0055.127] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.127] GetProcessHeap () returned 0x630000 [0055.127] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.127] GetProcessHeap () returned 0x630000 [0055.127] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.127] GetProcessHeap () returned 0x630000 [0055.127] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.127] GetProcessHeap () returned 0x630000 [0055.127] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.127] GetProcessHeap () returned 0x630000 [0055.127] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0055.127] GetProcessHeap () returned 0x630000 [0055.127] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.127] GetProcessHeap () returned 0x630000 [0055.127] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.127] GetProcessHeap () returned 0x630000 [0055.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.128] GetProcessHeap () returned 0x630000 [0055.128] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.128] GetProcessHeap () returned 0x630000 [0055.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.128] GetProcessHeap () returned 0x630000 [0055.128] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.128] GetProcessHeap () returned 0x630000 [0055.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.128] GetProcessHeap () returned 0x630000 [0055.128] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.128] GetProcessHeap () returned 0x630000 [0055.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.128] GetProcessHeap () returned 0x630000 [0055.128] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0055.128] GetProcessHeap () returned 0x630000 [0055.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0055.128] GetProcessHeap () returned 0x630000 [0055.128] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.128] GetProcessHeap () returned 0x630000 [0055.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.128] GetProcessHeap () returned 0x630000 [0055.128] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0055.128] GetProcessHeap () returned 0x630000 [0055.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.128] GetProcessHeap () returned 0x630000 [0055.128] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.128] GetProcessHeap () returned 0x630000 [0055.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.128] GetProcessHeap () returned 0x630000 [0055.128] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.128] GetProcessHeap () returned 0x630000 [0055.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.128] GetProcessHeap () returned 0x630000 [0055.128] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.128] GetProcessHeap () returned 0x630000 [0055.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.128] GetProcessHeap () returned 0x630000 [0055.128] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.128] GetProcessHeap () returned 0x630000 [0055.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.129] GetProcessHeap () returned 0x630000 [0055.129] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.129] GetProcessHeap () returned 0x630000 [0055.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.129] GetProcessHeap () returned 0x630000 [0055.129] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.129] GetProcessHeap () returned 0x630000 [0055.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.129] GetProcessHeap () returned 0x630000 [0055.129] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.129] GetProcessHeap () returned 0x630000 [0055.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.129] GetProcessHeap () returned 0x630000 [0055.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0055.129] GetProcessHeap () returned 0x630000 [0055.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0055.129] GetProcessHeap () returned 0x630000 [0055.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0055.129] GetProcessHeap () returned 0x630000 [0055.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0055.129] GetProcessHeap () returned 0x630000 [0055.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0055.129] GetProcessHeap () returned 0x630000 [0055.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0055.129] GetProcessHeap () returned 0x630000 [0055.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0055.129] GetProcessHeap () returned 0x630000 [0055.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0055.129] GetProcessHeap () returned 0x630000 [0055.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0055.129] GetProcessHeap () returned 0x630000 [0055.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.129] GetProcessHeap () returned 0x630000 [0055.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0055.129] WriteFile (in: hFile=0x230, lpBuffer=0x65ad08*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65ad08*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0055.133] GetProcessHeap () returned 0x630000 [0055.133] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65ad08, Size=0x30) returned 0x65ad08 [0055.133] GetProcessHeap () returned 0x630000 [0055.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0055.133] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.133] GetProcessHeap () returned 0x630000 [0055.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9ace3) returned 0x1f3c020 [0055.145] ReadFile (in: hFile=0x230, lpBuffer=0x1f3c020, nNumberOfBytesToRead=0x9ace3, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x1f3c020*, lpNumberOfBytesRead=0x243d7e8*=0x9ace3, lpOverlapped=0x0) returned 1 [0055.153] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.153] WriteFile (in: hFile=0x230, lpBuffer=0x1f3c020*, nNumberOfBytesToWrite=0x9ace3, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x1f3c020*, lpNumberOfBytesWritten=0x243d7e4*=0x9ace3, lpOverlapped=0x0) returned 1 [0055.158] GetProcessHeap () returned 0x630000 [0055.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x1f3c020 | out: hHeap=0x630000) returned 1 [0055.161] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.161] WriteFile (in: hFile=0x230, lpBuffer=0x65ad08*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65ad08*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0055.163] CloseHandle (hObject=0x230) returned 1 [0055.174] GetProcessHeap () returned 0x630000 [0055.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0055.174] GetProcessHeap () returned 0x630000 [0055.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655418 | out: hHeap=0x630000) returned 1 [0055.174] GetProcessHeap () returned 0x630000 [0055.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0055.174] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm" [0055.174] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm.happythreechoose" [0055.174] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ko-kr.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ko-kr.htm.happythreechoose"), dwFlags=0x1) returned 1 [0055.175] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0055.175] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0055.175] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" [0055.175] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\decryption info.html")) returned 0x20 [0055.175] GetProcessHeap () returned 0x630000 [0055.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0055.175] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3f33e0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3f33e0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1293b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_lt-lt.htm", cAlternateFileName="EULA_L~1.HTM")) returned 1 [0055.175] lstrcmpiW (lpString1="EULA_lt-lt.htm", lpString2=".") returned 1 [0055.175] lstrcmpiW (lpString1="EULA_lt-lt.htm", lpString2="..") returned 1 [0055.175] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_lt-lt.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm" [0055.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_lt-lt.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0055.175] GetProcessHeap () returned 0x630000 [0055.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64ca20 [0055.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_lt-lt.htm", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_lt-lt.htm", lpUsedDefaultChar=0x0) returned 15 [0055.176] lstrlenA (lpString="EULA_lt-lt.htm") returned 14 [0055.176] lstrlenA (lpString=".happythreechoose") returned 17 [0055.176] lstrcmpiW (lpString1="EULA_lt-lt.htm", lpString2="Decryption INFO.html") returned 1 [0055.176] lstrcmpiW (lpString1="EULA_lt-lt.htm", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0055.176] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0055.176] lstrcmpiW (lpString1="EULA_lt-lt.htm", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0055.176] GetProcessHeap () returned 0x630000 [0055.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0055.176] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lt-lt.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0055.176] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=76091) returned 1 [0055.176] GetProcessHeap () returned 0x630000 [0055.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655580 [0055.176] GetProcessHeap () returned 0x630000 [0055.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0055.176] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm") returned 52 [0055.176] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.176] GetProcessHeap () returned 0x630000 [0055.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0055.176] GetProcessHeap () returned 0x630000 [0055.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x65ad40 [0055.176] lstrlenA (lpString="rsa_encrypt") returned 11 [0055.177] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0055.177] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0055.177] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0055.177] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0055.177] GetProcessHeap () returned 0x630000 [0055.177] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0055.177] lstrlenA (lpString="010001") returned 6 [0055.177] GetProcessHeap () returned 0x630000 [0055.177] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0055.177] GetProcessHeap () returned 0x630000 [0055.177] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0055.177] GetProcessHeap () returned 0x630000 [0055.177] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e580 [0055.177] GetProcessHeap () returned 0x630000 [0055.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0055.177] GetProcessHeap () returned 0x630000 [0055.178] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0055.178] GetProcessHeap () returned 0x630000 [0055.178] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656b80 [0055.178] GetProcessHeap () returned 0x630000 [0055.178] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a348 [0055.178] GetProcessHeap () returned 0x630000 [0055.178] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0055.178] GetProcessHeap () returned 0x630000 [0055.178] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.178] GetProcessHeap () returned 0x630000 [0055.178] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0055.178] GetProcessHeap () returned 0x630000 [0055.178] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0055.178] GetProcessHeap () returned 0x630000 [0055.178] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657210 [0055.178] GetProcessHeap () returned 0x630000 [0055.178] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.178] GetProcessHeap () returned 0x630000 [0055.178] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0055.178] GetProcessHeap () returned 0x630000 [0055.178] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0055.178] GetProcessHeap () returned 0x630000 [0055.178] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0055.178] GetProcessHeap () returned 0x630000 [0055.178] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0055.178] GetProcessHeap () returned 0x630000 [0055.178] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0055.178] GetProcessHeap () returned 0x630000 [0055.178] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.178] GetProcessHeap () returned 0x630000 [0055.178] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x655fa0 [0055.178] GetProcessHeap () returned 0x630000 [0055.178] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.178] GetProcessHeap () returned 0x630000 [0055.178] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.178] GetProcessHeap () returned 0x630000 [0055.178] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.178] GetProcessHeap () returned 0x630000 [0055.178] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.179] GetProcessHeap () returned 0x630000 [0055.179] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ea00 [0055.179] GetProcessHeap () returned 0x630000 [0055.179] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655fa0 | out: hHeap=0x630000) returned 1 [0055.179] GetProcessHeap () returned 0x630000 [0055.179] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0055.179] GetProcessHeap () returned 0x630000 [0055.179] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0055.179] GetProcessHeap () returned 0x630000 [0055.179] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.179] GetProcessHeap () returned 0x630000 [0055.179] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.179] GetProcessHeap () returned 0x630000 [0055.179] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.179] GetProcessHeap () returned 0x630000 [0055.179] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.179] GetProcessHeap () returned 0x630000 [0055.179] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.179] GetProcessHeap () returned 0x630000 [0055.179] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.179] GetProcessHeap () returned 0x630000 [0055.179] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.179] GetProcessHeap () returned 0x630000 [0055.179] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.179] GetProcessHeap () returned 0x630000 [0055.179] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0055.179] GetProcessHeap () returned 0x630000 [0055.179] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0055.179] GetProcessHeap () returned 0x630000 [0055.179] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.179] GetProcessHeap () returned 0x630000 [0055.179] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.179] GetProcessHeap () returned 0x630000 [0055.179] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.179] GetProcessHeap () returned 0x630000 [0055.179] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.179] GetProcessHeap () returned 0x630000 [0055.179] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.180] GetProcessHeap () returned 0x630000 [0055.180] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.180] GetProcessHeap () returned 0x630000 [0055.180] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.180] GetProcessHeap () returned 0x630000 [0055.180] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.180] GetProcessHeap () returned 0x630000 [0055.180] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.180] GetProcessHeap () returned 0x630000 [0055.180] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.180] GetProcessHeap () returned 0x630000 [0055.180] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.180] GetProcessHeap () returned 0x630000 [0055.180] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.180] GetProcessHeap () returned 0x630000 [0055.180] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.180] GetProcessHeap () returned 0x630000 [0055.180] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.180] GetProcessHeap () returned 0x630000 [0055.180] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.180] GetProcessHeap () returned 0x630000 [0055.180] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.180] GetProcessHeap () returned 0x630000 [0055.180] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.180] GetProcessHeap () returned 0x630000 [0055.180] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.180] GetProcessHeap () returned 0x630000 [0055.180] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.180] GetProcessHeap () returned 0x630000 [0055.180] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.180] GetProcessHeap () returned 0x630000 [0055.180] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.180] GetProcessHeap () returned 0x630000 [0055.180] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.180] GetProcessHeap () returned 0x630000 [0055.180] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.180] GetProcessHeap () returned 0x630000 [0055.180] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.181] GetProcessHeap () returned 0x630000 [0055.181] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.181] GetProcessHeap () returned 0x630000 [0055.181] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.181] GetProcessHeap () returned 0x630000 [0055.181] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.181] GetProcessHeap () returned 0x630000 [0055.181] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.181] GetProcessHeap () returned 0x630000 [0055.181] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.181] GetProcessHeap () returned 0x630000 [0055.181] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.181] GetProcessHeap () returned 0x630000 [0055.181] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.181] GetProcessHeap () returned 0x630000 [0055.181] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.181] GetProcessHeap () returned 0x630000 [0055.181] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.181] GetProcessHeap () returned 0x630000 [0055.181] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.181] GetProcessHeap () returned 0x630000 [0055.181] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.181] GetProcessHeap () returned 0x630000 [0055.181] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.181] GetProcessHeap () returned 0x630000 [0055.181] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.181] GetProcessHeap () returned 0x630000 [0055.181] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.181] GetProcessHeap () returned 0x630000 [0055.181] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.181] GetProcessHeap () returned 0x630000 [0055.181] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.181] GetProcessHeap () returned 0x630000 [0055.181] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.181] GetProcessHeap () returned 0x630000 [0055.181] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.181] GetProcessHeap () returned 0x630000 [0055.182] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0055.182] GetProcessHeap () returned 0x630000 [0055.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0055.182] GetProcessHeap () returned 0x630000 [0055.182] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.182] GetProcessHeap () returned 0x630000 [0055.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.182] GetProcessHeap () returned 0x630000 [0055.182] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.182] GetProcessHeap () returned 0x630000 [0055.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.182] GetProcessHeap () returned 0x630000 [0055.182] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.182] GetProcessHeap () returned 0x630000 [0055.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.182] GetProcessHeap () returned 0x630000 [0055.182] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0055.182] GetProcessHeap () returned 0x630000 [0055.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.182] GetProcessHeap () returned 0x630000 [0055.182] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.182] GetProcessHeap () returned 0x630000 [0055.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.182] GetProcessHeap () returned 0x630000 [0055.182] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.182] GetProcessHeap () returned 0x630000 [0055.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.182] GetProcessHeap () returned 0x630000 [0055.182] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.182] GetProcessHeap () returned 0x630000 [0055.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.182] GetProcessHeap () returned 0x630000 [0055.182] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0055.182] GetProcessHeap () returned 0x630000 [0055.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0055.182] GetProcessHeap () returned 0x630000 [0055.182] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.182] GetProcessHeap () returned 0x630000 [0055.183] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.183] GetProcessHeap () returned 0x630000 [0055.183] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.183] GetProcessHeap () returned 0x630000 [0055.183] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.183] GetProcessHeap () returned 0x630000 [0055.183] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.183] GetProcessHeap () returned 0x630000 [0055.183] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.183] GetProcessHeap () returned 0x630000 [0055.183] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0055.183] GetProcessHeap () returned 0x630000 [0055.183] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.183] GetProcessHeap () returned 0x630000 [0055.183] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0055.183] GetProcessHeap () returned 0x630000 [0055.183] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.183] GetProcessHeap () returned 0x630000 [0055.183] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.183] GetProcessHeap () returned 0x630000 [0055.183] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.183] GetProcessHeap () returned 0x630000 [0055.183] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0055.183] GetProcessHeap () returned 0x630000 [0055.183] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0055.183] GetProcessHeap () returned 0x630000 [0055.183] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0055.183] GetProcessHeap () returned 0x630000 [0055.183] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0055.183] GetProcessHeap () returned 0x630000 [0055.183] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0055.183] GetProcessHeap () returned 0x630000 [0055.183] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0055.183] GetProcessHeap () returned 0x630000 [0055.183] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0055.183] GetProcessHeap () returned 0x630000 [0055.183] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0055.184] GetProcessHeap () returned 0x630000 [0055.184] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0055.184] GetProcessHeap () returned 0x630000 [0055.184] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.184] GetProcessHeap () returned 0x630000 [0055.184] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0055.184] WriteFile (in: hFile=0x230, lpBuffer=0x65ad40*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65ad40*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0055.189] GetProcessHeap () returned 0x630000 [0055.189] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65ad40, Size=0x30) returned 0x65ad40 [0055.189] GetProcessHeap () returned 0x630000 [0055.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0055.189] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.189] GetProcessHeap () returned 0x630000 [0055.189] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1293b) returned 0x65ed80 [0055.189] ReadFile (in: hFile=0x230, lpBuffer=0x65ed80, nNumberOfBytesToRead=0x1293b, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesRead=0x243d7e8*=0x1293b, lpOverlapped=0x0) returned 1 [0055.191] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.191] WriteFile (in: hFile=0x230, lpBuffer=0x65ed80*, nNumberOfBytesToWrite=0x1293b, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesWritten=0x243d7e4*=0x1293b, lpOverlapped=0x0) returned 1 [0055.192] GetProcessHeap () returned 0x630000 [0055.192] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ed80 | out: hHeap=0x630000) returned 1 [0055.192] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.192] WriteFile (in: hFile=0x230, lpBuffer=0x65ad40*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65ad40*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0055.193] CloseHandle (hObject=0x230) returned 1 [0055.197] GetProcessHeap () returned 0x630000 [0055.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0055.197] GetProcessHeap () returned 0x630000 [0055.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655580 | out: hHeap=0x630000) returned 1 [0055.197] GetProcessHeap () returned 0x630000 [0055.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0055.197] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm" [0055.197] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm.happythreechoose" [0055.197] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lt-lt.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lt-lt.htm.happythreechoose"), dwFlags=0x1) returned 1 [0055.198] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0055.198] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0055.198] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" [0055.198] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\decryption info.html")) returned 0x20 [0055.198] GetProcessHeap () returned 0x630000 [0055.198] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0055.198] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3f5af3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3f5af3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x147c5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_lv-lv.htm", cAlternateFileName="EULA_L~2.HTM")) returned 1 [0055.198] lstrcmpiW (lpString1="EULA_lv-lv.htm", lpString2=".") returned 1 [0055.198] lstrcmpiW (lpString1="EULA_lv-lv.htm", lpString2="..") returned 1 [0055.198] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_lv-lv.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm" [0055.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_lv-lv.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0055.198] GetProcessHeap () returned 0x630000 [0055.198] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0055.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_lv-lv.htm", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_lv-lv.htm", lpUsedDefaultChar=0x0) returned 15 [0055.198] lstrlenA (lpString="EULA_lv-lv.htm") returned 14 [0055.198] lstrlenA (lpString=".happythreechoose") returned 17 [0055.198] lstrcmpiW (lpString1="EULA_lv-lv.htm", lpString2="Decryption INFO.html") returned 1 [0055.198] lstrcmpiW (lpString1="EULA_lv-lv.htm", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0055.198] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0055.198] lstrcmpiW (lpString1="EULA_lv-lv.htm", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0055.198] GetProcessHeap () returned 0x630000 [0055.198] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0055.198] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lv-lv.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0055.199] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=83909) returned 1 [0055.199] GetProcessHeap () returned 0x630000 [0055.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655580 [0055.199] GetProcessHeap () returned 0x630000 [0055.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0055.199] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm") returned 52 [0055.199] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.199] GetProcessHeap () returned 0x630000 [0055.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0055.199] GetProcessHeap () returned 0x630000 [0055.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38b) returned 0x65ad78 [0055.199] lstrlenA (lpString="rsa_encrypt") returned 11 [0055.199] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0055.200] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0055.200] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0055.200] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0055.200] GetProcessHeap () returned 0x630000 [0055.200] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0055.200] lstrlenA (lpString="010001") returned 6 [0055.200] GetProcessHeap () returned 0x630000 [0055.200] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3c8 [0055.200] GetProcessHeap () returned 0x630000 [0055.200] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0055.200] GetProcessHeap () returned 0x630000 [0055.200] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e4f0 [0055.200] GetProcessHeap () returned 0x630000 [0055.200] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0055.200] GetProcessHeap () returned 0x630000 [0055.200] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65eb20 [0055.200] GetProcessHeap () returned 0x630000 [0055.200] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657440 [0055.200] GetProcessHeap () returned 0x630000 [0055.200] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a298 [0055.200] GetProcessHeap () returned 0x630000 [0055.200] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0055.200] GetProcessHeap () returned 0x630000 [0055.200] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.200] GetProcessHeap () returned 0x630000 [0055.200] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0055.200] GetProcessHeap () returned 0x630000 [0055.200] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0055.201] GetProcessHeap () returned 0x630000 [0055.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657670 [0055.201] GetProcessHeap () returned 0x630000 [0055.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.201] GetProcessHeap () returned 0x630000 [0055.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0055.201] GetProcessHeap () returned 0x630000 [0055.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e580 [0055.201] GetProcessHeap () returned 0x630000 [0055.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0055.201] GetProcessHeap () returned 0x630000 [0055.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0055.201] GetProcessHeap () returned 0x630000 [0055.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0055.201] GetProcessHeap () returned 0x630000 [0055.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.201] GetProcessHeap () returned 0x630000 [0055.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x655e98 [0055.201] GetProcessHeap () returned 0x630000 [0055.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.201] GetProcessHeap () returned 0x630000 [0055.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.201] GetProcessHeap () returned 0x630000 [0055.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.201] GetProcessHeap () returned 0x630000 [0055.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.201] GetProcessHeap () returned 0x630000 [0055.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ea00 [0055.201] GetProcessHeap () returned 0x630000 [0055.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655e98 | out: hHeap=0x630000) returned 1 [0055.201] GetProcessHeap () returned 0x630000 [0055.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0055.201] GetProcessHeap () returned 0x630000 [0055.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0055.201] GetProcessHeap () returned 0x630000 [0055.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0055.201] GetProcessHeap () returned 0x630000 [0055.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0055.201] GetProcessHeap () returned 0x630000 [0055.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.202] GetProcessHeap () returned 0x630000 [0055.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.202] GetProcessHeap () returned 0x630000 [0055.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.202] GetProcessHeap () returned 0x630000 [0055.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.202] GetProcessHeap () returned 0x630000 [0055.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.202] GetProcessHeap () returned 0x630000 [0055.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.202] GetProcessHeap () returned 0x630000 [0055.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0055.202] GetProcessHeap () returned 0x630000 [0055.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0055.202] GetProcessHeap () returned 0x630000 [0055.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.202] GetProcessHeap () returned 0x630000 [0055.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.202] GetProcessHeap () returned 0x630000 [0055.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.202] GetProcessHeap () returned 0x630000 [0055.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.202] GetProcessHeap () returned 0x630000 [0055.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.202] GetProcessHeap () returned 0x630000 [0055.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.202] GetProcessHeap () returned 0x630000 [0055.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.202] GetProcessHeap () returned 0x630000 [0055.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.202] GetProcessHeap () returned 0x630000 [0055.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.202] GetProcessHeap () returned 0x630000 [0055.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.202] GetProcessHeap () returned 0x630000 [0055.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.202] GetProcessHeap () returned 0x630000 [0055.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.203] GetProcessHeap () returned 0x630000 [0055.203] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.203] GetProcessHeap () returned 0x630000 [0055.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.203] GetProcessHeap () returned 0x630000 [0055.203] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.203] GetProcessHeap () returned 0x630000 [0055.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.203] GetProcessHeap () returned 0x630000 [0055.203] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.203] GetProcessHeap () returned 0x630000 [0055.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.203] GetProcessHeap () returned 0x630000 [0055.203] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.203] GetProcessHeap () returned 0x630000 [0055.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.203] GetProcessHeap () returned 0x630000 [0055.203] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.203] GetProcessHeap () returned 0x630000 [0055.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.203] GetProcessHeap () returned 0x630000 [0055.203] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0055.203] GetProcessHeap () returned 0x630000 [0055.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.203] GetProcessHeap () returned 0x630000 [0055.203] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.203] GetProcessHeap () returned 0x630000 [0055.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.203] GetProcessHeap () returned 0x630000 [0055.203] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.203] GetProcessHeap () returned 0x630000 [0055.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.203] GetProcessHeap () returned 0x630000 [0055.203] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0055.203] GetProcessHeap () returned 0x630000 [0055.204] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0055.204] GetProcessHeap () returned 0x630000 [0055.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.204] GetProcessHeap () returned 0x630000 [0055.204] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.204] GetProcessHeap () returned 0x630000 [0055.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.204] GetProcessHeap () returned 0x630000 [0055.204] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.204] GetProcessHeap () returned 0x630000 [0055.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.204] GetProcessHeap () returned 0x630000 [0055.204] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.204] GetProcessHeap () returned 0x630000 [0055.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.204] GetProcessHeap () returned 0x630000 [0055.204] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.204] GetProcessHeap () returned 0x630000 [0055.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.204] GetProcessHeap () returned 0x630000 [0055.204] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.204] GetProcessHeap () returned 0x630000 [0055.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.204] GetProcessHeap () returned 0x630000 [0055.204] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.204] GetProcessHeap () returned 0x630000 [0055.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0055.204] GetProcessHeap () returned 0x630000 [0055.204] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0055.204] GetProcessHeap () returned 0x630000 [0055.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.204] GetProcessHeap () returned 0x630000 [0055.204] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.204] GetProcessHeap () returned 0x630000 [0055.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.204] GetProcessHeap () returned 0x630000 [0055.204] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.205] GetProcessHeap () returned 0x630000 [0055.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.205] GetProcessHeap () returned 0x630000 [0055.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.205] GetProcessHeap () returned 0x630000 [0055.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.205] GetProcessHeap () returned 0x630000 [0055.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.205] GetProcessHeap () returned 0x630000 [0055.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0055.205] GetProcessHeap () returned 0x630000 [0055.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0055.205] GetProcessHeap () returned 0x630000 [0055.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.205] GetProcessHeap () returned 0x630000 [0055.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.205] GetProcessHeap () returned 0x630000 [0055.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.205] GetProcessHeap () returned 0x630000 [0055.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.205] GetProcessHeap () returned 0x630000 [0055.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.205] GetProcessHeap () returned 0x630000 [0055.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.205] GetProcessHeap () returned 0x630000 [0055.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.205] GetProcessHeap () returned 0x630000 [0055.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.205] GetProcessHeap () returned 0x630000 [0055.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0055.205] GetProcessHeap () returned 0x630000 [0055.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.205] GetProcessHeap () returned 0x630000 [0055.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.205] GetProcessHeap () returned 0x630000 [0055.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.205] GetProcessHeap () returned 0x630000 [0055.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.205] GetProcessHeap () returned 0x630000 [0055.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.206] GetProcessHeap () returned 0x630000 [0055.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.206] GetProcessHeap () returned 0x630000 [0055.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.206] GetProcessHeap () returned 0x630000 [0055.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.206] GetProcessHeap () returned 0x630000 [0055.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.206] GetProcessHeap () returned 0x630000 [0055.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0055.206] GetProcessHeap () returned 0x630000 [0055.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0055.206] GetProcessHeap () returned 0x630000 [0055.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0055.206] GetProcessHeap () returned 0x630000 [0055.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0055.206] GetProcessHeap () returned 0x630000 [0055.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0055.206] GetProcessHeap () returned 0x630000 [0055.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0055.206] GetProcessHeap () returned 0x630000 [0055.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0055.206] GetProcessHeap () returned 0x630000 [0055.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0055.206] GetProcessHeap () returned 0x630000 [0055.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0055.206] GetProcessHeap () returned 0x630000 [0055.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0055.206] GetProcessHeap () returned 0x630000 [0055.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0055.206] WriteFile (in: hFile=0x230, lpBuffer=0x65ad78*, nNumberOfBytesToWrite=0x38b, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65ad78*, lpNumberOfBytesWritten=0x243d864*=0x38b, lpOverlapped=0x0) returned 1 [0055.210] GetProcessHeap () returned 0x630000 [0055.211] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65ad78, Size=0x30) returned 0x65ad78 [0055.211] GetProcessHeap () returned 0x630000 [0055.211] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0055.211] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.211] GetProcessHeap () returned 0x630000 [0055.211] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x147d0) returned 0x65ed80 [0055.211] ReadFile (in: hFile=0x230, lpBuffer=0x65ed80, nNumberOfBytesToRead=0x147d0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesRead=0x243d7e8*=0x147d0, lpOverlapped=0x0) returned 1 [0055.212] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.212] WriteFile (in: hFile=0x230, lpBuffer=0x65ed80*, nNumberOfBytesToWrite=0x147d0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesWritten=0x243d7e4*=0x147d0, lpOverlapped=0x0) returned 1 [0055.213] GetProcessHeap () returned 0x630000 [0055.213] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ed80 | out: hHeap=0x630000) returned 1 [0055.215] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.215] WriteFile (in: hFile=0x230, lpBuffer=0x65ad78*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65ad78*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0055.216] CloseHandle (hObject=0x230) returned 1 [0055.218] GetProcessHeap () returned 0x630000 [0055.218] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0055.219] GetProcessHeap () returned 0x630000 [0055.219] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655580 | out: hHeap=0x630000) returned 1 [0055.219] GetProcessHeap () returned 0x630000 [0055.219] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0055.219] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm" [0055.219] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm.happythreechoose" [0055.219] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lv-lv.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lv-lv.htm.happythreechoose"), dwFlags=0x1) returned 1 [0055.233] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0055.233] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0055.233] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" [0055.233] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\decryption info.html")) returned 0x20 [0055.233] GetProcessHeap () returned 0x630000 [0055.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0055.233] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3fa921, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3fa921, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x10674, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_nb-no.htm", cAlternateFileName="EULA_N~1.HTM")) returned 1 [0055.233] lstrcmpiW (lpString1="EULA_nb-no.htm", lpString2=".") returned 1 [0055.233] lstrcmpiW (lpString1="EULA_nb-no.htm", lpString2="..") returned 1 [0055.233] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_nb-no.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm" [0055.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_nb-no.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0055.233] GetProcessHeap () returned 0x630000 [0055.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0055.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_nb-no.htm", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_nb-no.htm", lpUsedDefaultChar=0x0) returned 15 [0055.233] lstrlenA (lpString="EULA_nb-no.htm") returned 14 [0055.233] lstrlenA (lpString=".happythreechoose") returned 17 [0055.233] lstrcmpiW (lpString1="EULA_nb-no.htm", lpString2="Decryption INFO.html") returned 1 [0055.233] lstrcmpiW (lpString1="EULA_nb-no.htm", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0055.233] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0055.233] lstrcmpiW (lpString1="EULA_nb-no.htm", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0055.233] GetProcessHeap () returned 0x630000 [0055.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0055.233] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nb-no.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0055.234] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=67188) returned 1 [0055.234] GetProcessHeap () returned 0x630000 [0055.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655940 [0055.234] GetProcessHeap () returned 0x630000 [0055.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0055.234] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm") returned 52 [0055.234] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.234] GetProcessHeap () returned 0x630000 [0055.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0055.234] GetProcessHeap () returned 0x630000 [0055.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38c) returned 0x65adb0 [0055.234] lstrlenA (lpString="rsa_encrypt") returned 11 [0055.234] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0055.235] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0055.235] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0055.235] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0055.235] GetProcessHeap () returned 0x630000 [0055.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0055.235] lstrlenA (lpString="010001") returned 6 [0055.235] GetProcessHeap () returned 0x630000 [0055.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0055.235] GetProcessHeap () returned 0x630000 [0055.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0055.235] GetProcessHeap () returned 0x630000 [0055.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dec0 [0055.235] GetProcessHeap () returned 0x630000 [0055.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0055.235] GetProcessHeap () returned 0x630000 [0055.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0055.235] GetProcessHeap () returned 0x630000 [0055.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x6570f8 [0055.235] GetProcessHeap () returned 0x630000 [0055.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0055.236] GetProcessHeap () returned 0x630000 [0055.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0055.236] GetProcessHeap () returned 0x630000 [0055.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.236] GetProcessHeap () returned 0x630000 [0055.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0055.236] GetProcessHeap () returned 0x630000 [0055.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0055.236] GetProcessHeap () returned 0x630000 [0055.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656ec8 [0055.236] GetProcessHeap () returned 0x630000 [0055.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.236] GetProcessHeap () returned 0x630000 [0055.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0055.236] GetProcessHeap () returned 0x630000 [0055.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea00 [0055.236] GetProcessHeap () returned 0x630000 [0055.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0055.236] GetProcessHeap () returned 0x630000 [0055.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0055.236] GetProcessHeap () returned 0x630000 [0055.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0055.236] GetProcessHeap () returned 0x630000 [0055.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.236] GetProcessHeap () returned 0x630000 [0055.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x655dc0 [0055.236] GetProcessHeap () returned 0x630000 [0055.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.236] GetProcessHeap () returned 0x630000 [0055.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.236] GetProcessHeap () returned 0x630000 [0055.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.236] GetProcessHeap () returned 0x630000 [0055.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.236] GetProcessHeap () returned 0x630000 [0055.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65df50 [0055.236] GetProcessHeap () returned 0x630000 [0055.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655dc0 | out: hHeap=0x630000) returned 1 [0055.236] GetProcessHeap () returned 0x630000 [0055.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0055.237] GetProcessHeap () returned 0x630000 [0055.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0055.237] GetProcessHeap () returned 0x630000 [0055.237] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.237] GetProcessHeap () returned 0x630000 [0055.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.237] GetProcessHeap () returned 0x630000 [0055.237] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.237] GetProcessHeap () returned 0x630000 [0055.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.237] GetProcessHeap () returned 0x630000 [0055.237] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.237] GetProcessHeap () returned 0x630000 [0055.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.237] GetProcessHeap () returned 0x630000 [0055.237] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.237] GetProcessHeap () returned 0x630000 [0055.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.237] GetProcessHeap () returned 0x630000 [0055.237] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.237] GetProcessHeap () returned 0x630000 [0055.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.237] GetProcessHeap () returned 0x630000 [0055.237] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.237] GetProcessHeap () returned 0x630000 [0055.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.237] GetProcessHeap () returned 0x630000 [0055.237] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.237] GetProcessHeap () returned 0x630000 [0055.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.237] GetProcessHeap () returned 0x630000 [0055.237] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.237] GetProcessHeap () returned 0x630000 [0055.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.237] GetProcessHeap () returned 0x630000 [0055.237] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.237] GetProcessHeap () returned 0x630000 [0055.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.238] GetProcessHeap () returned 0x630000 [0055.238] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0055.238] GetProcessHeap () returned 0x630000 [0055.238] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0055.238] GetProcessHeap () returned 0x630000 [0055.238] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.238] GetProcessHeap () returned 0x630000 [0055.238] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.238] GetProcessHeap () returned 0x630000 [0055.238] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.238] GetProcessHeap () returned 0x630000 [0055.238] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.238] GetProcessHeap () returned 0x630000 [0055.238] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.238] GetProcessHeap () returned 0x630000 [0055.238] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.238] GetProcessHeap () returned 0x630000 [0055.238] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.238] GetProcessHeap () returned 0x630000 [0055.238] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.238] GetProcessHeap () returned 0x630000 [0055.238] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.238] GetProcessHeap () returned 0x630000 [0055.238] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.238] GetProcessHeap () returned 0x630000 [0055.238] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.238] GetProcessHeap () returned 0x630000 [0055.238] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.238] GetProcessHeap () returned 0x630000 [0055.238] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.238] GetProcessHeap () returned 0x630000 [0055.238] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.238] GetProcessHeap () returned 0x630000 [0055.238] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.238] GetProcessHeap () returned 0x630000 [0055.238] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.238] GetProcessHeap () returned 0x630000 [0055.239] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0055.239] GetProcessHeap () returned 0x630000 [0055.239] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0055.239] GetProcessHeap () returned 0x630000 [0055.239] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.239] GetProcessHeap () returned 0x630000 [0055.239] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.239] GetProcessHeap () returned 0x630000 [0055.239] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0055.239] GetProcessHeap () returned 0x630000 [0055.239] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.239] GetProcessHeap () returned 0x630000 [0055.239] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0055.239] GetProcessHeap () returned 0x630000 [0055.239] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.239] GetProcessHeap () returned 0x630000 [0055.239] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.239] GetProcessHeap () returned 0x630000 [0055.239] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.239] GetProcessHeap () returned 0x630000 [0055.239] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.239] GetProcessHeap () returned 0x630000 [0055.239] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.239] GetProcessHeap () returned 0x630000 [0055.239] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.239] GetProcessHeap () returned 0x630000 [0055.239] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.239] GetProcessHeap () returned 0x630000 [0055.239] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.239] GetProcessHeap () returned 0x630000 [0055.239] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.239] GetProcessHeap () returned 0x630000 [0055.239] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.239] GetProcessHeap () returned 0x630000 [0055.239] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.239] GetProcessHeap () returned 0x630000 [0055.239] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.239] GetProcessHeap () returned 0x630000 [0055.240] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.240] GetProcessHeap () returned 0x630000 [0055.240] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.240] GetProcessHeap () returned 0x630000 [0055.240] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.240] GetProcessHeap () returned 0x630000 [0055.240] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.240] GetProcessHeap () returned 0x630000 [0055.240] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.240] GetProcessHeap () returned 0x630000 [0055.240] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.240] GetProcessHeap () returned 0x630000 [0055.240] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.240] GetProcessHeap () returned 0x630000 [0055.240] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.240] GetProcessHeap () returned 0x630000 [0055.240] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.240] GetProcessHeap () returned 0x630000 [0055.240] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0055.240] GetProcessHeap () returned 0x630000 [0055.240] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.240] GetProcessHeap () returned 0x630000 [0055.240] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.240] GetProcessHeap () returned 0x630000 [0055.240] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.240] GetProcessHeap () returned 0x630000 [0055.240] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0055.240] GetProcessHeap () returned 0x630000 [0055.240] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.240] GetProcessHeap () returned 0x630000 [0055.240] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.240] GetProcessHeap () returned 0x630000 [0055.240] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.240] GetProcessHeap () returned 0x630000 [0055.240] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.240] GetProcessHeap () returned 0x630000 [0055.240] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.240] GetProcessHeap () returned 0x630000 [0055.240] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.241] GetProcessHeap () returned 0x630000 [0055.241] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.241] GetProcessHeap () returned 0x630000 [0055.241] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.241] GetProcessHeap () returned 0x630000 [0055.241] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.241] GetProcessHeap () returned 0x630000 [0055.241] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0055.241] GetProcessHeap () returned 0x630000 [0055.241] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.241] GetProcessHeap () returned 0x630000 [0055.241] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.241] GetProcessHeap () returned 0x630000 [0055.241] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.241] GetProcessHeap () returned 0x630000 [0055.241] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0055.241] GetProcessHeap () returned 0x630000 [0055.241] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0055.241] GetProcessHeap () returned 0x630000 [0055.241] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0055.241] GetProcessHeap () returned 0x630000 [0055.241] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0055.241] GetProcessHeap () returned 0x630000 [0055.241] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0055.241] GetProcessHeap () returned 0x630000 [0055.241] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0055.241] GetProcessHeap () returned 0x630000 [0055.241] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0055.241] GetProcessHeap () returned 0x630000 [0055.241] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0055.241] GetProcessHeap () returned 0x630000 [0055.241] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0055.241] GetProcessHeap () returned 0x630000 [0055.241] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.241] GetProcessHeap () returned 0x630000 [0055.241] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0055.242] WriteFile (in: hFile=0x230, lpBuffer=0x65adb0*, nNumberOfBytesToWrite=0x38c, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65adb0*, lpNumberOfBytesWritten=0x243d864*=0x38c, lpOverlapped=0x0) returned 1 [0055.245] GetProcessHeap () returned 0x630000 [0055.245] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65adb0, Size=0x30) returned 0x65adb0 [0055.245] GetProcessHeap () returned 0x630000 [0055.245] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0055.245] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.245] GetProcessHeap () returned 0x630000 [0055.245] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10680) returned 0x65ed80 [0055.247] ReadFile (in: hFile=0x230, lpBuffer=0x65ed80, nNumberOfBytesToRead=0x10680, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesRead=0x243d7e8*=0x10680, lpOverlapped=0x0) returned 1 [0055.249] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.249] WriteFile (in: hFile=0x230, lpBuffer=0x65ed80*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesWritten=0x243d7e4*=0x10680, lpOverlapped=0x0) returned 1 [0055.250] GetProcessHeap () returned 0x630000 [0055.250] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ed80 | out: hHeap=0x630000) returned 1 [0055.250] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.251] WriteFile (in: hFile=0x230, lpBuffer=0x65adb0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65adb0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0055.251] CloseHandle (hObject=0x230) returned 1 [0055.254] GetProcessHeap () returned 0x630000 [0055.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0055.254] GetProcessHeap () returned 0x630000 [0055.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655940 | out: hHeap=0x630000) returned 1 [0055.254] GetProcessHeap () returned 0x630000 [0055.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0055.254] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm" [0055.254] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm.happythreechoose" [0055.254] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nb-no.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nb-no.htm.happythreechoose"), dwFlags=0x1) returned 1 [0055.255] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0055.255] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0055.255] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" [0055.255] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\decryption info.html")) returned 0x20 [0055.255] GetProcessHeap () returned 0x630000 [0055.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0055.255] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3fe3b1, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3fe3b1, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x10698, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_nl-nl.htm", cAlternateFileName="EULA_N~2.HTM")) returned 1 [0055.255] lstrcmpiW (lpString1="EULA_nl-nl.htm", lpString2=".") returned 1 [0055.255] lstrcmpiW (lpString1="EULA_nl-nl.htm", lpString2="..") returned 1 [0055.255] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_nl-nl.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm" [0055.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_nl-nl.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0055.255] GetProcessHeap () returned 0x630000 [0055.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64ca20 [0055.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_nl-nl.htm", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_nl-nl.htm", lpUsedDefaultChar=0x0) returned 15 [0055.255] lstrlenA (lpString="EULA_nl-nl.htm") returned 14 [0055.255] lstrlenA (lpString=".happythreechoose") returned 17 [0055.255] lstrcmpiW (lpString1="EULA_nl-nl.htm", lpString2="Decryption INFO.html") returned 1 [0055.255] lstrcmpiW (lpString1="EULA_nl-nl.htm", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0055.255] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0055.255] lstrcmpiW (lpString1="EULA_nl-nl.htm", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0055.255] GetProcessHeap () returned 0x630000 [0055.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0055.255] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nl-nl.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0055.256] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=67224) returned 1 [0055.256] GetProcessHeap () returned 0x630000 [0055.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6557d8 [0055.256] GetProcessHeap () returned 0x630000 [0055.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0055.257] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm") returned 52 [0055.257] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.257] GetProcessHeap () returned 0x630000 [0055.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0055.257] GetProcessHeap () returned 0x630000 [0055.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x388) returned 0x65ade8 [0055.257] lstrlenA (lpString="rsa_encrypt") returned 11 [0055.257] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0055.257] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0055.257] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0055.257] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0055.257] GetProcessHeap () returned 0x630000 [0055.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0055.257] lstrlenA (lpString="010001") returned 6 [0055.258] GetProcessHeap () returned 0x630000 [0055.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a298 [0055.258] GetProcessHeap () returned 0x630000 [0055.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0055.258] GetProcessHeap () returned 0x630000 [0055.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e610 [0055.258] GetProcessHeap () returned 0x630000 [0055.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0055.258] GetProcessHeap () returned 0x630000 [0055.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e190 [0055.258] GetProcessHeap () returned 0x630000 [0055.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656950 [0055.258] GetProcessHeap () returned 0x630000 [0055.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a368 [0055.258] GetProcessHeap () returned 0x630000 [0055.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0055.258] GetProcessHeap () returned 0x630000 [0055.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.258] GetProcessHeap () returned 0x630000 [0055.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0055.258] GetProcessHeap () returned 0x630000 [0055.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0055.258] GetProcessHeap () returned 0x630000 [0055.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656a68 [0055.258] GetProcessHeap () returned 0x630000 [0055.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0055.258] GetProcessHeap () returned 0x630000 [0055.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0055.258] GetProcessHeap () returned 0x630000 [0055.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e460 [0055.258] GetProcessHeap () returned 0x630000 [0055.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0055.258] GetProcessHeap () returned 0x630000 [0055.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0055.258] GetProcessHeap () returned 0x630000 [0055.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e460 | out: hHeap=0x630000) returned 1 [0055.259] GetProcessHeap () returned 0x630000 [0055.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0055.259] GetProcessHeap () returned 0x630000 [0055.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x655ee0 [0055.259] GetProcessHeap () returned 0x630000 [0055.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0055.259] GetProcessHeap () returned 0x630000 [0055.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.259] GetProcessHeap () returned 0x630000 [0055.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.259] GetProcessHeap () returned 0x630000 [0055.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.259] GetProcessHeap () returned 0x630000 [0055.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65dec0 [0055.259] GetProcessHeap () returned 0x630000 [0055.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655ee0 | out: hHeap=0x630000) returned 1 [0055.259] GetProcessHeap () returned 0x630000 [0055.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0055.259] GetProcessHeap () returned 0x630000 [0055.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0055.259] GetProcessHeap () returned 0x630000 [0055.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.259] GetProcessHeap () returned 0x630000 [0055.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.259] GetProcessHeap () returned 0x630000 [0055.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0055.259] GetProcessHeap () returned 0x630000 [0055.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.259] GetProcessHeap () returned 0x630000 [0055.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0055.259] GetProcessHeap () returned 0x630000 [0055.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.259] GetProcessHeap () returned 0x630000 [0055.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.259] GetProcessHeap () returned 0x630000 [0055.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.259] GetProcessHeap () returned 0x630000 [0055.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0055.259] GetProcessHeap () returned 0x630000 [0055.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0055.260] GetProcessHeap () returned 0x630000 [0055.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.260] GetProcessHeap () returned 0x630000 [0055.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.260] GetProcessHeap () returned 0x630000 [0055.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.260] GetProcessHeap () returned 0x630000 [0055.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.260] GetProcessHeap () returned 0x630000 [0055.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.260] GetProcessHeap () returned 0x630000 [0055.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.260] GetProcessHeap () returned 0x630000 [0055.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.260] GetProcessHeap () returned 0x630000 [0055.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.260] GetProcessHeap () returned 0x630000 [0055.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.260] GetProcessHeap () returned 0x630000 [0055.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.260] GetProcessHeap () returned 0x630000 [0055.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.260] GetProcessHeap () returned 0x630000 [0055.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.260] GetProcessHeap () returned 0x630000 [0055.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.260] GetProcessHeap () returned 0x630000 [0055.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.260] GetProcessHeap () returned 0x630000 [0055.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.260] GetProcessHeap () returned 0x630000 [0055.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.260] GetProcessHeap () returned 0x630000 [0055.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.260] GetProcessHeap () returned 0x630000 [0055.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.261] GetProcessHeap () returned 0x630000 [0055.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.261] GetProcessHeap () returned 0x630000 [0055.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.261] GetProcessHeap () returned 0x630000 [0055.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.261] GetProcessHeap () returned 0x630000 [0055.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.261] GetProcessHeap () returned 0x630000 [0055.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.261] GetProcessHeap () returned 0x630000 [0055.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.261] GetProcessHeap () returned 0x630000 [0055.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.261] GetProcessHeap () returned 0x630000 [0055.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.261] GetProcessHeap () returned 0x630000 [0055.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.261] GetProcessHeap () returned 0x630000 [0055.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.261] GetProcessHeap () returned 0x630000 [0055.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.261] GetProcessHeap () returned 0x630000 [0055.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.261] GetProcessHeap () returned 0x630000 [0055.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.261] GetProcessHeap () returned 0x630000 [0055.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.261] GetProcessHeap () returned 0x630000 [0055.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.261] GetProcessHeap () returned 0x630000 [0055.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.261] GetProcessHeap () returned 0x630000 [0055.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.261] GetProcessHeap () returned 0x630000 [0055.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.261] GetProcessHeap () returned 0x630000 [0055.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.262] GetProcessHeap () returned 0x630000 [0055.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.262] GetProcessHeap () returned 0x630000 [0055.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.262] GetProcessHeap () returned 0x630000 [0055.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.262] GetProcessHeap () returned 0x630000 [0055.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.262] GetProcessHeap () returned 0x630000 [0055.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.262] GetProcessHeap () returned 0x630000 [0055.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.262] GetProcessHeap () returned 0x630000 [0055.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.262] GetProcessHeap () returned 0x630000 [0055.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0055.262] GetProcessHeap () returned 0x630000 [0055.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0055.262] GetProcessHeap () returned 0x630000 [0055.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0055.262] GetProcessHeap () returned 0x630000 [0055.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.262] GetProcessHeap () returned 0x630000 [0055.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.262] GetProcessHeap () returned 0x630000 [0055.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.262] GetProcessHeap () returned 0x630000 [0055.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.262] GetProcessHeap () returned 0x630000 [0055.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.262] GetProcessHeap () returned 0x630000 [0055.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0055.262] GetProcessHeap () returned 0x630000 [0055.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.262] GetProcessHeap () returned 0x630000 [0055.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.262] GetProcessHeap () returned 0x630000 [0055.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.263] GetProcessHeap () returned 0x630000 [0055.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.263] GetProcessHeap () returned 0x630000 [0055.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.263] GetProcessHeap () returned 0x630000 [0055.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.263] GetProcessHeap () returned 0x630000 [0055.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.263] GetProcessHeap () returned 0x630000 [0055.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.263] GetProcessHeap () returned 0x630000 [0055.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.263] GetProcessHeap () returned 0x630000 [0055.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.263] GetProcessHeap () returned 0x630000 [0055.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.263] GetProcessHeap () returned 0x630000 [0055.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.263] GetProcessHeap () returned 0x630000 [0055.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.263] GetProcessHeap () returned 0x630000 [0055.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.263] GetProcessHeap () returned 0x630000 [0055.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.263] GetProcessHeap () returned 0x630000 [0055.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.263] GetProcessHeap () returned 0x630000 [0055.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.263] GetProcessHeap () returned 0x630000 [0055.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.263] GetProcessHeap () returned 0x630000 [0055.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.263] GetProcessHeap () returned 0x630000 [0055.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0055.263] GetProcessHeap () returned 0x630000 [0055.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0055.263] GetProcessHeap () returned 0x630000 [0055.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0055.264] GetProcessHeap () returned 0x630000 [0055.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0055.264] GetProcessHeap () returned 0x630000 [0055.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0055.264] GetProcessHeap () returned 0x630000 [0055.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0055.264] GetProcessHeap () returned 0x630000 [0055.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0055.264] GetProcessHeap () returned 0x630000 [0055.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0055.264] GetProcessHeap () returned 0x630000 [0055.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0055.264] GetProcessHeap () returned 0x630000 [0055.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.264] GetProcessHeap () returned 0x630000 [0055.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0055.264] WriteFile (in: hFile=0x230, lpBuffer=0x65ade8*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65ade8*, lpNumberOfBytesWritten=0x243d864*=0x388, lpOverlapped=0x0) returned 1 [0055.267] GetProcessHeap () returned 0x630000 [0055.267] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65ade8, Size=0x30) returned 0x65ade8 [0055.267] GetProcessHeap () returned 0x630000 [0055.267] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0055.267] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.267] GetProcessHeap () returned 0x630000 [0055.267] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x106a0) returned 0x65ed80 [0055.267] ReadFile (in: hFile=0x230, lpBuffer=0x65ed80, nNumberOfBytesToRead=0x106a0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesRead=0x243d7e8*=0x106a0, lpOverlapped=0x0) returned 1 [0055.269] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.269] WriteFile (in: hFile=0x230, lpBuffer=0x65ed80*, nNumberOfBytesToWrite=0x106a0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesWritten=0x243d7e4*=0x106a0, lpOverlapped=0x0) returned 1 [0055.270] GetProcessHeap () returned 0x630000 [0055.270] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ed80 | out: hHeap=0x630000) returned 1 [0055.272] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.272] WriteFile (in: hFile=0x230, lpBuffer=0x65ade8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65ade8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0055.274] CloseHandle (hObject=0x230) returned 1 [0055.277] GetProcessHeap () returned 0x630000 [0055.277] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0055.277] GetProcessHeap () returned 0x630000 [0055.277] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6557d8 | out: hHeap=0x630000) returned 1 [0055.277] GetProcessHeap () returned 0x630000 [0055.277] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0055.277] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm" [0055.277] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm.happythreechoose" [0055.277] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nl-nl.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nl-nl.htm.happythreechoose"), dwFlags=0x1) returned 1 [0055.278] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0055.278] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0055.278] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" [0055.278] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\decryption info.html")) returned 0x20 [0055.278] GetProcessHeap () returned 0x630000 [0055.278] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0055.278] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ff747, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ff747, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x13f94, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_pl-pl.htm", cAlternateFileName="EULA_P~1.HTM")) returned 1 [0055.278] lstrcmpiW (lpString1="EULA_pl-pl.htm", lpString2=".") returned 1 [0055.278] lstrcmpiW (lpString1="EULA_pl-pl.htm", lpString2="..") returned 1 [0055.278] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_pl-pl.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm" [0055.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_pl-pl.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0055.278] GetProcessHeap () returned 0x630000 [0055.278] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0055.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_pl-pl.htm", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_pl-pl.htm", lpUsedDefaultChar=0x0) returned 15 [0055.278] lstrlenA (lpString="EULA_pl-pl.htm") returned 14 [0055.278] lstrlenA (lpString=".happythreechoose") returned 17 [0055.278] lstrcmpiW (lpString1="EULA_pl-pl.htm", lpString2="Decryption INFO.html") returned 1 [0055.278] lstrcmpiW (lpString1="EULA_pl-pl.htm", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0055.278] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0055.278] lstrcmpiW (lpString1="EULA_pl-pl.htm", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0055.278] GetProcessHeap () returned 0x630000 [0055.278] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0055.278] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pl-pl.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0055.279] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=81812) returned 1 [0055.279] GetProcessHeap () returned 0x630000 [0055.279] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655940 [0055.279] GetProcessHeap () returned 0x630000 [0055.279] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0055.279] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm") returned 52 [0055.279] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.279] GetProcessHeap () returned 0x630000 [0055.279] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0055.279] GetProcessHeap () returned 0x630000 [0055.279] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x65ae20 [0055.279] lstrlenA (lpString="rsa_encrypt") returned 11 [0055.279] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0055.280] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0055.280] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0055.280] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0055.280] GetProcessHeap () returned 0x630000 [0055.280] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0055.280] lstrlenA (lpString="010001") returned 6 [0055.280] GetProcessHeap () returned 0x630000 [0055.280] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0055.280] GetProcessHeap () returned 0x630000 [0055.280] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0055.280] GetProcessHeap () returned 0x630000 [0055.280] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e850 [0055.280] GetProcessHeap () returned 0x630000 [0055.280] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0055.280] GetProcessHeap () returned 0x630000 [0055.280] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65df50 [0055.280] GetProcessHeap () returned 0x630000 [0055.280] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657210 [0055.280] GetProcessHeap () returned 0x630000 [0055.280] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a348 [0055.280] GetProcessHeap () returned 0x630000 [0055.280] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0055.280] GetProcessHeap () returned 0x630000 [0055.280] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.280] GetProcessHeap () returned 0x630000 [0055.280] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0055.280] GetProcessHeap () returned 0x630000 [0055.280] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0055.280] GetProcessHeap () returned 0x630000 [0055.280] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657440 [0055.280] GetProcessHeap () returned 0x630000 [0055.280] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0055.281] GetProcessHeap () returned 0x630000 [0055.281] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0055.281] GetProcessHeap () returned 0x630000 [0055.281] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e100 [0055.281] GetProcessHeap () returned 0x630000 [0055.281] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0055.281] GetProcessHeap () returned 0x630000 [0055.281] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0055.281] GetProcessHeap () returned 0x630000 [0055.281] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0055.281] GetProcessHeap () returned 0x630000 [0055.281] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.281] GetProcessHeap () returned 0x630000 [0055.281] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x655dd8 [0055.281] GetProcessHeap () returned 0x630000 [0055.281] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0055.281] GetProcessHeap () returned 0x630000 [0055.281] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.281] GetProcessHeap () returned 0x630000 [0055.281] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.281] GetProcessHeap () returned 0x630000 [0055.281] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.281] GetProcessHeap () returned 0x630000 [0055.281] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e190 [0055.281] GetProcessHeap () returned 0x630000 [0055.281] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655dd8 | out: hHeap=0x630000) returned 1 [0055.281] GetProcessHeap () returned 0x630000 [0055.281] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0055.281] GetProcessHeap () returned 0x630000 [0055.281] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0055.282] GetProcessHeap () returned 0x630000 [0055.282] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.282] GetProcessHeap () returned 0x630000 [0055.282] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.282] GetProcessHeap () returned 0x630000 [0055.282] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.282] GetProcessHeap () returned 0x630000 [0055.282] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.282] GetProcessHeap () returned 0x630000 [0055.282] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.282] GetProcessHeap () returned 0x630000 [0055.282] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.282] GetProcessHeap () returned 0x630000 [0055.282] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.282] GetProcessHeap () returned 0x630000 [0055.282] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.282] GetProcessHeap () returned 0x630000 [0055.282] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.282] GetProcessHeap () returned 0x630000 [0055.282] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.282] GetProcessHeap () returned 0x630000 [0055.282] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.282] GetProcessHeap () returned 0x630000 [0055.282] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.282] GetProcessHeap () returned 0x630000 [0055.282] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.282] GetProcessHeap () returned 0x630000 [0055.282] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.282] GetProcessHeap () returned 0x630000 [0055.282] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0055.282] GetProcessHeap () returned 0x630000 [0055.282] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0055.282] GetProcessHeap () returned 0x630000 [0055.282] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.282] GetProcessHeap () returned 0x630000 [0055.282] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.282] GetProcessHeap () returned 0x630000 [0055.282] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0055.283] GetProcessHeap () returned 0x630000 [0055.283] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.283] GetProcessHeap () returned 0x630000 [0055.283] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.283] GetProcessHeap () returned 0x630000 [0055.283] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.283] GetProcessHeap () returned 0x630000 [0055.283] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.283] GetProcessHeap () returned 0x630000 [0055.283] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.283] GetProcessHeap () returned 0x630000 [0055.283] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.283] GetProcessHeap () returned 0x630000 [0055.283] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.283] GetProcessHeap () returned 0x630000 [0055.283] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.283] GetProcessHeap () returned 0x630000 [0055.283] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.283] GetProcessHeap () returned 0x630000 [0055.283] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.283] GetProcessHeap () returned 0x630000 [0055.283] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.283] GetProcessHeap () returned 0x630000 [0055.283] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0055.283] GetProcessHeap () returned 0x630000 [0055.283] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0055.283] GetProcessHeap () returned 0x630000 [0055.283] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.283] GetProcessHeap () returned 0x630000 [0055.283] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.283] GetProcessHeap () returned 0x630000 [0055.283] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.283] GetProcessHeap () returned 0x630000 [0055.283] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.283] GetProcessHeap () returned 0x630000 [0055.283] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.283] GetProcessHeap () returned 0x630000 [0055.283] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.284] GetProcessHeap () returned 0x630000 [0055.284] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.284] GetProcessHeap () returned 0x630000 [0055.284] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.284] GetProcessHeap () returned 0x630000 [0055.284] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0055.284] GetProcessHeap () returned 0x630000 [0055.284] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0055.284] GetProcessHeap () returned 0x630000 [0055.284] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.284] GetProcessHeap () returned 0x630000 [0055.284] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.284] GetProcessHeap () returned 0x630000 [0055.284] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.284] GetProcessHeap () returned 0x630000 [0055.284] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.284] GetProcessHeap () returned 0x630000 [0055.284] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.284] GetProcessHeap () returned 0x630000 [0055.284] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.284] GetProcessHeap () returned 0x630000 [0055.284] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.284] GetProcessHeap () returned 0x630000 [0055.284] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.284] GetProcessHeap () returned 0x630000 [0055.284] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.284] GetProcessHeap () returned 0x630000 [0055.284] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.284] GetProcessHeap () returned 0x630000 [0055.284] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.284] GetProcessHeap () returned 0x630000 [0055.284] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.284] GetProcessHeap () returned 0x630000 [0055.284] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.284] GetProcessHeap () returned 0x630000 [0055.284] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.284] GetProcessHeap () returned 0x630000 [0055.284] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.285] GetProcessHeap () returned 0x630000 [0055.285] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.285] GetProcessHeap () returned 0x630000 [0055.285] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.285] GetProcessHeap () returned 0x630000 [0055.285] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.285] GetProcessHeap () returned 0x630000 [0055.285] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.285] GetProcessHeap () returned 0x630000 [0055.285] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.285] GetProcessHeap () returned 0x630000 [0055.285] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.285] GetProcessHeap () returned 0x630000 [0055.285] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.285] GetProcessHeap () returned 0x630000 [0055.285] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.285] GetProcessHeap () returned 0x630000 [0055.285] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.285] GetProcessHeap () returned 0x630000 [0055.285] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.285] GetProcessHeap () returned 0x630000 [0055.285] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.285] GetProcessHeap () returned 0x630000 [0055.285] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0055.285] GetProcessHeap () returned 0x630000 [0055.285] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0055.285] GetProcessHeap () returned 0x630000 [0055.285] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.285] GetProcessHeap () returned 0x630000 [0055.285] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.285] GetProcessHeap () returned 0x630000 [0055.285] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.285] GetProcessHeap () returned 0x630000 [0055.285] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.285] GetProcessHeap () returned 0x630000 [0055.285] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.285] GetProcessHeap () returned 0x630000 [0055.285] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.285] GetProcessHeap () returned 0x630000 [0055.286] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.286] GetProcessHeap () returned 0x630000 [0055.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.286] GetProcessHeap () returned 0x630000 [0055.286] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.286] GetProcessHeap () returned 0x630000 [0055.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.286] GetProcessHeap () returned 0x630000 [0055.286] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.286] GetProcessHeap () returned 0x630000 [0055.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.286] GetProcessHeap () returned 0x630000 [0055.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0055.286] GetProcessHeap () returned 0x630000 [0055.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0055.286] GetProcessHeap () returned 0x630000 [0055.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0055.286] GetProcessHeap () returned 0x630000 [0055.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0055.286] GetProcessHeap () returned 0x630000 [0055.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0055.286] GetProcessHeap () returned 0x630000 [0055.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0055.286] GetProcessHeap () returned 0x630000 [0055.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0055.286] GetProcessHeap () returned 0x630000 [0055.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0055.286] GetProcessHeap () returned 0x630000 [0055.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0055.286] GetProcessHeap () returned 0x630000 [0055.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.286] GetProcessHeap () returned 0x630000 [0055.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0055.286] WriteFile (in: hFile=0x230, lpBuffer=0x65ae20*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65ae20*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0055.290] GetProcessHeap () returned 0x630000 [0055.290] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65ae20, Size=0x30) returned 0x65ae20 [0055.290] GetProcessHeap () returned 0x630000 [0055.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0055.290] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.290] GetProcessHeap () returned 0x630000 [0055.290] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x13f94) returned 0x65ed80 [0055.292] ReadFile (in: hFile=0x230, lpBuffer=0x65ed80, nNumberOfBytesToRead=0x13f94, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesRead=0x243d7e8*=0x13f94, lpOverlapped=0x0) returned 1 [0055.294] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.294] WriteFile (in: hFile=0x230, lpBuffer=0x65ed80*, nNumberOfBytesToWrite=0x13f94, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesWritten=0x243d7e4*=0x13f94, lpOverlapped=0x0) returned 1 [0055.295] GetProcessHeap () returned 0x630000 [0055.295] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ed80 | out: hHeap=0x630000) returned 1 [0055.295] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.295] WriteFile (in: hFile=0x230, lpBuffer=0x65ae20*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65ae20*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0055.296] CloseHandle (hObject=0x230) returned 1 [0055.299] GetProcessHeap () returned 0x630000 [0055.299] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0055.299] GetProcessHeap () returned 0x630000 [0055.299] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655940 | out: hHeap=0x630000) returned 1 [0055.299] GetProcessHeap () returned 0x630000 [0055.299] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0055.299] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm" [0055.299] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm.happythreechoose" [0055.299] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pl-pl.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pl-pl.htm.happythreechoose"), dwFlags=0x1) returned 1 [0055.300] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0055.300] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0055.300] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" [0055.300] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\decryption info.html")) returned 0x20 [0055.300] GetProcessHeap () returned 0x630000 [0055.300] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0055.300] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea400ac7, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea400ac7, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x10ac4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_pt-br.htm", cAlternateFileName="EULA_P~2.HTM")) returned 1 [0055.300] lstrcmpiW (lpString1="EULA_pt-br.htm", lpString2=".") returned 1 [0055.300] lstrcmpiW (lpString1="EULA_pt-br.htm", lpString2="..") returned 1 [0055.300] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_pt-br.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm" [0055.300] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_pt-br.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0055.300] GetProcessHeap () returned 0x630000 [0055.300] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0055.300] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_pt-br.htm", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_pt-br.htm", lpUsedDefaultChar=0x0) returned 15 [0055.300] lstrlenA (lpString="EULA_pt-br.htm") returned 14 [0055.300] lstrlenA (lpString=".happythreechoose") returned 17 [0055.300] lstrcmpiW (lpString1="EULA_pt-br.htm", lpString2="Decryption INFO.html") returned 1 [0055.300] lstrcmpiW (lpString1="EULA_pt-br.htm", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0055.300] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0055.300] lstrcmpiW (lpString1="EULA_pt-br.htm", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0055.300] GetProcessHeap () returned 0x630000 [0055.300] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0055.300] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-br.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0055.301] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=68292) returned 1 [0055.301] GetProcessHeap () returned 0x630000 [0055.301] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6557d8 [0055.301] GetProcessHeap () returned 0x630000 [0055.301] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0055.301] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm") returned 52 [0055.301] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.301] GetProcessHeap () returned 0x630000 [0055.301] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0055.301] GetProcessHeap () returned 0x630000 [0055.301] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38c) returned 0x65ae58 [0055.301] lstrlenA (lpString="rsa_encrypt") returned 11 [0055.301] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0055.302] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0055.302] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0055.302] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0055.302] GetProcessHeap () returned 0x630000 [0055.302] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0055.302] lstrlenA (lpString="010001") returned 6 [0055.302] GetProcessHeap () returned 0x630000 [0055.302] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3c8 [0055.302] GetProcessHeap () returned 0x630000 [0055.302] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0055.302] GetProcessHeap () returned 0x630000 [0055.302] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ecd0 [0055.302] GetProcessHeap () returned 0x630000 [0055.302] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0055.302] GetProcessHeap () returned 0x630000 [0055.302] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ebb0 [0055.302] GetProcessHeap () returned 0x630000 [0055.302] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657440 [0055.302] GetProcessHeap () returned 0x630000 [0055.302] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0055.302] GetProcessHeap () returned 0x630000 [0055.302] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0055.302] GetProcessHeap () returned 0x630000 [0055.302] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.302] GetProcessHeap () returned 0x630000 [0055.302] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0055.302] GetProcessHeap () returned 0x630000 [0055.302] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0055.302] GetProcessHeap () returned 0x630000 [0055.302] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656ec8 [0055.302] GetProcessHeap () returned 0x630000 [0055.303] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.303] GetProcessHeap () returned 0x630000 [0055.303] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0055.303] GetProcessHeap () returned 0x630000 [0055.303] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e850 [0055.303] GetProcessHeap () returned 0x630000 [0055.303] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0055.303] GetProcessHeap () returned 0x630000 [0055.303] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0055.303] GetProcessHeap () returned 0x630000 [0055.303] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0055.303] GetProcessHeap () returned 0x630000 [0055.303] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.303] GetProcessHeap () returned 0x630000 [0055.303] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x655c88 [0055.303] GetProcessHeap () returned 0x630000 [0055.303] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.303] GetProcessHeap () returned 0x630000 [0055.303] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.303] GetProcessHeap () returned 0x630000 [0055.303] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.303] GetProcessHeap () returned 0x630000 [0055.303] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.303] GetProcessHeap () returned 0x630000 [0055.303] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e100 [0055.303] GetProcessHeap () returned 0x630000 [0055.303] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655c88 | out: hHeap=0x630000) returned 1 [0055.303] GetProcessHeap () returned 0x630000 [0055.303] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0055.303] GetProcessHeap () returned 0x630000 [0055.303] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0055.303] GetProcessHeap () returned 0x630000 [0055.303] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.303] GetProcessHeap () returned 0x630000 [0055.303] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.303] GetProcessHeap () returned 0x630000 [0055.303] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.303] GetProcessHeap () returned 0x630000 [0055.303] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.303] GetProcessHeap () returned 0x630000 [0055.304] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0055.304] GetProcessHeap () returned 0x630000 [0055.304] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.304] GetProcessHeap () returned 0x630000 [0055.304] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.304] GetProcessHeap () returned 0x630000 [0055.304] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.304] GetProcessHeap () returned 0x630000 [0055.304] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0055.304] GetProcessHeap () returned 0x630000 [0055.304] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.304] GetProcessHeap () returned 0x630000 [0055.304] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.304] GetProcessHeap () returned 0x630000 [0055.304] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.304] GetProcessHeap () returned 0x630000 [0055.304] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.304] GetProcessHeap () returned 0x630000 [0055.304] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.304] GetProcessHeap () returned 0x630000 [0055.304] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.304] GetProcessHeap () returned 0x630000 [0055.304] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.304] GetProcessHeap () returned 0x630000 [0055.304] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.304] GetProcessHeap () returned 0x630000 [0055.304] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.304] GetProcessHeap () returned 0x630000 [0055.304] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.304] GetProcessHeap () returned 0x630000 [0055.304] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.304] GetProcessHeap () returned 0x630000 [0055.304] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0055.304] GetProcessHeap () returned 0x630000 [0055.304] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0055.304] GetProcessHeap () returned 0x630000 [0055.304] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.304] GetProcessHeap () returned 0x630000 [0055.304] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.305] GetProcessHeap () returned 0x630000 [0055.305] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.305] GetProcessHeap () returned 0x630000 [0055.305] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.305] GetProcessHeap () returned 0x630000 [0055.305] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.305] GetProcessHeap () returned 0x630000 [0055.305] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.305] GetProcessHeap () returned 0x630000 [0055.305] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.305] GetProcessHeap () returned 0x630000 [0055.305] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.305] GetProcessHeap () returned 0x630000 [0055.305] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.305] GetProcessHeap () returned 0x630000 [0055.305] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.305] GetProcessHeap () returned 0x630000 [0055.305] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.305] GetProcessHeap () returned 0x630000 [0055.305] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.305] GetProcessHeap () returned 0x630000 [0055.305] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.305] GetProcessHeap () returned 0x630000 [0055.305] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.305] GetProcessHeap () returned 0x630000 [0055.305] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.305] GetProcessHeap () returned 0x630000 [0055.305] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.305] GetProcessHeap () returned 0x630000 [0055.305] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.305] GetProcessHeap () returned 0x630000 [0055.305] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.305] GetProcessHeap () returned 0x630000 [0055.305] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.305] GetProcessHeap () returned 0x630000 [0055.305] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.305] GetProcessHeap () returned 0x630000 [0055.305] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.306] GetProcessHeap () returned 0x630000 [0055.306] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.306] GetProcessHeap () returned 0x630000 [0055.306] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.306] GetProcessHeap () returned 0x630000 [0055.306] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.306] GetProcessHeap () returned 0x630000 [0055.306] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.306] GetProcessHeap () returned 0x630000 [0055.306] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.306] GetProcessHeap () returned 0x630000 [0055.306] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.306] GetProcessHeap () returned 0x630000 [0055.306] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.306] GetProcessHeap () returned 0x630000 [0055.306] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.306] GetProcessHeap () returned 0x630000 [0055.306] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.306] GetProcessHeap () returned 0x630000 [0055.306] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.306] GetProcessHeap () returned 0x630000 [0055.306] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.306] GetProcessHeap () returned 0x630000 [0055.306] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.306] GetProcessHeap () returned 0x630000 [0055.306] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.306] GetProcessHeap () returned 0x630000 [0055.306] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.306] GetProcessHeap () returned 0x630000 [0055.306] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.306] GetProcessHeap () returned 0x630000 [0055.306] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0055.306] GetProcessHeap () returned 0x630000 [0055.306] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0055.306] GetProcessHeap () returned 0x630000 [0055.306] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.306] GetProcessHeap () returned 0x630000 [0055.307] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.307] GetProcessHeap () returned 0x630000 [0055.307] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.307] GetProcessHeap () returned 0x630000 [0055.307] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.307] GetProcessHeap () returned 0x630000 [0055.307] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.307] GetProcessHeap () returned 0x630000 [0055.307] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.307] GetProcessHeap () returned 0x630000 [0055.307] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.307] GetProcessHeap () returned 0x630000 [0055.307] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.307] GetProcessHeap () returned 0x630000 [0055.307] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.307] GetProcessHeap () returned 0x630000 [0055.307] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.307] GetProcessHeap () returned 0x630000 [0055.307] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.307] GetProcessHeap () returned 0x630000 [0055.307] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.307] GetProcessHeap () returned 0x630000 [0055.307] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.307] GetProcessHeap () returned 0x630000 [0055.307] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.307] GetProcessHeap () returned 0x630000 [0055.307] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.307] GetProcessHeap () returned 0x630000 [0055.307] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.307] GetProcessHeap () returned 0x630000 [0055.307] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.307] GetProcessHeap () returned 0x630000 [0055.307] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.307] GetProcessHeap () returned 0x630000 [0055.307] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.307] GetProcessHeap () returned 0x630000 [0055.307] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.307] GetProcessHeap () returned 0x630000 [0055.307] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.308] GetProcessHeap () returned 0x630000 [0055.308] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.308] GetProcessHeap () returned 0x630000 [0055.308] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0055.308] GetProcessHeap () returned 0x630000 [0055.308] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0055.308] GetProcessHeap () returned 0x630000 [0055.308] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0055.308] GetProcessHeap () returned 0x630000 [0055.308] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0055.308] GetProcessHeap () returned 0x630000 [0055.308] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0055.308] GetProcessHeap () returned 0x630000 [0055.308] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0055.308] GetProcessHeap () returned 0x630000 [0055.308] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0055.308] GetProcessHeap () returned 0x630000 [0055.308] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ecd0 | out: hHeap=0x630000) returned 1 [0055.308] GetProcessHeap () returned 0x630000 [0055.308] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0055.308] GetProcessHeap () returned 0x630000 [0055.308] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0055.308] GetProcessHeap () returned 0x630000 [0055.308] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0055.308] WriteFile (in: hFile=0x230, lpBuffer=0x65ae58*, nNumberOfBytesToWrite=0x38c, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65ae58*, lpNumberOfBytesWritten=0x243d864*=0x38c, lpOverlapped=0x0) returned 1 [0055.311] GetProcessHeap () returned 0x630000 [0055.311] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65ae58, Size=0x30) returned 0x65ae58 [0055.311] GetProcessHeap () returned 0x630000 [0055.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0055.311] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.311] GetProcessHeap () returned 0x630000 [0055.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10ad0) returned 0x65ed80 [0055.311] ReadFile (in: hFile=0x230, lpBuffer=0x65ed80, nNumberOfBytesToRead=0x10ad0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesRead=0x243d7e8*=0x10ad0, lpOverlapped=0x0) returned 1 [0055.313] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.313] WriteFile (in: hFile=0x230, lpBuffer=0x65ed80*, nNumberOfBytesToWrite=0x10ad0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesWritten=0x243d7e4*=0x10ad0, lpOverlapped=0x0) returned 1 [0055.314] GetProcessHeap () returned 0x630000 [0055.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ed80 | out: hHeap=0x630000) returned 1 [0055.315] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.315] WriteFile (in: hFile=0x230, lpBuffer=0x65ae58*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65ae58*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0055.316] CloseHandle (hObject=0x230) returned 1 [0055.319] GetProcessHeap () returned 0x630000 [0055.319] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0055.319] GetProcessHeap () returned 0x630000 [0055.319] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6557d8 | out: hHeap=0x630000) returned 1 [0055.319] GetProcessHeap () returned 0x630000 [0055.319] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0055.319] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm" [0055.319] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm.happythreechoose" [0055.319] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-br.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-br.htm.happythreechoose"), dwFlags=0x1) returned 1 [0055.319] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0055.319] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0055.320] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" [0055.320] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\decryption info.html")) returned 0x20 [0055.320] GetProcessHeap () returned 0x630000 [0055.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0055.320] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea401e7f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea401e7f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1158e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_pt-pt.htm", cAlternateFileName="EULA_P~3.HTM")) returned 1 [0055.320] lstrcmpiW (lpString1="EULA_pt-pt.htm", lpString2=".") returned 1 [0055.320] lstrcmpiW (lpString1="EULA_pt-pt.htm", lpString2="..") returned 1 [0055.320] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_pt-pt.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm" [0055.320] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_pt-pt.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0055.320] GetProcessHeap () returned 0x630000 [0055.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0055.320] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_pt-pt.htm", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_pt-pt.htm", lpUsedDefaultChar=0x0) returned 15 [0055.320] lstrlenA (lpString="EULA_pt-pt.htm") returned 14 [0055.320] lstrlenA (lpString=".happythreechoose") returned 17 [0055.320] lstrcmpiW (lpString1="EULA_pt-pt.htm", lpString2="Decryption INFO.html") returned 1 [0055.320] lstrcmpiW (lpString1="EULA_pt-pt.htm", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0055.320] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0055.320] lstrcmpiW (lpString1="EULA_pt-pt.htm", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0055.320] GetProcessHeap () returned 0x630000 [0055.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0055.320] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-pt.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0055.321] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=71054) returned 1 [0055.321] GetProcessHeap () returned 0x630000 [0055.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6557d8 [0055.321] GetProcessHeap () returned 0x630000 [0055.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0055.322] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm") returned 52 [0055.322] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.322] GetProcessHeap () returned 0x630000 [0055.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0055.322] GetProcessHeap () returned 0x630000 [0055.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x382) returned 0x65ae90 [0055.322] lstrlenA (lpString="rsa_encrypt") returned 11 [0055.322] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0055.322] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0055.322] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0055.322] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0055.322] GetProcessHeap () returned 0x630000 [0055.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0055.322] lstrlenA (lpString="010001") returned 6 [0055.322] GetProcessHeap () returned 0x630000 [0055.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0055.323] GetProcessHeap () returned 0x630000 [0055.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0055.323] GetProcessHeap () returned 0x630000 [0055.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e340 [0055.323] GetProcessHeap () returned 0x630000 [0055.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0055.323] GetProcessHeap () returned 0x630000 [0055.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea00 [0055.323] GetProcessHeap () returned 0x630000 [0055.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656950 [0055.323] GetProcessHeap () returned 0x630000 [0055.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0055.323] GetProcessHeap () returned 0x630000 [0055.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0055.323] GetProcessHeap () returned 0x630000 [0055.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.323] GetProcessHeap () returned 0x630000 [0055.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0055.323] GetProcessHeap () returned 0x630000 [0055.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0055.323] GetProcessHeap () returned 0x630000 [0055.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656a68 [0055.323] GetProcessHeap () returned 0x630000 [0055.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.323] GetProcessHeap () returned 0x630000 [0055.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0055.323] GetProcessHeap () returned 0x630000 [0055.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea90 [0055.323] GetProcessHeap () returned 0x630000 [0055.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0055.323] GetProcessHeap () returned 0x630000 [0055.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0055.323] GetProcessHeap () returned 0x630000 [0055.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea90 | out: hHeap=0x630000) returned 1 [0055.323] GetProcessHeap () returned 0x630000 [0055.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.323] GetProcessHeap () returned 0x630000 [0055.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x655fe8 [0055.324] GetProcessHeap () returned 0x630000 [0055.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.324] GetProcessHeap () returned 0x630000 [0055.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.324] GetProcessHeap () returned 0x630000 [0055.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.324] GetProcessHeap () returned 0x630000 [0055.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.324] GetProcessHeap () returned 0x630000 [0055.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ea90 [0055.324] GetProcessHeap () returned 0x630000 [0055.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655fe8 | out: hHeap=0x630000) returned 1 [0055.324] GetProcessHeap () returned 0x630000 [0055.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0055.324] GetProcessHeap () returned 0x630000 [0055.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea90 | out: hHeap=0x630000) returned 1 [0055.324] GetProcessHeap () returned 0x630000 [0055.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.324] GetProcessHeap () returned 0x630000 [0055.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.324] GetProcessHeap () returned 0x630000 [0055.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.324] GetProcessHeap () returned 0x630000 [0055.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.324] GetProcessHeap () returned 0x630000 [0055.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.324] GetProcessHeap () returned 0x630000 [0055.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.324] GetProcessHeap () returned 0x630000 [0055.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.324] GetProcessHeap () returned 0x630000 [0055.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.324] GetProcessHeap () returned 0x630000 [0055.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.324] GetProcessHeap () returned 0x630000 [0055.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.324] GetProcessHeap () returned 0x630000 [0055.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.325] GetProcessHeap () returned 0x630000 [0055.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.325] GetProcessHeap () returned 0x630000 [0055.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.325] GetProcessHeap () returned 0x630000 [0055.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.325] GetProcessHeap () returned 0x630000 [0055.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.325] GetProcessHeap () returned 0x630000 [0055.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.325] GetProcessHeap () returned 0x630000 [0055.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0055.325] GetProcessHeap () returned 0x630000 [0055.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.325] GetProcessHeap () returned 0x630000 [0055.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0055.325] GetProcessHeap () returned 0x630000 [0055.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0055.325] GetProcessHeap () returned 0x630000 [0055.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.325] GetProcessHeap () returned 0x630000 [0055.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.325] GetProcessHeap () returned 0x630000 [0055.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0055.325] GetProcessHeap () returned 0x630000 [0055.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0055.325] GetProcessHeap () returned 0x630000 [0055.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.325] GetProcessHeap () returned 0x630000 [0055.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.325] GetProcessHeap () returned 0x630000 [0055.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.325] GetProcessHeap () returned 0x630000 [0055.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.325] GetProcessHeap () returned 0x630000 [0055.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.325] GetProcessHeap () returned 0x630000 [0055.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.326] GetProcessHeap () returned 0x630000 [0055.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.326] GetProcessHeap () returned 0x630000 [0055.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.326] GetProcessHeap () returned 0x630000 [0055.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.326] GetProcessHeap () returned 0x630000 [0055.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.326] GetProcessHeap () returned 0x630000 [0055.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.326] GetProcessHeap () returned 0x630000 [0055.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.326] GetProcessHeap () returned 0x630000 [0055.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.326] GetProcessHeap () returned 0x630000 [0055.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.326] GetProcessHeap () returned 0x630000 [0055.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0055.326] GetProcessHeap () returned 0x630000 [0055.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0055.326] GetProcessHeap () returned 0x630000 [0055.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0055.326] GetProcessHeap () returned 0x630000 [0055.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0055.326] GetProcessHeap () returned 0x630000 [0055.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.326] GetProcessHeap () returned 0x630000 [0055.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.326] GetProcessHeap () returned 0x630000 [0055.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.326] GetProcessHeap () returned 0x630000 [0055.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.326] GetProcessHeap () returned 0x630000 [0055.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.326] GetProcessHeap () returned 0x630000 [0055.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.326] GetProcessHeap () returned 0x630000 [0055.327] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.327] GetProcessHeap () returned 0x630000 [0055.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.327] GetProcessHeap () returned 0x630000 [0055.327] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0055.327] GetProcessHeap () returned 0x630000 [0055.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.327] GetProcessHeap () returned 0x630000 [0055.327] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.327] GetProcessHeap () returned 0x630000 [0055.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.327] GetProcessHeap () returned 0x630000 [0055.327] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.327] GetProcessHeap () returned 0x630000 [0055.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.327] GetProcessHeap () returned 0x630000 [0055.327] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.327] GetProcessHeap () returned 0x630000 [0055.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.327] GetProcessHeap () returned 0x630000 [0055.327] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.327] GetProcessHeap () returned 0x630000 [0055.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.327] GetProcessHeap () returned 0x630000 [0055.327] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.327] GetProcessHeap () returned 0x630000 [0055.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.327] GetProcessHeap () returned 0x630000 [0055.327] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.327] GetProcessHeap () returned 0x630000 [0055.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.327] GetProcessHeap () returned 0x630000 [0055.327] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.327] GetProcessHeap () returned 0x630000 [0055.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.327] GetProcessHeap () returned 0x630000 [0055.327] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.327] GetProcessHeap () returned 0x630000 [0055.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.327] GetProcessHeap () returned 0x630000 [0055.328] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.328] GetProcessHeap () returned 0x630000 [0055.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.328] GetProcessHeap () returned 0x630000 [0055.328] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.328] GetProcessHeap () returned 0x630000 [0055.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.328] GetProcessHeap () returned 0x630000 [0055.328] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0055.328] GetProcessHeap () returned 0x630000 [0055.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0055.328] GetProcessHeap () returned 0x630000 [0055.328] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.328] GetProcessHeap () returned 0x630000 [0055.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.328] GetProcessHeap () returned 0x630000 [0055.328] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.328] GetProcessHeap () returned 0x630000 [0055.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.328] GetProcessHeap () returned 0x630000 [0055.328] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0055.328] GetProcessHeap () returned 0x630000 [0055.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0055.328] GetProcessHeap () returned 0x630000 [0055.328] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.328] GetProcessHeap () returned 0x630000 [0055.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.328] GetProcessHeap () returned 0x630000 [0055.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0055.328] GetProcessHeap () returned 0x630000 [0055.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0055.328] GetProcessHeap () returned 0x630000 [0055.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0055.328] GetProcessHeap () returned 0x630000 [0055.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0055.328] GetProcessHeap () returned 0x630000 [0055.329] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0055.329] GetProcessHeap () returned 0x630000 [0055.329] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0055.329] GetProcessHeap () returned 0x630000 [0055.329] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0055.329] GetProcessHeap () returned 0x630000 [0055.329] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0055.329] GetProcessHeap () returned 0x630000 [0055.329] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0055.329] GetProcessHeap () returned 0x630000 [0055.329] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.329] GetProcessHeap () returned 0x630000 [0055.329] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0055.329] WriteFile (in: hFile=0x230, lpBuffer=0x65ae90*, nNumberOfBytesToWrite=0x382, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65ae90*, lpNumberOfBytesWritten=0x243d864*=0x382, lpOverlapped=0x0) returned 1 [0055.332] GetProcessHeap () returned 0x630000 [0055.332] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65ae90, Size=0x30) returned 0x65ae90 [0055.332] GetProcessHeap () returned 0x630000 [0055.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0055.332] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.332] GetProcessHeap () returned 0x630000 [0055.332] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11590) returned 0x65ed80 [0055.335] ReadFile (in: hFile=0x230, lpBuffer=0x65ed80, nNumberOfBytesToRead=0x11590, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesRead=0x243d7e8*=0x11590, lpOverlapped=0x0) returned 1 [0055.336] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.336] WriteFile (in: hFile=0x230, lpBuffer=0x65ed80*, nNumberOfBytesToWrite=0x11590, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesWritten=0x243d7e4*=0x11590, lpOverlapped=0x0) returned 1 [0055.337] GetProcessHeap () returned 0x630000 [0055.337] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ed80 | out: hHeap=0x630000) returned 1 [0055.337] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.337] WriteFile (in: hFile=0x230, lpBuffer=0x65ae90*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65ae90*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0055.338] CloseHandle (hObject=0x230) returned 1 [0055.341] GetProcessHeap () returned 0x630000 [0055.341] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0055.341] GetProcessHeap () returned 0x630000 [0055.341] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6557d8 | out: hHeap=0x630000) returned 1 [0055.341] GetProcessHeap () returned 0x630000 [0055.341] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0055.341] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm" [0055.341] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm.happythreechoose" [0055.341] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-pt.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-pt.htm.happythreechoose"), dwFlags=0x1) returned 1 [0055.342] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0055.342] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0055.342] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" [0055.342] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\decryption info.html")) returned 0x20 [0055.342] GetProcessHeap () returned 0x630000 [0055.342] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0055.342] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5c6190, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5c6190, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x13160, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_ro-ro.htm", cAlternateFileName="EULA_R~1.HTM")) returned 1 [0055.342] lstrcmpiW (lpString1="EULA_ro-ro.htm", lpString2=".") returned 1 [0055.342] lstrcmpiW (lpString1="EULA_ro-ro.htm", lpString2="..") returned 1 [0055.342] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_ro-ro.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm" [0055.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_ro-ro.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0055.342] GetProcessHeap () returned 0x630000 [0055.342] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0055.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_ro-ro.htm", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_ro-ro.htm", lpUsedDefaultChar=0x0) returned 15 [0055.342] lstrlenA (lpString="EULA_ro-ro.htm") returned 14 [0055.342] lstrlenA (lpString=".happythreechoose") returned 17 [0055.342] lstrcmpiW (lpString1="EULA_ro-ro.htm", lpString2="Decryption INFO.html") returned 1 [0055.342] lstrcmpiW (lpString1="EULA_ro-ro.htm", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0055.342] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0055.342] lstrcmpiW (lpString1="EULA_ro-ro.htm", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0055.342] GetProcessHeap () returned 0x630000 [0055.342] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0055.342] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ro-ro.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0055.343] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=78176) returned 1 [0055.343] GetProcessHeap () returned 0x630000 [0055.343] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655940 [0055.343] GetProcessHeap () returned 0x630000 [0055.343] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0055.343] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm") returned 52 [0055.343] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.343] GetProcessHeap () returned 0x630000 [0055.343] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0055.343] GetProcessHeap () returned 0x630000 [0055.343] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x65aec8 [0055.343] lstrlenA (lpString="rsa_encrypt") returned 11 [0055.344] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0055.344] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0055.344] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0055.344] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0055.344] GetProcessHeap () returned 0x630000 [0055.344] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0055.344] lstrlenA (lpString="010001") returned 6 [0055.344] GetProcessHeap () returned 0x630000 [0055.345] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3f8 [0055.345] GetProcessHeap () returned 0x630000 [0055.345] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0055.345] GetProcessHeap () returned 0x630000 [0055.345] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dec0 [0055.345] GetProcessHeap () returned 0x630000 [0055.345] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0055.345] GetProcessHeap () returned 0x630000 [0055.345] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dfe0 [0055.345] GetProcessHeap () returned 0x630000 [0055.345] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656a68 [0055.345] GetProcessHeap () returned 0x630000 [0055.345] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0055.345] GetProcessHeap () returned 0x630000 [0055.345] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0055.345] GetProcessHeap () returned 0x630000 [0055.345] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.345] GetProcessHeap () returned 0x630000 [0055.345] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0055.345] GetProcessHeap () returned 0x630000 [0055.345] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0055.345] GetProcessHeap () returned 0x630000 [0055.345] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656ec8 [0055.345] GetProcessHeap () returned 0x630000 [0055.345] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.345] GetProcessHeap () returned 0x630000 [0055.345] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0055.345] GetProcessHeap () returned 0x630000 [0055.345] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ecd0 [0055.345] GetProcessHeap () returned 0x630000 [0055.345] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0055.345] GetProcessHeap () returned 0x630000 [0055.345] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0055.345] GetProcessHeap () returned 0x630000 [0055.345] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ecd0 | out: hHeap=0x630000) returned 1 [0055.345] GetProcessHeap () returned 0x630000 [0055.345] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.346] GetProcessHeap () returned 0x630000 [0055.346] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x655c58 [0055.346] GetProcessHeap () returned 0x630000 [0055.346] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.346] GetProcessHeap () returned 0x630000 [0055.346] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.346] GetProcessHeap () returned 0x630000 [0055.346] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0055.346] GetProcessHeap () returned 0x630000 [0055.346] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.346] GetProcessHeap () returned 0x630000 [0055.346] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ebb0 [0055.346] GetProcessHeap () returned 0x630000 [0055.346] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655c58 | out: hHeap=0x630000) returned 1 [0055.346] GetProcessHeap () returned 0x630000 [0055.346] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0055.346] GetProcessHeap () returned 0x630000 [0055.346] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0055.346] GetProcessHeap () returned 0x630000 [0055.346] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0055.346] GetProcessHeap () returned 0x630000 [0055.346] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0055.346] GetProcessHeap () returned 0x630000 [0055.346] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.346] GetProcessHeap () returned 0x630000 [0055.346] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.346] GetProcessHeap () returned 0x630000 [0055.346] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0055.346] GetProcessHeap () returned 0x630000 [0055.346] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.346] GetProcessHeap () returned 0x630000 [0055.346] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.346] GetProcessHeap () returned 0x630000 [0055.346] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.346] GetProcessHeap () returned 0x630000 [0055.346] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.346] GetProcessHeap () returned 0x630000 [0055.346] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.346] GetProcessHeap () returned 0x630000 [0055.347] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.347] GetProcessHeap () returned 0x630000 [0055.347] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.347] GetProcessHeap () returned 0x630000 [0055.347] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.347] GetProcessHeap () returned 0x630000 [0055.347] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.347] GetProcessHeap () returned 0x630000 [0055.347] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.347] GetProcessHeap () returned 0x630000 [0055.347] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.347] GetProcessHeap () returned 0x630000 [0055.347] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.347] GetProcessHeap () returned 0x630000 [0055.347] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.347] GetProcessHeap () returned 0x630000 [0055.347] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.347] GetProcessHeap () returned 0x630000 [0055.347] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.347] GetProcessHeap () returned 0x630000 [0055.347] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.347] GetProcessHeap () returned 0x630000 [0055.347] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.347] GetProcessHeap () returned 0x630000 [0055.347] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.347] GetProcessHeap () returned 0x630000 [0055.347] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.347] GetProcessHeap () returned 0x630000 [0055.347] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.347] GetProcessHeap () returned 0x630000 [0055.347] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.347] GetProcessHeap () returned 0x630000 [0055.347] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.347] GetProcessHeap () returned 0x630000 [0055.347] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.348] GetProcessHeap () returned 0x630000 [0055.349] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0055.349] GetProcessHeap () returned 0x630000 [0055.349] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.349] GetProcessHeap () returned 0x630000 [0055.349] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.349] GetProcessHeap () returned 0x630000 [0055.349] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.349] GetProcessHeap () returned 0x630000 [0055.349] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.349] GetProcessHeap () returned 0x630000 [0055.349] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.349] GetProcessHeap () returned 0x630000 [0055.349] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.349] GetProcessHeap () returned 0x630000 [0055.349] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.349] GetProcessHeap () returned 0x630000 [0055.349] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.349] GetProcessHeap () returned 0x630000 [0055.349] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.349] GetProcessHeap () returned 0x630000 [0055.349] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.349] GetProcessHeap () returned 0x630000 [0055.349] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.349] GetProcessHeap () returned 0x630000 [0055.349] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.349] GetProcessHeap () returned 0x630000 [0055.349] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.349] GetProcessHeap () returned 0x630000 [0055.349] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.349] GetProcessHeap () returned 0x630000 [0055.349] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.349] GetProcessHeap () returned 0x630000 [0055.349] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.349] GetProcessHeap () returned 0x630000 [0055.349] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.349] GetProcessHeap () returned 0x630000 [0055.349] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.349] GetProcessHeap () returned 0x630000 [0055.350] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.350] GetProcessHeap () returned 0x630000 [0055.350] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.350] GetProcessHeap () returned 0x630000 [0055.350] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.350] GetProcessHeap () returned 0x630000 [0055.350] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.350] GetProcessHeap () returned 0x630000 [0055.350] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.350] GetProcessHeap () returned 0x630000 [0055.350] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.350] GetProcessHeap () returned 0x630000 [0055.350] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.350] GetProcessHeap () returned 0x630000 [0055.350] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.350] GetProcessHeap () returned 0x630000 [0055.350] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.350] GetProcessHeap () returned 0x630000 [0055.350] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.350] GetProcessHeap () returned 0x630000 [0055.350] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.350] GetProcessHeap () returned 0x630000 [0055.350] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.350] GetProcessHeap () returned 0x630000 [0055.350] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.350] GetProcessHeap () returned 0x630000 [0055.350] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.350] GetProcessHeap () returned 0x630000 [0055.350] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.350] GetProcessHeap () returned 0x630000 [0055.350] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0055.350] GetProcessHeap () returned 0x630000 [0055.350] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.350] GetProcessHeap () returned 0x630000 [0055.350] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0055.350] GetProcessHeap () returned 0x630000 [0055.350] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0055.350] GetProcessHeap () returned 0x630000 [0055.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.351] GetProcessHeap () returned 0x630000 [0055.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.351] GetProcessHeap () returned 0x630000 [0055.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.351] GetProcessHeap () returned 0x630000 [0055.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.351] GetProcessHeap () returned 0x630000 [0055.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.351] GetProcessHeap () returned 0x630000 [0055.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.351] GetProcessHeap () returned 0x630000 [0055.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.351] GetProcessHeap () returned 0x630000 [0055.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.351] GetProcessHeap () returned 0x630000 [0055.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.351] GetProcessHeap () returned 0x630000 [0055.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.351] GetProcessHeap () returned 0x630000 [0055.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.351] GetProcessHeap () returned 0x630000 [0055.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.351] GetProcessHeap () returned 0x630000 [0055.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.351] GetProcessHeap () returned 0x630000 [0055.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.351] GetProcessHeap () returned 0x630000 [0055.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.351] GetProcessHeap () returned 0x630000 [0055.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.351] GetProcessHeap () returned 0x630000 [0055.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0055.351] GetProcessHeap () returned 0x630000 [0055.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0055.351] GetProcessHeap () returned 0x630000 [0055.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0055.351] GetProcessHeap () returned 0x630000 [0055.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0055.352] GetProcessHeap () returned 0x630000 [0055.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0055.352] GetProcessHeap () returned 0x630000 [0055.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0055.352] GetProcessHeap () returned 0x630000 [0055.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0055.352] GetProcessHeap () returned 0x630000 [0055.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0055.352] GetProcessHeap () returned 0x630000 [0055.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0055.352] GetProcessHeap () returned 0x630000 [0055.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.352] GetProcessHeap () returned 0x630000 [0055.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0055.352] WriteFile (in: hFile=0x230, lpBuffer=0x65aec8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65aec8*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0055.355] GetProcessHeap () returned 0x630000 [0055.355] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65aec8, Size=0x30) returned 0x65aec8 [0055.355] GetProcessHeap () returned 0x630000 [0055.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0055.355] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.355] GetProcessHeap () returned 0x630000 [0055.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x13160) returned 0x65ed80 [0055.355] ReadFile (in: hFile=0x230, lpBuffer=0x65ed80, nNumberOfBytesToRead=0x13160, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesRead=0x243d7e8*=0x13160, lpOverlapped=0x0) returned 1 [0055.357] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.357] WriteFile (in: hFile=0x230, lpBuffer=0x65ed80*, nNumberOfBytesToWrite=0x13160, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesWritten=0x243d7e4*=0x13160, lpOverlapped=0x0) returned 1 [0055.358] GetProcessHeap () returned 0x630000 [0055.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ed80 | out: hHeap=0x630000) returned 1 [0055.359] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.359] WriteFile (in: hFile=0x230, lpBuffer=0x65aec8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65aec8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0055.361] CloseHandle (hObject=0x230) returned 1 [0055.364] GetProcessHeap () returned 0x630000 [0055.364] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0055.364] GetProcessHeap () returned 0x630000 [0055.364] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655940 | out: hHeap=0x630000) returned 1 [0055.365] GetProcessHeap () returned 0x630000 [0055.365] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0055.365] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm" [0055.365] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm.happythreechoose" [0055.365] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ro-ro.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ro-ro.htm.happythreechoose"), dwFlags=0x1) returned 1 [0055.365] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0055.365] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0055.365] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" [0055.365] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\decryption info.html")) returned 0x20 [0055.365] GetProcessHeap () returned 0x630000 [0055.365] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0055.366] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5cfdc2, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5cfdc2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x454cc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_ru-ru.htm", cAlternateFileName="EULA_R~2.HTM")) returned 1 [0055.366] lstrcmpiW (lpString1="EULA_ru-ru.htm", lpString2=".") returned 1 [0055.366] lstrcmpiW (lpString1="EULA_ru-ru.htm", lpString2="..") returned 1 [0055.366] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_ru-ru.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm" [0055.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_ru-ru.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0055.366] GetProcessHeap () returned 0x630000 [0055.366] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0055.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_ru-ru.htm", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_ru-ru.htm", lpUsedDefaultChar=0x0) returned 15 [0055.366] lstrlenA (lpString="EULA_ru-ru.htm") returned 14 [0055.366] lstrlenA (lpString=".happythreechoose") returned 17 [0055.366] lstrcmpiW (lpString1="EULA_ru-ru.htm", lpString2="Decryption INFO.html") returned 1 [0055.366] lstrcmpiW (lpString1="EULA_ru-ru.htm", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0055.366] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0055.366] lstrcmpiW (lpString1="EULA_ru-ru.htm", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0055.366] GetProcessHeap () returned 0x630000 [0055.366] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0055.366] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ru-ru.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0055.366] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=283852) returned 1 [0055.367] GetProcessHeap () returned 0x630000 [0055.367] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6559b8 [0055.367] GetProcessHeap () returned 0x630000 [0055.367] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0055.367] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm") returned 52 [0055.367] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.367] GetProcessHeap () returned 0x630000 [0055.367] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0055.367] GetProcessHeap () returned 0x630000 [0055.367] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x384) returned 0x65af00 [0055.367] lstrlenA (lpString="rsa_encrypt") returned 11 [0055.367] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0055.367] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0055.367] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0055.368] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0055.368] GetProcessHeap () returned 0x630000 [0055.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0055.368] lstrlenA (lpString="010001") returned 6 [0055.368] GetProcessHeap () returned 0x630000 [0055.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0055.368] GetProcessHeap () returned 0x630000 [0055.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0055.368] GetProcessHeap () returned 0x630000 [0055.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e730 [0055.368] GetProcessHeap () returned 0x630000 [0055.368] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0055.368] GetProcessHeap () returned 0x630000 [0055.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e7c0 [0055.368] GetProcessHeap () returned 0x630000 [0055.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657210 [0055.368] GetProcessHeap () returned 0x630000 [0055.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a348 [0055.368] GetProcessHeap () returned 0x630000 [0055.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0055.368] GetProcessHeap () returned 0x630000 [0055.368] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.368] GetProcessHeap () returned 0x630000 [0055.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0055.368] GetProcessHeap () returned 0x630000 [0055.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0055.368] GetProcessHeap () returned 0x630000 [0055.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656db0 [0055.368] GetProcessHeap () returned 0x630000 [0055.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.368] GetProcessHeap () returned 0x630000 [0055.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0055.368] GetProcessHeap () returned 0x630000 [0055.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e6a0 [0055.368] GetProcessHeap () returned 0x630000 [0055.368] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0055.369] GetProcessHeap () returned 0x630000 [0055.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0055.369] GetProcessHeap () returned 0x630000 [0055.369] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e6a0 | out: hHeap=0x630000) returned 1 [0055.369] GetProcessHeap () returned 0x630000 [0055.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.369] GetProcessHeap () returned 0x630000 [0055.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x655fe8 [0055.369] GetProcessHeap () returned 0x630000 [0055.369] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.369] GetProcessHeap () returned 0x630000 [0055.369] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.369] GetProcessHeap () returned 0x630000 [0055.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0055.369] GetProcessHeap () returned 0x630000 [0055.369] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0055.369] GetProcessHeap () returned 0x630000 [0055.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e070 [0055.369] GetProcessHeap () returned 0x630000 [0055.369] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655fe8 | out: hHeap=0x630000) returned 1 [0055.369] GetProcessHeap () returned 0x630000 [0055.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0055.369] GetProcessHeap () returned 0x630000 [0055.369] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0055.369] GetProcessHeap () returned 0x630000 [0055.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.369] GetProcessHeap () returned 0x630000 [0055.369] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.369] GetProcessHeap () returned 0x630000 [0055.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.369] GetProcessHeap () returned 0x630000 [0055.369] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.369] GetProcessHeap () returned 0x630000 [0055.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.369] GetProcessHeap () returned 0x630000 [0055.369] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.369] GetProcessHeap () returned 0x630000 [0055.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.369] GetProcessHeap () returned 0x630000 [0055.369] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.370] GetProcessHeap () returned 0x630000 [0055.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.370] GetProcessHeap () returned 0x630000 [0055.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.370] GetProcessHeap () returned 0x630000 [0055.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.370] GetProcessHeap () returned 0x630000 [0055.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.370] GetProcessHeap () returned 0x630000 [0055.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.370] GetProcessHeap () returned 0x630000 [0055.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.370] GetProcessHeap () returned 0x630000 [0055.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.370] GetProcessHeap () returned 0x630000 [0055.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.370] GetProcessHeap () returned 0x630000 [0055.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.370] GetProcessHeap () returned 0x630000 [0055.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.370] GetProcessHeap () returned 0x630000 [0055.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.370] GetProcessHeap () returned 0x630000 [0055.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.370] GetProcessHeap () returned 0x630000 [0055.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.370] GetProcessHeap () returned 0x630000 [0055.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.370] GetProcessHeap () returned 0x630000 [0055.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.370] GetProcessHeap () returned 0x630000 [0055.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.370] GetProcessHeap () returned 0x630000 [0055.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.370] GetProcessHeap () returned 0x630000 [0055.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.371] GetProcessHeap () returned 0x630000 [0055.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.371] GetProcessHeap () returned 0x630000 [0055.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.371] GetProcessHeap () returned 0x630000 [0055.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0055.371] GetProcessHeap () returned 0x630000 [0055.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0055.371] GetProcessHeap () returned 0x630000 [0055.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.371] GetProcessHeap () returned 0x630000 [0055.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.371] GetProcessHeap () returned 0x630000 [0055.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.371] GetProcessHeap () returned 0x630000 [0055.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.371] GetProcessHeap () returned 0x630000 [0055.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.371] GetProcessHeap () returned 0x630000 [0055.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.371] GetProcessHeap () returned 0x630000 [0055.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.371] GetProcessHeap () returned 0x630000 [0055.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.371] GetProcessHeap () returned 0x630000 [0055.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.371] GetProcessHeap () returned 0x630000 [0055.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.371] GetProcessHeap () returned 0x630000 [0055.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.371] GetProcessHeap () returned 0x630000 [0055.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.371] GetProcessHeap () returned 0x630000 [0055.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0055.371] GetProcessHeap () returned 0x630000 [0055.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.371] GetProcessHeap () returned 0x630000 [0055.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.372] GetProcessHeap () returned 0x630000 [0055.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.372] GetProcessHeap () returned 0x630000 [0055.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.372] GetProcessHeap () returned 0x630000 [0055.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.372] GetProcessHeap () returned 0x630000 [0055.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.372] GetProcessHeap () returned 0x630000 [0055.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.372] GetProcessHeap () returned 0x630000 [0055.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.372] GetProcessHeap () returned 0x630000 [0055.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.372] GetProcessHeap () returned 0x630000 [0055.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0055.372] GetProcessHeap () returned 0x630000 [0055.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.372] GetProcessHeap () returned 0x630000 [0055.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0055.372] GetProcessHeap () returned 0x630000 [0055.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.372] GetProcessHeap () returned 0x630000 [0055.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.372] GetProcessHeap () returned 0x630000 [0055.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.372] GetProcessHeap () returned 0x630000 [0055.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0055.372] GetProcessHeap () returned 0x630000 [0055.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0055.372] GetProcessHeap () returned 0x630000 [0055.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.372] GetProcessHeap () returned 0x630000 [0055.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.372] GetProcessHeap () returned 0x630000 [0055.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.373] GetProcessHeap () returned 0x630000 [0055.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.373] GetProcessHeap () returned 0x630000 [0055.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.373] GetProcessHeap () returned 0x630000 [0055.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.373] GetProcessHeap () returned 0x630000 [0055.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.373] GetProcessHeap () returned 0x630000 [0055.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.373] GetProcessHeap () returned 0x630000 [0055.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.373] GetProcessHeap () returned 0x630000 [0055.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.373] GetProcessHeap () returned 0x630000 [0055.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.373] GetProcessHeap () returned 0x630000 [0055.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.373] GetProcessHeap () returned 0x630000 [0055.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.373] GetProcessHeap () returned 0x630000 [0055.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.373] GetProcessHeap () returned 0x630000 [0055.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.373] GetProcessHeap () returned 0x630000 [0055.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.373] GetProcessHeap () returned 0x630000 [0055.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.373] GetProcessHeap () returned 0x630000 [0055.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.373] GetProcessHeap () returned 0x630000 [0055.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.373] GetProcessHeap () returned 0x630000 [0055.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.373] GetProcessHeap () returned 0x630000 [0055.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.374] GetProcessHeap () returned 0x630000 [0055.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.374] GetProcessHeap () returned 0x630000 [0055.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0055.374] GetProcessHeap () returned 0x630000 [0055.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0055.374] GetProcessHeap () returned 0x630000 [0055.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0055.374] GetProcessHeap () returned 0x630000 [0055.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0055.374] GetProcessHeap () returned 0x630000 [0055.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0055.374] GetProcessHeap () returned 0x630000 [0055.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e7c0 | out: hHeap=0x630000) returned 1 [0055.374] GetProcessHeap () returned 0x630000 [0055.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0055.374] GetProcessHeap () returned 0x630000 [0055.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0055.374] GetProcessHeap () returned 0x630000 [0055.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0055.374] GetProcessHeap () returned 0x630000 [0055.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.374] GetProcessHeap () returned 0x630000 [0055.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0055.374] WriteFile (in: hFile=0x230, lpBuffer=0x65af00*, nNumberOfBytesToWrite=0x384, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65af00*, lpNumberOfBytesWritten=0x243d864*=0x384, lpOverlapped=0x0) returned 1 [0055.377] GetProcessHeap () returned 0x630000 [0055.377] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65af00, Size=0x30) returned 0x65af00 [0055.377] GetProcessHeap () returned 0x630000 [0055.377] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0055.377] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.377] GetProcessHeap () returned 0x630000 [0055.377] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x454d0) returned 0x65ed80 [0055.383] ReadFile (in: hFile=0x230, lpBuffer=0x65ed80, nNumberOfBytesToRead=0x454d0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesRead=0x243d7e8*=0x454d0, lpOverlapped=0x0) returned 1 [0055.387] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.387] WriteFile (in: hFile=0x230, lpBuffer=0x65ed80*, nNumberOfBytesToWrite=0x454d0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesWritten=0x243d7e4*=0x454d0, lpOverlapped=0x0) returned 1 [0055.390] GetProcessHeap () returned 0x630000 [0055.390] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ed80 | out: hHeap=0x630000) returned 1 [0055.390] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.390] WriteFile (in: hFile=0x230, lpBuffer=0x65af00*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65af00*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0055.392] CloseHandle (hObject=0x230) returned 1 [0055.398] GetProcessHeap () returned 0x630000 [0055.398] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0055.398] GetProcessHeap () returned 0x630000 [0055.398] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6559b8 | out: hHeap=0x630000) returned 1 [0055.398] GetProcessHeap () returned 0x630000 [0055.398] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0055.399] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm" [0055.399] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm.happythreechoose" [0055.399] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ru-ru.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ru-ru.htm.happythreechoose"), dwFlags=0x1) returned 1 [0055.399] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0055.399] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0055.399] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" [0055.399] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\decryption info.html")) returned 0x20 [0055.399] GetProcessHeap () returned 0x630000 [0055.400] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0055.400] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5cfdc2, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5cfdc2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x14021, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_sk-sk.htm", cAlternateFileName="EULA_S~1.HTM")) returned 1 [0055.400] lstrcmpiW (lpString1="EULA_sk-sk.htm", lpString2=".") returned 1 [0055.400] lstrcmpiW (lpString1="EULA_sk-sk.htm", lpString2="..") returned 1 [0055.400] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_sk-sk.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm" [0055.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_sk-sk.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0055.400] GetProcessHeap () returned 0x630000 [0055.400] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0055.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_sk-sk.htm", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_sk-sk.htm", lpUsedDefaultChar=0x0) returned 15 [0055.400] lstrlenA (lpString="EULA_sk-sk.htm") returned 14 [0055.400] lstrlenA (lpString=".happythreechoose") returned 17 [0055.400] lstrcmpiW (lpString1="EULA_sk-sk.htm", lpString2="Decryption INFO.html") returned 1 [0055.400] lstrcmpiW (lpString1="EULA_sk-sk.htm", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0055.400] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0055.400] lstrcmpiW (lpString1="EULA_sk-sk.htm", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0055.400] GetProcessHeap () returned 0x630000 [0055.400] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0055.400] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sk-sk.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0055.400] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=81953) returned 1 [0055.400] GetProcessHeap () returned 0x630000 [0055.400] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655418 [0055.400] GetProcessHeap () returned 0x630000 [0055.401] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0055.401] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm") returned 52 [0055.401] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.401] GetProcessHeap () returned 0x630000 [0055.401] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0055.401] GetProcessHeap () returned 0x630000 [0055.401] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38f) returned 0x65af38 [0055.401] lstrlenA (lpString="rsa_encrypt") returned 11 [0055.401] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0055.401] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0055.401] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0055.401] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0055.401] GetProcessHeap () returned 0x630000 [0055.401] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0055.401] lstrlenA (lpString="010001") returned 6 [0055.401] GetProcessHeap () returned 0x630000 [0055.402] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0055.402] GetProcessHeap () returned 0x630000 [0055.402] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0055.402] GetProcessHeap () returned 0x630000 [0055.402] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e7c0 [0055.402] GetProcessHeap () returned 0x630000 [0055.402] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0055.402] GetProcessHeap () returned 0x630000 [0055.402] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e8e0 [0055.402] GetProcessHeap () returned 0x630000 [0055.402] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657558 [0055.402] GetProcessHeap () returned 0x630000 [0055.402] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a368 [0055.402] GetProcessHeap () returned 0x630000 [0055.402] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0055.402] GetProcessHeap () returned 0x630000 [0055.402] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.402] GetProcessHeap () returned 0x630000 [0055.402] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0055.402] GetProcessHeap () returned 0x630000 [0055.402] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0055.402] GetProcessHeap () returned 0x630000 [0055.402] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657440 [0055.402] GetProcessHeap () returned 0x630000 [0055.402] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.402] GetProcessHeap () returned 0x630000 [0055.402] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0055.402] GetProcessHeap () returned 0x630000 [0055.402] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e610 [0055.402] GetProcessHeap () returned 0x630000 [0055.402] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0055.402] GetProcessHeap () returned 0x630000 [0055.402] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0055.402] GetProcessHeap () returned 0x630000 [0055.402] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0055.402] GetProcessHeap () returned 0x630000 [0055.402] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.403] GetProcessHeap () returned 0x630000 [0055.403] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x655ec8 [0055.403] GetProcessHeap () returned 0x630000 [0055.403] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.403] GetProcessHeap () returned 0x630000 [0055.403] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.403] GetProcessHeap () returned 0x630000 [0055.403] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.403] GetProcessHeap () returned 0x630000 [0055.403] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.403] GetProcessHeap () returned 0x630000 [0055.403] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ebb0 [0055.403] GetProcessHeap () returned 0x630000 [0055.403] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655ec8 | out: hHeap=0x630000) returned 1 [0055.403] GetProcessHeap () returned 0x630000 [0055.403] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0055.403] GetProcessHeap () returned 0x630000 [0055.403] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0055.403] GetProcessHeap () returned 0x630000 [0055.403] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.403] GetProcessHeap () returned 0x630000 [0055.403] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.403] GetProcessHeap () returned 0x630000 [0055.403] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.403] GetProcessHeap () returned 0x630000 [0055.403] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.403] GetProcessHeap () returned 0x630000 [0055.403] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0055.403] GetProcessHeap () returned 0x630000 [0055.403] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0055.403] GetProcessHeap () returned 0x630000 [0055.403] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.403] GetProcessHeap () returned 0x630000 [0055.403] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.403] GetProcessHeap () returned 0x630000 [0055.403] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0055.403] GetProcessHeap () returned 0x630000 [0055.404] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0055.404] GetProcessHeap () returned 0x630000 [0055.404] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.404] GetProcessHeap () returned 0x630000 [0055.404] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.404] GetProcessHeap () returned 0x630000 [0055.404] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.404] GetProcessHeap () returned 0x630000 [0055.404] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.404] GetProcessHeap () returned 0x630000 [0055.404] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0055.404] GetProcessHeap () returned 0x630000 [0055.404] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.404] GetProcessHeap () returned 0x630000 [0055.404] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.404] GetProcessHeap () returned 0x630000 [0055.404] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.404] GetProcessHeap () returned 0x630000 [0055.404] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.404] GetProcessHeap () returned 0x630000 [0055.404] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.404] GetProcessHeap () returned 0x630000 [0055.404] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.404] GetProcessHeap () returned 0x630000 [0055.404] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.404] GetProcessHeap () returned 0x630000 [0055.404] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.404] GetProcessHeap () returned 0x630000 [0055.404] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.404] GetProcessHeap () returned 0x630000 [0055.404] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0055.404] GetProcessHeap () returned 0x630000 [0055.404] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0055.404] GetProcessHeap () returned 0x630000 [0055.404] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.404] GetProcessHeap () returned 0x630000 [0055.404] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.404] GetProcessHeap () returned 0x630000 [0055.405] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.405] GetProcessHeap () returned 0x630000 [0055.405] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.405] GetProcessHeap () returned 0x630000 [0055.405] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.405] GetProcessHeap () returned 0x630000 [0055.405] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.405] GetProcessHeap () returned 0x630000 [0055.405] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.405] GetProcessHeap () returned 0x630000 [0055.405] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.405] GetProcessHeap () returned 0x630000 [0055.405] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.405] GetProcessHeap () returned 0x630000 [0055.405] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.405] GetProcessHeap () returned 0x630000 [0055.405] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.405] GetProcessHeap () returned 0x630000 [0055.405] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.405] GetProcessHeap () returned 0x630000 [0055.405] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.405] GetProcessHeap () returned 0x630000 [0055.405] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.405] GetProcessHeap () returned 0x630000 [0055.405] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.405] GetProcessHeap () returned 0x630000 [0055.405] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.405] GetProcessHeap () returned 0x630000 [0055.405] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.405] GetProcessHeap () returned 0x630000 [0055.405] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.405] GetProcessHeap () returned 0x630000 [0055.405] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.405] GetProcessHeap () returned 0x630000 [0055.405] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.405] GetProcessHeap () returned 0x630000 [0055.405] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.406] GetProcessHeap () returned 0x630000 [0055.406] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.406] GetProcessHeap () returned 0x630000 [0055.406] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.406] GetProcessHeap () returned 0x630000 [0055.406] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.406] GetProcessHeap () returned 0x630000 [0055.406] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.406] GetProcessHeap () returned 0x630000 [0055.406] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.406] GetProcessHeap () returned 0x630000 [0055.406] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.406] GetProcessHeap () returned 0x630000 [0055.406] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.406] GetProcessHeap () returned 0x630000 [0055.406] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.406] GetProcessHeap () returned 0x630000 [0055.406] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.406] GetProcessHeap () returned 0x630000 [0055.406] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.441] GetProcessHeap () returned 0x630000 [0055.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.441] GetProcessHeap () returned 0x630000 [0055.441] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.441] GetProcessHeap () returned 0x630000 [0055.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.441] GetProcessHeap () returned 0x630000 [0055.442] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0055.442] GetProcessHeap () returned 0x630000 [0055.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.442] GetProcessHeap () returned 0x630000 [0055.442] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0055.442] GetProcessHeap () returned 0x630000 [0055.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.442] GetProcessHeap () returned 0x630000 [0055.442] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0055.442] GetProcessHeap () returned 0x630000 [0055.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.442] GetProcessHeap () returned 0x630000 [0055.442] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.442] GetProcessHeap () returned 0x630000 [0055.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.442] GetProcessHeap () returned 0x630000 [0055.442] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0055.442] GetProcessHeap () returned 0x630000 [0055.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0055.442] GetProcessHeap () returned 0x630000 [0055.442] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0055.442] GetProcessHeap () returned 0x630000 [0055.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0055.442] GetProcessHeap () returned 0x630000 [0055.442] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.442] GetProcessHeap () returned 0x630000 [0055.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.442] GetProcessHeap () returned 0x630000 [0055.442] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.442] GetProcessHeap () returned 0x630000 [0055.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.442] GetProcessHeap () returned 0x630000 [0055.442] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.442] GetProcessHeap () returned 0x630000 [0055.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.442] GetProcessHeap () returned 0x630000 [0055.442] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0055.442] GetProcessHeap () returned 0x630000 [0055.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.443] GetProcessHeap () returned 0x630000 [0055.443] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.443] GetProcessHeap () returned 0x630000 [0055.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.443] GetProcessHeap () returned 0x630000 [0055.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0055.443] GetProcessHeap () returned 0x630000 [0055.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0055.443] GetProcessHeap () returned 0x630000 [0055.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0055.443] GetProcessHeap () returned 0x630000 [0055.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0055.443] GetProcessHeap () returned 0x630000 [0055.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0055.443] GetProcessHeap () returned 0x630000 [0055.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0055.443] GetProcessHeap () returned 0x630000 [0055.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0055.443] GetProcessHeap () returned 0x630000 [0055.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e7c0 | out: hHeap=0x630000) returned 1 [0055.443] GetProcessHeap () returned 0x630000 [0055.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0055.443] GetProcessHeap () returned 0x630000 [0055.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.443] GetProcessHeap () returned 0x630000 [0055.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0055.443] WriteFile (in: hFile=0x230, lpBuffer=0x65af38*, nNumberOfBytesToWrite=0x38f, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65af38*, lpNumberOfBytesWritten=0x243d864*=0x38f, lpOverlapped=0x0) returned 1 [0055.446] GetProcessHeap () returned 0x630000 [0055.446] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65af38, Size=0x30) returned 0x65af38 [0055.446] GetProcessHeap () returned 0x630000 [0055.446] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0055.446] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.446] GetProcessHeap () returned 0x630000 [0055.446] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14030) returned 0x65ed80 [0055.446] ReadFile (in: hFile=0x230, lpBuffer=0x65ed80, nNumberOfBytesToRead=0x14030, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesRead=0x243d7e8*=0x14030, lpOverlapped=0x0) returned 1 [0055.448] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.448] WriteFile (in: hFile=0x230, lpBuffer=0x65ed80*, nNumberOfBytesToWrite=0x14030, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesWritten=0x243d7e4*=0x14030, lpOverlapped=0x0) returned 1 [0055.449] GetProcessHeap () returned 0x630000 [0055.449] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ed80 | out: hHeap=0x630000) returned 1 [0055.451] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.451] WriteFile (in: hFile=0x230, lpBuffer=0x65af38*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65af38*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0055.452] CloseHandle (hObject=0x230) returned 1 [0055.505] GetProcessHeap () returned 0x630000 [0055.505] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0055.505] GetProcessHeap () returned 0x630000 [0055.506] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655418 | out: hHeap=0x630000) returned 1 [0055.506] GetProcessHeap () returned 0x630000 [0055.506] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0055.506] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm" [0055.506] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm.happythreechoose" [0055.506] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sk-sk.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sk-sk.htm.happythreechoose"), dwFlags=0x1) returned 1 [0055.507] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0055.507] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0055.507] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" [0055.507] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\decryption info.html")) returned 0x20 [0055.507] GetProcessHeap () returned 0x630000 [0055.507] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0055.507] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5cfdc2, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5cfdc2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1026f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_sl-si.htm", cAlternateFileName="EULA_S~2.HTM")) returned 1 [0055.507] lstrcmpiW (lpString1="EULA_sl-si.htm", lpString2=".") returned 1 [0055.507] lstrcmpiW (lpString1="EULA_sl-si.htm", lpString2="..") returned 1 [0055.507] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_sl-si.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm" [0055.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_sl-si.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0055.507] GetProcessHeap () returned 0x630000 [0055.507] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0055.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_sl-si.htm", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_sl-si.htm", lpUsedDefaultChar=0x0) returned 15 [0055.507] lstrlenA (lpString="EULA_sl-si.htm") returned 14 [0055.507] lstrlenA (lpString=".happythreechoose") returned 17 [0055.507] lstrcmpiW (lpString1="EULA_sl-si.htm", lpString2="Decryption INFO.html") returned 1 [0055.507] lstrcmpiW (lpString1="EULA_sl-si.htm", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0055.507] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0055.507] lstrcmpiW (lpString1="EULA_sl-si.htm", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0055.507] GetProcessHeap () returned 0x630000 [0055.507] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0055.507] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sl-si.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0055.508] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=66159) returned 1 [0055.508] GetProcessHeap () returned 0x630000 [0055.508] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655760 [0055.508] GetProcessHeap () returned 0x630000 [0055.508] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0055.508] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm") returned 52 [0055.508] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.508] GetProcessHeap () returned 0x630000 [0055.508] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0055.508] GetProcessHeap () returned 0x630000 [0055.508] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x381) returned 0x65af70 [0055.508] lstrlenA (lpString="rsa_encrypt") returned 11 [0055.508] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0055.509] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0055.509] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0055.509] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0055.509] GetProcessHeap () returned 0x630000 [0055.509] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0055.509] lstrlenA (lpString="010001") returned 6 [0055.509] GetProcessHeap () returned 0x630000 [0055.509] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0055.509] GetProcessHeap () returned 0x630000 [0055.509] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0055.509] GetProcessHeap () returned 0x630000 [0055.509] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e7c0 [0055.509] GetProcessHeap () returned 0x630000 [0055.509] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0055.509] GetProcessHeap () returned 0x630000 [0055.509] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0055.509] GetProcessHeap () returned 0x630000 [0055.509] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x6570f8 [0055.509] GetProcessHeap () returned 0x630000 [0055.509] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a298 [0055.509] GetProcessHeap () returned 0x630000 [0055.509] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0055.509] GetProcessHeap () returned 0x630000 [0055.509] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.509] GetProcessHeap () returned 0x630000 [0055.509] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0055.509] GetProcessHeap () returned 0x630000 [0055.509] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0055.509] GetProcessHeap () returned 0x630000 [0055.509] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657788 [0055.509] GetProcessHeap () returned 0x630000 [0055.509] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.510] GetProcessHeap () returned 0x630000 [0055.510] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0055.510] GetProcessHeap () returned 0x630000 [0055.510] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e460 [0055.510] GetProcessHeap () returned 0x630000 [0055.510] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0055.510] GetProcessHeap () returned 0x630000 [0055.510] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0055.510] GetProcessHeap () returned 0x630000 [0055.510] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e460 | out: hHeap=0x630000) returned 1 [0055.510] GetProcessHeap () returned 0x630000 [0055.510] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.510] GetProcessHeap () returned 0x630000 [0055.510] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x655c40 [0055.510] GetProcessHeap () returned 0x630000 [0055.510] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.510] GetProcessHeap () returned 0x630000 [0055.510] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.510] GetProcessHeap () returned 0x630000 [0055.510] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.510] GetProcessHeap () returned 0x630000 [0055.510] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.510] GetProcessHeap () returned 0x630000 [0055.510] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ea00 [0055.510] GetProcessHeap () returned 0x630000 [0055.510] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655c40 | out: hHeap=0x630000) returned 1 [0055.510] GetProcessHeap () returned 0x630000 [0055.510] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0055.510] GetProcessHeap () returned 0x630000 [0055.510] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0055.510] GetProcessHeap () returned 0x630000 [0055.510] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.510] GetProcessHeap () returned 0x630000 [0055.510] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.510] GetProcessHeap () returned 0x630000 [0055.510] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.510] GetProcessHeap () returned 0x630000 [0055.510] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.510] GetProcessHeap () returned 0x630000 [0055.511] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.511] GetProcessHeap () returned 0x630000 [0055.511] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.511] GetProcessHeap () returned 0x630000 [0055.511] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.511] GetProcessHeap () returned 0x630000 [0055.511] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.511] GetProcessHeap () returned 0x630000 [0055.511] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.511] GetProcessHeap () returned 0x630000 [0055.511] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.511] GetProcessHeap () returned 0x630000 [0055.511] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.511] GetProcessHeap () returned 0x630000 [0055.511] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.511] GetProcessHeap () returned 0x630000 [0055.511] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0055.511] GetProcessHeap () returned 0x630000 [0055.511] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0055.511] GetProcessHeap () returned 0x630000 [0055.511] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.511] GetProcessHeap () returned 0x630000 [0055.511] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.511] GetProcessHeap () returned 0x630000 [0055.511] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0055.511] GetProcessHeap () returned 0x630000 [0055.511] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.511] GetProcessHeap () returned 0x630000 [0055.511] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0055.511] GetProcessHeap () returned 0x630000 [0055.511] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.511] GetProcessHeap () returned 0x630000 [0055.511] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.511] GetProcessHeap () returned 0x630000 [0055.511] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.511] GetProcessHeap () returned 0x630000 [0055.511] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.511] GetProcessHeap () returned 0x630000 [0055.512] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.512] GetProcessHeap () returned 0x630000 [0055.512] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.512] GetProcessHeap () returned 0x630000 [0055.512] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.512] GetProcessHeap () returned 0x630000 [0055.512] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.512] GetProcessHeap () returned 0x630000 [0055.512] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.512] GetProcessHeap () returned 0x630000 [0055.512] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.512] GetProcessHeap () returned 0x630000 [0055.512] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.512] GetProcessHeap () returned 0x630000 [0055.512] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.512] GetProcessHeap () returned 0x630000 [0055.512] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.512] GetProcessHeap () returned 0x630000 [0055.512] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.512] GetProcessHeap () returned 0x630000 [0055.512] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.512] GetProcessHeap () returned 0x630000 [0055.512] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0055.512] GetProcessHeap () returned 0x630000 [0055.512] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0055.512] GetProcessHeap () returned 0x630000 [0055.512] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.512] GetProcessHeap () returned 0x630000 [0055.512] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.512] GetProcessHeap () returned 0x630000 [0055.512] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.512] GetProcessHeap () returned 0x630000 [0055.512] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.512] GetProcessHeap () returned 0x630000 [0055.512] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.512] GetProcessHeap () returned 0x630000 [0055.512] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.513] GetProcessHeap () returned 0x630000 [0055.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.513] GetProcessHeap () returned 0x630000 [0055.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.513] GetProcessHeap () returned 0x630000 [0055.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.513] GetProcessHeap () returned 0x630000 [0055.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.513] GetProcessHeap () returned 0x630000 [0055.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.513] GetProcessHeap () returned 0x630000 [0055.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.513] GetProcessHeap () returned 0x630000 [0055.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.513] GetProcessHeap () returned 0x630000 [0055.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.513] GetProcessHeap () returned 0x630000 [0055.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.513] GetProcessHeap () returned 0x630000 [0055.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.513] GetProcessHeap () returned 0x630000 [0055.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.513] GetProcessHeap () returned 0x630000 [0055.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.513] GetProcessHeap () returned 0x630000 [0055.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0055.513] GetProcessHeap () returned 0x630000 [0055.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.521] GetProcessHeap () returned 0x630000 [0055.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.521] GetProcessHeap () returned 0x630000 [0055.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.521] GetProcessHeap () returned 0x630000 [0055.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0055.521] GetProcessHeap () returned 0x630000 [0055.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.521] GetProcessHeap () returned 0x630000 [0055.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.521] GetProcessHeap () returned 0x630000 [0055.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.521] GetProcessHeap () returned 0x630000 [0055.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.521] GetProcessHeap () returned 0x630000 [0055.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.521] GetProcessHeap () returned 0x630000 [0055.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.521] GetProcessHeap () returned 0x630000 [0055.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.521] GetProcessHeap () returned 0x630000 [0055.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.521] GetProcessHeap () returned 0x630000 [0055.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.521] GetProcessHeap () returned 0x630000 [0055.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.521] GetProcessHeap () returned 0x630000 [0055.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.521] GetProcessHeap () returned 0x630000 [0055.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0055.521] GetProcessHeap () returned 0x630000 [0055.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0055.522] GetProcessHeap () returned 0x630000 [0055.522] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.522] GetProcessHeap () returned 0x630000 [0055.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.522] GetProcessHeap () returned 0x630000 [0055.522] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.522] GetProcessHeap () returned 0x630000 [0055.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.522] GetProcessHeap () returned 0x630000 [0055.522] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.522] GetProcessHeap () returned 0x630000 [0055.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.522] GetProcessHeap () returned 0x630000 [0055.522] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.522] GetProcessHeap () returned 0x630000 [0055.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.522] GetProcessHeap () returned 0x630000 [0055.522] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.522] GetProcessHeap () returned 0x630000 [0055.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.522] GetProcessHeap () returned 0x630000 [0055.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0055.522] GetProcessHeap () returned 0x630000 [0055.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0055.522] GetProcessHeap () returned 0x630000 [0055.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0055.522] GetProcessHeap () returned 0x630000 [0055.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0055.522] GetProcessHeap () returned 0x630000 [0055.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0055.522] GetProcessHeap () returned 0x630000 [0055.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0055.522] GetProcessHeap () returned 0x630000 [0055.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0055.522] GetProcessHeap () returned 0x630000 [0055.523] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e7c0 | out: hHeap=0x630000) returned 1 [0055.523] GetProcessHeap () returned 0x630000 [0055.523] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0055.523] GetProcessHeap () returned 0x630000 [0055.523] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.523] GetProcessHeap () returned 0x630000 [0055.523] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0055.523] WriteFile (in: hFile=0x230, lpBuffer=0x65af70*, nNumberOfBytesToWrite=0x381, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65af70*, lpNumberOfBytesWritten=0x243d864*=0x381, lpOverlapped=0x0) returned 1 [0055.530] GetProcessHeap () returned 0x630000 [0055.530] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65af70, Size=0x30) returned 0x65af70 [0055.530] GetProcessHeap () returned 0x630000 [0055.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0055.530] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.530] GetProcessHeap () returned 0x630000 [0055.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10270) returned 0x65ed80 [0055.532] ReadFile (in: hFile=0x230, lpBuffer=0x65ed80, nNumberOfBytesToRead=0x10270, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesRead=0x243d7e8*=0x10270, lpOverlapped=0x0) returned 1 [0055.549] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.549] WriteFile (in: hFile=0x230, lpBuffer=0x65ed80*, nNumberOfBytesToWrite=0x10270, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesWritten=0x243d7e4*=0x10270, lpOverlapped=0x0) returned 1 [0055.550] GetProcessHeap () returned 0x630000 [0055.550] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ed80 | out: hHeap=0x630000) returned 1 [0055.550] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.550] WriteFile (in: hFile=0x230, lpBuffer=0x65af70*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65af70*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0055.551] CloseHandle (hObject=0x230) returned 1 [0055.554] GetProcessHeap () returned 0x630000 [0055.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0055.554] GetProcessHeap () returned 0x630000 [0055.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655760 | out: hHeap=0x630000) returned 1 [0055.554] GetProcessHeap () returned 0x630000 [0055.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0055.554] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm" [0055.554] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm.happythreechoose" [0055.554] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sl-si.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sl-si.htm.happythreechoose"), dwFlags=0x1) returned 1 [0055.555] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0055.555] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0055.555] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" [0055.555] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\decryption info.html")) returned 0x20 [0055.555] GetProcessHeap () returned 0x630000 [0055.555] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0055.555] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5e364e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5e364e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x12720, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_sr-latn-cs.htm", cAlternateFileName="EULA_S~3.HTM")) returned 1 [0055.555] lstrcmpiW (lpString1="EULA_sr-latn-cs.htm", lpString2=".") returned 1 [0055.555] lstrcmpiW (lpString1="EULA_sr-latn-cs.htm", lpString2="..") returned 1 [0055.555] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_sr-latn-cs.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm" [0055.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_sr-latn-cs.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0055.555] GetProcessHeap () returned 0x630000 [0055.555] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x645e78 [0055.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_sr-latn-cs.htm", cchWideChar=-1, lpMultiByteStr=0x645e78, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_sr-latn-cs.htm", lpUsedDefaultChar=0x0) returned 20 [0055.555] lstrlenA (lpString="EULA_sr-latn-cs.htm") returned 19 [0055.555] lstrlenA (lpString=".happythreechoose") returned 17 [0055.555] lstrlenA (lpString=".happythreechoose") returned 17 [0055.555] lstrlenA (lpString="EULA_sr-latn-cs.htm") returned 19 [0055.555] lstrcmpiA (lpString1="LA_sr-latn-cs.htm", lpString2=".happythreechoose") returned 1 [0055.555] lstrcmpiW (lpString1="EULA_sr-latn-cs.htm", lpString2="Decryption INFO.html") returned 1 [0055.555] lstrcmpiW (lpString1="EULA_sr-latn-cs.htm", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0055.555] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0055.555] lstrcmpiW (lpString1="EULA_sr-latn-cs.htm", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0055.555] GetProcessHeap () returned 0x630000 [0055.555] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0055.555] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sr-latn-cs.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0055.558] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=75552) returned 1 [0055.559] GetProcessHeap () returned 0x630000 [0055.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655850 [0055.559] GetProcessHeap () returned 0x630000 [0055.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0055.559] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm") returned 57 [0055.559] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.559] GetProcessHeap () returned 0x630000 [0055.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0055.559] GetProcessHeap () returned 0x630000 [0055.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x65afa8 [0055.559] lstrlenA (lpString="rsa_encrypt") returned 11 [0055.559] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0055.559] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0055.559] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0055.559] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0055.560] GetProcessHeap () returned 0x630000 [0055.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0055.560] lstrlenA (lpString="010001") returned 6 [0055.560] GetProcessHeap () returned 0x630000 [0055.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0055.560] GetProcessHeap () returned 0x630000 [0055.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0055.560] GetProcessHeap () returned 0x630000 [0055.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dfe0 [0055.560] GetProcessHeap () returned 0x630000 [0055.560] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0055.560] GetProcessHeap () returned 0x630000 [0055.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e730 [0055.560] GetProcessHeap () returned 0x630000 [0055.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656a68 [0055.560] GetProcessHeap () returned 0x630000 [0055.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a398 [0055.560] GetProcessHeap () returned 0x630000 [0055.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0055.560] GetProcessHeap () returned 0x630000 [0055.560] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.560] GetProcessHeap () returned 0x630000 [0055.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0055.560] GetProcessHeap () returned 0x630000 [0055.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0055.560] GetProcessHeap () returned 0x630000 [0055.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656b80 [0055.560] GetProcessHeap () returned 0x630000 [0055.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.560] GetProcessHeap () returned 0x630000 [0055.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0055.560] GetProcessHeap () returned 0x630000 [0055.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e970 [0055.560] GetProcessHeap () returned 0x630000 [0055.560] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0055.560] GetProcessHeap () returned 0x630000 [0055.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0055.560] GetProcessHeap () returned 0x630000 [0055.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0055.561] GetProcessHeap () returned 0x630000 [0055.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.561] GetProcessHeap () returned 0x630000 [0055.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0055.561] GetProcessHeap () returned 0x630000 [0055.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.561] GetProcessHeap () returned 0x630000 [0055.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.561] GetProcessHeap () returned 0x630000 [0055.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.561] GetProcessHeap () returned 0x630000 [0055.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.561] GetProcessHeap () returned 0x630000 [0055.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e070 [0055.561] GetProcessHeap () returned 0x630000 [0055.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0055.561] GetProcessHeap () returned 0x630000 [0055.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0055.561] GetProcessHeap () returned 0x630000 [0055.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0055.561] GetProcessHeap () returned 0x630000 [0055.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.561] GetProcessHeap () returned 0x630000 [0055.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.561] GetProcessHeap () returned 0x630000 [0055.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.561] GetProcessHeap () returned 0x630000 [0055.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.561] GetProcessHeap () returned 0x630000 [0055.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.561] GetProcessHeap () returned 0x630000 [0055.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.561] GetProcessHeap () returned 0x630000 [0055.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.561] GetProcessHeap () returned 0x630000 [0055.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.561] GetProcessHeap () returned 0x630000 [0055.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.561] GetProcessHeap () returned 0x630000 [0055.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.562] GetProcessHeap () returned 0x630000 [0055.562] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.562] GetProcessHeap () returned 0x630000 [0055.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.562] GetProcessHeap () returned 0x630000 [0055.562] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.562] GetProcessHeap () returned 0x630000 [0055.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.562] GetProcessHeap () returned 0x630000 [0055.562] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.562] GetProcessHeap () returned 0x630000 [0055.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.562] GetProcessHeap () returned 0x630000 [0055.562] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.562] GetProcessHeap () returned 0x630000 [0055.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.562] GetProcessHeap () returned 0x630000 [0055.562] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.562] GetProcessHeap () returned 0x630000 [0055.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.562] GetProcessHeap () returned 0x630000 [0055.562] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.562] GetProcessHeap () returned 0x630000 [0055.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.562] GetProcessHeap () returned 0x630000 [0055.562] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.563] GetProcessHeap () returned 0x630000 [0055.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.563] GetProcessHeap () returned 0x630000 [0055.563] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.563] GetProcessHeap () returned 0x630000 [0055.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.563] GetProcessHeap () returned 0x630000 [0055.563] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.563] GetProcessHeap () returned 0x630000 [0055.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.563] GetProcessHeap () returned 0x630000 [0055.563] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.563] GetProcessHeap () returned 0x630000 [0055.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.563] GetProcessHeap () returned 0x630000 [0055.563] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.563] GetProcessHeap () returned 0x630000 [0055.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.563] GetProcessHeap () returned 0x630000 [0055.563] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.563] GetProcessHeap () returned 0x630000 [0055.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.563] GetProcessHeap () returned 0x630000 [0055.563] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.563] GetProcessHeap () returned 0x630000 [0055.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.563] GetProcessHeap () returned 0x630000 [0055.563] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0055.563] GetProcessHeap () returned 0x630000 [0055.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0055.563] GetProcessHeap () returned 0x630000 [0055.563] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.563] GetProcessHeap () returned 0x630000 [0055.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.563] GetProcessHeap () returned 0x630000 [0055.563] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.563] GetProcessHeap () returned 0x630000 [0055.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.564] GetProcessHeap () returned 0x630000 [0055.564] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.564] GetProcessHeap () returned 0x630000 [0055.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.564] GetProcessHeap () returned 0x630000 [0055.564] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.564] GetProcessHeap () returned 0x630000 [0055.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.564] GetProcessHeap () returned 0x630000 [0055.564] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0055.564] GetProcessHeap () returned 0x630000 [0055.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.564] GetProcessHeap () returned 0x630000 [0055.564] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.564] GetProcessHeap () returned 0x630000 [0055.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.564] GetProcessHeap () returned 0x630000 [0055.564] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.564] GetProcessHeap () returned 0x630000 [0055.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.564] GetProcessHeap () returned 0x630000 [0055.564] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.564] GetProcessHeap () returned 0x630000 [0055.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.564] GetProcessHeap () returned 0x630000 [0055.564] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.564] GetProcessHeap () returned 0x630000 [0055.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.564] GetProcessHeap () returned 0x630000 [0055.564] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.564] GetProcessHeap () returned 0x630000 [0055.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.564] GetProcessHeap () returned 0x630000 [0055.564] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.564] GetProcessHeap () returned 0x630000 [0055.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.564] GetProcessHeap () returned 0x630000 [0055.564] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.565] GetProcessHeap () returned 0x630000 [0055.565] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.565] GetProcessHeap () returned 0x630000 [0055.565] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.565] GetProcessHeap () returned 0x630000 [0055.565] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.565] GetProcessHeap () returned 0x630000 [0055.565] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.565] GetProcessHeap () returned 0x630000 [0055.565] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.565] GetProcessHeap () returned 0x630000 [0055.565] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0055.565] GetProcessHeap () returned 0x630000 [0055.565] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0055.565] GetProcessHeap () returned 0x630000 [0055.565] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.565] GetProcessHeap () returned 0x630000 [0055.565] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.565] GetProcessHeap () returned 0x630000 [0055.565] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.565] GetProcessHeap () returned 0x630000 [0055.565] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.565] GetProcessHeap () returned 0x630000 [0055.565] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0055.565] GetProcessHeap () returned 0x630000 [0055.565] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.565] GetProcessHeap () returned 0x630000 [0055.565] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.565] GetProcessHeap () returned 0x630000 [0055.565] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.565] GetProcessHeap () returned 0x630000 [0055.565] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0055.565] GetProcessHeap () returned 0x630000 [0055.565] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.565] GetProcessHeap () returned 0x630000 [0055.565] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0055.565] GetProcessHeap () returned 0x630000 [0055.565] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0055.566] GetProcessHeap () returned 0x630000 [0055.566] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0055.566] GetProcessHeap () returned 0x630000 [0055.566] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.566] GetProcessHeap () returned 0x630000 [0055.566] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0055.566] GetProcessHeap () returned 0x630000 [0055.566] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0055.566] GetProcessHeap () returned 0x630000 [0055.566] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0055.566] GetProcessHeap () returned 0x630000 [0055.566] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0055.566] GetProcessHeap () returned 0x630000 [0055.566] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0055.566] GetProcessHeap () returned 0x630000 [0055.566] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0055.566] GetProcessHeap () returned 0x630000 [0055.566] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0055.566] GetProcessHeap () returned 0x630000 [0055.566] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0055.566] GetProcessHeap () returned 0x630000 [0055.566] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0055.566] GetProcessHeap () returned 0x630000 [0055.566] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.566] GetProcessHeap () returned 0x630000 [0055.566] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0055.566] WriteFile (in: hFile=0x230, lpBuffer=0x65afa8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65afa8*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0055.571] GetProcessHeap () returned 0x630000 [0055.571] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65afa8, Size=0x30) returned 0x65afa8 [0055.571] GetProcessHeap () returned 0x630000 [0055.571] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0055.571] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.571] GetProcessHeap () returned 0x630000 [0055.571] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12720) returned 0x65ed80 [0055.572] ReadFile (in: hFile=0x230, lpBuffer=0x65ed80, nNumberOfBytesToRead=0x12720, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesRead=0x243d7e8*=0x12720, lpOverlapped=0x0) returned 1 [0055.573] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.573] WriteFile (in: hFile=0x230, lpBuffer=0x65ed80*, nNumberOfBytesToWrite=0x12720, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesWritten=0x243d7e4*=0x12720, lpOverlapped=0x0) returned 1 [0055.574] GetProcessHeap () returned 0x630000 [0055.574] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ed80 | out: hHeap=0x630000) returned 1 [0055.575] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.575] WriteFile (in: hFile=0x230, lpBuffer=0x65afa8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65afa8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0055.576] CloseHandle (hObject=0x230) returned 1 [0055.579] GetProcessHeap () returned 0x630000 [0055.579] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0055.579] GetProcessHeap () returned 0x630000 [0055.579] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655850 | out: hHeap=0x630000) returned 1 [0055.579] GetProcessHeap () returned 0x630000 [0055.579] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0055.579] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm" [0055.579] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm.happythreechoose" [0055.579] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sr-latn-cs.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sr-latn-cs.htm.happythreechoose"), dwFlags=0x1) returned 1 [0055.580] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0055.580] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0055.580] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" [0055.580] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\decryption info.html")) returned 0x20 [0055.580] GetProcessHeap () returned 0x630000 [0055.580] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645e78 | out: hHeap=0x630000) returned 1 [0055.580] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5e364e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5e364e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x112f7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_sv-se.htm", cAlternateFileName="EULA_S~4.HTM")) returned 1 [0055.580] lstrcmpiW (lpString1="EULA_sv-se.htm", lpString2=".") returned 1 [0055.580] lstrcmpiW (lpString1="EULA_sv-se.htm", lpString2="..") returned 1 [0055.580] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_sv-se.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm" [0055.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_sv-se.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0055.580] GetProcessHeap () returned 0x630000 [0055.580] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0055.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_sv-se.htm", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_sv-se.htm", lpUsedDefaultChar=0x0) returned 15 [0055.580] lstrlenA (lpString="EULA_sv-se.htm") returned 14 [0055.580] lstrlenA (lpString=".happythreechoose") returned 17 [0055.580] lstrcmpiW (lpString1="EULA_sv-se.htm", lpString2="Decryption INFO.html") returned 1 [0055.580] lstrcmpiW (lpString1="EULA_sv-se.htm", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0055.580] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0055.580] lstrcmpiW (lpString1="EULA_sv-se.htm", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0055.580] GetProcessHeap () returned 0x630000 [0055.580] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0055.580] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sv-se.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0055.581] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=70391) returned 1 [0055.581] GetProcessHeap () returned 0x630000 [0055.581] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655670 [0055.581] GetProcessHeap () returned 0x630000 [0055.581] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0055.581] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm") returned 52 [0055.581] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.581] GetProcessHeap () returned 0x630000 [0055.581] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0055.581] GetProcessHeap () returned 0x630000 [0055.581] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x389) returned 0x65afe0 [0055.581] lstrlenA (lpString="rsa_encrypt") returned 11 [0055.581] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0055.582] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0055.582] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0055.582] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0055.582] GetProcessHeap () returned 0x630000 [0055.582] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0055.582] lstrlenA (lpString="010001") returned 6 [0055.582] GetProcessHeap () returned 0x630000 [0055.582] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a368 [0055.582] GetProcessHeap () returned 0x630000 [0055.582] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x65b378 [0055.582] GetProcessHeap () returned 0x630000 [0055.582] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0055.582] GetProcessHeap () returned 0x630000 [0055.582] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b378 | out: hHeap=0x630000) returned 1 [0055.582] GetProcessHeap () returned 0x630000 [0055.582] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ec40 [0055.582] GetProcessHeap () returned 0x630000 [0055.582] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656c98 [0055.582] GetProcessHeap () returned 0x630000 [0055.582] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a298 [0055.582] GetProcessHeap () returned 0x630000 [0055.582] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0055.582] GetProcessHeap () returned 0x630000 [0055.582] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.582] GetProcessHeap () returned 0x630000 [0055.582] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0055.582] GetProcessHeap () returned 0x630000 [0055.582] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x65b378 [0055.582] GetProcessHeap () returned 0x630000 [0055.582] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657788 [0055.582] GetProcessHeap () returned 0x630000 [0055.582] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.582] GetProcessHeap () returned 0x630000 [0055.582] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0055.582] GetProcessHeap () returned 0x630000 [0055.582] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e190 [0055.583] GetProcessHeap () returned 0x630000 [0055.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b378 | out: hHeap=0x630000) returned 1 [0055.583] GetProcessHeap () returned 0x630000 [0055.583] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0055.583] GetProcessHeap () returned 0x630000 [0055.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0055.583] GetProcessHeap () returned 0x630000 [0055.583] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.583] GetProcessHeap () returned 0x630000 [0055.583] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x655c58 [0055.583] GetProcessHeap () returned 0x630000 [0055.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.583] GetProcessHeap () returned 0x630000 [0055.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.583] GetProcessHeap () returned 0x630000 [0055.583] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0055.583] GetProcessHeap () returned 0x630000 [0055.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.583] GetProcessHeap () returned 0x630000 [0055.583] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e8e0 [0055.583] GetProcessHeap () returned 0x630000 [0055.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655c58 | out: hHeap=0x630000) returned 1 [0055.583] GetProcessHeap () returned 0x630000 [0055.583] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0055.583] GetProcessHeap () returned 0x630000 [0055.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0055.583] GetProcessHeap () returned 0x630000 [0055.583] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.583] GetProcessHeap () returned 0x630000 [0055.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.583] GetProcessHeap () returned 0x630000 [0055.583] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.583] GetProcessHeap () returned 0x630000 [0055.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.583] GetProcessHeap () returned 0x630000 [0055.583] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0055.583] GetProcessHeap () returned 0x630000 [0055.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.583] GetProcessHeap () returned 0x630000 [0055.584] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.584] GetProcessHeap () returned 0x630000 [0055.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.584] GetProcessHeap () returned 0x630000 [0055.584] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.584] GetProcessHeap () returned 0x630000 [0055.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.584] GetProcessHeap () returned 0x630000 [0055.584] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.584] GetProcessHeap () returned 0x630000 [0055.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.584] GetProcessHeap () returned 0x630000 [0055.584] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.584] GetProcessHeap () returned 0x630000 [0055.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.584] GetProcessHeap () returned 0x630000 [0055.584] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.584] GetProcessHeap () returned 0x630000 [0055.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.584] GetProcessHeap () returned 0x630000 [0055.584] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0055.584] GetProcessHeap () returned 0x630000 [0055.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0055.584] GetProcessHeap () returned 0x630000 [0055.584] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.584] GetProcessHeap () returned 0x630000 [0055.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.584] GetProcessHeap () returned 0x630000 [0055.584] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.584] GetProcessHeap () returned 0x630000 [0055.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.584] GetProcessHeap () returned 0x630000 [0055.584] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.584] GetProcessHeap () returned 0x630000 [0055.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.584] GetProcessHeap () returned 0x630000 [0055.584] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.584] GetProcessHeap () returned 0x630000 [0055.585] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.585] GetProcessHeap () returned 0x630000 [0055.585] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0055.585] GetProcessHeap () returned 0x630000 [0055.585] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0055.585] GetProcessHeap () returned 0x630000 [0055.585] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.585] GetProcessHeap () returned 0x630000 [0055.585] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.585] GetProcessHeap () returned 0x630000 [0055.585] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0055.585] GetProcessHeap () returned 0x630000 [0055.585] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.585] GetProcessHeap () returned 0x630000 [0055.585] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0055.585] GetProcessHeap () returned 0x630000 [0055.585] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.585] GetProcessHeap () returned 0x630000 [0055.585] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.585] GetProcessHeap () returned 0x630000 [0055.585] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.585] GetProcessHeap () returned 0x630000 [0055.585] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.585] GetProcessHeap () returned 0x630000 [0055.585] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.585] GetProcessHeap () returned 0x630000 [0055.585] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.585] GetProcessHeap () returned 0x630000 [0055.585] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.585] GetProcessHeap () returned 0x630000 [0055.585] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.585] GetProcessHeap () returned 0x630000 [0055.585] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.585] GetProcessHeap () returned 0x630000 [0055.585] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.585] GetProcessHeap () returned 0x630000 [0055.586] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.586] GetProcessHeap () returned 0x630000 [0055.586] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.586] GetProcessHeap () returned 0x630000 [0055.586] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.586] GetProcessHeap () returned 0x630000 [0055.586] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.586] GetProcessHeap () returned 0x630000 [0055.586] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.586] GetProcessHeap () returned 0x630000 [0055.586] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.586] GetProcessHeap () returned 0x630000 [0055.586] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.586] GetProcessHeap () returned 0x630000 [0055.586] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.586] GetProcessHeap () returned 0x630000 [0055.586] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.586] GetProcessHeap () returned 0x630000 [0055.586] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.586] GetProcessHeap () returned 0x630000 [0055.586] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.586] GetProcessHeap () returned 0x630000 [0055.586] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.586] GetProcessHeap () returned 0x630000 [0055.586] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.586] GetProcessHeap () returned 0x630000 [0055.586] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0055.586] GetProcessHeap () returned 0x630000 [0055.586] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.586] GetProcessHeap () returned 0x630000 [0055.586] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.586] GetProcessHeap () returned 0x630000 [0055.586] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.586] GetProcessHeap () returned 0x630000 [0055.586] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0055.586] GetProcessHeap () returned 0x630000 [0055.587] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0055.587] GetProcessHeap () returned 0x630000 [0055.587] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.587] GetProcessHeap () returned 0x630000 [0055.587] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.587] GetProcessHeap () returned 0x630000 [0055.587] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0055.587] GetProcessHeap () returned 0x630000 [0055.587] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.587] GetProcessHeap () returned 0x630000 [0055.587] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.587] GetProcessHeap () returned 0x630000 [0055.587] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.587] GetProcessHeap () returned 0x630000 [0055.587] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.587] GetProcessHeap () returned 0x630000 [0055.587] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.587] GetProcessHeap () returned 0x630000 [0055.587] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.587] GetProcessHeap () returned 0x630000 [0055.587] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.587] GetProcessHeap () returned 0x630000 [0055.587] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.587] GetProcessHeap () returned 0x630000 [0055.587] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.587] GetProcessHeap () returned 0x630000 [0055.587] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.587] GetProcessHeap () returned 0x630000 [0055.587] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.587] GetProcessHeap () returned 0x630000 [0055.587] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.587] GetProcessHeap () returned 0x630000 [0055.587] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.587] GetProcessHeap () returned 0x630000 [0055.587] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.587] GetProcessHeap () returned 0x630000 [0055.587] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.588] GetProcessHeap () returned 0x630000 [0055.588] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.588] GetProcessHeap () returned 0x630000 [0055.588] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.588] GetProcessHeap () returned 0x630000 [0055.588] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0055.588] GetProcessHeap () returned 0x630000 [0055.588] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0055.588] GetProcessHeap () returned 0x630000 [0055.588] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0055.588] GetProcessHeap () returned 0x630000 [0055.588] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0055.588] GetProcessHeap () returned 0x630000 [0055.588] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0055.588] GetProcessHeap () returned 0x630000 [0055.588] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ec40 | out: hHeap=0x630000) returned 1 [0055.588] GetProcessHeap () returned 0x630000 [0055.588] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0055.588] GetProcessHeap () returned 0x630000 [0055.588] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0055.588] GetProcessHeap () returned 0x630000 [0055.588] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0055.588] GetProcessHeap () returned 0x630000 [0055.588] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.588] GetProcessHeap () returned 0x630000 [0055.588] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0055.588] WriteFile (in: hFile=0x230, lpBuffer=0x65afe0*, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65afe0*, lpNumberOfBytesWritten=0x243d864*=0x389, lpOverlapped=0x0) returned 1 [0055.591] GetProcessHeap () returned 0x630000 [0055.591] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65afe0, Size=0x30) returned 0x65afe0 [0055.591] GetProcessHeap () returned 0x630000 [0055.592] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0055.592] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.592] GetProcessHeap () returned 0x630000 [0055.592] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11300) returned 0x65ed80 [0055.594] ReadFile (in: hFile=0x230, lpBuffer=0x65ed80, nNumberOfBytesToRead=0x11300, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesRead=0x243d7e8*=0x11300, lpOverlapped=0x0) returned 1 [0055.595] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.595] WriteFile (in: hFile=0x230, lpBuffer=0x65ed80*, nNumberOfBytesToWrite=0x11300, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesWritten=0x243d7e4*=0x11300, lpOverlapped=0x0) returned 1 [0055.597] GetProcessHeap () returned 0x630000 [0055.597] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ed80 | out: hHeap=0x630000) returned 1 [0055.597] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.597] WriteFile (in: hFile=0x230, lpBuffer=0x65afe0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65afe0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0055.598] CloseHandle (hObject=0x230) returned 1 [0055.601] GetProcessHeap () returned 0x630000 [0055.601] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0055.601] GetProcessHeap () returned 0x630000 [0055.601] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655670 | out: hHeap=0x630000) returned 1 [0055.601] GetProcessHeap () returned 0x630000 [0055.601] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0055.601] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm" [0055.601] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm.happythreechoose" [0055.601] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sv-se.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sv-se.htm.happythreechoose"), dwFlags=0x1) returned 1 [0055.601] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0055.602] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0055.602] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" [0055.602] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\decryption info.html")) returned 0x20 [0055.602] GetProcessHeap () returned 0x630000 [0055.602] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0055.602] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5e364e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5e364e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x3e0c1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_th-th.htm", cAlternateFileName="EULA_T~1.HTM")) returned 1 [0055.602] lstrcmpiW (lpString1="EULA_th-th.htm", lpString2=".") returned 1 [0055.602] lstrcmpiW (lpString1="EULA_th-th.htm", lpString2="..") returned 1 [0055.602] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_th-th.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm" [0055.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_th-th.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0055.602] GetProcessHeap () returned 0x630000 [0055.602] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0055.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_th-th.htm", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_th-th.htm", lpUsedDefaultChar=0x0) returned 15 [0055.602] lstrlenA (lpString="EULA_th-th.htm") returned 14 [0055.602] lstrlenA (lpString=".happythreechoose") returned 17 [0055.602] lstrcmpiW (lpString1="EULA_th-th.htm", lpString2="Decryption INFO.html") returned 1 [0055.602] lstrcmpiW (lpString1="EULA_th-th.htm", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0055.602] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0055.602] lstrcmpiW (lpString1="EULA_th-th.htm", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0055.602] GetProcessHeap () returned 0x630000 [0055.602] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651ec0 [0055.602] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_th-th.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0055.602] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=254145) returned 1 [0055.603] GetProcessHeap () returned 0x630000 [0055.603] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655a30 [0055.603] GetProcessHeap () returned 0x630000 [0055.603] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0055.603] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm") returned 52 [0055.603] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.603] GetProcessHeap () returned 0x630000 [0055.603] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0055.603] GetProcessHeap () returned 0x630000 [0055.603] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x65b018 [0055.603] lstrlenA (lpString="rsa_encrypt") returned 11 [0055.603] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x65b3a0) returned 1 [0055.603] CryptGenRandom (in: hProv=0x65b3a0, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0055.603] CryptReleaseContext (hProv=0x65b3a0, dwFlags=0x0) returned 1 [0055.603] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0055.604] GetProcessHeap () returned 0x630000 [0055.604] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x65b3a0 [0055.604] lstrlenA (lpString="010001") returned 6 [0055.604] GetProcessHeap () returned 0x630000 [0055.604] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0055.604] GetProcessHeap () returned 0x630000 [0055.604] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0055.604] GetProcessHeap () returned 0x630000 [0055.604] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0055.604] GetProcessHeap () returned 0x630000 [0055.604] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0055.604] GetProcessHeap () returned 0x630000 [0055.604] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dec0 [0055.604] GetProcessHeap () returned 0x630000 [0055.604] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656ec8 [0055.604] GetProcessHeap () returned 0x630000 [0055.604] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3c8 [0055.604] GetProcessHeap () returned 0x630000 [0055.604] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0055.604] GetProcessHeap () returned 0x630000 [0055.604] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0055.604] GetProcessHeap () returned 0x630000 [0055.604] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0055.604] GetProcessHeap () returned 0x630000 [0055.604] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0055.604] GetProcessHeap () returned 0x630000 [0055.604] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657670 [0055.604] GetProcessHeap () returned 0x630000 [0055.604] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.604] GetProcessHeap () returned 0x630000 [0055.604] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0055.604] GetProcessHeap () returned 0x630000 [0055.604] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e100 [0055.604] GetProcessHeap () returned 0x630000 [0055.604] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0055.604] GetProcessHeap () returned 0x630000 [0055.604] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0055.605] GetProcessHeap () returned 0x630000 [0055.605] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0055.605] GetProcessHeap () returned 0x630000 [0055.605] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.605] GetProcessHeap () returned 0x630000 [0055.605] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x655e20 [0055.605] GetProcessHeap () returned 0x630000 [0055.605] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.605] GetProcessHeap () returned 0x630000 [0055.605] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.605] GetProcessHeap () returned 0x630000 [0055.605] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.605] GetProcessHeap () returned 0x630000 [0055.605] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.605] GetProcessHeap () returned 0x630000 [0055.605] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e850 [0055.605] GetProcessHeap () returned 0x630000 [0055.605] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655e20 | out: hHeap=0x630000) returned 1 [0055.605] GetProcessHeap () returned 0x630000 [0055.605] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0055.605] GetProcessHeap () returned 0x630000 [0055.605] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0055.605] GetProcessHeap () returned 0x630000 [0055.605] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.605] GetProcessHeap () returned 0x630000 [0055.605] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.605] GetProcessHeap () returned 0x630000 [0055.605] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.605] GetProcessHeap () returned 0x630000 [0055.605] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.605] GetProcessHeap () returned 0x630000 [0055.605] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.605] GetProcessHeap () returned 0x630000 [0055.605] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.605] GetProcessHeap () returned 0x630000 [0055.605] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0055.605] GetProcessHeap () returned 0x630000 [0055.605] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0055.605] GetProcessHeap () returned 0x630000 [0055.605] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.606] GetProcessHeap () returned 0x630000 [0055.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.606] GetProcessHeap () returned 0x630000 [0055.606] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.606] GetProcessHeap () returned 0x630000 [0055.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.606] GetProcessHeap () returned 0x630000 [0055.606] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.606] GetProcessHeap () returned 0x630000 [0055.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.606] GetProcessHeap () returned 0x630000 [0055.606] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.606] GetProcessHeap () returned 0x630000 [0055.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.606] GetProcessHeap () returned 0x630000 [0055.606] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.606] GetProcessHeap () returned 0x630000 [0055.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.606] GetProcessHeap () returned 0x630000 [0055.606] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.606] GetProcessHeap () returned 0x630000 [0055.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.606] GetProcessHeap () returned 0x630000 [0055.606] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.606] GetProcessHeap () returned 0x630000 [0055.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.606] GetProcessHeap () returned 0x630000 [0055.606] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.606] GetProcessHeap () returned 0x630000 [0055.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.606] GetProcessHeap () returned 0x630000 [0055.606] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.606] GetProcessHeap () returned 0x630000 [0055.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.606] GetProcessHeap () returned 0x630000 [0055.606] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.606] GetProcessHeap () returned 0x630000 [0055.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.607] GetProcessHeap () returned 0x630000 [0055.607] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.607] GetProcessHeap () returned 0x630000 [0055.607] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.607] GetProcessHeap () returned 0x630000 [0055.607] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.607] GetProcessHeap () returned 0x630000 [0055.607] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.607] GetProcessHeap () returned 0x630000 [0055.607] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0055.607] GetProcessHeap () returned 0x630000 [0055.607] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0055.607] GetProcessHeap () returned 0x630000 [0055.607] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.607] GetProcessHeap () returned 0x630000 [0055.607] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.607] GetProcessHeap () returned 0x630000 [0055.607] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.607] GetProcessHeap () returned 0x630000 [0055.607] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.607] GetProcessHeap () returned 0x630000 [0055.607] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.607] GetProcessHeap () returned 0x630000 [0055.607] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.607] GetProcessHeap () returned 0x630000 [0055.607] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.607] GetProcessHeap () returned 0x630000 [0055.607] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.607] GetProcessHeap () returned 0x630000 [0055.607] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.607] GetProcessHeap () returned 0x630000 [0055.607] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.607] GetProcessHeap () returned 0x630000 [0055.607] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0055.607] GetProcessHeap () returned 0x630000 [0055.607] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0055.607] GetProcessHeap () returned 0x630000 [0055.607] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.608] GetProcessHeap () returned 0x630000 [0055.608] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.608] GetProcessHeap () returned 0x630000 [0055.608] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.608] GetProcessHeap () returned 0x630000 [0055.608] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.608] GetProcessHeap () returned 0x630000 [0055.608] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.608] GetProcessHeap () returned 0x630000 [0055.608] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.608] GetProcessHeap () returned 0x630000 [0055.608] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0055.608] GetProcessHeap () returned 0x630000 [0055.608] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.608] GetProcessHeap () returned 0x630000 [0055.608] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0055.608] GetProcessHeap () returned 0x630000 [0055.608] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0055.608] GetProcessHeap () returned 0x630000 [0055.608] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0055.608] GetProcessHeap () returned 0x630000 [0055.608] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0055.608] GetProcessHeap () returned 0x630000 [0055.608] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.608] GetProcessHeap () returned 0x630000 [0055.608] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.608] GetProcessHeap () returned 0x630000 [0055.608] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.608] GetProcessHeap () returned 0x630000 [0055.608] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.608] GetProcessHeap () returned 0x630000 [0055.608] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.608] GetProcessHeap () returned 0x630000 [0055.608] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.608] GetProcessHeap () returned 0x630000 [0055.608] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.608] GetProcessHeap () returned 0x630000 [0055.608] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.608] GetProcessHeap () returned 0x630000 [0055.608] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.609] GetProcessHeap () returned 0x630000 [0055.609] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.609] GetProcessHeap () returned 0x630000 [0055.609] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.609] GetProcessHeap () returned 0x630000 [0055.609] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.609] GetProcessHeap () returned 0x630000 [0055.609] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.609] GetProcessHeap () returned 0x630000 [0055.609] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.609] GetProcessHeap () returned 0x630000 [0055.609] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.609] GetProcessHeap () returned 0x630000 [0055.609] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.609] GetProcessHeap () returned 0x630000 [0055.609] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.609] GetProcessHeap () returned 0x630000 [0055.609] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.609] GetProcessHeap () returned 0x630000 [0055.609] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.609] GetProcessHeap () returned 0x630000 [0055.609] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.609] GetProcessHeap () returned 0x630000 [0055.609] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.609] GetProcessHeap () returned 0x630000 [0055.609] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.609] GetProcessHeap () returned 0x630000 [0055.609] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.609] GetProcessHeap () returned 0x630000 [0055.609] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.609] GetProcessHeap () returned 0x630000 [0055.609] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0055.609] GetProcessHeap () returned 0x630000 [0055.609] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0055.609] GetProcessHeap () returned 0x630000 [0055.609] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0055.610] GetProcessHeap () returned 0x630000 [0055.610] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0055.610] GetProcessHeap () returned 0x630000 [0055.610] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0055.610] GetProcessHeap () returned 0x630000 [0055.610] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0055.610] GetProcessHeap () returned 0x630000 [0055.610] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0055.610] GetProcessHeap () returned 0x630000 [0055.610] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0055.610] GetProcessHeap () returned 0x630000 [0055.610] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0055.610] GetProcessHeap () returned 0x630000 [0055.610] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.610] GetProcessHeap () returned 0x630000 [0055.610] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b3a0 | out: hHeap=0x630000) returned 1 [0055.610] WriteFile (in: hFile=0x230, lpBuffer=0x65b018*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65b018*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0055.614] GetProcessHeap () returned 0x630000 [0055.614] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65b018, Size=0x30) returned 0x65b018 [0055.614] GetProcessHeap () returned 0x630000 [0055.614] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0055.614] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.614] GetProcessHeap () returned 0x630000 [0055.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3e0c1) returned 0x65ed80 [0055.617] ReadFile (in: hFile=0x230, lpBuffer=0x65ed80, nNumberOfBytesToRead=0x3e0c1, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesRead=0x243d7e8*=0x3e0c1, lpOverlapped=0x0) returned 1 [0055.620] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.620] WriteFile (in: hFile=0x230, lpBuffer=0x65ed80*, nNumberOfBytesToWrite=0x3e0c1, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesWritten=0x243d7e4*=0x3e0c1, lpOverlapped=0x0) returned 1 [0055.623] GetProcessHeap () returned 0x630000 [0055.623] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ed80 | out: hHeap=0x630000) returned 1 [0055.625] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.625] WriteFile (in: hFile=0x230, lpBuffer=0x65b018*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65b018*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0055.626] CloseHandle (hObject=0x230) returned 1 [0055.631] GetProcessHeap () returned 0x630000 [0055.631] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651ec0 | out: hHeap=0x630000) returned 1 [0055.631] GetProcessHeap () returned 0x630000 [0055.631] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655a30 | out: hHeap=0x630000) returned 1 [0055.631] GetProcessHeap () returned 0x630000 [0055.631] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0055.631] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm" [0055.631] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm.happythreechoose" [0055.632] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_th-th.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_th-th.htm.happythreechoose"), dwFlags=0x1) returned 1 [0055.632] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0055.632] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0055.632] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" [0055.632] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\decryption info.html")) returned 0x20 [0055.632] GetProcessHeap () returned 0x630000 [0055.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0055.632] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5ed27d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5ed27d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x12581, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_tr-tr.htm", cAlternateFileName="EULA_T~2.HTM")) returned 1 [0055.632] lstrcmpiW (lpString1="EULA_tr-tr.htm", lpString2=".") returned 1 [0055.632] lstrcmpiW (lpString1="EULA_tr-tr.htm", lpString2="..") returned 1 [0055.632] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_tr-tr.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm" [0055.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_tr-tr.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0055.633] GetProcessHeap () returned 0x630000 [0055.633] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0055.633] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_tr-tr.htm", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_tr-tr.htm", lpUsedDefaultChar=0x0) returned 15 [0055.633] lstrlenA (lpString="EULA_tr-tr.htm") returned 14 [0055.633] lstrlenA (lpString=".happythreechoose") returned 17 [0055.633] lstrcmpiW (lpString1="EULA_tr-tr.htm", lpString2="Decryption INFO.html") returned 1 [0055.633] lstrcmpiW (lpString1="EULA_tr-tr.htm", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0055.633] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0055.633] lstrcmpiW (lpString1="EULA_tr-tr.htm", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0055.633] GetProcessHeap () returned 0x630000 [0055.633] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0055.633] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_tr-tr.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0055.633] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=75137) returned 1 [0055.633] GetProcessHeap () returned 0x630000 [0055.633] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655940 [0055.633] GetProcessHeap () returned 0x630000 [0055.633] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0055.633] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm") returned 52 [0055.633] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.633] GetProcessHeap () returned 0x630000 [0055.633] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0055.633] GetProcessHeap () returned 0x630000 [0055.634] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x65b050 [0055.634] lstrlenA (lpString="rsa_encrypt") returned 11 [0055.634] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0055.634] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0055.634] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0055.634] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0055.634] GetProcessHeap () returned 0x630000 [0055.634] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0055.634] lstrlenA (lpString="010001") returned 6 [0055.634] GetProcessHeap () returned 0x630000 [0055.634] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0055.634] GetProcessHeap () returned 0x630000 [0055.634] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0055.634] GetProcessHeap () returned 0x630000 [0055.634] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65df50 [0055.634] GetProcessHeap () returned 0x630000 [0055.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0055.635] GetProcessHeap () returned 0x630000 [0055.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e2b0 [0055.635] GetProcessHeap () returned 0x630000 [0055.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657440 [0055.635] GetProcessHeap () returned 0x630000 [0055.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0055.635] GetProcessHeap () returned 0x630000 [0055.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0055.635] GetProcessHeap () returned 0x630000 [0055.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.635] GetProcessHeap () returned 0x630000 [0055.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0055.635] GetProcessHeap () returned 0x630000 [0055.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0055.635] GetProcessHeap () returned 0x630000 [0055.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x6570f8 [0055.635] GetProcessHeap () returned 0x630000 [0055.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.635] GetProcessHeap () returned 0x630000 [0055.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0055.635] GetProcessHeap () returned 0x630000 [0055.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea00 [0055.635] GetProcessHeap () returned 0x630000 [0055.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0055.635] GetProcessHeap () returned 0x630000 [0055.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0055.635] GetProcessHeap () returned 0x630000 [0055.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0055.635] GetProcessHeap () returned 0x630000 [0055.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.635] GetProcessHeap () returned 0x630000 [0055.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x655e50 [0055.635] GetProcessHeap () returned 0x630000 [0055.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.635] GetProcessHeap () returned 0x630000 [0055.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.635] GetProcessHeap () returned 0x630000 [0055.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.635] GetProcessHeap () returned 0x630000 [0055.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.636] GetProcessHeap () returned 0x630000 [0055.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e340 [0055.636] GetProcessHeap () returned 0x630000 [0055.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655e50 | out: hHeap=0x630000) returned 1 [0055.636] GetProcessHeap () returned 0x630000 [0055.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0055.636] GetProcessHeap () returned 0x630000 [0055.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0055.636] GetProcessHeap () returned 0x630000 [0055.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.636] GetProcessHeap () returned 0x630000 [0055.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.636] GetProcessHeap () returned 0x630000 [0055.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0055.636] GetProcessHeap () returned 0x630000 [0055.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.636] GetProcessHeap () returned 0x630000 [0055.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0055.636] GetProcessHeap () returned 0x630000 [0055.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0055.636] GetProcessHeap () returned 0x630000 [0055.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.636] GetProcessHeap () returned 0x630000 [0055.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.636] GetProcessHeap () returned 0x630000 [0055.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0055.636] GetProcessHeap () returned 0x630000 [0055.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0055.636] GetProcessHeap () returned 0x630000 [0055.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.636] GetProcessHeap () returned 0x630000 [0055.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.636] GetProcessHeap () returned 0x630000 [0055.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.636] GetProcessHeap () returned 0x630000 [0055.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.637] GetProcessHeap () returned 0x630000 [0055.637] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.637] GetProcessHeap () returned 0x630000 [0055.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.637] GetProcessHeap () returned 0x630000 [0055.637] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.637] GetProcessHeap () returned 0x630000 [0055.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.637] GetProcessHeap () returned 0x630000 [0055.637] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.637] GetProcessHeap () returned 0x630000 [0055.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.637] GetProcessHeap () returned 0x630000 [0055.637] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.637] GetProcessHeap () returned 0x630000 [0055.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.637] GetProcessHeap () returned 0x630000 [0055.637] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.637] GetProcessHeap () returned 0x630000 [0055.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.637] GetProcessHeap () returned 0x630000 [0055.637] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0055.637] GetProcessHeap () returned 0x630000 [0055.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0055.637] GetProcessHeap () returned 0x630000 [0055.637] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0055.637] GetProcessHeap () returned 0x630000 [0055.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0055.637] GetProcessHeap () returned 0x630000 [0055.637] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.637] GetProcessHeap () returned 0x630000 [0055.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.637] GetProcessHeap () returned 0x630000 [0055.637] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.637] GetProcessHeap () returned 0x630000 [0055.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.637] GetProcessHeap () returned 0x630000 [0055.637] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.637] GetProcessHeap () returned 0x630000 [0055.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.638] GetProcessHeap () returned 0x630000 [0055.638] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.638] GetProcessHeap () returned 0x630000 [0055.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.638] GetProcessHeap () returned 0x630000 [0055.638] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0055.638] GetProcessHeap () returned 0x630000 [0055.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.638] GetProcessHeap () returned 0x630000 [0055.638] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.638] GetProcessHeap () returned 0x630000 [0055.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.638] GetProcessHeap () returned 0x630000 [0055.638] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.638] GetProcessHeap () returned 0x630000 [0055.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.638] GetProcessHeap () returned 0x630000 [0055.638] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.638] GetProcessHeap () returned 0x630000 [0055.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.638] GetProcessHeap () returned 0x630000 [0055.638] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.638] GetProcessHeap () returned 0x630000 [0055.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.638] GetProcessHeap () returned 0x630000 [0055.638] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.638] GetProcessHeap () returned 0x630000 [0055.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.638] GetProcessHeap () returned 0x630000 [0055.638] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.638] GetProcessHeap () returned 0x630000 [0055.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.638] GetProcessHeap () returned 0x630000 [0055.638] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.638] GetProcessHeap () returned 0x630000 [0055.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.638] GetProcessHeap () returned 0x630000 [0055.639] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.639] GetProcessHeap () returned 0x630000 [0055.639] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.639] GetProcessHeap () returned 0x630000 [0055.639] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.639] GetProcessHeap () returned 0x630000 [0055.639] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.639] GetProcessHeap () returned 0x630000 [0055.639] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.639] GetProcessHeap () returned 0x630000 [0055.639] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.639] GetProcessHeap () returned 0x630000 [0055.639] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.639] GetProcessHeap () returned 0x630000 [0055.639] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.639] GetProcessHeap () returned 0x630000 [0055.639] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.639] GetProcessHeap () returned 0x630000 [0055.639] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.639] GetProcessHeap () returned 0x630000 [0055.639] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.639] GetProcessHeap () returned 0x630000 [0055.639] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.639] GetProcessHeap () returned 0x630000 [0055.639] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0055.639] GetProcessHeap () returned 0x630000 [0055.639] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0055.639] GetProcessHeap () returned 0x630000 [0055.639] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.639] GetProcessHeap () returned 0x630000 [0055.639] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.639] GetProcessHeap () returned 0x630000 [0055.639] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0055.639] GetProcessHeap () returned 0x630000 [0055.639] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0055.639] GetProcessHeap () returned 0x630000 [0055.639] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.639] GetProcessHeap () returned 0x630000 [0055.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.640] GetProcessHeap () returned 0x630000 [0055.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.640] GetProcessHeap () returned 0x630000 [0055.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.640] GetProcessHeap () returned 0x630000 [0055.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0055.640] GetProcessHeap () returned 0x630000 [0055.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.640] GetProcessHeap () returned 0x630000 [0055.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.640] GetProcessHeap () returned 0x630000 [0055.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.640] GetProcessHeap () returned 0x630000 [0055.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.640] GetProcessHeap () returned 0x630000 [0055.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.640] GetProcessHeap () returned 0x630000 [0055.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.640] GetProcessHeap () returned 0x630000 [0055.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.640] GetProcessHeap () returned 0x630000 [0055.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0055.640] GetProcessHeap () returned 0x630000 [0055.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0055.640] GetProcessHeap () returned 0x630000 [0055.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0055.640] GetProcessHeap () returned 0x630000 [0055.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0055.640] GetProcessHeap () returned 0x630000 [0055.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0055.640] GetProcessHeap () returned 0x630000 [0055.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e2b0 | out: hHeap=0x630000) returned 1 [0055.641] GetProcessHeap () returned 0x630000 [0055.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0055.641] GetProcessHeap () returned 0x630000 [0055.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0055.641] GetProcessHeap () returned 0x630000 [0055.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0055.641] GetProcessHeap () returned 0x630000 [0055.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.641] GetProcessHeap () returned 0x630000 [0055.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0055.641] WriteFile (in: hFile=0x230, lpBuffer=0x65b050*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65b050*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0055.643] GetProcessHeap () returned 0x630000 [0055.643] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65b050, Size=0x30) returned 0x65b050 [0055.643] GetProcessHeap () returned 0x630000 [0055.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0055.644] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.644] GetProcessHeap () returned 0x630000 [0055.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12581) returned 0x65ed80 [0055.646] ReadFile (in: hFile=0x230, lpBuffer=0x65ed80, nNumberOfBytesToRead=0x12581, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesRead=0x243d7e8*=0x12581, lpOverlapped=0x0) returned 1 [0055.647] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.647] WriteFile (in: hFile=0x230, lpBuffer=0x65ed80*, nNumberOfBytesToWrite=0x12581, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesWritten=0x243d7e4*=0x12581, lpOverlapped=0x0) returned 1 [0055.649] GetProcessHeap () returned 0x630000 [0055.649] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ed80 | out: hHeap=0x630000) returned 1 [0055.649] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.649] WriteFile (in: hFile=0x230, lpBuffer=0x65b050*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65b050*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0055.650] CloseHandle (hObject=0x230) returned 1 [0055.652] GetProcessHeap () returned 0x630000 [0055.652] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0055.652] GetProcessHeap () returned 0x630000 [0055.652] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655940 | out: hHeap=0x630000) returned 1 [0055.652] GetProcessHeap () returned 0x630000 [0055.652] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0055.652] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm" [0055.652] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm.happythreechoose" [0055.653] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_tr-tr.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_tr-tr.htm.happythreechoose"), dwFlags=0x1) returned 1 [0055.653] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0055.653] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0055.653] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" [0055.653] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\decryption info.html")) returned 0x20 [0055.653] GetProcessHeap () returned 0x630000 [0055.653] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0055.653] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5ed27d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5ed27d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x411eb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_uk-ua.htm", cAlternateFileName="EULA_U~1.HTM")) returned 1 [0055.653] lstrcmpiW (lpString1="EULA_uk-ua.htm", lpString2=".") returned 1 [0055.653] lstrcmpiW (lpString1="EULA_uk-ua.htm", lpString2="..") returned 1 [0055.653] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_uk-ua.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm" [0055.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_uk-ua.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0055.654] GetProcessHeap () returned 0x630000 [0055.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0055.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_uk-ua.htm", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_uk-ua.htm", lpUsedDefaultChar=0x0) returned 15 [0055.654] lstrlenA (lpString="EULA_uk-ua.htm") returned 14 [0055.654] lstrlenA (lpString=".happythreechoose") returned 17 [0055.654] lstrcmpiW (lpString1="EULA_uk-ua.htm", lpString2="Decryption INFO.html") returned 1 [0055.654] lstrcmpiW (lpString1="EULA_uk-ua.htm", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0055.654] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0055.654] lstrcmpiW (lpString1="EULA_uk-ua.htm", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0055.654] GetProcessHeap () returned 0x630000 [0055.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0055.654] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_uk-ua.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0055.655] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=266731) returned 1 [0055.655] GetProcessHeap () returned 0x630000 [0055.655] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655580 [0055.655] GetProcessHeap () returned 0x630000 [0055.655] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0055.655] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm") returned 52 [0055.655] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.655] GetProcessHeap () returned 0x630000 [0055.655] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0055.655] GetProcessHeap () returned 0x630000 [0055.655] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x385) returned 0x65b088 [0055.655] lstrlenA (lpString="rsa_encrypt") returned 11 [0055.655] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0055.656] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0055.656] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0055.656] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0055.656] GetProcessHeap () returned 0x630000 [0055.656] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0055.656] lstrlenA (lpString="010001") returned 6 [0055.656] GetProcessHeap () returned 0x630000 [0055.656] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0055.656] GetProcessHeap () returned 0x630000 [0055.656] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0055.656] GetProcessHeap () returned 0x630000 [0055.656] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e4f0 [0055.656] GetProcessHeap () returned 0x630000 [0055.656] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0055.656] GetProcessHeap () returned 0x630000 [0055.656] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e340 [0055.656] GetProcessHeap () returned 0x630000 [0055.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656fe0 [0055.657] GetProcessHeap () returned 0x630000 [0055.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0055.657] GetProcessHeap () returned 0x630000 [0055.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0055.657] GetProcessHeap () returned 0x630000 [0055.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.657] GetProcessHeap () returned 0x630000 [0055.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0055.657] GetProcessHeap () returned 0x630000 [0055.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0055.657] GetProcessHeap () returned 0x630000 [0055.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x6570f8 [0055.657] GetProcessHeap () returned 0x630000 [0055.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.657] GetProcessHeap () returned 0x630000 [0055.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0055.657] GetProcessHeap () returned 0x630000 [0055.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0055.657] GetProcessHeap () returned 0x630000 [0055.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0055.657] GetProcessHeap () returned 0x630000 [0055.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0055.657] GetProcessHeap () returned 0x630000 [0055.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0055.657] GetProcessHeap () returned 0x630000 [0055.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.657] GetProcessHeap () returned 0x630000 [0055.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x655f88 [0055.657] GetProcessHeap () returned 0x630000 [0055.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.657] GetProcessHeap () returned 0x630000 [0055.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.657] GetProcessHeap () returned 0x630000 [0055.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.657] GetProcessHeap () returned 0x630000 [0055.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.657] GetProcessHeap () returned 0x630000 [0055.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e610 [0055.657] GetProcessHeap () returned 0x630000 [0055.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655f88 | out: hHeap=0x630000) returned 1 [0055.657] GetProcessHeap () returned 0x630000 [0055.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0055.658] GetProcessHeap () returned 0x630000 [0055.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0055.658] GetProcessHeap () returned 0x630000 [0055.658] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.658] GetProcessHeap () returned 0x630000 [0055.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.658] GetProcessHeap () returned 0x630000 [0055.658] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.658] GetProcessHeap () returned 0x630000 [0055.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.658] GetProcessHeap () returned 0x630000 [0055.658] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.658] GetProcessHeap () returned 0x630000 [0055.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.658] GetProcessHeap () returned 0x630000 [0055.658] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.658] GetProcessHeap () returned 0x630000 [0055.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.658] GetProcessHeap () returned 0x630000 [0055.658] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.658] GetProcessHeap () returned 0x630000 [0055.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.658] GetProcessHeap () returned 0x630000 [0055.658] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.658] GetProcessHeap () returned 0x630000 [0055.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.658] GetProcessHeap () returned 0x630000 [0055.658] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.658] GetProcessHeap () returned 0x630000 [0055.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.658] GetProcessHeap () returned 0x630000 [0055.658] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.658] GetProcessHeap () returned 0x630000 [0055.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.658] GetProcessHeap () returned 0x630000 [0055.658] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.658] GetProcessHeap () returned 0x630000 [0055.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.659] GetProcessHeap () returned 0x630000 [0055.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.659] GetProcessHeap () returned 0x630000 [0055.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.659] GetProcessHeap () returned 0x630000 [0055.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.659] GetProcessHeap () returned 0x630000 [0055.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.659] GetProcessHeap () returned 0x630000 [0055.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.659] GetProcessHeap () returned 0x630000 [0055.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.659] GetProcessHeap () returned 0x630000 [0055.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.659] GetProcessHeap () returned 0x630000 [0055.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.659] GetProcessHeap () returned 0x630000 [0055.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.659] GetProcessHeap () returned 0x630000 [0055.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.659] GetProcessHeap () returned 0x630000 [0055.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.659] GetProcessHeap () returned 0x630000 [0055.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.659] GetProcessHeap () returned 0x630000 [0055.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.659] GetProcessHeap () returned 0x630000 [0055.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.659] GetProcessHeap () returned 0x630000 [0055.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.659] GetProcessHeap () returned 0x630000 [0055.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.659] GetProcessHeap () returned 0x630000 [0055.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.659] GetProcessHeap () returned 0x630000 [0055.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.659] GetProcessHeap () returned 0x630000 [0055.660] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.660] GetProcessHeap () returned 0x630000 [0055.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.660] GetProcessHeap () returned 0x630000 [0055.660] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.660] GetProcessHeap () returned 0x630000 [0055.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.660] GetProcessHeap () returned 0x630000 [0055.660] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.660] GetProcessHeap () returned 0x630000 [0055.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.660] GetProcessHeap () returned 0x630000 [0055.660] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.660] GetProcessHeap () returned 0x630000 [0055.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.660] GetProcessHeap () returned 0x630000 [0055.660] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.660] GetProcessHeap () returned 0x630000 [0055.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.660] GetProcessHeap () returned 0x630000 [0055.660] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.660] GetProcessHeap () returned 0x630000 [0055.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.660] GetProcessHeap () returned 0x630000 [0055.660] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.660] GetProcessHeap () returned 0x630000 [0055.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.660] GetProcessHeap () returned 0x630000 [0055.660] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0055.660] GetProcessHeap () returned 0x630000 [0055.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0055.660] GetProcessHeap () returned 0x630000 [0055.660] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.660] GetProcessHeap () returned 0x630000 [0055.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.660] GetProcessHeap () returned 0x630000 [0055.660] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.660] GetProcessHeap () returned 0x630000 [0055.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.661] GetProcessHeap () returned 0x630000 [0055.661] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.661] GetProcessHeap () returned 0x630000 [0055.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.661] GetProcessHeap () returned 0x630000 [0055.661] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.661] GetProcessHeap () returned 0x630000 [0055.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.661] GetProcessHeap () returned 0x630000 [0055.661] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.661] GetProcessHeap () returned 0x630000 [0055.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.661] GetProcessHeap () returned 0x630000 [0055.661] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.661] GetProcessHeap () returned 0x630000 [0055.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.661] GetProcessHeap () returned 0x630000 [0055.661] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.661] GetProcessHeap () returned 0x630000 [0055.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.661] GetProcessHeap () returned 0x630000 [0055.661] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.661] GetProcessHeap () returned 0x630000 [0055.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.661] GetProcessHeap () returned 0x630000 [0055.661] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.661] GetProcessHeap () returned 0x630000 [0055.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.661] GetProcessHeap () returned 0x630000 [0055.661] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.661] GetProcessHeap () returned 0x630000 [0055.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.661] GetProcessHeap () returned 0x630000 [0055.661] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0055.661] GetProcessHeap () returned 0x630000 [0055.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0055.661] GetProcessHeap () returned 0x630000 [0055.661] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.661] GetProcessHeap () returned 0x630000 [0055.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.662] GetProcessHeap () returned 0x630000 [0055.662] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.662] GetProcessHeap () returned 0x630000 [0055.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.662] GetProcessHeap () returned 0x630000 [0055.662] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0055.662] GetProcessHeap () returned 0x630000 [0055.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.662] GetProcessHeap () returned 0x630000 [0055.662] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.662] GetProcessHeap () returned 0x630000 [0055.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.662] GetProcessHeap () returned 0x630000 [0055.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0055.662] GetProcessHeap () returned 0x630000 [0055.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0055.662] GetProcessHeap () returned 0x630000 [0055.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0055.662] GetProcessHeap () returned 0x630000 [0055.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0055.662] GetProcessHeap () returned 0x630000 [0055.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0055.662] GetProcessHeap () returned 0x630000 [0055.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0055.662] GetProcessHeap () returned 0x630000 [0055.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0055.662] GetProcessHeap () returned 0x630000 [0055.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0055.662] GetProcessHeap () returned 0x630000 [0055.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0055.662] GetProcessHeap () returned 0x630000 [0055.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.662] GetProcessHeap () returned 0x630000 [0055.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0055.662] WriteFile (in: hFile=0x230, lpBuffer=0x65b088*, nNumberOfBytesToWrite=0x385, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65b088*, lpNumberOfBytesWritten=0x243d864*=0x385, lpOverlapped=0x0) returned 1 [0055.665] GetProcessHeap () returned 0x630000 [0055.665] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65b088, Size=0x30) returned 0x65b088 [0055.665] GetProcessHeap () returned 0x630000 [0055.665] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0055.665] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.665] GetProcessHeap () returned 0x630000 [0055.665] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x411f0) returned 0x65ed80 [0055.668] ReadFile (in: hFile=0x230, lpBuffer=0x65ed80, nNumberOfBytesToRead=0x411f0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesRead=0x243d7e8*=0x411f0, lpOverlapped=0x0) returned 1 [0055.672] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.672] WriteFile (in: hFile=0x230, lpBuffer=0x65ed80*, nNumberOfBytesToWrite=0x411f0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesWritten=0x243d7e4*=0x411f0, lpOverlapped=0x0) returned 1 [0055.675] GetProcessHeap () returned 0x630000 [0055.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ed80 | out: hHeap=0x630000) returned 1 [0055.677] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.677] WriteFile (in: hFile=0x230, lpBuffer=0x65b088*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65b088*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0055.678] CloseHandle (hObject=0x230) returned 1 [0055.683] GetProcessHeap () returned 0x630000 [0055.683] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0055.683] GetProcessHeap () returned 0x630000 [0055.683] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655580 | out: hHeap=0x630000) returned 1 [0055.683] GetProcessHeap () returned 0x630000 [0055.683] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0055.683] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm" [0055.683] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm.happythreechoose" [0055.683] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_uk-ua.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_uk-ua.htm.happythreechoose"), dwFlags=0x1) returned 1 [0055.684] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0055.684] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0055.684] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" [0055.684] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\decryption info.html")) returned 0x20 [0055.684] GetProcessHeap () returned 0x630000 [0055.684] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0055.684] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5ed27d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5ed27d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1ed21, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_zh-cn.htm", cAlternateFileName="EULA_Z~1.HTM")) returned 1 [0055.684] lstrcmpiW (lpString1="EULA_zh-cn.htm", lpString2=".") returned 1 [0055.684] lstrcmpiW (lpString1="EULA_zh-cn.htm", lpString2="..") returned 1 [0055.684] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_zh-cn.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm" [0055.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_zh-cn.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0055.684] GetProcessHeap () returned 0x630000 [0055.684] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0055.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_zh-cn.htm", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_zh-cn.htm", lpUsedDefaultChar=0x0) returned 15 [0055.684] lstrlenA (lpString="EULA_zh-cn.htm") returned 14 [0055.685] lstrlenA (lpString=".happythreechoose") returned 17 [0055.685] lstrcmpiW (lpString1="EULA_zh-cn.htm", lpString2="Decryption INFO.html") returned 1 [0055.685] lstrcmpiW (lpString1="EULA_zh-cn.htm", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0055.685] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0055.685] lstrcmpiW (lpString1="EULA_zh-cn.htm", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0055.685] GetProcessHeap () returned 0x630000 [0055.685] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0055.685] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-cn.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0055.685] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=126241) returned 1 [0055.685] GetProcessHeap () returned 0x630000 [0055.685] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655490 [0055.685] GetProcessHeap () returned 0x630000 [0055.685] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0055.685] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm") returned 52 [0055.685] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.685] GetProcessHeap () returned 0x630000 [0055.685] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0055.685] GetProcessHeap () returned 0x630000 [0055.685] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x65a4c8 [0055.685] lstrlenA (lpString="rsa_encrypt") returned 11 [0055.685] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0055.686] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0055.686] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0055.686] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0055.686] GetProcessHeap () returned 0x630000 [0055.686] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0055.686] lstrlenA (lpString="010001") returned 6 [0055.686] GetProcessHeap () returned 0x630000 [0055.686] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3c8 [0055.686] GetProcessHeap () returned 0x630000 [0055.686] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0055.686] GetProcessHeap () returned 0x630000 [0055.686] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e460 [0055.686] GetProcessHeap () returned 0x630000 [0055.686] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0055.686] GetProcessHeap () returned 0x630000 [0055.686] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e2b0 [0055.687] GetProcessHeap () returned 0x630000 [0055.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656950 [0055.687] GetProcessHeap () returned 0x630000 [0055.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0055.687] GetProcessHeap () returned 0x630000 [0055.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0055.687] GetProcessHeap () returned 0x630000 [0055.687] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.687] GetProcessHeap () returned 0x630000 [0055.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0055.687] GetProcessHeap () returned 0x630000 [0055.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0055.687] GetProcessHeap () returned 0x630000 [0055.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657670 [0055.687] GetProcessHeap () returned 0x630000 [0055.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.687] GetProcessHeap () returned 0x630000 [0055.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0055.687] GetProcessHeap () returned 0x630000 [0055.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ebb0 [0055.687] GetProcessHeap () returned 0x630000 [0055.687] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0055.687] GetProcessHeap () returned 0x630000 [0055.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0055.687] GetProcessHeap () returned 0x630000 [0055.687] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0055.687] GetProcessHeap () returned 0x630000 [0055.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0055.687] GetProcessHeap () returned 0x630000 [0055.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x655c88 [0055.688] GetProcessHeap () returned 0x630000 [0055.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.688] GetProcessHeap () returned 0x630000 [0055.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0055.688] GetProcessHeap () returned 0x630000 [0055.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.688] GetProcessHeap () returned 0x630000 [0055.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.688] GetProcessHeap () returned 0x630000 [0055.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e3d0 [0055.688] GetProcessHeap () returned 0x630000 [0055.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655c88 | out: hHeap=0x630000) returned 1 [0055.688] GetProcessHeap () returned 0x630000 [0055.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0055.688] GetProcessHeap () returned 0x630000 [0055.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0055.688] GetProcessHeap () returned 0x630000 [0055.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.688] GetProcessHeap () returned 0x630000 [0055.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.688] GetProcessHeap () returned 0x630000 [0055.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.688] GetProcessHeap () returned 0x630000 [0055.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.688] GetProcessHeap () returned 0x630000 [0055.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.688] GetProcessHeap () returned 0x630000 [0055.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.688] GetProcessHeap () returned 0x630000 [0055.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.688] GetProcessHeap () returned 0x630000 [0055.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.688] GetProcessHeap () returned 0x630000 [0055.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.688] GetProcessHeap () returned 0x630000 [0055.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.688] GetProcessHeap () returned 0x630000 [0055.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.688] GetProcessHeap () returned 0x630000 [0055.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.689] GetProcessHeap () returned 0x630000 [0055.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.689] GetProcessHeap () returned 0x630000 [0055.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.689] GetProcessHeap () returned 0x630000 [0055.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.689] GetProcessHeap () returned 0x630000 [0055.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.689] GetProcessHeap () returned 0x630000 [0055.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.689] GetProcessHeap () returned 0x630000 [0055.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.689] GetProcessHeap () returned 0x630000 [0055.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0055.689] GetProcessHeap () returned 0x630000 [0055.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0055.689] GetProcessHeap () returned 0x630000 [0055.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.689] GetProcessHeap () returned 0x630000 [0055.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.689] GetProcessHeap () returned 0x630000 [0055.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.689] GetProcessHeap () returned 0x630000 [0055.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.689] GetProcessHeap () returned 0x630000 [0055.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.689] GetProcessHeap () returned 0x630000 [0055.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.689] GetProcessHeap () returned 0x630000 [0055.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.689] GetProcessHeap () returned 0x630000 [0055.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.689] GetProcessHeap () returned 0x630000 [0055.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.689] GetProcessHeap () returned 0x630000 [0055.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.689] GetProcessHeap () returned 0x630000 [0055.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.690] GetProcessHeap () returned 0x630000 [0055.690] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.690] GetProcessHeap () returned 0x630000 [0055.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0055.690] GetProcessHeap () returned 0x630000 [0055.690] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.690] GetProcessHeap () returned 0x630000 [0055.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.690] GetProcessHeap () returned 0x630000 [0055.690] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.690] GetProcessHeap () returned 0x630000 [0055.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.690] GetProcessHeap () returned 0x630000 [0055.690] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.690] GetProcessHeap () returned 0x630000 [0055.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.690] GetProcessHeap () returned 0x630000 [0055.690] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.690] GetProcessHeap () returned 0x630000 [0055.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.690] GetProcessHeap () returned 0x630000 [0055.690] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.690] GetProcessHeap () returned 0x630000 [0055.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0055.690] GetProcessHeap () returned 0x630000 [0055.690] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.690] GetProcessHeap () returned 0x630000 [0055.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0055.690] GetProcessHeap () returned 0x630000 [0055.690] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.690] GetProcessHeap () returned 0x630000 [0055.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.690] GetProcessHeap () returned 0x630000 [0055.690] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.690] GetProcessHeap () returned 0x630000 [0055.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0055.690] GetProcessHeap () returned 0x630000 [0055.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0055.691] GetProcessHeap () returned 0x630000 [0055.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.691] GetProcessHeap () returned 0x630000 [0055.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.691] GetProcessHeap () returned 0x630000 [0055.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.691] GetProcessHeap () returned 0x630000 [0055.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.691] GetProcessHeap () returned 0x630000 [0055.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.691] GetProcessHeap () returned 0x630000 [0055.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.691] GetProcessHeap () returned 0x630000 [0055.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.691] GetProcessHeap () returned 0x630000 [0055.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.691] GetProcessHeap () returned 0x630000 [0055.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.691] GetProcessHeap () returned 0x630000 [0055.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.691] GetProcessHeap () returned 0x630000 [0055.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.691] GetProcessHeap () returned 0x630000 [0055.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.691] GetProcessHeap () returned 0x630000 [0055.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.691] GetProcessHeap () returned 0x630000 [0055.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.691] GetProcessHeap () returned 0x630000 [0055.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.691] GetProcessHeap () returned 0x630000 [0055.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.691] GetProcessHeap () returned 0x630000 [0055.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.691] GetProcessHeap () returned 0x630000 [0055.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.691] GetProcessHeap () returned 0x630000 [0055.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.692] GetProcessHeap () returned 0x630000 [0055.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.692] GetProcessHeap () returned 0x630000 [0055.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.692] GetProcessHeap () returned 0x630000 [0055.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.692] GetProcessHeap () returned 0x630000 [0055.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.692] GetProcessHeap () returned 0x630000 [0055.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.692] GetProcessHeap () returned 0x630000 [0055.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.692] GetProcessHeap () returned 0x630000 [0055.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.692] GetProcessHeap () returned 0x630000 [0055.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.692] GetProcessHeap () returned 0x630000 [0055.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.692] GetProcessHeap () returned 0x630000 [0055.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.692] GetProcessHeap () returned 0x630000 [0055.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.692] GetProcessHeap () returned 0x630000 [0055.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.692] GetProcessHeap () returned 0x630000 [0055.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.692] GetProcessHeap () returned 0x630000 [0055.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0055.692] GetProcessHeap () returned 0x630000 [0055.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0055.692] GetProcessHeap () returned 0x630000 [0055.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0055.692] GetProcessHeap () returned 0x630000 [0055.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0055.692] GetProcessHeap () returned 0x630000 [0055.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0055.692] GetProcessHeap () returned 0x630000 [0055.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e2b0 | out: hHeap=0x630000) returned 1 [0055.693] GetProcessHeap () returned 0x630000 [0055.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0055.693] GetProcessHeap () returned 0x630000 [0055.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e460 | out: hHeap=0x630000) returned 1 [0055.693] GetProcessHeap () returned 0x630000 [0055.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0055.693] GetProcessHeap () returned 0x630000 [0055.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0055.693] GetProcessHeap () returned 0x630000 [0055.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0055.693] WriteFile (in: hFile=0x230, lpBuffer=0x65a4c8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65a4c8*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0055.696] GetProcessHeap () returned 0x630000 [0055.697] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65a4c8, Size=0x30) returned 0x65a4c8 [0055.697] GetProcessHeap () returned 0x630000 [0055.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0055.697] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.697] GetProcessHeap () returned 0x630000 [0055.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1ed21) returned 0x65ed80 [0055.700] ReadFile (in: hFile=0x230, lpBuffer=0x65ed80, nNumberOfBytesToRead=0x1ed21, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesRead=0x243d7e8*=0x1ed21, lpOverlapped=0x0) returned 1 [0055.702] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.702] WriteFile (in: hFile=0x230, lpBuffer=0x65ed80*, nNumberOfBytesToWrite=0x1ed21, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesWritten=0x243d7e4*=0x1ed21, lpOverlapped=0x0) returned 1 [0055.715] GetProcessHeap () returned 0x630000 [0055.715] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ed80 | out: hHeap=0x630000) returned 1 [0055.716] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.716] WriteFile (in: hFile=0x230, lpBuffer=0x65a4c8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65a4c8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0055.717] CloseHandle (hObject=0x230) returned 1 [0055.722] GetProcessHeap () returned 0x630000 [0055.722] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0055.722] GetProcessHeap () returned 0x630000 [0055.722] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655490 | out: hHeap=0x630000) returned 1 [0055.722] GetProcessHeap () returned 0x630000 [0055.722] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0055.722] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm" [0055.722] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm.happythreechoose" [0055.722] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-cn.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-cn.htm.happythreechoose"), dwFlags=0x1) returned 1 [0055.722] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0055.723] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0055.723] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" [0055.723] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\decryption info.html")) returned 0x20 [0055.723] GetProcessHeap () returned 0x630000 [0055.723] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0055.723] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5f6eb5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x23ec4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_zh-hk.htm", cAlternateFileName="EULA_Z~2.HTM")) returned 1 [0055.723] lstrcmpiW (lpString1="EULA_zh-hk.htm", lpString2=".") returned 1 [0055.723] lstrcmpiW (lpString1="EULA_zh-hk.htm", lpString2="..") returned 1 [0055.723] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_zh-hk.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm" [0055.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_zh-hk.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0055.723] GetProcessHeap () returned 0x630000 [0055.723] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0055.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_zh-hk.htm", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_zh-hk.htm", lpUsedDefaultChar=0x0) returned 15 [0055.723] lstrlenA (lpString="EULA_zh-hk.htm") returned 14 [0055.723] lstrlenA (lpString=".happythreechoose") returned 17 [0055.723] lstrcmpiW (lpString1="EULA_zh-hk.htm", lpString2="Decryption INFO.html") returned 1 [0055.723] lstrcmpiW (lpString1="EULA_zh-hk.htm", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0055.723] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0055.723] lstrcmpiW (lpString1="EULA_zh-hk.htm", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0055.723] GetProcessHeap () returned 0x630000 [0055.723] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0055.723] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-hk.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0055.724] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=147140) returned 1 [0055.724] GetProcessHeap () returned 0x630000 [0055.724] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655490 [0055.724] GetProcessHeap () returned 0x630000 [0055.724] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0055.724] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm") returned 52 [0055.724] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.724] GetProcessHeap () returned 0x630000 [0055.724] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0055.724] GetProcessHeap () returned 0x630000 [0055.724] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x65a500 [0055.724] lstrlenA (lpString="rsa_encrypt") returned 11 [0055.724] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0055.724] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0055.724] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0055.725] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0055.725] GetProcessHeap () returned 0x630000 [0055.725] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0055.725] lstrlenA (lpString="010001") returned 6 [0055.725] GetProcessHeap () returned 0x630000 [0055.725] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3f8 [0055.725] GetProcessHeap () returned 0x630000 [0055.725] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0055.725] GetProcessHeap () returned 0x630000 [0055.725] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0055.725] GetProcessHeap () returned 0x630000 [0055.725] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0055.725] GetProcessHeap () returned 0x630000 [0055.725] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e8e0 [0055.725] GetProcessHeap () returned 0x630000 [0055.725] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656950 [0055.725] GetProcessHeap () returned 0x630000 [0055.725] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3c8 [0055.725] GetProcessHeap () returned 0x630000 [0055.725] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0055.725] GetProcessHeap () returned 0x630000 [0055.725] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0055.725] GetProcessHeap () returned 0x630000 [0055.725] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0055.725] GetProcessHeap () returned 0x630000 [0055.725] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0055.725] GetProcessHeap () returned 0x630000 [0055.725] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657328 [0055.725] GetProcessHeap () returned 0x630000 [0055.725] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0055.725] GetProcessHeap () returned 0x630000 [0055.725] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0055.725] GetProcessHeap () returned 0x630000 [0055.725] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ebb0 [0055.725] GetProcessHeap () returned 0x630000 [0055.725] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0055.725] GetProcessHeap () returned 0x630000 [0055.725] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0055.726] GetProcessHeap () returned 0x630000 [0055.726] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0055.726] GetProcessHeap () returned 0x630000 [0055.726] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.726] GetProcessHeap () returned 0x630000 [0055.726] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x655eb0 [0055.726] GetProcessHeap () returned 0x630000 [0055.726] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.726] GetProcessHeap () returned 0x630000 [0055.726] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.726] GetProcessHeap () returned 0x630000 [0055.726] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.726] GetProcessHeap () returned 0x630000 [0055.726] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.726] GetProcessHeap () returned 0x630000 [0055.726] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e970 [0055.726] GetProcessHeap () returned 0x630000 [0055.726] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655eb0 | out: hHeap=0x630000) returned 1 [0055.726] GetProcessHeap () returned 0x630000 [0055.726] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0055.726] GetProcessHeap () returned 0x630000 [0055.726] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0055.726] GetProcessHeap () returned 0x630000 [0055.726] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.726] GetProcessHeap () returned 0x630000 [0055.726] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.726] GetProcessHeap () returned 0x630000 [0055.726] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.726] GetProcessHeap () returned 0x630000 [0055.726] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.726] GetProcessHeap () returned 0x630000 [0055.726] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.726] GetProcessHeap () returned 0x630000 [0055.726] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.726] GetProcessHeap () returned 0x630000 [0055.726] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.726] GetProcessHeap () returned 0x630000 [0055.726] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.726] GetProcessHeap () returned 0x630000 [0055.726] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.727] GetProcessHeap () returned 0x630000 [0055.727] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.727] GetProcessHeap () returned 0x630000 [0055.727] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.727] GetProcessHeap () returned 0x630000 [0055.727] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.727] GetProcessHeap () returned 0x630000 [0055.727] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.727] GetProcessHeap () returned 0x630000 [0055.727] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.727] GetProcessHeap () returned 0x630000 [0055.727] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.727] GetProcessHeap () returned 0x630000 [0055.727] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.727] GetProcessHeap () returned 0x630000 [0055.727] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.727] GetProcessHeap () returned 0x630000 [0055.727] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.727] GetProcessHeap () returned 0x630000 [0055.727] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0055.727] GetProcessHeap () returned 0x630000 [0055.727] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0055.727] GetProcessHeap () returned 0x630000 [0055.727] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.727] GetProcessHeap () returned 0x630000 [0055.727] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.727] GetProcessHeap () returned 0x630000 [0055.727] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.727] GetProcessHeap () returned 0x630000 [0055.727] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.727] GetProcessHeap () returned 0x630000 [0055.727] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.727] GetProcessHeap () returned 0x630000 [0055.727] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.727] GetProcessHeap () returned 0x630000 [0055.727] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.727] GetProcessHeap () returned 0x630000 [0055.727] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.728] GetProcessHeap () returned 0x630000 [0055.728] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.728] GetProcessHeap () returned 0x630000 [0055.728] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.728] GetProcessHeap () returned 0x630000 [0055.728] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.728] GetProcessHeap () returned 0x630000 [0055.728] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.728] GetProcessHeap () returned 0x630000 [0055.728] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.728] GetProcessHeap () returned 0x630000 [0055.728] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.728] GetProcessHeap () returned 0x630000 [0055.728] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.728] GetProcessHeap () returned 0x630000 [0055.728] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.728] GetProcessHeap () returned 0x630000 [0055.728] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.728] GetProcessHeap () returned 0x630000 [0055.728] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.728] GetProcessHeap () returned 0x630000 [0055.728] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.728] GetProcessHeap () returned 0x630000 [0055.728] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.728] GetProcessHeap () returned 0x630000 [0055.728] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.728] GetProcessHeap () returned 0x630000 [0055.728] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.728] GetProcessHeap () returned 0x630000 [0055.728] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.728] GetProcessHeap () returned 0x630000 [0055.728] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.728] GetProcessHeap () returned 0x630000 [0055.728] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.728] GetProcessHeap () returned 0x630000 [0055.728] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.728] GetProcessHeap () returned 0x630000 [0055.728] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.728] GetProcessHeap () returned 0x630000 [0055.729] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.729] GetProcessHeap () returned 0x630000 [0055.729] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0055.729] GetProcessHeap () returned 0x630000 [0055.729] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.729] GetProcessHeap () returned 0x630000 [0055.729] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0055.729] GetProcessHeap () returned 0x630000 [0055.729] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.729] GetProcessHeap () returned 0x630000 [0055.729] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.729] GetProcessHeap () returned 0x630000 [0055.729] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.729] GetProcessHeap () returned 0x630000 [0055.729] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.729] GetProcessHeap () returned 0x630000 [0055.729] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.729] GetProcessHeap () returned 0x630000 [0055.729] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.729] GetProcessHeap () returned 0x630000 [0055.729] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.729] GetProcessHeap () returned 0x630000 [0055.729] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0055.729] GetProcessHeap () returned 0x630000 [0055.729] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.729] GetProcessHeap () returned 0x630000 [0055.729] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.729] GetProcessHeap () returned 0x630000 [0055.729] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.729] GetProcessHeap () returned 0x630000 [0055.729] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.729] GetProcessHeap () returned 0x630000 [0055.729] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.729] GetProcessHeap () returned 0x630000 [0055.729] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.729] GetProcessHeap () returned 0x630000 [0055.729] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.729] GetProcessHeap () returned 0x630000 [0055.729] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.729] GetProcessHeap () returned 0x630000 [0055.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.730] GetProcessHeap () returned 0x630000 [0055.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0055.730] GetProcessHeap () returned 0x630000 [0055.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.730] GetProcessHeap () returned 0x630000 [0055.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0055.730] GetProcessHeap () returned 0x630000 [0055.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0055.730] GetProcessHeap () returned 0x630000 [0055.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.730] GetProcessHeap () returned 0x630000 [0055.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.730] GetProcessHeap () returned 0x630000 [0055.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.730] GetProcessHeap () returned 0x630000 [0055.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.730] GetProcessHeap () returned 0x630000 [0055.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.730] GetProcessHeap () returned 0x630000 [0055.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.730] GetProcessHeap () returned 0x630000 [0055.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.730] GetProcessHeap () returned 0x630000 [0055.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.730] GetProcessHeap () returned 0x630000 [0055.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0055.730] GetProcessHeap () returned 0x630000 [0055.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0055.730] GetProcessHeap () returned 0x630000 [0055.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0055.730] GetProcessHeap () returned 0x630000 [0055.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0055.730] GetProcessHeap () returned 0x630000 [0055.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0055.730] GetProcessHeap () returned 0x630000 [0055.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0055.730] GetProcessHeap () returned 0x630000 [0055.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0055.731] GetProcessHeap () returned 0x630000 [0055.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0055.731] GetProcessHeap () returned 0x630000 [0055.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0055.731] GetProcessHeap () returned 0x630000 [0055.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0055.731] GetProcessHeap () returned 0x630000 [0055.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0055.731] GetProcessHeap () returned 0x630000 [0055.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.731] GetProcessHeap () returned 0x630000 [0055.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0055.731] WriteFile (in: hFile=0x230, lpBuffer=0x65a500*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65a500*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0055.735] GetProcessHeap () returned 0x630000 [0055.735] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65a500, Size=0x30) returned 0x65a500 [0055.735] GetProcessHeap () returned 0x630000 [0055.735] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0055.735] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.735] GetProcessHeap () returned 0x630000 [0055.735] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x23ec4) returned 0x65ed80 [0055.735] ReadFile (in: hFile=0x230, lpBuffer=0x65ed80, nNumberOfBytesToRead=0x23ec4, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesRead=0x243d7e8*=0x23ec4, lpOverlapped=0x0) returned 1 [0055.737] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.737] WriteFile (in: hFile=0x230, lpBuffer=0x65ed80*, nNumberOfBytesToWrite=0x23ec4, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesWritten=0x243d7e4*=0x23ec4, lpOverlapped=0x0) returned 1 [0055.739] GetProcessHeap () returned 0x630000 [0055.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ed80 | out: hHeap=0x630000) returned 1 [0055.741] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.741] WriteFile (in: hFile=0x230, lpBuffer=0x65a500*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65a500*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0055.742] CloseHandle (hObject=0x230) returned 1 [0055.745] GetProcessHeap () returned 0x630000 [0055.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0055.746] GetProcessHeap () returned 0x630000 [0055.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655490 | out: hHeap=0x630000) returned 1 [0055.746] GetProcessHeap () returned 0x630000 [0055.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0055.746] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm" [0055.746] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm.happythreechoose" [0055.746] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-hk.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-hk.htm.happythreechoose"), dwFlags=0x1) returned 1 [0055.746] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0055.746] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0055.746] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" [0055.746] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\decryption info.html")) returned 0x20 [0055.747] GetProcessHeap () returned 0x630000 [0055.747] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0055.747] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5f6eb5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x23ec4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_zh-tw.htm", cAlternateFileName="EULA_Z~3.HTM")) returned 1 [0055.747] lstrcmpiW (lpString1="EULA_zh-tw.htm", lpString2=".") returned 1 [0055.747] lstrcmpiW (lpString1="EULA_zh-tw.htm", lpString2="..") returned 1 [0055.747] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_zh-tw.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm" [0055.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_zh-tw.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0055.747] GetProcessHeap () returned 0x630000 [0055.747] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0055.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_zh-tw.htm", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_zh-tw.htm", lpUsedDefaultChar=0x0) returned 15 [0055.747] lstrlenA (lpString="EULA_zh-tw.htm") returned 14 [0055.747] lstrlenA (lpString=".happythreechoose") returned 17 [0055.747] lstrcmpiW (lpString1="EULA_zh-tw.htm", lpString2="Decryption INFO.html") returned 1 [0055.747] lstrcmpiW (lpString1="EULA_zh-tw.htm", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0055.747] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0055.747] lstrcmpiW (lpString1="EULA_zh-tw.htm", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0055.747] GetProcessHeap () returned 0x630000 [0055.747] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0055.747] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-tw.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0055.747] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=147140) returned 1 [0055.747] GetProcessHeap () returned 0x630000 [0055.747] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655760 [0055.748] GetProcessHeap () returned 0x630000 [0055.748] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0055.748] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm") returned 52 [0055.748] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.748] GetProcessHeap () returned 0x630000 [0055.748] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0055.748] GetProcessHeap () returned 0x630000 [0055.748] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x65a538 [0055.748] lstrlenA (lpString="rsa_encrypt") returned 11 [0055.748] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0055.748] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0055.748] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0055.748] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0055.748] GetProcessHeap () returned 0x630000 [0055.748] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0055.749] lstrlenA (lpString="010001") returned 6 [0055.749] GetProcessHeap () returned 0x630000 [0055.749] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a298 [0055.749] GetProcessHeap () returned 0x630000 [0055.749] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0055.749] GetProcessHeap () returned 0x630000 [0055.749] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e460 [0055.749] GetProcessHeap () returned 0x630000 [0055.749] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0055.749] GetProcessHeap () returned 0x630000 [0055.749] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ecd0 [0055.749] GetProcessHeap () returned 0x630000 [0055.749] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656db0 [0055.749] GetProcessHeap () returned 0x630000 [0055.749] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0055.749] GetProcessHeap () returned 0x630000 [0055.749] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0055.749] GetProcessHeap () returned 0x630000 [0055.749] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.749] GetProcessHeap () returned 0x630000 [0055.749] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0055.749] GetProcessHeap () returned 0x630000 [0055.749] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0055.749] GetProcessHeap () returned 0x630000 [0055.749] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656ec8 [0055.749] GetProcessHeap () returned 0x630000 [0055.749] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.749] GetProcessHeap () returned 0x630000 [0055.749] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0055.749] GetProcessHeap () returned 0x630000 [0055.749] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0055.750] GetProcessHeap () returned 0x630000 [0055.750] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0055.750] GetProcessHeap () returned 0x630000 [0055.750] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0055.750] GetProcessHeap () returned 0x630000 [0055.750] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0055.750] GetProcessHeap () returned 0x630000 [0055.750] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.751] GetProcessHeap () returned 0x630000 [0055.751] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x655c88 [0055.751] GetProcessHeap () returned 0x630000 [0055.751] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.751] GetProcessHeap () returned 0x630000 [0055.751] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.751] GetProcessHeap () returned 0x630000 [0055.751] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0055.751] GetProcessHeap () returned 0x630000 [0055.751] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.751] GetProcessHeap () returned 0x630000 [0055.751] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e340 [0055.751] GetProcessHeap () returned 0x630000 [0055.751] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655c88 | out: hHeap=0x630000) returned 1 [0055.751] GetProcessHeap () returned 0x630000 [0055.751] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0055.751] GetProcessHeap () returned 0x630000 [0055.751] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0055.751] GetProcessHeap () returned 0x630000 [0055.751] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.751] GetProcessHeap () returned 0x630000 [0055.751] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.751] GetProcessHeap () returned 0x630000 [0055.752] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.752] GetProcessHeap () returned 0x630000 [0055.752] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.752] GetProcessHeap () returned 0x630000 [0055.752] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0055.752] GetProcessHeap () returned 0x630000 [0055.752] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.752] GetProcessHeap () returned 0x630000 [0055.752] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0055.752] GetProcessHeap () returned 0x630000 [0055.752] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.752] GetProcessHeap () returned 0x630000 [0055.752] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0055.752] GetProcessHeap () returned 0x630000 [0055.752] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.752] GetProcessHeap () returned 0x630000 [0055.752] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.752] GetProcessHeap () returned 0x630000 [0055.752] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.752] GetProcessHeap () returned 0x630000 [0055.752] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.752] GetProcessHeap () returned 0x630000 [0055.752] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.752] GetProcessHeap () returned 0x630000 [0055.752] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.752] GetProcessHeap () returned 0x630000 [0055.752] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.752] GetProcessHeap () returned 0x630000 [0055.752] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.752] GetProcessHeap () returned 0x630000 [0055.752] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.752] GetProcessHeap () returned 0x630000 [0055.752] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.752] GetProcessHeap () returned 0x630000 [0055.753] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.753] GetProcessHeap () returned 0x630000 [0055.753] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.753] GetProcessHeap () returned 0x630000 [0055.753] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.753] GetProcessHeap () returned 0x630000 [0055.753] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.753] GetProcessHeap () returned 0x630000 [0055.753] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.753] GetProcessHeap () returned 0x630000 [0055.753] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0055.753] GetProcessHeap () returned 0x630000 [0055.753] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0055.753] GetProcessHeap () returned 0x630000 [0055.753] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.753] GetProcessHeap () returned 0x630000 [0055.753] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.753] GetProcessHeap () returned 0x630000 [0055.753] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.753] GetProcessHeap () returned 0x630000 [0055.753] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.753] GetProcessHeap () returned 0x630000 [0055.753] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.753] GetProcessHeap () returned 0x630000 [0055.753] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.753] GetProcessHeap () returned 0x630000 [0055.753] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.753] GetProcessHeap () returned 0x630000 [0055.753] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.753] GetProcessHeap () returned 0x630000 [0055.753] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.753] GetProcessHeap () returned 0x630000 [0055.753] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.754] GetProcessHeap () returned 0x630000 [0055.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.754] GetProcessHeap () returned 0x630000 [0055.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.754] GetProcessHeap () returned 0x630000 [0055.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0055.754] GetProcessHeap () returned 0x630000 [0055.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0055.754] GetProcessHeap () returned 0x630000 [0055.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.754] GetProcessHeap () returned 0x630000 [0055.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.754] GetProcessHeap () returned 0x630000 [0055.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0055.754] GetProcessHeap () returned 0x630000 [0055.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.754] GetProcessHeap () returned 0x630000 [0055.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.754] GetProcessHeap () returned 0x630000 [0055.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.754] GetProcessHeap () returned 0x630000 [0055.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.754] GetProcessHeap () returned 0x630000 [0055.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.754] GetProcessHeap () returned 0x630000 [0055.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.754] GetProcessHeap () returned 0x630000 [0055.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.754] GetProcessHeap () returned 0x630000 [0055.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.754] GetProcessHeap () returned 0x630000 [0055.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.754] GetProcessHeap () returned 0x630000 [0055.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.754] GetProcessHeap () returned 0x630000 [0055.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.754] GetProcessHeap () returned 0x630000 [0055.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.755] GetProcessHeap () returned 0x630000 [0055.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.755] GetProcessHeap () returned 0x630000 [0055.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.755] GetProcessHeap () returned 0x630000 [0055.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.755] GetProcessHeap () returned 0x630000 [0055.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.755] GetProcessHeap () returned 0x630000 [0055.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.755] GetProcessHeap () returned 0x630000 [0055.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0055.755] GetProcessHeap () returned 0x630000 [0055.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0055.755] GetProcessHeap () returned 0x630000 [0055.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.755] GetProcessHeap () returned 0x630000 [0055.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.755] GetProcessHeap () returned 0x630000 [0055.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.755] GetProcessHeap () returned 0x630000 [0055.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.755] GetProcessHeap () returned 0x630000 [0055.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.755] GetProcessHeap () returned 0x630000 [0055.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.755] GetProcessHeap () returned 0x630000 [0055.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.755] GetProcessHeap () returned 0x630000 [0055.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.755] GetProcessHeap () returned 0x630000 [0055.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.755] GetProcessHeap () returned 0x630000 [0055.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.755] GetProcessHeap () returned 0x630000 [0055.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.755] GetProcessHeap () returned 0x630000 [0055.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.756] GetProcessHeap () returned 0x630000 [0055.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.756] GetProcessHeap () returned 0x630000 [0055.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.756] GetProcessHeap () returned 0x630000 [0055.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.756] GetProcessHeap () returned 0x630000 [0055.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.756] GetProcessHeap () returned 0x630000 [0055.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.756] GetProcessHeap () returned 0x630000 [0055.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.756] GetProcessHeap () returned 0x630000 [0055.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.756] GetProcessHeap () returned 0x630000 [0055.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.756] GetProcessHeap () returned 0x630000 [0055.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0055.756] GetProcessHeap () returned 0x630000 [0055.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0055.756] GetProcessHeap () returned 0x630000 [0055.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0055.756] GetProcessHeap () returned 0x630000 [0055.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0055.756] GetProcessHeap () returned 0x630000 [0055.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0055.756] GetProcessHeap () returned 0x630000 [0055.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ecd0 | out: hHeap=0x630000) returned 1 [0055.756] GetProcessHeap () returned 0x630000 [0055.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0055.756] GetProcessHeap () returned 0x630000 [0055.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e460 | out: hHeap=0x630000) returned 1 [0055.756] GetProcessHeap () returned 0x630000 [0055.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0055.756] GetProcessHeap () returned 0x630000 [0055.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.756] GetProcessHeap () returned 0x630000 [0055.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0055.756] WriteFile (in: hFile=0x230, lpBuffer=0x65a538*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65a538*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0055.760] GetProcessHeap () returned 0x630000 [0055.760] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65a538, Size=0x30) returned 0x65a538 [0055.760] GetProcessHeap () returned 0x630000 [0055.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0055.760] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.760] GetProcessHeap () returned 0x630000 [0055.760] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x23ec4) returned 0x65ed80 [0055.763] ReadFile (in: hFile=0x230, lpBuffer=0x65ed80, nNumberOfBytesToRead=0x23ec4, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesRead=0x243d7e8*=0x23ec4, lpOverlapped=0x0) returned 1 [0055.765] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.765] WriteFile (in: hFile=0x230, lpBuffer=0x65ed80*, nNumberOfBytesToWrite=0x23ec4, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesWritten=0x243d7e4*=0x23ec4, lpOverlapped=0x0) returned 1 [0055.794] GetProcessHeap () returned 0x630000 [0055.794] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ed80 | out: hHeap=0x630000) returned 1 [0055.794] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.794] WriteFile (in: hFile=0x230, lpBuffer=0x65a538*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65a538*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0055.811] CloseHandle (hObject=0x230) returned 1 [0055.815] GetProcessHeap () returned 0x630000 [0055.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0055.815] GetProcessHeap () returned 0x630000 [0055.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655760 | out: hHeap=0x630000) returned 1 [0055.815] GetProcessHeap () returned 0x630000 [0055.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0055.815] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm" [0055.815] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm.happythreechoose" [0055.815] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-tw.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-tw.htm.happythreechoose"), dwFlags=0x1) returned 1 [0055.816] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0055.816] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0055.816] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" [0055.816] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\decryption info.html")) returned 0x20 [0055.816] GetProcessHeap () returned 0x630000 [0055.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0055.816] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5f6eb5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x23ec4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_zh-tw.htm", cAlternateFileName="EULA_Z~3.HTM")) returned 0 [0055.816] FindClose (in: hFindFile=0x648a90 | out: hFindFile=0x648a90) returned 1 [0055.816] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Windows10Upgrade\\resources\\i386\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\") returned="C:\\Windows10Upgrade\\resources\\i386\\" [0055.816] GetProcessHeap () returned 0x630000 [0055.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653ca0 | out: hHeap=0x630000) returned 1 [0055.816] GetProcessHeap () returned 0x630000 [0055.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0055.817] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\i386\\") returned 35 [0055.817] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\", lpString2="*" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\*") returned="C:\\Windows10Upgrade\\resources\\i386\\*" [0055.817] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\i386\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3a9fd3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b1515, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3b2895, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648810 [0055.818] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0055.818] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3a9fd3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b1515, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3b2895, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.818] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0055.818] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0055.818] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ab347, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ab347, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x16600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BiosBlocks.xml", cAlternateFileName="BIOSBL~1.XML")) returned 1 [0055.818] lstrcmpiW (lpString1="BiosBlocks.xml", lpString2=".") returned 1 [0055.818] lstrcmpiW (lpString1="BiosBlocks.xml", lpString2="..") returned 1 [0055.818] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\", lpString2="BiosBlocks.xml" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml") returned="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml" [0055.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BiosBlocks.xml", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0055.818] GetProcessHeap () returned 0x630000 [0055.818] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0055.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BiosBlocks.xml", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BiosBlocks.xml", lpUsedDefaultChar=0x0) returned 15 [0055.819] lstrlenA (lpString="BiosBlocks.xml") returned 14 [0055.819] lstrlenA (lpString=".happythreechoose") returned 17 [0055.819] lstrcmpiW (lpString1="BiosBlocks.xml", lpString2="Decryption INFO.html") returned -1 [0055.819] lstrcmpiW (lpString1="BiosBlocks.xml", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0055.819] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0055.819] lstrcmpiW (lpString1="BiosBlocks.xml", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0055.819] GetProcessHeap () returned 0x630000 [0055.819] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0055.819] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\i386\\biosblocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0055.820] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=91648) returned 1 [0055.820] GetProcessHeap () returned 0x630000 [0055.820] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655b20 [0055.820] GetProcessHeap () returned 0x630000 [0055.820] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0055.820] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml") returned 49 [0055.820] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.820] GetProcessHeap () returned 0x630000 [0055.820] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0055.820] GetProcessHeap () returned 0x630000 [0055.820] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x65a570 [0055.820] lstrlenA (lpString="rsa_encrypt") returned 11 [0055.820] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0055.821] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0055.821] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0055.821] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0055.821] GetProcessHeap () returned 0x630000 [0055.821] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0055.821] lstrlenA (lpString="010001") returned 6 [0055.821] GetProcessHeap () returned 0x630000 [0055.821] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a328 [0055.821] GetProcessHeap () returned 0x630000 [0055.821] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0055.821] GetProcessHeap () returned 0x630000 [0055.821] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e8e0 [0055.821] GetProcessHeap () returned 0x630000 [0055.821] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0055.821] GetProcessHeap () returned 0x630000 [0055.821] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0055.821] GetProcessHeap () returned 0x630000 [0055.821] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656b80 [0055.821] GetProcessHeap () returned 0x630000 [0055.821] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0055.821] GetProcessHeap () returned 0x630000 [0055.821] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0055.821] GetProcessHeap () returned 0x630000 [0055.821] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.821] GetProcessHeap () returned 0x630000 [0055.821] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0055.821] GetProcessHeap () returned 0x630000 [0055.821] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0055.821] GetProcessHeap () returned 0x630000 [0055.821] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657440 [0055.821] GetProcessHeap () returned 0x630000 [0055.821] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.821] GetProcessHeap () returned 0x630000 [0055.821] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0055.822] GetProcessHeap () returned 0x630000 [0055.822] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65df50 [0055.822] GetProcessHeap () returned 0x630000 [0055.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0055.822] GetProcessHeap () returned 0x630000 [0055.822] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0055.822] GetProcessHeap () returned 0x630000 [0055.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0055.822] GetProcessHeap () returned 0x630000 [0055.822] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.822] GetProcessHeap () returned 0x630000 [0055.822] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65ee40 [0055.822] GetProcessHeap () returned 0x630000 [0055.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.822] GetProcessHeap () returned 0x630000 [0055.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.822] GetProcessHeap () returned 0x630000 [0055.822] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.822] GetProcessHeap () returned 0x630000 [0055.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.822] GetProcessHeap () returned 0x630000 [0055.822] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e340 [0055.822] GetProcessHeap () returned 0x630000 [0055.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ee40 | out: hHeap=0x630000) returned 1 [0055.822] GetProcessHeap () returned 0x630000 [0055.822] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0055.822] GetProcessHeap () returned 0x630000 [0055.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0055.822] GetProcessHeap () returned 0x630000 [0055.822] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0055.822] GetProcessHeap () returned 0x630000 [0055.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.822] GetProcessHeap () returned 0x630000 [0055.822] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.822] GetProcessHeap () returned 0x630000 [0055.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.822] GetProcessHeap () returned 0x630000 [0055.822] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0055.822] GetProcessHeap () returned 0x630000 [0055.823] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.823] GetProcessHeap () returned 0x630000 [0055.823] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.823] GetProcessHeap () returned 0x630000 [0055.823] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.823] GetProcessHeap () returned 0x630000 [0055.823] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0055.823] GetProcessHeap () returned 0x630000 [0055.823] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0055.823] GetProcessHeap () returned 0x630000 [0055.823] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.823] GetProcessHeap () returned 0x630000 [0055.823] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.823] GetProcessHeap () returned 0x630000 [0055.823] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.823] GetProcessHeap () returned 0x630000 [0055.823] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.823] GetProcessHeap () returned 0x630000 [0055.823] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.823] GetProcessHeap () returned 0x630000 [0055.823] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.823] GetProcessHeap () returned 0x630000 [0055.823] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.823] GetProcessHeap () returned 0x630000 [0055.823] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.823] GetProcessHeap () returned 0x630000 [0055.823] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0055.823] GetProcessHeap () returned 0x630000 [0055.823] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.823] GetProcessHeap () returned 0x630000 [0055.823] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.823] GetProcessHeap () returned 0x630000 [0055.823] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.823] GetProcessHeap () returned 0x630000 [0055.823] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.823] GetProcessHeap () returned 0x630000 [0055.823] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.823] GetProcessHeap () returned 0x630000 [0055.823] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.824] GetProcessHeap () returned 0x630000 [0055.824] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.824] GetProcessHeap () returned 0x630000 [0055.824] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.824] GetProcessHeap () returned 0x630000 [0055.824] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.824] GetProcessHeap () returned 0x630000 [0055.824] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.824] GetProcessHeap () returned 0x630000 [0055.824] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.824] GetProcessHeap () returned 0x630000 [0055.824] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0055.824] GetProcessHeap () returned 0x630000 [0055.824] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.824] GetProcessHeap () returned 0x630000 [0055.824] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0055.824] GetProcessHeap () returned 0x630000 [0055.824] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0055.824] GetProcessHeap () returned 0x630000 [0055.824] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.824] GetProcessHeap () returned 0x630000 [0055.824] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.824] GetProcessHeap () returned 0x630000 [0055.824] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.824] GetProcessHeap () returned 0x630000 [0055.824] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.824] GetProcessHeap () returned 0x630000 [0055.824] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0055.824] GetProcessHeap () returned 0x630000 [0055.824] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0055.824] GetProcessHeap () returned 0x630000 [0055.824] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.824] GetProcessHeap () returned 0x630000 [0055.824] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.824] GetProcessHeap () returned 0x630000 [0055.824] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.824] GetProcessHeap () returned 0x630000 [0055.824] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.824] GetProcessHeap () returned 0x630000 [0055.825] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0055.825] GetProcessHeap () returned 0x630000 [0055.825] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.825] GetProcessHeap () returned 0x630000 [0055.825] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.825] GetProcessHeap () returned 0x630000 [0055.825] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.825] GetProcessHeap () returned 0x630000 [0055.825] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0055.825] GetProcessHeap () returned 0x630000 [0055.825] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.825] GetProcessHeap () returned 0x630000 [0055.825] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0055.825] GetProcessHeap () returned 0x630000 [0055.825] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0055.825] GetProcessHeap () returned 0x630000 [0055.825] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0055.825] GetProcessHeap () returned 0x630000 [0055.825] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0055.825] GetProcessHeap () returned 0x630000 [0055.825] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.825] GetProcessHeap () returned 0x630000 [0055.825] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.825] GetProcessHeap () returned 0x630000 [0055.825] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.825] GetProcessHeap () returned 0x630000 [0055.825] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.825] GetProcessHeap () returned 0x630000 [0055.825] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.825] GetProcessHeap () returned 0x630000 [0055.825] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.825] GetProcessHeap () returned 0x630000 [0055.825] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.825] GetProcessHeap () returned 0x630000 [0055.825] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.825] GetProcessHeap () returned 0x630000 [0055.825] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.825] GetProcessHeap () returned 0x630000 [0055.825] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.825] GetProcessHeap () returned 0x630000 [0055.825] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.826] GetProcessHeap () returned 0x630000 [0055.826] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.826] GetProcessHeap () returned 0x630000 [0055.826] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0055.826] GetProcessHeap () returned 0x630000 [0055.826] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.826] GetProcessHeap () returned 0x630000 [0055.826] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.826] GetProcessHeap () returned 0x630000 [0055.826] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.826] GetProcessHeap () returned 0x630000 [0055.826] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.826] GetProcessHeap () returned 0x630000 [0055.826] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.826] GetProcessHeap () returned 0x630000 [0055.826] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.826] GetProcessHeap () returned 0x630000 [0055.826] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.826] GetProcessHeap () returned 0x630000 [0055.826] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.826] GetProcessHeap () returned 0x630000 [0055.826] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.826] GetProcessHeap () returned 0x630000 [0055.826] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0055.826] GetProcessHeap () returned 0x630000 [0055.826] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0055.826] GetProcessHeap () returned 0x630000 [0055.826] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.826] GetProcessHeap () returned 0x630000 [0055.826] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.826] GetProcessHeap () returned 0x630000 [0055.826] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0055.826] GetProcessHeap () returned 0x630000 [0055.826] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0055.826] GetProcessHeap () returned 0x630000 [0055.826] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0055.826] GetProcessHeap () returned 0x630000 [0055.826] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0055.826] GetProcessHeap () returned 0x630000 [0055.827] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0055.827] GetProcessHeap () returned 0x630000 [0055.827] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0055.827] GetProcessHeap () returned 0x630000 [0055.827] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0055.827] GetProcessHeap () returned 0x630000 [0055.827] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0055.827] GetProcessHeap () returned 0x630000 [0055.827] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0055.827] GetProcessHeap () returned 0x630000 [0055.827] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0055.827] GetProcessHeap () returned 0x630000 [0055.827] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0055.827] GetProcessHeap () returned 0x630000 [0055.827] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0055.827] GetProcessHeap () returned 0x630000 [0055.827] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0055.827] WriteFile (in: hFile=0x230, lpBuffer=0x65a570*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65a570*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0055.830] GetProcessHeap () returned 0x630000 [0055.830] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65a570, Size=0x30) returned 0x65a570 [0055.830] GetProcessHeap () returned 0x630000 [0055.830] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0055.830] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.830] GetProcessHeap () returned 0x630000 [0055.830] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16600) returned 0x65f188 [0055.830] ReadFile (in: hFile=0x230, lpBuffer=0x65f188, nNumberOfBytesToRead=0x16600, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65f188*, lpNumberOfBytesRead=0x243d7e8*=0x16600, lpOverlapped=0x0) returned 1 [0055.832] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0055.832] WriteFile (in: hFile=0x230, lpBuffer=0x65f188*, nNumberOfBytesToWrite=0x16600, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65f188*, lpNumberOfBytesWritten=0x243d7e4*=0x16600, lpOverlapped=0x0) returned 1 [0055.876] GetProcessHeap () returned 0x630000 [0055.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65f188 | out: hHeap=0x630000) returned 1 [0055.877] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.877] WriteFile (in: hFile=0x230, lpBuffer=0x65a570*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65a570*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0055.879] CloseHandle (hObject=0x230) returned 1 [0055.882] GetProcessHeap () returned 0x630000 [0055.882] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0055.882] GetProcessHeap () returned 0x630000 [0055.882] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655b20 | out: hHeap=0x630000) returned 1 [0055.882] GetProcessHeap () returned 0x630000 [0055.882] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0055.882] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml") returned="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml" [0055.882] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml.happythreechoose" [0055.882] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\i386\\biosblocks.xml"), lpNewFileName="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\i386\\biosblocks.xml.happythreechoose"), dwFlags=0x1) returned 1 [0055.883] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml" | out: pszPath="C:\\Windows10Upgrade\\resources\\i386") returned 1 [0055.883] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\i386" | out: pszPath="C:\\Windows10Upgrade\\resources\\i386\\") returned="" [0055.883] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\i386\\Decryption INFO.html" [0055.883] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\i386\\decryption info.html")) returned 0xffffffff [0055.883] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\i386\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0055.883] GetProcessHeap () returned 0x630000 [0055.883] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6557d8 [0055.883] GetProcessHeap () returned 0x630000 [0055.883] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0055.890] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.897] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.897] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.897] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.897] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.897] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.897] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.898] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.898] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.898] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.898] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.898] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.898] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.898] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.898] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.898] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.898] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.899] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.899] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.899] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.899] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.899] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.899] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.899] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.899] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.900] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.900] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.900] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.900] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.900] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.900] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.900] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.900] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.900] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.900] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.900] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.900] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.902] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.902] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.902] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.902] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.902] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.902] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.902] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.902] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.902] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.903] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.903] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.903] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.903] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.903] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.903] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.903] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.903] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.903] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.903] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.903] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.904] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.904] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.904] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.904] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.904] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.904] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.904] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.904] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.904] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.904] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.905] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.905] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.905] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.905] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.905] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.905] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.905] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.905] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.905] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.905] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.905] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.905] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.905] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.906] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.906] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.906] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.906] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.906] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.906] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.906] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.907] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.907] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.907] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.907] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.907] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.907] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.907] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.907] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.907] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.907] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.907] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.907] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.908] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.908] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.908] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.908] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.908] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.908] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.908] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.908] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.908] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.908] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.908] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.908] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.909] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.909] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.909] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.909] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.909] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.909] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.909] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.909] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.909] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.909] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.909] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.910] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.910] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.910] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.910] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.910] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.910] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.910] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.910] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.910] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.910] GetProcessHeap () returned 0x630000 [0055.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6557d8 | out: hHeap=0x630000) returned 1 [0055.910] GetProcessHeap () returned 0x630000 [0055.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0055.910] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0055.910] GetProcessHeap () returned 0x630000 [0055.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655a30 [0055.911] GetProcessHeap () returned 0x630000 [0055.911] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0055.919] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.919] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.920] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.920] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.920] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.920] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.920] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.920] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.920] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.920] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.920] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.920] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.920] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.920] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.920] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.921] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.921] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.921] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.921] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.921] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.934] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.934] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.934] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.934] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.934] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.934] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.934] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.934] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.934] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.934] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.934] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.934] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.934] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.937] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.937] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.937] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.937] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.937] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.937] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.937] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.941] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.942] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.942] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.942] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.942] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.942] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.942] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.943] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.943] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.943] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.943] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.943] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.943] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.943] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.943] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.943] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.943] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.943] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.943] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.944] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.944] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.944] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.944] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.944] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.944] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.944] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.944] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.944] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.944] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.944] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.945] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.945] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.945] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.945] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.945] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.945] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.945] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.945] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.945] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.945] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.945] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.945] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.946] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.946] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.946] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.946] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.946] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.946] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.946] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.946] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.946] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.946] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.946] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.946] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.946] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.947] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.947] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.947] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.947] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.947] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.947] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.947] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.947] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.947] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.948] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0055.948] GetProcessHeap () returned 0x630000 [0055.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655a30 | out: hHeap=0x630000) returned 1 [0055.948] GetProcessHeap () returned 0x630000 [0055.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0055.948] CloseHandle (hObject=0x230) returned 1 [0055.948] GetProcessHeap () returned 0x630000 [0055.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0055.948] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ac6e0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ac6e0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x4071, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hwcompat.txt", cAlternateFileName="")) returned 1 [0055.948] lstrcmpiW (lpString1="hwcompat.txt", lpString2=".") returned 1 [0055.948] lstrcmpiW (lpString1="hwcompat.txt", lpString2="..") returned 1 [0055.948] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\", lpString2="hwcompat.txt" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt") returned="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt" [0055.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwcompat.txt", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0055.948] GetProcessHeap () returned 0x630000 [0055.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd) returned 0x64ca20 [0055.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwcompat.txt", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hwcompat.txt", lpUsedDefaultChar=0x0) returned 13 [0055.948] lstrlenA (lpString="hwcompat.txt") returned 12 [0055.948] lstrlenA (lpString=".happythreechoose") returned 17 [0055.948] lstrcmpiW (lpString1="hwcompat.txt", lpString2="Decryption INFO.html") returned 1 [0055.948] lstrcmpiW (lpString1="hwcompat.txt", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0055.949] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0055.949] lstrcmpiW (lpString1="hwcompat.txt", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0055.949] GetProcessHeap () returned 0x630000 [0055.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0055.949] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwcompat.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0055.950] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=16497) returned 1 [0055.950] GetProcessHeap () returned 0x630000 [0055.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655aa8 [0055.950] GetProcessHeap () returned 0x630000 [0055.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0055.950] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt") returned 47 [0055.950] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0055.950] GetProcessHeap () returned 0x630000 [0055.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0055.950] GetProcessHeap () returned 0x630000 [0055.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38f) returned 0x65a5a8 [0055.951] lstrlenA (lpString="rsa_encrypt") returned 11 [0055.951] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0055.951] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0055.951] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0055.951] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0055.951] GetProcessHeap () returned 0x630000 [0055.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0055.951] lstrlenA (lpString="010001") returned 6 [0055.951] GetProcessHeap () returned 0x630000 [0055.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0055.951] GetProcessHeap () returned 0x630000 [0055.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0055.951] GetProcessHeap () returned 0x630000 [0055.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65df50 [0055.951] GetProcessHeap () returned 0x630000 [0055.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0055.951] GetProcessHeap () returned 0x630000 [0055.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0055.952] GetProcessHeap () returned 0x630000 [0055.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656db0 [0055.952] GetProcessHeap () returned 0x630000 [0055.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a298 [0055.952] GetProcessHeap () returned 0x630000 [0055.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0055.952] GetProcessHeap () returned 0x630000 [0055.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.952] GetProcessHeap () returned 0x630000 [0055.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0055.952] GetProcessHeap () returned 0x630000 [0055.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0055.952] GetProcessHeap () returned 0x630000 [0055.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656950 [0055.952] GetProcessHeap () returned 0x630000 [0055.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0055.952] GetProcessHeap () returned 0x630000 [0055.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0055.952] GetProcessHeap () returned 0x630000 [0055.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e460 [0055.952] GetProcessHeap () returned 0x630000 [0055.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0055.952] GetProcessHeap () returned 0x630000 [0055.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0055.952] GetProcessHeap () returned 0x630000 [0055.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e460 | out: hHeap=0x630000) returned 1 [0055.952] GetProcessHeap () returned 0x630000 [0055.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.952] GetProcessHeap () returned 0x630000 [0055.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cfb8 [0055.952] GetProcessHeap () returned 0x630000 [0055.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0055.952] GetProcessHeap () returned 0x630000 [0055.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.952] GetProcessHeap () returned 0x630000 [0055.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.952] GetProcessHeap () returned 0x630000 [0055.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.952] GetProcessHeap () returned 0x630000 [0055.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65dfe0 [0055.952] GetProcessHeap () returned 0x630000 [0055.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cfb8 | out: hHeap=0x630000) returned 1 [0055.953] GetProcessHeap () returned 0x630000 [0055.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0055.953] GetProcessHeap () returned 0x630000 [0055.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0055.953] GetProcessHeap () returned 0x630000 [0055.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0055.953] GetProcessHeap () returned 0x630000 [0055.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0055.953] GetProcessHeap () returned 0x630000 [0055.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0055.953] GetProcessHeap () returned 0x630000 [0055.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0055.953] GetProcessHeap () returned 0x630000 [0055.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.953] GetProcessHeap () returned 0x630000 [0055.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.953] GetProcessHeap () returned 0x630000 [0055.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0055.953] GetProcessHeap () returned 0x630000 [0055.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0055.953] GetProcessHeap () returned 0x630000 [0055.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.953] GetProcessHeap () returned 0x630000 [0055.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.953] GetProcessHeap () returned 0x630000 [0055.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.953] GetProcessHeap () returned 0x630000 [0055.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.953] GetProcessHeap () returned 0x630000 [0055.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0055.953] GetProcessHeap () returned 0x630000 [0055.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0055.953] GetProcessHeap () returned 0x630000 [0055.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.953] GetProcessHeap () returned 0x630000 [0055.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.953] GetProcessHeap () returned 0x630000 [0055.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0055.954] GetProcessHeap () returned 0x630000 [0055.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0055.954] GetProcessHeap () returned 0x630000 [0055.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.954] GetProcessHeap () returned 0x630000 [0055.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.954] GetProcessHeap () returned 0x630000 [0055.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.954] GetProcessHeap () returned 0x630000 [0055.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.954] GetProcessHeap () returned 0x630000 [0055.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.954] GetProcessHeap () returned 0x630000 [0055.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.954] GetProcessHeap () returned 0x630000 [0055.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.954] GetProcessHeap () returned 0x630000 [0055.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.954] GetProcessHeap () returned 0x630000 [0055.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.954] GetProcessHeap () returned 0x630000 [0055.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.954] GetProcessHeap () returned 0x630000 [0055.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.954] GetProcessHeap () returned 0x630000 [0055.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.954] GetProcessHeap () returned 0x630000 [0055.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.954] GetProcessHeap () returned 0x630000 [0055.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.954] GetProcessHeap () returned 0x630000 [0055.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.954] GetProcessHeap () returned 0x630000 [0055.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.954] GetProcessHeap () returned 0x630000 [0055.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0055.954] GetProcessHeap () returned 0x630000 [0055.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0055.954] GetProcessHeap () returned 0x630000 [0055.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0055.955] GetProcessHeap () returned 0x630000 [0055.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0055.955] GetProcessHeap () returned 0x630000 [0055.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0055.955] GetProcessHeap () returned 0x630000 [0055.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0055.955] GetProcessHeap () returned 0x630000 [0055.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0055.955] GetProcessHeap () returned 0x630000 [0055.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0055.955] GetProcessHeap () returned 0x630000 [0055.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0055.955] GetProcessHeap () returned 0x630000 [0055.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0055.955] GetProcessHeap () returned 0x630000 [0055.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0055.955] GetProcessHeap () returned 0x630000 [0055.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0055.955] GetProcessHeap () returned 0x630000 [0055.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0055.955] GetProcessHeap () returned 0x630000 [0055.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0055.955] GetProcessHeap () returned 0x630000 [0055.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0055.955] GetProcessHeap () returned 0x630000 [0055.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0055.955] GetProcessHeap () returned 0x630000 [0055.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0055.955] GetProcessHeap () returned 0x630000 [0055.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0055.955] GetProcessHeap () returned 0x630000 [0055.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.955] GetProcessHeap () returned 0x630000 [0055.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.955] GetProcessHeap () returned 0x630000 [0055.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0055.955] GetProcessHeap () returned 0x630000 [0055.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0055.955] GetProcessHeap () returned 0x630000 [0055.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0055.956] GetProcessHeap () returned 0x630000 [0055.956] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0055.956] GetProcessHeap () returned 0x630000 [0055.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.956] GetProcessHeap () returned 0x630000 [0055.956] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.956] GetProcessHeap () returned 0x630000 [0055.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0055.956] GetProcessHeap () returned 0x630000 [0055.956] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0055.956] GetProcessHeap () returned 0x630000 [0055.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.956] GetProcessHeap () returned 0x630000 [0055.956] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.956] GetProcessHeap () returned 0x630000 [0055.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.956] GetProcessHeap () returned 0x630000 [0055.956] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.956] GetProcessHeap () returned 0x630000 [0055.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0055.956] GetProcessHeap () returned 0x630000 [0055.956] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0055.956] GetProcessHeap () returned 0x630000 [0055.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0055.956] GetProcessHeap () returned 0x630000 [0055.956] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0055.956] GetProcessHeap () returned 0x630000 [0055.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0055.956] GetProcessHeap () returned 0x630000 [0055.956] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0055.956] GetProcessHeap () returned 0x630000 [0055.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0055.956] GetProcessHeap () returned 0x630000 [0055.956] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0055.956] GetProcessHeap () returned 0x630000 [0055.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0055.956] GetProcessHeap () returned 0x630000 [0055.956] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0055.957] GetProcessHeap () returned 0x630000 [0055.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0055.957] GetProcessHeap () returned 0x630000 [0055.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0055.957] GetProcessHeap () returned 0x630000 [0055.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0055.957] GetProcessHeap () returned 0x630000 [0055.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0055.957] GetProcessHeap () returned 0x630000 [0055.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0055.957] GetProcessHeap () returned 0x630000 [0055.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0055.957] GetProcessHeap () returned 0x630000 [0055.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0055.957] GetProcessHeap () returned 0x630000 [0055.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0055.957] GetProcessHeap () returned 0x630000 [0055.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0055.957] GetProcessHeap () returned 0x630000 [0055.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0055.957] GetProcessHeap () returned 0x630000 [0055.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0055.957] GetProcessHeap () returned 0x630000 [0055.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0055.957] GetProcessHeap () returned 0x630000 [0055.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0055.957] GetProcessHeap () returned 0x630000 [0055.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0055.957] GetProcessHeap () returned 0x630000 [0055.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0055.957] GetProcessHeap () returned 0x630000 [0055.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0055.957] GetProcessHeap () returned 0x630000 [0055.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0055.957] WriteFile (in: hFile=0x230, lpBuffer=0x65a5a8*, nNumberOfBytesToWrite=0x38f, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65a5a8*, lpNumberOfBytesWritten=0x243d864*=0x38f, lpOverlapped=0x0) returned 1 [0056.049] GetProcessHeap () returned 0x630000 [0056.049] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65a5a8, Size=0x30) returned 0x65a5a8 [0056.049] GetProcessHeap () returned 0x630000 [0056.049] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0056.049] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0056.049] GetProcessHeap () returned 0x630000 [0056.049] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4080) returned 0x65ed80 [0056.050] ReadFile (in: hFile=0x230, lpBuffer=0x65ed80, nNumberOfBytesToRead=0x4080, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesRead=0x243d7e8*=0x4080, lpOverlapped=0x0) returned 1 [0056.052] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0056.052] WriteFile (in: hFile=0x230, lpBuffer=0x65ed80*, nNumberOfBytesToWrite=0x4080, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ed80*, lpNumberOfBytesWritten=0x243d7e4*=0x4080, lpOverlapped=0x0) returned 1 [0056.064] GetProcessHeap () returned 0x630000 [0056.064] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ed80 | out: hHeap=0x630000) returned 1 [0056.065] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0056.065] WriteFile (in: hFile=0x230, lpBuffer=0x65a5a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65a5a8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0056.067] CloseHandle (hObject=0x230) returned 1 [0056.068] GetProcessHeap () returned 0x630000 [0056.068] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0056.068] GetProcessHeap () returned 0x630000 [0056.068] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655aa8 | out: hHeap=0x630000) returned 1 [0056.068] GetProcessHeap () returned 0x630000 [0056.068] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0056.068] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt") returned="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt" [0056.068] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt.happythreechoose" [0056.068] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwcompat.txt"), lpNewFileName="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwcompat.txt.happythreechoose"), dwFlags=0x1) returned 1 [0056.069] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt" | out: pszPath="C:\\Windows10Upgrade\\resources\\i386") returned 1 [0056.069] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\i386" | out: pszPath="C:\\Windows10Upgrade\\resources\\i386\\") returned="" [0056.069] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\i386\\Decryption INFO.html" [0056.069] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\i386\\decryption info.html")) returned 0x20 [0056.069] GetProcessHeap () returned 0x630000 [0056.069] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0056.069] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ada69, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ada69, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x8d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hwexclude.txt", cAlternateFileName="HWEXCL~1.TXT")) returned 1 [0056.069] lstrcmpiW (lpString1="hwexclude.txt", lpString2=".") returned 1 [0056.069] lstrcmpiW (lpString1="hwexclude.txt", lpString2="..") returned 1 [0056.069] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\", lpString2="hwexclude.txt" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt") returned="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt" [0056.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwexclude.txt", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0056.069] GetProcessHeap () returned 0x630000 [0056.069] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x64c9f0 [0056.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwexclude.txt", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hwexclude.txt", lpUsedDefaultChar=0x0) returned 14 [0056.070] lstrlenA (lpString="hwexclude.txt") returned 13 [0056.070] lstrlenA (lpString=".happythreechoose") returned 17 [0056.070] lstrcmpiW (lpString1="hwexclude.txt", lpString2="Decryption INFO.html") returned 1 [0056.070] lstrcmpiW (lpString1="hwexclude.txt", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0056.070] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0056.070] lstrcmpiW (lpString1="hwexclude.txt", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0056.070] GetProcessHeap () returned 0x630000 [0056.070] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651ec0 [0056.070] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwexclude.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0056.070] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=2263) returned 1 [0056.070] GetProcessHeap () returned 0x630000 [0056.070] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6558c8 [0056.070] GetProcessHeap () returned 0x630000 [0056.070] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0056.070] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt") returned 48 [0056.070] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0056.070] GetProcessHeap () returned 0x630000 [0056.070] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0056.070] GetProcessHeap () returned 0x630000 [0056.070] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x389) returned 0x65a5e0 [0056.070] lstrlenA (lpString="rsa_encrypt") returned 11 [0056.070] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0056.071] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0056.071] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0056.071] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0056.071] GetProcessHeap () returned 0x630000 [0056.071] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0056.071] lstrlenA (lpString="010001") returned 6 [0056.071] GetProcessHeap () returned 0x630000 [0056.071] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a328 [0056.071] GetProcessHeap () returned 0x630000 [0056.071] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0056.071] GetProcessHeap () returned 0x630000 [0056.071] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e3d0 [0056.071] GetProcessHeap () returned 0x630000 [0056.071] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0056.071] GetProcessHeap () returned 0x630000 [0056.072] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e730 [0056.072] GetProcessHeap () returned 0x630000 [0056.072] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657328 [0056.072] GetProcessHeap () returned 0x630000 [0056.072] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a398 [0056.072] GetProcessHeap () returned 0x630000 [0056.072] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0056.072] GetProcessHeap () returned 0x630000 [0056.072] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0056.072] GetProcessHeap () returned 0x630000 [0056.072] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0056.072] GetProcessHeap () returned 0x630000 [0056.072] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0056.072] GetProcessHeap () returned 0x630000 [0056.072] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656a68 [0056.072] GetProcessHeap () returned 0x630000 [0056.072] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0056.072] GetProcessHeap () returned 0x630000 [0056.072] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0056.072] GetProcessHeap () returned 0x630000 [0056.072] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e6a0 [0056.072] GetProcessHeap () returned 0x630000 [0056.072] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0056.074] GetProcessHeap () returned 0x630000 [0056.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0056.074] GetProcessHeap () returned 0x630000 [0056.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e6a0 | out: hHeap=0x630000) returned 1 [0056.074] GetProcessHeap () returned 0x630000 [0056.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0056.074] GetProcessHeap () returned 0x630000 [0056.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65f0c8 [0056.075] GetProcessHeap () returned 0x630000 [0056.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0056.076] GetProcessHeap () returned 0x630000 [0056.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0056.076] GetProcessHeap () returned 0x630000 [0056.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0056.076] GetProcessHeap () returned 0x630000 [0056.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0056.076] GetProcessHeap () returned 0x630000 [0056.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e580 [0056.076] GetProcessHeap () returned 0x630000 [0056.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65f0c8 | out: hHeap=0x630000) returned 1 [0056.076] GetProcessHeap () returned 0x630000 [0056.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0056.076] GetProcessHeap () returned 0x630000 [0056.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0056.076] GetProcessHeap () returned 0x630000 [0056.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0056.076] GetProcessHeap () returned 0x630000 [0056.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0056.076] GetProcessHeap () returned 0x630000 [0056.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0056.076] GetProcessHeap () returned 0x630000 [0056.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0056.076] GetProcessHeap () returned 0x630000 [0056.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0056.076] GetProcessHeap () returned 0x630000 [0056.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0056.076] GetProcessHeap () returned 0x630000 [0056.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0056.076] GetProcessHeap () returned 0x630000 [0056.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0056.076] GetProcessHeap () returned 0x630000 [0056.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0056.076] GetProcessHeap () returned 0x630000 [0056.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0056.076] GetProcessHeap () returned 0x630000 [0056.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0056.077] GetProcessHeap () returned 0x630000 [0056.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0056.077] GetProcessHeap () returned 0x630000 [0056.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0056.077] GetProcessHeap () returned 0x630000 [0056.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0056.077] GetProcessHeap () returned 0x630000 [0056.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.077] GetProcessHeap () returned 0x630000 [0056.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.077] GetProcessHeap () returned 0x630000 [0056.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.077] GetProcessHeap () returned 0x630000 [0056.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.077] GetProcessHeap () returned 0x630000 [0056.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0056.077] GetProcessHeap () returned 0x630000 [0056.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0056.077] GetProcessHeap () returned 0x630000 [0056.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0056.077] GetProcessHeap () returned 0x630000 [0056.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0056.077] GetProcessHeap () returned 0x630000 [0056.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.077] GetProcessHeap () returned 0x630000 [0056.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.077] GetProcessHeap () returned 0x630000 [0056.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0056.077] GetProcessHeap () returned 0x630000 [0056.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0056.077] GetProcessHeap () returned 0x630000 [0056.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0056.077] GetProcessHeap () returned 0x630000 [0056.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0056.078] GetProcessHeap () returned 0x630000 [0056.078] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0056.078] GetProcessHeap () returned 0x630000 [0056.078] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0056.078] GetProcessHeap () returned 0x630000 [0056.078] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0056.078] GetProcessHeap () returned 0x630000 [0056.078] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0056.078] GetProcessHeap () returned 0x630000 [0056.078] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.078] GetProcessHeap () returned 0x630000 [0056.078] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.078] GetProcessHeap () returned 0x630000 [0056.078] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0056.078] GetProcessHeap () returned 0x630000 [0056.078] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0056.078] GetProcessHeap () returned 0x630000 [0056.078] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0056.078] GetProcessHeap () returned 0x630000 [0056.078] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0056.078] GetProcessHeap () returned 0x630000 [0056.078] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0056.078] GetProcessHeap () returned 0x630000 [0056.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0056.079] GetProcessHeap () returned 0x630000 [0056.079] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.079] GetProcessHeap () returned 0x630000 [0056.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.079] GetProcessHeap () returned 0x630000 [0056.079] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0056.079] GetProcessHeap () returned 0x630000 [0056.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0056.079] GetProcessHeap () returned 0x630000 [0056.079] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0056.079] GetProcessHeap () returned 0x630000 [0056.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0056.079] GetProcessHeap () returned 0x630000 [0056.079] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0056.079] GetProcessHeap () returned 0x630000 [0056.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0056.079] GetProcessHeap () returned 0x630000 [0056.079] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.079] GetProcessHeap () returned 0x630000 [0056.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.079] GetProcessHeap () returned 0x630000 [0056.079] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0056.079] GetProcessHeap () returned 0x630000 [0056.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0056.079] GetProcessHeap () returned 0x630000 [0056.079] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0056.079] GetProcessHeap () returned 0x630000 [0056.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0056.079] GetProcessHeap () returned 0x630000 [0056.079] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0056.079] GetProcessHeap () returned 0x630000 [0056.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0056.079] GetProcessHeap () returned 0x630000 [0056.079] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0056.080] GetProcessHeap () returned 0x630000 [0056.080] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0056.080] GetProcessHeap () returned 0x630000 [0056.080] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0056.080] GetProcessHeap () returned 0x630000 [0056.080] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0056.080] GetProcessHeap () returned 0x630000 [0056.080] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0056.080] GetProcessHeap () returned 0x630000 [0056.080] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0056.080] GetProcessHeap () returned 0x630000 [0056.080] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0056.080] GetProcessHeap () returned 0x630000 [0056.080] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0056.080] GetProcessHeap () returned 0x630000 [0056.080] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0056.080] GetProcessHeap () returned 0x630000 [0056.080] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0056.080] GetProcessHeap () returned 0x630000 [0056.080] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0056.080] GetProcessHeap () returned 0x630000 [0056.080] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0056.080] GetProcessHeap () returned 0x630000 [0056.080] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0056.080] GetProcessHeap () returned 0x630000 [0056.081] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0056.081] GetProcessHeap () returned 0x630000 [0056.081] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0056.081] GetProcessHeap () returned 0x630000 [0056.081] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0056.081] GetProcessHeap () returned 0x630000 [0056.081] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0056.081] GetProcessHeap () returned 0x630000 [0056.081] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0056.081] GetProcessHeap () returned 0x630000 [0056.081] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0056.081] GetProcessHeap () returned 0x630000 [0056.081] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0056.081] GetProcessHeap () returned 0x630000 [0056.081] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0056.081] GetProcessHeap () returned 0x630000 [0056.081] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0056.081] GetProcessHeap () returned 0x630000 [0056.081] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.081] GetProcessHeap () returned 0x630000 [0056.081] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.081] GetProcessHeap () returned 0x630000 [0056.081] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0056.081] GetProcessHeap () returned 0x630000 [0056.081] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0056.081] GetProcessHeap () returned 0x630000 [0056.081] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0056.081] GetProcessHeap () returned 0x630000 [0056.081] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0056.081] GetProcessHeap () returned 0x630000 [0056.081] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0056.081] GetProcessHeap () returned 0x630000 [0056.081] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0056.081] GetProcessHeap () returned 0x630000 [0056.081] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0056.082] GetProcessHeap () returned 0x630000 [0056.082] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0056.082] GetProcessHeap () returned 0x630000 [0056.082] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0056.082] GetProcessHeap () returned 0x630000 [0056.082] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0056.082] GetProcessHeap () returned 0x630000 [0056.082] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0056.082] GetProcessHeap () returned 0x630000 [0056.082] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.082] GetProcessHeap () returned 0x630000 [0056.082] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0056.082] WriteFile (in: hFile=0x230, lpBuffer=0x65a5e0*, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65a5e0*, lpNumberOfBytesWritten=0x243d864*=0x389, lpOverlapped=0x0) returned 1 [0056.085] GetProcessHeap () returned 0x630000 [0056.085] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65a5e0, Size=0x30) returned 0x65a5e0 [0056.085] GetProcessHeap () returned 0x630000 [0056.085] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0056.085] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0056.085] GetProcessHeap () returned 0x630000 [0056.085] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8e0) returned 0x65f188 [0056.085] ReadFile (in: hFile=0x230, lpBuffer=0x65f188, nNumberOfBytesToRead=0x8e0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65f188*, lpNumberOfBytesRead=0x243d7e8*=0x8e0, lpOverlapped=0x0) returned 1 [0056.085] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0056.085] WriteFile (in: hFile=0x230, lpBuffer=0x65f188*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65f188*, lpNumberOfBytesWritten=0x243d7e4*=0x8e0, lpOverlapped=0x0) returned 1 [0056.086] GetProcessHeap () returned 0x630000 [0056.086] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65f188 | out: hHeap=0x630000) returned 1 [0056.086] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0056.086] WriteFile (in: hFile=0x230, lpBuffer=0x65a5e0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65a5e0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0056.087] CloseHandle (hObject=0x230) returned 1 [0056.089] GetProcessHeap () returned 0x630000 [0056.089] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651ec0 | out: hHeap=0x630000) returned 1 [0056.089] GetProcessHeap () returned 0x630000 [0056.089] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6558c8 | out: hHeap=0x630000) returned 1 [0056.089] GetProcessHeap () returned 0x630000 [0056.089] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0056.089] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt") returned="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt" [0056.089] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt.happythreechoose" [0056.089] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwexclude.txt"), lpNewFileName="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwexclude.txt.happythreechoose"), dwFlags=0x1) returned 1 [0056.090] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt" | out: pszPath="C:\\Windows10Upgrade\\resources\\i386") returned 1 [0056.090] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\i386" | out: pszPath="C:\\Windows10Upgrade\\resources\\i386\\") returned="" [0056.090] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\i386\\Decryption INFO.html" [0056.090] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\i386\\decryption info.html")) returned 0x20 [0056.090] GetProcessHeap () returned 0x630000 [0056.090] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0056.090] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3aedef, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3aedef, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x2684, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nxquery.cat", cAlternateFileName="")) returned 1 [0056.090] lstrcmpiW (lpString1="nxquery.cat", lpString2=".") returned 1 [0056.090] lstrcmpiW (lpString1="nxquery.cat", lpString2="..") returned 1 [0056.090] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\", lpString2="nxquery.cat" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat") returned="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat" [0056.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nxquery.cat", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0056.090] GetProcessHeap () returned 0x630000 [0056.090] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64ca20 [0056.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nxquery.cat", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nxquery.cat", lpUsedDefaultChar=0x0) returned 12 [0056.090] lstrlenA (lpString="nxquery.cat") returned 11 [0056.090] lstrlenA (lpString=".happythreechoose") returned 17 [0056.090] lstrcmpiW (lpString1="nxquery.cat", lpString2="Decryption INFO.html") returned 1 [0056.090] lstrcmpiW (lpString1="nxquery.cat", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0056.090] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0056.090] lstrcmpiW (lpString1="nxquery.cat", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0056.090] GetProcessHeap () returned 0x630000 [0056.090] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651ec0 [0056.090] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0056.091] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=9860) returned 1 [0056.091] GetProcessHeap () returned 0x630000 [0056.091] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655670 [0056.091] GetProcessHeap () returned 0x630000 [0056.091] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0056.091] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat") returned 46 [0056.091] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0056.091] GetProcessHeap () returned 0x630000 [0056.091] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0056.091] GetProcessHeap () returned 0x630000 [0056.091] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x65a618 [0056.092] lstrlenA (lpString="rsa_encrypt") returned 11 [0056.092] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0056.092] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0056.092] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0056.092] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0056.092] GetProcessHeap () returned 0x630000 [0056.092] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0056.092] lstrlenA (lpString="010001") returned 6 [0056.092] GetProcessHeap () returned 0x630000 [0056.092] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a398 [0056.092] GetProcessHeap () returned 0x630000 [0056.092] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0056.092] GetProcessHeap () returned 0x630000 [0056.092] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e8e0 [0056.093] GetProcessHeap () returned 0x630000 [0056.093] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0056.093] GetProcessHeap () returned 0x630000 [0056.093] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea90 [0056.093] GetProcessHeap () returned 0x630000 [0056.093] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x6570f8 [0056.093] GetProcessHeap () returned 0x630000 [0056.093] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3f8 [0056.093] GetProcessHeap () returned 0x630000 [0056.093] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0056.093] GetProcessHeap () returned 0x630000 [0056.093] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0056.093] GetProcessHeap () returned 0x630000 [0056.093] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0056.093] GetProcessHeap () returned 0x630000 [0056.093] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0056.093] GetProcessHeap () returned 0x630000 [0056.093] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656950 [0056.093] GetProcessHeap () returned 0x630000 [0056.093] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0056.093] GetProcessHeap () returned 0x630000 [0056.094] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0056.094] GetProcessHeap () returned 0x630000 [0056.094] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0056.094] GetProcessHeap () returned 0x630000 [0056.094] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0056.094] GetProcessHeap () returned 0x630000 [0056.094] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0056.094] GetProcessHeap () returned 0x630000 [0056.094] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0056.094] GetProcessHeap () returned 0x630000 [0056.094] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0056.094] GetProcessHeap () returned 0x630000 [0056.094] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65efd8 [0056.094] GetProcessHeap () returned 0x630000 [0056.094] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0056.094] GetProcessHeap () returned 0x630000 [0056.094] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0056.094] GetProcessHeap () returned 0x630000 [0056.094] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0056.094] GetProcessHeap () returned 0x630000 [0056.094] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0056.094] GetProcessHeap () returned 0x630000 [0056.094] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e4f0 [0056.094] GetProcessHeap () returned 0x630000 [0056.094] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65efd8 | out: hHeap=0x630000) returned 1 [0056.094] GetProcessHeap () returned 0x630000 [0056.095] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0056.095] GetProcessHeap () returned 0x630000 [0056.095] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0056.095] GetProcessHeap () returned 0x630000 [0056.095] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0056.095] GetProcessHeap () returned 0x630000 [0056.095] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0056.095] GetProcessHeap () returned 0x630000 [0056.095] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.095] GetProcessHeap () returned 0x630000 [0056.095] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.095] GetProcessHeap () returned 0x630000 [0056.095] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0056.095] GetProcessHeap () returned 0x630000 [0056.095] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0056.095] GetProcessHeap () returned 0x630000 [0056.095] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.095] GetProcessHeap () returned 0x630000 [0056.095] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.095] GetProcessHeap () returned 0x630000 [0056.095] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.095] GetProcessHeap () returned 0x630000 [0056.095] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.095] GetProcessHeap () returned 0x630000 [0056.095] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0056.095] GetProcessHeap () returned 0x630000 [0056.095] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0056.095] GetProcessHeap () returned 0x630000 [0056.095] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0056.095] GetProcessHeap () returned 0x630000 [0056.095] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0056.095] GetProcessHeap () returned 0x630000 [0056.095] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0056.095] GetProcessHeap () returned 0x630000 [0056.095] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0056.095] GetProcessHeap () returned 0x630000 [0056.095] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0056.095] GetProcessHeap () returned 0x630000 [0056.095] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0056.095] GetProcessHeap () returned 0x630000 [0056.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.096] GetProcessHeap () returned 0x630000 [0056.096] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.096] GetProcessHeap () returned 0x630000 [0056.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0056.096] GetProcessHeap () returned 0x630000 [0056.096] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0056.096] GetProcessHeap () returned 0x630000 [0056.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0056.096] GetProcessHeap () returned 0x630000 [0056.096] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0056.096] GetProcessHeap () returned 0x630000 [0056.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.096] GetProcessHeap () returned 0x630000 [0056.096] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.096] GetProcessHeap () returned 0x630000 [0056.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0056.096] GetProcessHeap () returned 0x630000 [0056.096] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0056.096] GetProcessHeap () returned 0x630000 [0056.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0056.096] GetProcessHeap () returned 0x630000 [0056.096] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0056.096] GetProcessHeap () returned 0x630000 [0056.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.096] GetProcessHeap () returned 0x630000 [0056.096] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.096] GetProcessHeap () returned 0x630000 [0056.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.096] GetProcessHeap () returned 0x630000 [0056.096] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.096] GetProcessHeap () returned 0x630000 [0056.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.096] GetProcessHeap () returned 0x630000 [0056.096] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.096] GetProcessHeap () returned 0x630000 [0056.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.096] GetProcessHeap () returned 0x630000 [0056.096] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.097] GetProcessHeap () returned 0x630000 [0056.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0056.097] GetProcessHeap () returned 0x630000 [0056.097] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0056.097] GetProcessHeap () returned 0x630000 [0056.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.097] GetProcessHeap () returned 0x630000 [0056.097] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.097] GetProcessHeap () returned 0x630000 [0056.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0056.097] GetProcessHeap () returned 0x630000 [0056.097] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0056.097] GetProcessHeap () returned 0x630000 [0056.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.097] GetProcessHeap () returned 0x630000 [0056.097] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.097] GetProcessHeap () returned 0x630000 [0056.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0056.097] GetProcessHeap () returned 0x630000 [0056.097] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0056.097] GetProcessHeap () returned 0x630000 [0056.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0056.097] GetProcessHeap () returned 0x630000 [0056.097] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0056.097] GetProcessHeap () returned 0x630000 [0056.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0056.097] GetProcessHeap () returned 0x630000 [0056.097] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0056.097] GetProcessHeap () returned 0x630000 [0056.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0056.097] GetProcessHeap () returned 0x630000 [0056.097] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0056.097] GetProcessHeap () returned 0x630000 [0056.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0056.097] GetProcessHeap () returned 0x630000 [0056.097] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0056.097] GetProcessHeap () returned 0x630000 [0056.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0056.097] GetProcessHeap () returned 0x630000 [0056.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0056.098] GetProcessHeap () returned 0x630000 [0056.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.098] GetProcessHeap () returned 0x630000 [0056.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.098] GetProcessHeap () returned 0x630000 [0056.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0056.098] GetProcessHeap () returned 0x630000 [0056.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0056.098] GetProcessHeap () returned 0x630000 [0056.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.098] GetProcessHeap () returned 0x630000 [0056.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.098] GetProcessHeap () returned 0x630000 [0056.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.098] GetProcessHeap () returned 0x630000 [0056.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.098] GetProcessHeap () returned 0x630000 [0056.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0056.098] GetProcessHeap () returned 0x630000 [0056.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0056.098] GetProcessHeap () returned 0x630000 [0056.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0056.098] GetProcessHeap () returned 0x630000 [0056.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0056.098] GetProcessHeap () returned 0x630000 [0056.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.098] GetProcessHeap () returned 0x630000 [0056.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.098] GetProcessHeap () returned 0x630000 [0056.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.098] GetProcessHeap () returned 0x630000 [0056.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.098] GetProcessHeap () returned 0x630000 [0056.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.098] GetProcessHeap () returned 0x630000 [0056.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.098] GetProcessHeap () returned 0x630000 [0056.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0056.098] GetProcessHeap () returned 0x630000 [0056.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0056.099] GetProcessHeap () returned 0x630000 [0056.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0056.099] GetProcessHeap () returned 0x630000 [0056.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0056.099] GetProcessHeap () returned 0x630000 [0056.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0056.099] GetProcessHeap () returned 0x630000 [0056.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0056.099] GetProcessHeap () returned 0x630000 [0056.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0056.099] GetProcessHeap () returned 0x630000 [0056.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0056.099] GetProcessHeap () returned 0x630000 [0056.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0056.099] GetProcessHeap () returned 0x630000 [0056.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0056.099] GetProcessHeap () returned 0x630000 [0056.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0056.099] GetProcessHeap () returned 0x630000 [0056.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea90 | out: hHeap=0x630000) returned 1 [0056.099] GetProcessHeap () returned 0x630000 [0056.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0056.099] GetProcessHeap () returned 0x630000 [0056.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0056.099] GetProcessHeap () returned 0x630000 [0056.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0056.099] GetProcessHeap () returned 0x630000 [0056.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0056.099] GetProcessHeap () returned 0x630000 [0056.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0056.099] WriteFile (in: hFile=0x230, lpBuffer=0x65a618*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65a618*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0056.108] GetProcessHeap () returned 0x630000 [0056.108] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65a618, Size=0x30) returned 0x65a618 [0056.108] GetProcessHeap () returned 0x630000 [0056.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0056.108] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0056.108] GetProcessHeap () returned 0x630000 [0056.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2684) returned 0x65f188 [0056.109] ReadFile (in: hFile=0x230, lpBuffer=0x65f188, nNumberOfBytesToRead=0x2684, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65f188*, lpNumberOfBytesRead=0x243d7e8*=0x2684, lpOverlapped=0x0) returned 1 [0056.109] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0056.110] WriteFile (in: hFile=0x230, lpBuffer=0x65f188*, nNumberOfBytesToWrite=0x2684, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65f188*, lpNumberOfBytesWritten=0x243d7e4*=0x2684, lpOverlapped=0x0) returned 1 [0056.110] GetProcessHeap () returned 0x630000 [0056.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65f188 | out: hHeap=0x630000) returned 1 [0056.111] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0056.111] WriteFile (in: hFile=0x230, lpBuffer=0x65a618*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65a618*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0056.111] CloseHandle (hObject=0x230) returned 1 [0056.113] GetProcessHeap () returned 0x630000 [0056.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651ec0 | out: hHeap=0x630000) returned 1 [0056.113] GetProcessHeap () returned 0x630000 [0056.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655670 | out: hHeap=0x630000) returned 1 [0056.113] GetProcessHeap () returned 0x630000 [0056.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0056.113] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat") returned="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat" [0056.113] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat.happythreechoose" [0056.113] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.cat"), lpNewFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.cat.happythreechoose"), dwFlags=0x1) returned 1 [0056.113] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat" | out: pszPath="C:\\Windows10Upgrade\\resources\\i386") returned 1 [0056.113] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\i386" | out: pszPath="C:\\Windows10Upgrade\\resources\\i386\\") returned="" [0056.113] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\i386\\Decryption INFO.html" [0056.114] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\i386\\decryption info.html")) returned 0x20 [0056.114] GetProcessHeap () returned 0x630000 [0056.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0056.114] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b017f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b017f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x5d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nxquery.inf", cAlternateFileName="")) returned 1 [0056.114] lstrcmpiW (lpString1="nxquery.inf", lpString2=".") returned 1 [0056.114] lstrcmpiW (lpString1="nxquery.inf", lpString2="..") returned 1 [0056.114] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\", lpString2="nxquery.inf" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf") returned="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf" [0056.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nxquery.inf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0056.114] GetProcessHeap () returned 0x630000 [0056.114] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0056.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nxquery.inf", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nxquery.inf", lpUsedDefaultChar=0x0) returned 12 [0056.114] lstrlenA (lpString="nxquery.inf") returned 11 [0056.114] lstrlenA (lpString=".happythreechoose") returned 17 [0056.114] lstrcmpiW (lpString1="nxquery.inf", lpString2="Decryption INFO.html") returned 1 [0056.114] lstrcmpiW (lpString1="nxquery.inf", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0056.114] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0056.114] lstrcmpiW (lpString1="nxquery.inf", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0056.114] GetProcessHeap () returned 0x630000 [0056.114] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0056.114] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0056.114] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=1495) returned 1 [0056.114] GetProcessHeap () returned 0x630000 [0056.114] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655940 [0056.114] GetProcessHeap () returned 0x630000 [0056.115] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0056.115] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf") returned 46 [0056.115] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0056.115] GetProcessHeap () returned 0x630000 [0056.115] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0056.115] GetProcessHeap () returned 0x630000 [0056.115] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x389) returned 0x65a650 [0056.115] lstrlenA (lpString="rsa_encrypt") returned 11 [0056.115] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0056.115] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0056.115] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0056.115] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0056.115] GetProcessHeap () returned 0x630000 [0056.115] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0056.115] lstrlenA (lpString="010001") returned 6 [0056.115] GetProcessHeap () returned 0x630000 [0056.115] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a368 [0056.116] GetProcessHeap () returned 0x630000 [0056.116] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0056.116] GetProcessHeap () returned 0x630000 [0056.116] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65df50 [0056.116] GetProcessHeap () returned 0x630000 [0056.116] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0056.116] GetProcessHeap () returned 0x630000 [0056.116] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dec0 [0056.116] GetProcessHeap () returned 0x630000 [0056.116] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656fe0 [0056.116] GetProcessHeap () returned 0x630000 [0056.116] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0056.116] GetProcessHeap () returned 0x630000 [0056.116] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0056.116] GetProcessHeap () returned 0x630000 [0056.116] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0056.116] GetProcessHeap () returned 0x630000 [0056.116] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0056.116] GetProcessHeap () returned 0x630000 [0056.116] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0056.116] GetProcessHeap () returned 0x630000 [0056.116] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657210 [0056.116] GetProcessHeap () returned 0x630000 [0056.116] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.116] GetProcessHeap () returned 0x630000 [0056.116] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0056.116] GetProcessHeap () returned 0x630000 [0056.116] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea00 [0056.116] GetProcessHeap () returned 0x630000 [0056.116] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0056.116] GetProcessHeap () returned 0x630000 [0056.116] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0056.116] GetProcessHeap () returned 0x630000 [0056.116] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0056.116] GetProcessHeap () returned 0x630000 [0056.116] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0056.116] GetProcessHeap () returned 0x630000 [0056.116] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65f020 [0056.116] GetProcessHeap () returned 0x630000 [0056.116] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.116] GetProcessHeap () returned 0x630000 [0056.117] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0056.117] GetProcessHeap () returned 0x630000 [0056.117] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0056.117] GetProcessHeap () returned 0x630000 [0056.117] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0056.117] GetProcessHeap () returned 0x630000 [0056.117] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65eb20 [0056.117] GetProcessHeap () returned 0x630000 [0056.117] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65f020 | out: hHeap=0x630000) returned 1 [0056.117] GetProcessHeap () returned 0x630000 [0056.117] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0056.117] GetProcessHeap () returned 0x630000 [0056.117] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0056.117] GetProcessHeap () returned 0x630000 [0056.117] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0056.117] GetProcessHeap () returned 0x630000 [0056.117] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0056.117] GetProcessHeap () returned 0x630000 [0056.117] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0056.117] GetProcessHeap () returned 0x630000 [0056.117] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0056.117] GetProcessHeap () returned 0x630000 [0056.117] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.117] GetProcessHeap () returned 0x630000 [0056.117] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.117] GetProcessHeap () returned 0x630000 [0056.117] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0056.117] GetProcessHeap () returned 0x630000 [0056.117] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0056.117] GetProcessHeap () returned 0x630000 [0056.117] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0056.117] GetProcessHeap () returned 0x630000 [0056.117] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0056.117] GetProcessHeap () returned 0x630000 [0056.117] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0056.117] GetProcessHeap () returned 0x630000 [0056.117] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0056.117] GetProcessHeap () returned 0x630000 [0056.118] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0056.118] GetProcessHeap () returned 0x630000 [0056.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0056.118] GetProcessHeap () returned 0x630000 [0056.118] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0056.118] GetProcessHeap () returned 0x630000 [0056.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0056.118] GetProcessHeap () returned 0x630000 [0056.118] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0056.118] GetProcessHeap () returned 0x630000 [0056.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0056.118] GetProcessHeap () returned 0x630000 [0056.118] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0056.118] GetProcessHeap () returned 0x630000 [0056.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0056.118] GetProcessHeap () returned 0x630000 [0056.118] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0056.118] GetProcessHeap () returned 0x630000 [0056.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0056.118] GetProcessHeap () returned 0x630000 [0056.118] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0056.118] GetProcessHeap () returned 0x630000 [0056.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0056.118] GetProcessHeap () returned 0x630000 [0056.118] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.118] GetProcessHeap () returned 0x630000 [0056.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.118] GetProcessHeap () returned 0x630000 [0056.118] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.118] GetProcessHeap () returned 0x630000 [0056.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.118] GetProcessHeap () returned 0x630000 [0056.118] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0056.118] GetProcessHeap () returned 0x630000 [0056.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0056.118] GetProcessHeap () returned 0x630000 [0056.118] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.118] GetProcessHeap () returned 0x630000 [0056.119] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.119] GetProcessHeap () returned 0x630000 [0056.119] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0056.119] GetProcessHeap () returned 0x630000 [0056.119] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0056.119] GetProcessHeap () returned 0x630000 [0056.119] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0056.119] GetProcessHeap () returned 0x630000 [0056.119] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0056.119] GetProcessHeap () returned 0x630000 [0056.119] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.119] GetProcessHeap () returned 0x630000 [0056.119] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.119] GetProcessHeap () returned 0x630000 [0056.119] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0056.119] GetProcessHeap () returned 0x630000 [0056.119] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0056.119] GetProcessHeap () returned 0x630000 [0056.119] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.119] GetProcessHeap () returned 0x630000 [0056.119] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.119] GetProcessHeap () returned 0x630000 [0056.119] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0056.119] GetProcessHeap () returned 0x630000 [0056.119] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0056.119] GetProcessHeap () returned 0x630000 [0056.119] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.119] GetProcessHeap () returned 0x630000 [0056.119] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.119] GetProcessHeap () returned 0x630000 [0056.119] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0056.119] GetProcessHeap () returned 0x630000 [0056.119] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0056.119] GetProcessHeap () returned 0x630000 [0056.119] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0056.119] GetProcessHeap () returned 0x630000 [0056.119] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0056.119] GetProcessHeap () returned 0x630000 [0056.119] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0056.120] GetProcessHeap () returned 0x630000 [0056.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0056.120] GetProcessHeap () returned 0x630000 [0056.120] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0056.120] GetProcessHeap () returned 0x630000 [0056.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0056.120] GetProcessHeap () returned 0x630000 [0056.120] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0056.120] GetProcessHeap () returned 0x630000 [0056.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0056.120] GetProcessHeap () returned 0x630000 [0056.120] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0056.120] GetProcessHeap () returned 0x630000 [0056.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0056.120] GetProcessHeap () returned 0x630000 [0056.120] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.120] GetProcessHeap () returned 0x630000 [0056.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.120] GetProcessHeap () returned 0x630000 [0056.120] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0056.120] GetProcessHeap () returned 0x630000 [0056.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0056.120] GetProcessHeap () returned 0x630000 [0056.120] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0056.120] GetProcessHeap () returned 0x630000 [0056.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0056.120] GetProcessHeap () returned 0x630000 [0056.120] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0056.120] GetProcessHeap () returned 0x630000 [0056.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0056.120] GetProcessHeap () returned 0x630000 [0056.120] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.120] GetProcessHeap () returned 0x630000 [0056.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.120] GetProcessHeap () returned 0x630000 [0056.120] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.120] GetProcessHeap () returned 0x630000 [0056.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.120] GetProcessHeap () returned 0x630000 [0056.120] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0056.121] GetProcessHeap () returned 0x630000 [0056.121] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0056.121] GetProcessHeap () returned 0x630000 [0056.121] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.121] GetProcessHeap () returned 0x630000 [0056.121] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.121] GetProcessHeap () returned 0x630000 [0056.121] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0056.121] GetProcessHeap () returned 0x630000 [0056.121] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0056.121] GetProcessHeap () returned 0x630000 [0056.121] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0056.121] GetProcessHeap () returned 0x630000 [0056.121] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0056.121] GetProcessHeap () returned 0x630000 [0056.121] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.121] GetProcessHeap () returned 0x630000 [0056.121] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.121] GetProcessHeap () returned 0x630000 [0056.121] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.121] GetProcessHeap () returned 0x630000 [0056.121] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.121] GetProcessHeap () returned 0x630000 [0056.121] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0056.121] GetProcessHeap () returned 0x630000 [0056.121] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0056.121] GetProcessHeap () returned 0x630000 [0056.121] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0056.121] GetProcessHeap () returned 0x630000 [0056.121] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0056.121] GetProcessHeap () returned 0x630000 [0056.121] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0056.121] GetProcessHeap () returned 0x630000 [0056.121] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0056.121] GetProcessHeap () returned 0x630000 [0056.121] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0056.121] GetProcessHeap () returned 0x630000 [0056.121] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0056.121] GetProcessHeap () returned 0x630000 [0056.122] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0056.122] GetProcessHeap () returned 0x630000 [0056.122] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.122] GetProcessHeap () returned 0x630000 [0056.122] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0056.122] WriteFile (in: hFile=0x230, lpBuffer=0x65a650*, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65a650*, lpNumberOfBytesWritten=0x243d864*=0x389, lpOverlapped=0x0) returned 1 [0056.124] GetProcessHeap () returned 0x630000 [0056.124] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65a650, Size=0x30) returned 0x65a650 [0056.124] GetProcessHeap () returned 0x630000 [0056.124] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0056.124] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0056.124] GetProcessHeap () returned 0x630000 [0056.124] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5e0) returned 0x65f188 [0056.125] ReadFile (in: hFile=0x230, lpBuffer=0x65f188, nNumberOfBytesToRead=0x5e0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65f188*, lpNumberOfBytesRead=0x243d7e8*=0x5e0, lpOverlapped=0x0) returned 1 [0056.125] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0056.125] WriteFile (in: hFile=0x230, lpBuffer=0x65f188*, nNumberOfBytesToWrite=0x5e0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65f188*, lpNumberOfBytesWritten=0x243d7e4*=0x5e0, lpOverlapped=0x0) returned 1 [0056.126] GetProcessHeap () returned 0x630000 [0056.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65f188 | out: hHeap=0x630000) returned 1 [0056.126] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0056.126] WriteFile (in: hFile=0x230, lpBuffer=0x65a650*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65a650*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0056.127] CloseHandle (hObject=0x230) returned 1 [0056.128] GetProcessHeap () returned 0x630000 [0056.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0056.128] GetProcessHeap () returned 0x630000 [0056.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655940 | out: hHeap=0x630000) returned 1 [0056.128] GetProcessHeap () returned 0x630000 [0056.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0056.128] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf") returned="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf" [0056.128] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf.happythreechoose" [0056.128] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.inf"), lpNewFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.inf.happythreechoose"), dwFlags=0x1) returned 1 [0056.128] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf" | out: pszPath="C:\\Windows10Upgrade\\resources\\i386") returned 1 [0056.128] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\i386" | out: pszPath="C:\\Windows10Upgrade\\resources\\i386\\") returned="" [0056.128] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\i386\\Decryption INFO.html" [0056.129] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\i386\\decryption info.html")) returned 0x20 [0056.129] GetProcessHeap () returned 0x630000 [0056.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0056.129] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b2895, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b2895, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x4eb0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NXQuery.sys", cAlternateFileName="")) returned 1 [0056.129] lstrcmpiW (lpString1="NXQuery.sys", lpString2=".") returned 1 [0056.129] lstrcmpiW (lpString1="NXQuery.sys", lpString2="..") returned 1 [0056.129] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\", lpString2="NXQuery.sys" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\NXQuery.sys") returned="C:\\Windows10Upgrade\\resources\\i386\\NXQuery.sys" [0056.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NXQuery.sys", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0056.129] GetProcessHeap () returned 0x630000 [0056.129] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0056.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NXQuery.sys", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NXQuery.sys", lpUsedDefaultChar=0x0) returned 12 [0056.129] lstrlenA (lpString="NXQuery.sys") returned 11 [0056.129] lstrlenA (lpString=".happythreechoose") returned 17 [0056.129] lstrcmpiW (lpString1="NXQuery.sys", lpString2="Decryption INFO.html") returned 1 [0056.129] lstrcmpiW (lpString1="NXQuery.sys", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0056.129] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0056.129] lstrcmpiW (lpString1="NXQuery.sys", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0056.129] GetProcessHeap () returned 0x630000 [0056.129] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0056.129] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\NXQuery.sys" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0056.129] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=20144) returned 1 [0056.129] GetProcessHeap () returned 0x630000 [0056.129] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655490 [0056.129] GetProcessHeap () returned 0x630000 [0056.129] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0056.129] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\i386\\NXQuery.sys") returned 46 [0056.130] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0056.130] GetProcessHeap () returned 0x630000 [0056.130] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0056.130] GetProcessHeap () returned 0x630000 [0056.130] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x65a688 [0056.130] lstrlenA (lpString="rsa_encrypt") returned 11 [0056.130] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0056.130] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0056.130] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0056.130] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0056.130] GetProcessHeap () returned 0x630000 [0056.130] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0056.130] lstrlenA (lpString="010001") returned 6 [0056.130] GetProcessHeap () returned 0x630000 [0056.130] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0056.130] GetProcessHeap () returned 0x630000 [0056.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0056.131] GetProcessHeap () returned 0x630000 [0056.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e460 [0056.131] GetProcessHeap () returned 0x630000 [0056.131] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0056.131] GetProcessHeap () returned 0x630000 [0056.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dec0 [0056.131] GetProcessHeap () returned 0x630000 [0056.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656ec8 [0056.131] GetProcessHeap () returned 0x630000 [0056.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a328 [0056.131] GetProcessHeap () returned 0x630000 [0056.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0056.131] GetProcessHeap () returned 0x630000 [0056.131] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.131] GetProcessHeap () returned 0x630000 [0056.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0056.131] GetProcessHeap () returned 0x630000 [0056.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0056.131] GetProcessHeap () returned 0x630000 [0056.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656c98 [0056.131] GetProcessHeap () returned 0x630000 [0056.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0056.131] GetProcessHeap () returned 0x630000 [0056.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0056.131] GetProcessHeap () returned 0x630000 [0056.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dfe0 [0056.131] GetProcessHeap () returned 0x630000 [0056.131] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0056.131] GetProcessHeap () returned 0x630000 [0056.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0056.131] GetProcessHeap () returned 0x630000 [0056.131] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0056.131] GetProcessHeap () returned 0x630000 [0056.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0056.131] GetProcessHeap () returned 0x630000 [0056.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65f140 [0056.131] GetProcessHeap () returned 0x630000 [0056.131] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0056.131] GetProcessHeap () returned 0x630000 [0056.131] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0056.132] GetProcessHeap () returned 0x630000 [0056.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.132] GetProcessHeap () returned 0x630000 [0056.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.132] GetProcessHeap () returned 0x630000 [0056.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e3d0 [0056.132] GetProcessHeap () returned 0x630000 [0056.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65f140 | out: hHeap=0x630000) returned 1 [0056.132] GetProcessHeap () returned 0x630000 [0056.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0056.132] GetProcessHeap () returned 0x630000 [0056.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0056.132] GetProcessHeap () returned 0x630000 [0056.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0056.132] GetProcessHeap () returned 0x630000 [0056.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0056.132] GetProcessHeap () returned 0x630000 [0056.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.132] GetProcessHeap () returned 0x630000 [0056.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.132] GetProcessHeap () returned 0x630000 [0056.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.132] GetProcessHeap () returned 0x630000 [0056.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.132] GetProcessHeap () returned 0x630000 [0056.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0056.132] GetProcessHeap () returned 0x630000 [0056.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0056.132] GetProcessHeap () returned 0x630000 [0056.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.132] GetProcessHeap () returned 0x630000 [0056.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.132] GetProcessHeap () returned 0x630000 [0056.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.132] GetProcessHeap () returned 0x630000 [0056.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.132] GetProcessHeap () returned 0x630000 [0056.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.132] GetProcessHeap () returned 0x630000 [0056.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.133] GetProcessHeap () returned 0x630000 [0056.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0056.133] GetProcessHeap () returned 0x630000 [0056.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0056.133] GetProcessHeap () returned 0x630000 [0056.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.133] GetProcessHeap () returned 0x630000 [0056.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.133] GetProcessHeap () returned 0x630000 [0056.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0056.133] GetProcessHeap () returned 0x630000 [0056.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0056.133] GetProcessHeap () returned 0x630000 [0056.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.133] GetProcessHeap () returned 0x630000 [0056.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.133] GetProcessHeap () returned 0x630000 [0056.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0056.133] GetProcessHeap () returned 0x630000 [0056.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0056.133] GetProcessHeap () returned 0x630000 [0056.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.133] GetProcessHeap () returned 0x630000 [0056.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.133] GetProcessHeap () returned 0x630000 [0056.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.133] GetProcessHeap () returned 0x630000 [0056.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.133] GetProcessHeap () returned 0x630000 [0056.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.133] GetProcessHeap () returned 0x630000 [0056.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.133] GetProcessHeap () returned 0x630000 [0056.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.133] GetProcessHeap () returned 0x630000 [0056.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.133] GetProcessHeap () returned 0x630000 [0056.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0056.134] GetProcessHeap () returned 0x630000 [0056.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0056.134] GetProcessHeap () returned 0x630000 [0056.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0056.134] GetProcessHeap () returned 0x630000 [0056.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0056.134] GetProcessHeap () returned 0x630000 [0056.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.134] GetProcessHeap () returned 0x630000 [0056.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.134] GetProcessHeap () returned 0x630000 [0056.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.134] GetProcessHeap () returned 0x630000 [0056.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.134] GetProcessHeap () returned 0x630000 [0056.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.134] GetProcessHeap () returned 0x630000 [0056.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.134] GetProcessHeap () returned 0x630000 [0056.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0056.134] GetProcessHeap () returned 0x630000 [0056.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0056.134] GetProcessHeap () returned 0x630000 [0056.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0056.134] GetProcessHeap () returned 0x630000 [0056.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0056.134] GetProcessHeap () returned 0x630000 [0056.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0056.134] GetProcessHeap () returned 0x630000 [0056.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0056.134] GetProcessHeap () returned 0x630000 [0056.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0056.134] GetProcessHeap () returned 0x630000 [0056.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0056.134] GetProcessHeap () returned 0x630000 [0056.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.134] GetProcessHeap () returned 0x630000 [0056.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.135] GetProcessHeap () returned 0x630000 [0056.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0056.135] GetProcessHeap () returned 0x630000 [0056.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0056.135] GetProcessHeap () returned 0x630000 [0056.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0056.135] GetProcessHeap () returned 0x630000 [0056.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0056.135] GetProcessHeap () returned 0x630000 [0056.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0056.135] GetProcessHeap () returned 0x630000 [0056.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0056.135] GetProcessHeap () returned 0x630000 [0056.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0056.135] GetProcessHeap () returned 0x630000 [0056.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0056.135] GetProcessHeap () returned 0x630000 [0056.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.135] GetProcessHeap () returned 0x630000 [0056.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.135] GetProcessHeap () returned 0x630000 [0056.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0056.135] GetProcessHeap () returned 0x630000 [0056.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0056.135] GetProcessHeap () returned 0x630000 [0056.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0056.135] GetProcessHeap () returned 0x630000 [0056.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0056.135] GetProcessHeap () returned 0x630000 [0056.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0056.135] GetProcessHeap () returned 0x630000 [0056.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0056.135] GetProcessHeap () returned 0x630000 [0056.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0056.135] GetProcessHeap () returned 0x630000 [0056.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0056.135] GetProcessHeap () returned 0x630000 [0056.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0056.135] GetProcessHeap () returned 0x630000 [0056.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0056.136] GetProcessHeap () returned 0x630000 [0056.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.136] GetProcessHeap () returned 0x630000 [0056.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.136] GetProcessHeap () returned 0x630000 [0056.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.136] GetProcessHeap () returned 0x630000 [0056.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.136] GetProcessHeap () returned 0x630000 [0056.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0056.136] GetProcessHeap () returned 0x630000 [0056.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0056.136] GetProcessHeap () returned 0x630000 [0056.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0056.136] GetProcessHeap () returned 0x630000 [0056.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0056.136] GetProcessHeap () returned 0x630000 [0056.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0056.136] GetProcessHeap () returned 0x630000 [0056.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0056.136] GetProcessHeap () returned 0x630000 [0056.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0056.136] GetProcessHeap () returned 0x630000 [0056.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0056.136] GetProcessHeap () returned 0x630000 [0056.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0056.136] GetProcessHeap () returned 0x630000 [0056.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0056.136] GetProcessHeap () returned 0x630000 [0056.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0056.136] GetProcessHeap () returned 0x630000 [0056.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0056.136] GetProcessHeap () returned 0x630000 [0056.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0056.136] GetProcessHeap () returned 0x630000 [0056.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e460 | out: hHeap=0x630000) returned 1 [0056.136] GetProcessHeap () returned 0x630000 [0056.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0056.137] GetProcessHeap () returned 0x630000 [0056.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0056.137] GetProcessHeap () returned 0x630000 [0056.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0056.137] WriteFile (in: hFile=0x230, lpBuffer=0x65a688*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65a688*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0056.183] GetProcessHeap () returned 0x630000 [0056.183] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65a688, Size=0x30) returned 0x65a688 [0056.183] GetProcessHeap () returned 0x630000 [0056.183] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0056.184] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0056.184] GetProcessHeap () returned 0x630000 [0056.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4eb0) returned 0x65f188 [0056.184] ReadFile (in: hFile=0x230, lpBuffer=0x65f188, nNumberOfBytesToRead=0x4eb0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65f188*, lpNumberOfBytesRead=0x243d7e8*=0x4eb0, lpOverlapped=0x0) returned 1 [0056.188] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0056.188] WriteFile (in: hFile=0x230, lpBuffer=0x65f188*, nNumberOfBytesToWrite=0x4eb0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65f188*, lpNumberOfBytesWritten=0x243d7e4*=0x4eb0, lpOverlapped=0x0) returned 1 [0056.190] GetProcessHeap () returned 0x630000 [0056.191] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65f188 | out: hHeap=0x630000) returned 1 [0056.192] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0056.192] WriteFile (in: hFile=0x230, lpBuffer=0x65a688*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65a688*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0056.203] CloseHandle (hObject=0x230) returned 1 [0056.205] GetProcessHeap () returned 0x630000 [0056.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0056.205] GetProcessHeap () returned 0x630000 [0056.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655490 | out: hHeap=0x630000) returned 1 [0056.205] GetProcessHeap () returned 0x630000 [0056.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0056.205] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\i386\\NXQuery.sys" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\NXQuery.sys") returned="C:\\Windows10Upgrade\\resources\\i386\\NXQuery.sys" [0056.205] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\NXQuery.sys", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\NXQuery.sys.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\i386\\NXQuery.sys.happythreechoose" [0056.205] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\i386\\NXQuery.sys" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.sys"), lpNewFileName="C:\\Windows10Upgrade\\resources\\i386\\NXQuery.sys.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.sys.happythreechoose"), dwFlags=0x1) returned 1 [0056.206] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\i386\\NXQuery.sys" | out: pszPath="C:\\Windows10Upgrade\\resources\\i386") returned 1 [0056.206] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\i386" | out: pszPath="C:\\Windows10Upgrade\\resources\\i386\\") returned="" [0056.206] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\i386\\Decryption INFO.html" [0056.206] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\i386\\decryption info.html")) returned 0x20 [0056.206] GetProcessHeap () returned 0x630000 [0056.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0056.206] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b2895, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b2895, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x4eb0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NXQuery.sys", cAlternateFileName="")) returned 0 [0056.206] FindClose (in: hFindFile=0x648810 | out: hFindFile=0x648810) returned 1 [0056.206] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Windows10Upgrade\\resources\\amd64\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\") returned="C:\\Windows10Upgrade\\resources\\amd64\\" [0056.206] GetProcessHeap () returned 0x630000 [0056.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656300 | out: hHeap=0x630000) returned 1 [0056.207] GetProcessHeap () returned 0x630000 [0056.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.207] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\amd64\\") returned 36 [0056.207] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\", lpString2="*" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\*") returned="C:\\Windows10Upgrade\\resources\\amd64\\*" [0056.207] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a5195, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3a652e, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648a90 [0056.209] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0056.209] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a5195, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3a652e, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.209] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0056.209] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0056.209] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39b5b0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39b5b0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x16ebc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BiosBlocks.xml", cAlternateFileName="BIOSBL~1.XML")) returned 1 [0056.209] lstrcmpiW (lpString1="BiosBlocks.xml", lpString2=".") returned 1 [0056.209] lstrcmpiW (lpString1="BiosBlocks.xml", lpString2="..") returned 1 [0056.209] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\", lpString2="BiosBlocks.xml" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml") returned="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml" [0056.209] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BiosBlocks.xml", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0056.210] GetProcessHeap () returned 0x630000 [0056.210] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0056.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BiosBlocks.xml", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BiosBlocks.xml", lpUsedDefaultChar=0x0) returned 15 [0056.210] lstrlenA (lpString="BiosBlocks.xml") returned 14 [0056.210] lstrlenA (lpString=".happythreechoose") returned 17 [0056.210] lstrcmpiW (lpString1="BiosBlocks.xml", lpString2="Decryption INFO.html") returned -1 [0056.210] lstrcmpiW (lpString1="BiosBlocks.xml", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0056.210] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0056.210] lstrcmpiW (lpString1="BiosBlocks.xml", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0056.210] GetProcessHeap () returned 0x630000 [0056.210] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0056.210] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\amd64\\biosblocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0056.211] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=93884) returned 1 [0056.211] GetProcessHeap () returned 0x630000 [0056.211] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6557d8 [0056.211] GetProcessHeap () returned 0x630000 [0056.211] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0056.211] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml") returned 50 [0056.211] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0056.211] GetProcessHeap () returned 0x630000 [0056.211] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0056.211] GetProcessHeap () returned 0x630000 [0056.211] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x656000 [0056.211] lstrlenA (lpString="rsa_encrypt") returned 11 [0056.211] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0056.212] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0056.212] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0056.212] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0056.212] GetProcessHeap () returned 0x630000 [0056.212] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0056.212] lstrlenA (lpString="010001") returned 6 [0056.212] GetProcessHeap () returned 0x630000 [0056.212] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0056.212] GetProcessHeap () returned 0x630000 [0056.212] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0056.212] GetProcessHeap () returned 0x630000 [0056.212] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e8e0 [0056.212] GetProcessHeap () returned 0x630000 [0056.212] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0056.212] GetProcessHeap () returned 0x630000 [0056.212] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea00 [0056.212] GetProcessHeap () returned 0x630000 [0056.212] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x6570f8 [0056.212] GetProcessHeap () returned 0x630000 [0056.212] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0056.212] GetProcessHeap () returned 0x630000 [0056.212] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0056.212] GetProcessHeap () returned 0x630000 [0056.213] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0056.213] GetProcessHeap () returned 0x630000 [0056.213] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0056.213] GetProcessHeap () returned 0x630000 [0056.213] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0056.213] GetProcessHeap () returned 0x630000 [0056.213] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657440 [0056.213] GetProcessHeap () returned 0x630000 [0056.213] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0056.213] GetProcessHeap () returned 0x630000 [0056.213] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0056.213] GetProcessHeap () returned 0x630000 [0056.213] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0056.213] GetProcessHeap () returned 0x630000 [0056.213] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0056.213] GetProcessHeap () returned 0x630000 [0056.213] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0056.213] GetProcessHeap () returned 0x630000 [0056.213] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0056.213] GetProcessHeap () returned 0x630000 [0056.213] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0056.213] GetProcessHeap () returned 0x630000 [0056.213] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65a918 [0056.213] GetProcessHeap () returned 0x630000 [0056.213] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0056.213] GetProcessHeap () returned 0x630000 [0056.213] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0056.213] GetProcessHeap () returned 0x630000 [0056.213] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.213] GetProcessHeap () returned 0x630000 [0056.213] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.213] GetProcessHeap () returned 0x630000 [0056.213] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65dfe0 [0056.213] GetProcessHeap () returned 0x630000 [0056.213] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a918 | out: hHeap=0x630000) returned 1 [0056.213] GetProcessHeap () returned 0x630000 [0056.213] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0056.213] GetProcessHeap () returned 0x630000 [0056.213] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0056.213] GetProcessHeap () returned 0x630000 [0056.214] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0056.214] GetProcessHeap () returned 0x630000 [0056.214] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0056.214] GetProcessHeap () returned 0x630000 [0056.214] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.214] GetProcessHeap () returned 0x630000 [0056.214] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.214] GetProcessHeap () returned 0x630000 [0056.214] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0056.214] GetProcessHeap () returned 0x630000 [0056.214] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0056.214] GetProcessHeap () returned 0x630000 [0056.214] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0056.214] GetProcessHeap () returned 0x630000 [0056.214] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0056.214] GetProcessHeap () returned 0x630000 [0056.214] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0056.214] GetProcessHeap () returned 0x630000 [0056.214] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0056.214] GetProcessHeap () returned 0x630000 [0056.214] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.214] GetProcessHeap () returned 0x630000 [0056.214] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.214] GetProcessHeap () returned 0x630000 [0056.214] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.214] GetProcessHeap () returned 0x630000 [0056.214] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.214] GetProcessHeap () returned 0x630000 [0056.214] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0056.214] GetProcessHeap () returned 0x630000 [0056.214] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0056.214] GetProcessHeap () returned 0x630000 [0056.214] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.214] GetProcessHeap () returned 0x630000 [0056.214] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.214] GetProcessHeap () returned 0x630000 [0056.214] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0056.215] GetProcessHeap () returned 0x630000 [0056.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0056.215] GetProcessHeap () returned 0x630000 [0056.215] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.215] GetProcessHeap () returned 0x630000 [0056.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.215] GetProcessHeap () returned 0x630000 [0056.215] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0056.215] GetProcessHeap () returned 0x630000 [0056.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0056.215] GetProcessHeap () returned 0x630000 [0056.215] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.215] GetProcessHeap () returned 0x630000 [0056.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.215] GetProcessHeap () returned 0x630000 [0056.215] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0056.215] GetProcessHeap () returned 0x630000 [0056.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0056.215] GetProcessHeap () returned 0x630000 [0056.215] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0056.215] GetProcessHeap () returned 0x630000 [0056.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0056.215] GetProcessHeap () returned 0x630000 [0056.215] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0056.215] GetProcessHeap () returned 0x630000 [0056.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0056.215] GetProcessHeap () returned 0x630000 [0056.215] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.215] GetProcessHeap () returned 0x630000 [0056.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.215] GetProcessHeap () returned 0x630000 [0056.215] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0056.215] GetProcessHeap () returned 0x630000 [0056.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0056.215] GetProcessHeap () returned 0x630000 [0056.215] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0056.215] GetProcessHeap () returned 0x630000 [0056.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0056.216] GetProcessHeap () returned 0x630000 [0056.216] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.216] GetProcessHeap () returned 0x630000 [0056.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.216] GetProcessHeap () returned 0x630000 [0056.216] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.216] GetProcessHeap () returned 0x630000 [0056.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.216] GetProcessHeap () returned 0x630000 [0056.216] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.216] GetProcessHeap () returned 0x630000 [0056.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.216] GetProcessHeap () returned 0x630000 [0056.216] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.216] GetProcessHeap () returned 0x630000 [0056.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.216] GetProcessHeap () returned 0x630000 [0056.216] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.216] GetProcessHeap () returned 0x630000 [0056.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.216] GetProcessHeap () returned 0x630000 [0056.216] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.216] GetProcessHeap () returned 0x630000 [0056.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.216] GetProcessHeap () returned 0x630000 [0056.216] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0056.216] GetProcessHeap () returned 0x630000 [0056.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0056.216] GetProcessHeap () returned 0x630000 [0056.216] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.216] GetProcessHeap () returned 0x630000 [0056.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.216] GetProcessHeap () returned 0x630000 [0056.216] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.216] GetProcessHeap () returned 0x630000 [0056.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.216] GetProcessHeap () returned 0x630000 [0056.216] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0056.217] GetProcessHeap () returned 0x630000 [0056.217] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0056.217] GetProcessHeap () returned 0x630000 [0056.217] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.217] GetProcessHeap () returned 0x630000 [0056.217] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.217] GetProcessHeap () returned 0x630000 [0056.217] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0056.217] GetProcessHeap () returned 0x630000 [0056.217] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0056.217] GetProcessHeap () returned 0x630000 [0056.217] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.217] GetProcessHeap () returned 0x630000 [0056.217] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.217] GetProcessHeap () returned 0x630000 [0056.217] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.217] GetProcessHeap () returned 0x630000 [0056.217] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.217] GetProcessHeap () returned 0x630000 [0056.217] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0056.217] GetProcessHeap () returned 0x630000 [0056.217] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0056.217] GetProcessHeap () returned 0x630000 [0056.217] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.217] GetProcessHeap () returned 0x630000 [0056.217] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.217] GetProcessHeap () returned 0x630000 [0056.217] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.217] GetProcessHeap () returned 0x630000 [0056.217] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.217] GetProcessHeap () returned 0x630000 [0056.217] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.217] GetProcessHeap () returned 0x630000 [0056.217] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.217] GetProcessHeap () returned 0x630000 [0056.217] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.217] GetProcessHeap () returned 0x630000 [0056.217] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.218] GetProcessHeap () returned 0x630000 [0056.218] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0056.218] GetProcessHeap () returned 0x630000 [0056.218] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0056.218] GetProcessHeap () returned 0x630000 [0056.218] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0056.218] GetProcessHeap () returned 0x630000 [0056.218] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0056.218] GetProcessHeap () returned 0x630000 [0056.218] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.218] GetProcessHeap () returned 0x630000 [0056.218] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.218] GetProcessHeap () returned 0x630000 [0056.218] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0056.218] GetProcessHeap () returned 0x630000 [0056.218] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0056.218] GetProcessHeap () returned 0x630000 [0056.218] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0056.218] GetProcessHeap () returned 0x630000 [0056.218] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0056.218] GetProcessHeap () returned 0x630000 [0056.218] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0056.218] GetProcessHeap () returned 0x630000 [0056.218] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0056.218] GetProcessHeap () returned 0x630000 [0056.218] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0056.218] GetProcessHeap () returned 0x630000 [0056.218] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0056.218] GetProcessHeap () returned 0x630000 [0056.218] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0056.218] GetProcessHeap () returned 0x630000 [0056.218] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0056.218] GetProcessHeap () returned 0x630000 [0056.218] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0056.218] WriteFile (in: hFile=0x230, lpBuffer=0x656000*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x656000*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0056.224] GetProcessHeap () returned 0x630000 [0056.224] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x656000, Size=0x30) returned 0x656000 [0056.224] GetProcessHeap () returned 0x630000 [0056.224] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0056.224] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0056.224] GetProcessHeap () returned 0x630000 [0056.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16ebc) returned 0x65f588 [0056.226] ReadFile (in: hFile=0x230, lpBuffer=0x65f588, nNumberOfBytesToRead=0x16ebc, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65f588*, lpNumberOfBytesRead=0x243d7e8*=0x16ebc, lpOverlapped=0x0) returned 1 [0056.228] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0056.228] WriteFile (in: hFile=0x230, lpBuffer=0x65f588*, nNumberOfBytesToWrite=0x16ebc, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65f588*, lpNumberOfBytesWritten=0x243d7e4*=0x16ebc, lpOverlapped=0x0) returned 1 [0056.230] GetProcessHeap () returned 0x630000 [0056.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65f588 | out: hHeap=0x630000) returned 1 [0056.230] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0056.230] WriteFile (in: hFile=0x230, lpBuffer=0x656000*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x656000*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0056.231] CloseHandle (hObject=0x230) returned 1 [0056.234] GetProcessHeap () returned 0x630000 [0056.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0056.234] GetProcessHeap () returned 0x630000 [0056.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6557d8 | out: hHeap=0x630000) returned 1 [0056.234] GetProcessHeap () returned 0x630000 [0056.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0056.234] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml") returned="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml" [0056.234] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml.happythreechoose" [0056.234] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\amd64\\biosblocks.xml"), lpNewFileName="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\amd64\\biosblocks.xml.happythreechoose"), dwFlags=0x1) returned 1 [0056.235] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml" | out: pszPath="C:\\Windows10Upgrade\\resources\\amd64") returned 1 [0056.235] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\amd64" | out: pszPath="C:\\Windows10Upgrade\\resources\\amd64\\") returned="" [0056.235] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\amd64\\Decryption INFO.html" [0056.235] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\amd64\\decryption info.html")) returned 0xffffffff [0056.235] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\amd64\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0056.236] GetProcessHeap () returned 0x630000 [0056.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655850 [0056.236] GetProcessHeap () returned 0x630000 [0056.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0056.242] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.243] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.243] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.243] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.244] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.244] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.244] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.244] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.244] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.244] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.244] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.244] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.244] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.244] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.244] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.244] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.244] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.245] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.245] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.245] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.245] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.245] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.245] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.245] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.245] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.245] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.245] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.245] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.245] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.245] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.246] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.246] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.246] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.246] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.246] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.246] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.246] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.247] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.248] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.248] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.248] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.248] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.248] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.248] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.248] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.248] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.248] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.248] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.248] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.248] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.248] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.249] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.249] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.249] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.249] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.249] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.249] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.249] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.249] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.249] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.249] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.249] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.249] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.249] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.249] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.250] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.250] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.250] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.250] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.250] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.250] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.250] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.250] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.250] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.250] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.250] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.251] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.251] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.251] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.251] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.251] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.251] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.251] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.251] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.251] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.251] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.251] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.251] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.251] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.252] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.252] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.252] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.252] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.252] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.252] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.252] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.252] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.252] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.252] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.252] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.252] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.252] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.252] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.254] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.254] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.254] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.254] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.255] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.255] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.255] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.255] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.255] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.255] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.255] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.255] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.255] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.255] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.255] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.255] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.256] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.256] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.256] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.256] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.256] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.256] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.256] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.256] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.256] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.256] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.256] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.256] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.256] GetProcessHeap () returned 0x630000 [0056.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655850 | out: hHeap=0x630000) returned 1 [0056.256] GetProcessHeap () returned 0x630000 [0056.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0056.257] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0056.257] GetProcessHeap () returned 0x630000 [0056.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655b20 [0056.257] GetProcessHeap () returned 0x630000 [0056.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0056.264] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.264] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.264] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.264] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.264] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.264] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.264] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.264] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.264] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.264] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.265] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.265] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.265] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.265] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.265] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.265] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.265] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.265] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.265] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.265] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.265] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.265] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.265] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.265] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.265] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.266] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.267] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.267] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.268] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.268] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.268] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.268] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.270] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.272] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.272] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.272] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.356] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.356] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.357] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.357] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.357] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.357] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.357] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.358] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.358] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.358] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.358] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.358] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.358] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.359] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.359] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.359] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.359] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.362] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.362] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.369] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.370] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.370] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.370] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.371] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.371] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.371] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.372] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.372] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.373] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.373] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.384] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.384] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.384] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.384] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.384] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.384] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.384] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.384] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.385] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.385] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.385] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.385] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.385] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.385] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.385] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.385] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.385] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.385] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.385] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.385] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.386] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.386] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.386] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.386] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.386] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.386] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.386] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.386] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.386] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.386] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.386] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.386] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.386] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.386] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.387] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.387] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.387] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.387] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.387] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.387] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.387] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.387] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.387] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.387] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.387] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.387] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.387] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.387] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.388] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.388] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.388] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.388] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0056.388] GetProcessHeap () returned 0x630000 [0056.388] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655b20 | out: hHeap=0x630000) returned 1 [0056.389] GetProcessHeap () returned 0x630000 [0056.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0056.389] CloseHandle (hObject=0x230) returned 1 [0056.389] GetProcessHeap () returned 0x630000 [0056.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0056.389] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39c8ec, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39c8ec, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x11daf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hwcompat.txt", cAlternateFileName="")) returned 1 [0056.389] lstrcmpiW (lpString1="hwcompat.txt", lpString2=".") returned 1 [0056.389] lstrcmpiW (lpString1="hwcompat.txt", lpString2="..") returned 1 [0056.389] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\", lpString2="hwcompat.txt" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt") returned="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt" [0056.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwcompat.txt", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0056.389] GetProcessHeap () returned 0x630000 [0056.389] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd) returned 0x64c9f0 [0056.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwcompat.txt", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hwcompat.txt", lpUsedDefaultChar=0x0) returned 13 [0056.389] lstrlenA (lpString="hwcompat.txt") returned 12 [0056.389] lstrlenA (lpString=".happythreechoose") returned 17 [0056.389] lstrcmpiW (lpString1="hwcompat.txt", lpString2="Decryption INFO.html") returned 1 [0056.389] lstrcmpiW (lpString1="hwcompat.txt", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0056.389] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0056.389] lstrcmpiW (lpString1="hwcompat.txt", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0056.389] GetProcessHeap () returned 0x630000 [0056.389] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0056.389] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwcompat.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0056.390] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=73135) returned 1 [0056.390] GetProcessHeap () returned 0x630000 [0056.390] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655850 [0056.390] GetProcessHeap () returned 0x630000 [0056.390] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0056.390] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt") returned 48 [0056.390] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0056.390] GetProcessHeap () returned 0x630000 [0056.390] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0056.390] GetProcessHeap () returned 0x630000 [0056.390] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x381) returned 0x656038 [0056.390] lstrlenA (lpString="rsa_encrypt") returned 11 [0056.390] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0056.391] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0056.391] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0056.391] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0056.391] GetProcessHeap () returned 0x630000 [0056.391] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0056.391] lstrlenA (lpString="010001") returned 6 [0056.391] GetProcessHeap () returned 0x630000 [0056.391] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a378 [0056.391] GetProcessHeap () returned 0x630000 [0056.391] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0056.391] GetProcessHeap () returned 0x630000 [0056.391] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e340 [0056.391] GetProcessHeap () returned 0x630000 [0056.392] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0056.392] GetProcessHeap () returned 0x630000 [0056.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e7c0 [0056.392] GetProcessHeap () returned 0x630000 [0056.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656a68 [0056.392] GetProcessHeap () returned 0x630000 [0056.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3a8 [0056.392] GetProcessHeap () returned 0x630000 [0056.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0056.392] GetProcessHeap () returned 0x630000 [0056.392] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0056.392] GetProcessHeap () returned 0x630000 [0056.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0056.392] GetProcessHeap () returned 0x630000 [0056.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0056.392] GetProcessHeap () returned 0x630000 [0056.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657788 [0056.392] GetProcessHeap () returned 0x630000 [0056.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.392] GetProcessHeap () returned 0x630000 [0056.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0056.392] GetProcessHeap () returned 0x630000 [0056.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e6a0 [0056.392] GetProcessHeap () returned 0x630000 [0056.392] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0056.392] GetProcessHeap () returned 0x630000 [0056.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0056.392] GetProcessHeap () returned 0x630000 [0056.392] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e6a0 | out: hHeap=0x630000) returned 1 [0056.392] GetProcessHeap () returned 0x630000 [0056.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.392] GetProcessHeap () returned 0x630000 [0056.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65a7e0 [0056.392] GetProcessHeap () returned 0x630000 [0056.392] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.392] GetProcessHeap () returned 0x630000 [0056.392] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.392] GetProcessHeap () returned 0x630000 [0056.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0056.393] GetProcessHeap () returned 0x630000 [0056.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0056.393] GetProcessHeap () returned 0x630000 [0056.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e730 [0056.393] GetProcessHeap () returned 0x630000 [0056.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a7e0 | out: hHeap=0x630000) returned 1 [0056.393] GetProcessHeap () returned 0x630000 [0056.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0056.393] GetProcessHeap () returned 0x630000 [0056.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0056.393] GetProcessHeap () returned 0x630000 [0056.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0056.393] GetProcessHeap () returned 0x630000 [0056.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0056.393] GetProcessHeap () returned 0x630000 [0056.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0056.393] GetProcessHeap () returned 0x630000 [0056.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0056.393] GetProcessHeap () returned 0x630000 [0056.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0056.393] GetProcessHeap () returned 0x630000 [0056.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0056.393] GetProcessHeap () returned 0x630000 [0056.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0056.393] GetProcessHeap () returned 0x630000 [0056.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0056.393] GetProcessHeap () returned 0x630000 [0056.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0056.393] GetProcessHeap () returned 0x630000 [0056.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0056.393] GetProcessHeap () returned 0x630000 [0056.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.393] GetProcessHeap () returned 0x630000 [0056.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.393] GetProcessHeap () returned 0x630000 [0056.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.393] GetProcessHeap () returned 0x630000 [0056.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.393] GetProcessHeap () returned 0x630000 [0056.394] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.394] GetProcessHeap () returned 0x630000 [0056.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.394] GetProcessHeap () returned 0x630000 [0056.394] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.394] GetProcessHeap () returned 0x630000 [0056.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.394] GetProcessHeap () returned 0x630000 [0056.394] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0056.394] GetProcessHeap () returned 0x630000 [0056.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0056.394] GetProcessHeap () returned 0x630000 [0056.394] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0056.394] GetProcessHeap () returned 0x630000 [0056.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0056.394] GetProcessHeap () returned 0x630000 [0056.394] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0056.394] GetProcessHeap () returned 0x630000 [0056.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0056.394] GetProcessHeap () returned 0x630000 [0056.394] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.394] GetProcessHeap () returned 0x630000 [0056.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.394] GetProcessHeap () returned 0x630000 [0056.394] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0056.394] GetProcessHeap () returned 0x630000 [0056.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0056.394] GetProcessHeap () returned 0x630000 [0056.394] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.394] GetProcessHeap () returned 0x630000 [0056.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.394] GetProcessHeap () returned 0x630000 [0056.394] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.394] GetProcessHeap () returned 0x630000 [0056.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.394] GetProcessHeap () returned 0x630000 [0056.394] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.394] GetProcessHeap () returned 0x630000 [0056.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.395] GetProcessHeap () returned 0x630000 [0056.395] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0056.395] GetProcessHeap () returned 0x630000 [0056.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0056.395] GetProcessHeap () returned 0x630000 [0056.395] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.395] GetProcessHeap () returned 0x630000 [0056.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.395] GetProcessHeap () returned 0x630000 [0056.395] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.395] GetProcessHeap () returned 0x630000 [0056.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.395] GetProcessHeap () returned 0x630000 [0056.395] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.395] GetProcessHeap () returned 0x630000 [0056.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.395] GetProcessHeap () returned 0x630000 [0056.395] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0056.395] GetProcessHeap () returned 0x630000 [0056.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0056.395] GetProcessHeap () returned 0x630000 [0056.395] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.395] GetProcessHeap () returned 0x630000 [0056.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.395] GetProcessHeap () returned 0x630000 [0056.395] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.395] GetProcessHeap () returned 0x630000 [0056.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.395] GetProcessHeap () returned 0x630000 [0056.395] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0056.395] GetProcessHeap () returned 0x630000 [0056.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0056.395] GetProcessHeap () returned 0x630000 [0056.395] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0056.395] GetProcessHeap () returned 0x630000 [0056.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0056.395] GetProcessHeap () returned 0x630000 [0056.396] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0056.396] GetProcessHeap () returned 0x630000 [0056.396] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0056.396] GetProcessHeap () returned 0x630000 [0056.396] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.396] GetProcessHeap () returned 0x630000 [0056.396] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.396] GetProcessHeap () returned 0x630000 [0056.396] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.396] GetProcessHeap () returned 0x630000 [0056.396] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.396] GetProcessHeap () returned 0x630000 [0056.396] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0056.396] GetProcessHeap () returned 0x630000 [0056.396] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0056.396] GetProcessHeap () returned 0x630000 [0056.396] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0056.396] GetProcessHeap () returned 0x630000 [0056.396] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0056.396] GetProcessHeap () returned 0x630000 [0056.396] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.396] GetProcessHeap () returned 0x630000 [0056.396] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.396] GetProcessHeap () returned 0x630000 [0056.396] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0056.396] GetProcessHeap () returned 0x630000 [0056.396] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0056.396] GetProcessHeap () returned 0x630000 [0056.396] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0056.396] GetProcessHeap () returned 0x630000 [0056.396] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0056.396] GetProcessHeap () returned 0x630000 [0056.396] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.396] GetProcessHeap () returned 0x630000 [0056.396] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.396] GetProcessHeap () returned 0x630000 [0056.396] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.396] GetProcessHeap () returned 0x630000 [0056.396] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.397] GetProcessHeap () returned 0x630000 [0056.397] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.397] GetProcessHeap () returned 0x630000 [0056.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.397] GetProcessHeap () returned 0x630000 [0056.397] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.397] GetProcessHeap () returned 0x630000 [0056.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.397] GetProcessHeap () returned 0x630000 [0056.397] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0056.397] GetProcessHeap () returned 0x630000 [0056.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0056.397] GetProcessHeap () returned 0x630000 [0056.397] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0056.397] GetProcessHeap () returned 0x630000 [0056.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0056.397] GetProcessHeap () returned 0x630000 [0056.397] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.397] GetProcessHeap () returned 0x630000 [0056.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.397] GetProcessHeap () returned 0x630000 [0056.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0056.397] GetProcessHeap () returned 0x630000 [0056.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0056.397] GetProcessHeap () returned 0x630000 [0056.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0056.397] GetProcessHeap () returned 0x630000 [0056.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0056.397] GetProcessHeap () returned 0x630000 [0056.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0056.397] GetProcessHeap () returned 0x630000 [0056.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e7c0 | out: hHeap=0x630000) returned 1 [0056.397] GetProcessHeap () returned 0x630000 [0056.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0056.397] GetProcessHeap () returned 0x630000 [0056.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0056.397] GetProcessHeap () returned 0x630000 [0056.398] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0056.398] GetProcessHeap () returned 0x630000 [0056.398] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0056.398] GetProcessHeap () returned 0x630000 [0056.398] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0056.398] WriteFile (in: hFile=0x230, lpBuffer=0x656038*, nNumberOfBytesToWrite=0x381, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x656038*, lpNumberOfBytesWritten=0x243d864*=0x381, lpOverlapped=0x0) returned 1 [0056.461] GetProcessHeap () returned 0x630000 [0056.461] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x656038, Size=0x30) returned 0x656038 [0056.461] GetProcessHeap () returned 0x630000 [0056.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0056.461] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0056.461] GetProcessHeap () returned 0x630000 [0056.461] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11db0) returned 0x65f588 [0056.461] ReadFile (in: hFile=0x230, lpBuffer=0x65f588, nNumberOfBytesToRead=0x11db0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65f588*, lpNumberOfBytesRead=0x243d7e8*=0x11db0, lpOverlapped=0x0) returned 1 [0056.463] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0056.463] WriteFile (in: hFile=0x230, lpBuffer=0x65f588*, nNumberOfBytesToWrite=0x11db0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65f588*, lpNumberOfBytesWritten=0x243d7e4*=0x11db0, lpOverlapped=0x0) returned 1 [0056.506] GetProcessHeap () returned 0x630000 [0056.506] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65f588 | out: hHeap=0x630000) returned 1 [0056.506] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0056.506] WriteFile (in: hFile=0x230, lpBuffer=0x656038*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x656038*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0056.510] CloseHandle (hObject=0x230) returned 1 [0056.512] GetProcessHeap () returned 0x630000 [0056.512] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0056.512] GetProcessHeap () returned 0x630000 [0056.512] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655850 | out: hHeap=0x630000) returned 1 [0056.512] GetProcessHeap () returned 0x630000 [0056.512] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0056.512] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt") returned="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt" [0056.512] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt.happythreechoose" [0056.512] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwcompat.txt"), lpNewFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwcompat.txt.happythreechoose"), dwFlags=0x1) returned 1 [0056.513] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt" | out: pszPath="C:\\Windows10Upgrade\\resources\\amd64") returned 1 [0056.513] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\amd64" | out: pszPath="C:\\Windows10Upgrade\\resources\\amd64\\") returned="" [0056.513] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\amd64\\Decryption INFO.html" [0056.513] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\amd64\\decryption info.html")) returned 0x20 [0056.513] GetProcessHeap () returned 0x630000 [0056.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0056.513] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39dcc9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39dcc9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x90d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hwexclude.txt", cAlternateFileName="HWEXCL~1.TXT")) returned 1 [0056.513] lstrcmpiW (lpString1="hwexclude.txt", lpString2=".") returned 1 [0056.513] lstrcmpiW (lpString1="hwexclude.txt", lpString2="..") returned 1 [0056.513] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\", lpString2="hwexclude.txt" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt") returned="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt" [0056.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwexclude.txt", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0056.513] GetProcessHeap () returned 0x630000 [0056.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x64ca20 [0056.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwexclude.txt", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hwexclude.txt", lpUsedDefaultChar=0x0) returned 14 [0056.513] lstrlenA (lpString="hwexclude.txt") returned 13 [0056.513] lstrlenA (lpString=".happythreechoose") returned 17 [0056.514] lstrcmpiW (lpString1="hwexclude.txt", lpString2="Decryption INFO.html") returned 1 [0056.514] lstrcmpiW (lpString1="hwexclude.txt", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0056.514] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0056.514] lstrcmpiW (lpString1="hwexclude.txt", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0056.514] GetProcessHeap () returned 0x630000 [0056.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f10 [0056.514] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwexclude.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0056.514] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=2317) returned 1 [0056.514] GetProcessHeap () returned 0x630000 [0056.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655aa8 [0056.514] GetProcessHeap () returned 0x630000 [0056.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0056.514] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt") returned 49 [0056.514] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0056.514] GetProcessHeap () returned 0x630000 [0056.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0056.514] GetProcessHeap () returned 0x630000 [0056.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x383) returned 0x656070 [0056.514] lstrlenA (lpString="rsa_encrypt") returned 11 [0056.515] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0056.515] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0056.515] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0056.515] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0056.515] GetProcessHeap () returned 0x630000 [0056.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0056.515] lstrlenA (lpString="010001") returned 6 [0056.515] GetProcessHeap () returned 0x630000 [0056.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3f8 [0056.515] GetProcessHeap () returned 0x630000 [0056.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0056.515] GetProcessHeap () returned 0x630000 [0056.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e8e0 [0056.515] GetProcessHeap () returned 0x630000 [0056.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0056.515] GetProcessHeap () returned 0x630000 [0056.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65df50 [0056.516] GetProcessHeap () returned 0x630000 [0056.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657440 [0056.516] GetProcessHeap () returned 0x630000 [0056.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2b8 [0056.516] GetProcessHeap () returned 0x630000 [0056.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0056.516] GetProcessHeap () returned 0x630000 [0056.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0056.516] GetProcessHeap () returned 0x630000 [0056.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0056.516] GetProcessHeap () returned 0x630000 [0056.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0056.516] GetProcessHeap () returned 0x630000 [0056.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657210 [0056.516] GetProcessHeap () returned 0x630000 [0056.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.516] GetProcessHeap () returned 0x630000 [0056.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0056.516] GetProcessHeap () returned 0x630000 [0056.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ec40 [0056.516] GetProcessHeap () returned 0x630000 [0056.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0056.516] GetProcessHeap () returned 0x630000 [0056.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0056.516] GetProcessHeap () returned 0x630000 [0056.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ec40 | out: hHeap=0x630000) returned 1 [0056.517] GetProcessHeap () returned 0x630000 [0056.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0056.517] GetProcessHeap () returned 0x630000 [0056.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65aa08 [0056.517] GetProcessHeap () returned 0x630000 [0056.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.517] GetProcessHeap () returned 0x630000 [0056.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0056.517] GetProcessHeap () returned 0x630000 [0056.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.517] GetProcessHeap () returned 0x630000 [0056.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.517] GetProcessHeap () returned 0x630000 [0056.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ebb0 [0056.517] GetProcessHeap () returned 0x630000 [0056.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65aa08 | out: hHeap=0x630000) returned 1 [0056.517] GetProcessHeap () returned 0x630000 [0056.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0056.517] GetProcessHeap () returned 0x630000 [0056.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0056.517] GetProcessHeap () returned 0x630000 [0056.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.517] GetProcessHeap () returned 0x630000 [0056.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.517] GetProcessHeap () returned 0x630000 [0056.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.517] GetProcessHeap () returned 0x630000 [0056.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.517] GetProcessHeap () returned 0x630000 [0056.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.517] GetProcessHeap () returned 0x630000 [0056.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.517] GetProcessHeap () returned 0x630000 [0056.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.517] GetProcessHeap () returned 0x630000 [0056.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.517] GetProcessHeap () returned 0x630000 [0056.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0056.517] GetProcessHeap () returned 0x630000 [0056.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0056.518] GetProcessHeap () returned 0x630000 [0056.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.518] GetProcessHeap () returned 0x630000 [0056.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.518] GetProcessHeap () returned 0x630000 [0056.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.518] GetProcessHeap () returned 0x630000 [0056.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.518] GetProcessHeap () returned 0x630000 [0056.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0056.518] GetProcessHeap () returned 0x630000 [0056.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0056.518] GetProcessHeap () returned 0x630000 [0056.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.518] GetProcessHeap () returned 0x630000 [0056.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.518] GetProcessHeap () returned 0x630000 [0056.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0056.518] GetProcessHeap () returned 0x630000 [0056.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0056.518] GetProcessHeap () returned 0x630000 [0056.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0056.518] GetProcessHeap () returned 0x630000 [0056.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0056.518] GetProcessHeap () returned 0x630000 [0056.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0056.518] GetProcessHeap () returned 0x630000 [0056.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0056.518] GetProcessHeap () returned 0x630000 [0056.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.518] GetProcessHeap () returned 0x630000 [0056.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.518] GetProcessHeap () returned 0x630000 [0056.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0056.518] GetProcessHeap () returned 0x630000 [0056.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0056.518] GetProcessHeap () returned 0x630000 [0056.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.519] GetProcessHeap () returned 0x630000 [0056.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.519] GetProcessHeap () returned 0x630000 [0056.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.519] GetProcessHeap () returned 0x630000 [0056.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.519] GetProcessHeap () returned 0x630000 [0056.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0056.519] GetProcessHeap () returned 0x630000 [0056.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0056.519] GetProcessHeap () returned 0x630000 [0056.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0056.519] GetProcessHeap () returned 0x630000 [0056.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0056.519] GetProcessHeap () returned 0x630000 [0056.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0056.519] GetProcessHeap () returned 0x630000 [0056.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0056.519] GetProcessHeap () returned 0x630000 [0056.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0056.519] GetProcessHeap () returned 0x630000 [0056.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0056.519] GetProcessHeap () returned 0x630000 [0056.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.519] GetProcessHeap () returned 0x630000 [0056.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.519] GetProcessHeap () returned 0x630000 [0056.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0056.519] GetProcessHeap () returned 0x630000 [0056.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0056.519] GetProcessHeap () returned 0x630000 [0056.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0056.519] GetProcessHeap () returned 0x630000 [0056.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0056.519] GetProcessHeap () returned 0x630000 [0056.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.519] GetProcessHeap () returned 0x630000 [0056.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.520] GetProcessHeap () returned 0x630000 [0056.520] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0056.520] GetProcessHeap () returned 0x630000 [0056.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0056.520] GetProcessHeap () returned 0x630000 [0056.520] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0056.520] GetProcessHeap () returned 0x630000 [0056.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0056.520] GetProcessHeap () returned 0x630000 [0056.520] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.520] GetProcessHeap () returned 0x630000 [0056.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.520] GetProcessHeap () returned 0x630000 [0056.520] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.520] GetProcessHeap () returned 0x630000 [0056.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.520] GetProcessHeap () returned 0x630000 [0056.520] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.520] GetProcessHeap () returned 0x630000 [0056.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.520] GetProcessHeap () returned 0x630000 [0056.520] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.520] GetProcessHeap () returned 0x630000 [0056.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.520] GetProcessHeap () returned 0x630000 [0056.520] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0056.520] GetProcessHeap () returned 0x630000 [0056.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0056.520] GetProcessHeap () returned 0x630000 [0056.520] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.520] GetProcessHeap () returned 0x630000 [0056.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.520] GetProcessHeap () returned 0x630000 [0056.520] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0056.520] GetProcessHeap () returned 0x630000 [0056.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0056.520] GetProcessHeap () returned 0x630000 [0056.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.521] GetProcessHeap () returned 0x630000 [0056.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.521] GetProcessHeap () returned 0x630000 [0056.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0056.521] GetProcessHeap () returned 0x630000 [0056.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0056.521] GetProcessHeap () returned 0x630000 [0056.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0056.521] GetProcessHeap () returned 0x630000 [0056.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0056.521] GetProcessHeap () returned 0x630000 [0056.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0056.521] GetProcessHeap () returned 0x630000 [0056.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0056.521] GetProcessHeap () returned 0x630000 [0056.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0056.521] GetProcessHeap () returned 0x630000 [0056.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0056.521] GetProcessHeap () returned 0x630000 [0056.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0056.521] GetProcessHeap () returned 0x630000 [0056.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0056.521] GetProcessHeap () returned 0x630000 [0056.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0056.521] GetProcessHeap () returned 0x630000 [0056.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0056.521] GetProcessHeap () returned 0x630000 [0056.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.521] GetProcessHeap () returned 0x630000 [0056.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.521] GetProcessHeap () returned 0x630000 [0056.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0056.521] GetProcessHeap () returned 0x630000 [0056.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0056.521] GetProcessHeap () returned 0x630000 [0056.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0056.521] GetProcessHeap () returned 0x630000 [0056.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0056.521] GetProcessHeap () returned 0x630000 [0056.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0056.522] GetProcessHeap () returned 0x630000 [0056.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0056.522] GetProcessHeap () returned 0x630000 [0056.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0056.522] GetProcessHeap () returned 0x630000 [0056.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0056.522] GetProcessHeap () returned 0x630000 [0056.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0056.522] GetProcessHeap () returned 0x630000 [0056.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0056.522] GetProcessHeap () returned 0x630000 [0056.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0056.522] WriteFile (in: hFile=0x230, lpBuffer=0x656070*, nNumberOfBytesToWrite=0x383, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x656070*, lpNumberOfBytesWritten=0x243d864*=0x383, lpOverlapped=0x0) returned 1 [0056.527] GetProcessHeap () returned 0x630000 [0056.527] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x656070, Size=0x30) returned 0x656070 [0056.527] GetProcessHeap () returned 0x630000 [0056.527] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0056.527] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0056.527] GetProcessHeap () returned 0x630000 [0056.527] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x910) returned 0x65f588 [0056.527] ReadFile (in: hFile=0x230, lpBuffer=0x65f588, nNumberOfBytesToRead=0x910, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65f588*, lpNumberOfBytesRead=0x243d7e8*=0x910, lpOverlapped=0x0) returned 1 [0056.528] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0056.528] WriteFile (in: hFile=0x230, lpBuffer=0x65f588*, nNumberOfBytesToWrite=0x910, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65f588*, lpNumberOfBytesWritten=0x243d7e4*=0x910, lpOverlapped=0x0) returned 1 [0056.529] GetProcessHeap () returned 0x630000 [0056.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65f588 | out: hHeap=0x630000) returned 1 [0056.530] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0056.530] WriteFile (in: hFile=0x230, lpBuffer=0x656070*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x656070*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0056.545] CloseHandle (hObject=0x230) returned 1 [0056.546] GetProcessHeap () returned 0x630000 [0056.546] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f10 | out: hHeap=0x630000) returned 1 [0056.546] GetProcessHeap () returned 0x630000 [0056.546] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655aa8 | out: hHeap=0x630000) returned 1 [0056.546] GetProcessHeap () returned 0x630000 [0056.546] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0056.546] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt") returned="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt" [0056.546] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt.happythreechoose" [0056.547] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwexclude.txt"), lpNewFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwexclude.txt.happythreechoose"), dwFlags=0x1) returned 1 [0056.548] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt" | out: pszPath="C:\\Windows10Upgrade\\resources\\amd64") returned 1 [0056.548] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\amd64" | out: pszPath="C:\\Windows10Upgrade\\resources\\amd64\\") returned="" [0056.548] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\amd64\\Decryption INFO.html" [0056.548] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\amd64\\decryption info.html")) returned 0x20 [0056.548] GetProcessHeap () returned 0x630000 [0056.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0056.548] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39eff9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39eff9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x26b6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nxquery.cat", cAlternateFileName="")) returned 1 [0056.548] lstrcmpiW (lpString1="nxquery.cat", lpString2=".") returned 1 [0056.548] lstrcmpiW (lpString1="nxquery.cat", lpString2="..") returned 1 [0056.548] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\", lpString2="nxquery.cat" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat") returned="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat" [0056.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nxquery.cat", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0056.548] GetProcessHeap () returned 0x630000 [0056.548] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0056.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nxquery.cat", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nxquery.cat", lpUsedDefaultChar=0x0) returned 12 [0056.548] lstrlenA (lpString="nxquery.cat") returned 11 [0056.548] lstrlenA (lpString=".happythreechoose") returned 17 [0056.548] lstrcmpiW (lpString1="nxquery.cat", lpString2="Decryption INFO.html") returned 1 [0056.548] lstrcmpiW (lpString1="nxquery.cat", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0056.548] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0056.548] lstrcmpiW (lpString1="nxquery.cat", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0056.548] GetProcessHeap () returned 0x630000 [0056.548] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0056.548] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0056.549] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=9910) returned 1 [0056.549] GetProcessHeap () returned 0x630000 [0056.549] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6555f8 [0056.549] GetProcessHeap () returned 0x630000 [0056.549] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0056.549] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat") returned 47 [0056.549] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0056.549] GetProcessHeap () returned 0x630000 [0056.549] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0056.549] GetProcessHeap () returned 0x630000 [0056.549] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x6560a8 [0056.549] lstrlenA (lpString="rsa_encrypt") returned 11 [0056.549] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0056.550] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0056.550] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0056.550] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0056.550] GetProcessHeap () returned 0x630000 [0056.550] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0056.550] lstrlenA (lpString="010001") returned 6 [0056.550] GetProcessHeap () returned 0x630000 [0056.550] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a308 [0056.550] GetProcessHeap () returned 0x630000 [0056.550] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0056.550] GetProcessHeap () returned 0x630000 [0056.550] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0056.550] GetProcessHeap () returned 0x630000 [0056.550] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0056.550] GetProcessHeap () returned 0x630000 [0056.550] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e580 [0056.550] GetProcessHeap () returned 0x630000 [0056.550] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656b80 [0056.550] GetProcessHeap () returned 0x630000 [0056.550] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3f8 [0056.550] GetProcessHeap () returned 0x630000 [0056.550] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0056.550] GetProcessHeap () returned 0x630000 [0056.550] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0056.550] GetProcessHeap () returned 0x630000 [0056.550] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0056.550] GetProcessHeap () returned 0x630000 [0056.550] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0056.550] GetProcessHeap () returned 0x630000 [0056.550] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657440 [0056.550] GetProcessHeap () returned 0x630000 [0056.550] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.550] GetProcessHeap () returned 0x630000 [0056.551] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0056.551] GetProcessHeap () returned 0x630000 [0056.551] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65df50 [0056.551] GetProcessHeap () returned 0x630000 [0056.551] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0056.551] GetProcessHeap () returned 0x630000 [0056.551] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0056.551] GetProcessHeap () returned 0x630000 [0056.551] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0056.551] GetProcessHeap () returned 0x630000 [0056.551] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0056.551] GetProcessHeap () returned 0x630000 [0056.551] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65a960 [0056.551] GetProcessHeap () returned 0x630000 [0056.551] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.551] GetProcessHeap () returned 0x630000 [0056.551] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0056.551] GetProcessHeap () returned 0x630000 [0056.551] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0056.551] GetProcessHeap () returned 0x630000 [0056.551] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0056.551] GetProcessHeap () returned 0x630000 [0056.551] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e730 [0056.551] GetProcessHeap () returned 0x630000 [0056.551] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a960 | out: hHeap=0x630000) returned 1 [0056.551] GetProcessHeap () returned 0x630000 [0056.551] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0056.551] GetProcessHeap () returned 0x630000 [0056.551] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0056.551] GetProcessHeap () returned 0x630000 [0056.551] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0056.551] GetProcessHeap () returned 0x630000 [0056.551] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0056.551] GetProcessHeap () returned 0x630000 [0056.551] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0056.551] GetProcessHeap () returned 0x630000 [0056.551] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0056.552] GetProcessHeap () returned 0x630000 [0056.552] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0056.552] GetProcessHeap () returned 0x630000 [0056.552] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0056.552] GetProcessHeap () returned 0x630000 [0056.552] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.552] GetProcessHeap () returned 0x630000 [0056.552] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.552] GetProcessHeap () returned 0x630000 [0056.552] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0056.552] GetProcessHeap () returned 0x630000 [0056.552] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0056.552] GetProcessHeap () returned 0x630000 [0056.552] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0056.552] GetProcessHeap () returned 0x630000 [0056.552] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0056.552] GetProcessHeap () returned 0x630000 [0056.552] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0056.552] GetProcessHeap () returned 0x630000 [0056.552] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0056.552] GetProcessHeap () returned 0x630000 [0056.552] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0056.552] GetProcessHeap () returned 0x630000 [0056.552] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0056.552] GetProcessHeap () returned 0x630000 [0056.552] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0056.552] GetProcessHeap () returned 0x630000 [0056.552] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0056.552] GetProcessHeap () returned 0x630000 [0056.552] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0056.552] GetProcessHeap () returned 0x630000 [0056.552] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0056.552] GetProcessHeap () returned 0x630000 [0056.552] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0056.552] GetProcessHeap () returned 0x630000 [0056.552] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0056.553] GetProcessHeap () returned 0x630000 [0056.553] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.553] GetProcessHeap () returned 0x630000 [0056.553] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.553] GetProcessHeap () returned 0x630000 [0056.553] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0056.553] GetProcessHeap () returned 0x630000 [0056.553] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0056.553] GetProcessHeap () returned 0x630000 [0056.553] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0056.553] GetProcessHeap () returned 0x630000 [0056.553] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0056.553] GetProcessHeap () returned 0x630000 [0056.553] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0056.553] GetProcessHeap () returned 0x630000 [0056.553] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0056.553] GetProcessHeap () returned 0x630000 [0056.553] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0056.553] GetProcessHeap () returned 0x630000 [0056.553] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0056.553] GetProcessHeap () returned 0x630000 [0056.553] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0056.553] GetProcessHeap () returned 0x630000 [0056.553] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0056.553] GetProcessHeap () returned 0x630000 [0056.553] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0056.553] GetProcessHeap () returned 0x630000 [0056.553] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0056.553] GetProcessHeap () returned 0x630000 [0056.553] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0056.553] GetProcessHeap () returned 0x630000 [0056.553] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0056.553] GetProcessHeap () returned 0x630000 [0056.553] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0056.553] GetProcessHeap () returned 0x630000 [0056.553] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0056.554] GetProcessHeap () returned 0x630000 [0056.554] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0056.554] GetProcessHeap () returned 0x630000 [0056.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0056.554] GetProcessHeap () returned 0x630000 [0056.554] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.554] GetProcessHeap () returned 0x630000 [0056.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.554] GetProcessHeap () returned 0x630000 [0056.554] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.554] GetProcessHeap () returned 0x630000 [0056.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.554] GetProcessHeap () returned 0x630000 [0056.554] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0056.554] GetProcessHeap () returned 0x630000 [0056.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0056.554] GetProcessHeap () returned 0x630000 [0056.554] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.554] GetProcessHeap () returned 0x630000 [0056.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.554] GetProcessHeap () returned 0x630000 [0056.554] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.554] GetProcessHeap () returned 0x630000 [0056.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.554] GetProcessHeap () returned 0x630000 [0056.554] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0056.554] GetProcessHeap () returned 0x630000 [0056.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0056.554] GetProcessHeap () returned 0x630000 [0056.554] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.554] GetProcessHeap () returned 0x630000 [0056.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.554] GetProcessHeap () returned 0x630000 [0056.554] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0056.555] GetProcessHeap () returned 0x630000 [0056.555] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0056.555] GetProcessHeap () returned 0x630000 [0056.555] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.555] GetProcessHeap () returned 0x630000 [0056.555] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.555] GetProcessHeap () returned 0x630000 [0056.555] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0056.555] GetProcessHeap () returned 0x630000 [0056.555] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0056.555] GetProcessHeap () returned 0x630000 [0056.555] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.555] GetProcessHeap () returned 0x630000 [0056.555] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.555] GetProcessHeap () returned 0x630000 [0056.555] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0056.555] GetProcessHeap () returned 0x630000 [0056.555] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0056.555] GetProcessHeap () returned 0x630000 [0056.555] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0056.555] GetProcessHeap () returned 0x630000 [0056.555] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0056.555] GetProcessHeap () returned 0x630000 [0056.555] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0056.555] GetProcessHeap () returned 0x630000 [0056.555] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0056.555] GetProcessHeap () returned 0x630000 [0056.555] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0056.555] GetProcessHeap () returned 0x630000 [0056.555] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0056.555] GetProcessHeap () returned 0x630000 [0056.555] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0056.555] GetProcessHeap () returned 0x630000 [0056.555] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0056.555] GetProcessHeap () returned 0x630000 [0056.555] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0056.555] GetProcessHeap () returned 0x630000 [0056.555] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0056.556] GetProcessHeap () returned 0x630000 [0056.556] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.556] GetProcessHeap () returned 0x630000 [0056.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.556] GetProcessHeap () returned 0x630000 [0056.556] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0056.556] GetProcessHeap () returned 0x630000 [0056.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0056.556] GetProcessHeap () returned 0x630000 [0056.556] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0056.556] GetProcessHeap () returned 0x630000 [0056.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0056.556] GetProcessHeap () returned 0x630000 [0056.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0056.556] GetProcessHeap () returned 0x630000 [0056.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0056.556] GetProcessHeap () returned 0x630000 [0056.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0056.556] GetProcessHeap () returned 0x630000 [0056.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0056.556] GetProcessHeap () returned 0x630000 [0056.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0056.556] GetProcessHeap () returned 0x630000 [0056.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0056.556] GetProcessHeap () returned 0x630000 [0056.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0056.556] GetProcessHeap () returned 0x630000 [0056.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0056.556] GetProcessHeap () returned 0x630000 [0056.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0056.556] GetProcessHeap () returned 0x630000 [0056.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.556] GetProcessHeap () returned 0x630000 [0056.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0056.556] WriteFile (in: hFile=0x230, lpBuffer=0x6560a8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6560a8*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0056.588] GetProcessHeap () returned 0x630000 [0056.588] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6560a8, Size=0x30) returned 0x6560a8 [0056.588] GetProcessHeap () returned 0x630000 [0056.588] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0056.588] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0056.588] GetProcessHeap () returned 0x630000 [0056.588] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x26b6) returned 0x65f588 [0056.589] ReadFile (in: hFile=0x230, lpBuffer=0x65f588, nNumberOfBytesToRead=0x26b6, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65f588*, lpNumberOfBytesRead=0x243d7e8*=0x26b6, lpOverlapped=0x0) returned 1 [0056.590] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0056.590] WriteFile (in: hFile=0x230, lpBuffer=0x65f588*, nNumberOfBytesToWrite=0x26b6, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65f588*, lpNumberOfBytesWritten=0x243d7e4*=0x26b6, lpOverlapped=0x0) returned 1 [0056.616] GetProcessHeap () returned 0x630000 [0056.616] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65f588 | out: hHeap=0x630000) returned 1 [0056.616] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0056.616] WriteFile (in: hFile=0x230, lpBuffer=0x6560a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6560a8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0056.618] CloseHandle (hObject=0x230) returned 1 [0056.619] GetProcessHeap () returned 0x630000 [0056.619] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0056.619] GetProcessHeap () returned 0x630000 [0056.619] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6555f8 | out: hHeap=0x630000) returned 1 [0056.619] GetProcessHeap () returned 0x630000 [0056.619] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0056.619] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat") returned="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat" [0056.619] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat.happythreechoose" [0056.619] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.cat"), lpNewFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.cat.happythreechoose"), dwFlags=0x1) returned 1 [0056.620] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat" | out: pszPath="C:\\Windows10Upgrade\\resources\\amd64") returned 1 [0056.620] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\amd64" | out: pszPath="C:\\Windows10Upgrade\\resources\\amd64\\") returned="" [0056.620] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\amd64\\Decryption INFO.html" [0056.620] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\amd64\\decryption info.html")) returned 0x20 [0056.620] GetProcessHeap () returned 0x630000 [0056.620] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0056.620] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3a3e27, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a3e27, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x5d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nxquery.inf", cAlternateFileName="")) returned 1 [0056.620] lstrcmpiW (lpString1="nxquery.inf", lpString2=".") returned 1 [0056.620] lstrcmpiW (lpString1="nxquery.inf", lpString2="..") returned 1 [0056.620] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\", lpString2="nxquery.inf" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf") returned="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf" [0056.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nxquery.inf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0056.620] GetProcessHeap () returned 0x630000 [0056.620] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0056.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nxquery.inf", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nxquery.inf", lpUsedDefaultChar=0x0) returned 12 [0056.621] lstrlenA (lpString="nxquery.inf") returned 11 [0056.621] lstrlenA (lpString=".happythreechoose") returned 17 [0056.621] lstrcmpiW (lpString1="nxquery.inf", lpString2="Decryption INFO.html") returned 1 [0056.621] lstrcmpiW (lpString1="nxquery.inf", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0056.621] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0056.621] lstrcmpiW (lpString1="nxquery.inf", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0056.621] GetProcessHeap () returned 0x630000 [0056.621] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0056.621] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0056.621] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=1495) returned 1 [0056.621] GetProcessHeap () returned 0x630000 [0056.621] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6558c8 [0056.621] GetProcessHeap () returned 0x630000 [0056.621] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0056.621] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf") returned 47 [0056.621] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0056.621] GetProcessHeap () returned 0x630000 [0056.621] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0056.621] GetProcessHeap () returned 0x630000 [0056.621] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x389) returned 0x6560e0 [0056.621] lstrlenA (lpString="rsa_encrypt") returned 11 [0056.621] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0056.622] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0056.622] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0056.622] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0056.622] GetProcessHeap () returned 0x630000 [0056.622] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0056.622] lstrlenA (lpString="010001") returned 6 [0056.622] GetProcessHeap () returned 0x630000 [0056.622] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a378 [0056.622] GetProcessHeap () returned 0x630000 [0056.622] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x656478 [0056.622] GetProcessHeap () returned 0x630000 [0056.622] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0056.622] GetProcessHeap () returned 0x630000 [0056.622] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656478 | out: hHeap=0x630000) returned 1 [0056.622] GetProcessHeap () returned 0x630000 [0056.622] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e8e0 [0056.623] GetProcessHeap () returned 0x630000 [0056.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x6570f8 [0056.623] GetProcessHeap () returned 0x630000 [0056.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a328 [0056.623] GetProcessHeap () returned 0x630000 [0056.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0056.623] GetProcessHeap () returned 0x630000 [0056.623] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.623] GetProcessHeap () returned 0x630000 [0056.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0056.623] GetProcessHeap () returned 0x630000 [0056.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x656478 [0056.623] GetProcessHeap () returned 0x630000 [0056.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656a68 [0056.623] GetProcessHeap () returned 0x630000 [0056.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0056.623] GetProcessHeap () returned 0x630000 [0056.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0056.623] GetProcessHeap () returned 0x630000 [0056.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e460 [0056.623] GetProcessHeap () returned 0x630000 [0056.623] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656478 | out: hHeap=0x630000) returned 1 [0056.623] GetProcessHeap () returned 0x630000 [0056.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0056.623] GetProcessHeap () returned 0x630000 [0056.623] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e460 | out: hHeap=0x630000) returned 1 [0056.623] GetProcessHeap () returned 0x630000 [0056.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.623] GetProcessHeap () returned 0x630000 [0056.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65a930 [0056.623] GetProcessHeap () returned 0x630000 [0056.623] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0056.623] GetProcessHeap () returned 0x630000 [0056.623] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.623] GetProcessHeap () returned 0x630000 [0056.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.623] GetProcessHeap () returned 0x630000 [0056.623] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.623] GetProcessHeap () returned 0x630000 [0056.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ec40 [0056.623] GetProcessHeap () returned 0x630000 [0056.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a930 | out: hHeap=0x630000) returned 1 [0056.624] GetProcessHeap () returned 0x630000 [0056.624] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0056.624] GetProcessHeap () returned 0x630000 [0056.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ec40 | out: hHeap=0x630000) returned 1 [0056.624] GetProcessHeap () returned 0x630000 [0056.624] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.624] GetProcessHeap () returned 0x630000 [0056.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.624] GetProcessHeap () returned 0x630000 [0056.624] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0056.624] GetProcessHeap () returned 0x630000 [0056.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0056.624] GetProcessHeap () returned 0x630000 [0056.624] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0056.624] GetProcessHeap () returned 0x630000 [0056.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0056.624] GetProcessHeap () returned 0x630000 [0056.624] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0056.624] GetProcessHeap () returned 0x630000 [0056.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0056.624] GetProcessHeap () returned 0x630000 [0056.624] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0056.624] GetProcessHeap () returned 0x630000 [0056.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0056.624] GetProcessHeap () returned 0x630000 [0056.624] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0056.624] GetProcessHeap () returned 0x630000 [0056.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0056.624] GetProcessHeap () returned 0x630000 [0056.624] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.624] GetProcessHeap () returned 0x630000 [0056.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.624] GetProcessHeap () returned 0x630000 [0056.624] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.624] GetProcessHeap () returned 0x630000 [0056.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.624] GetProcessHeap () returned 0x630000 [0056.625] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.625] GetProcessHeap () returned 0x630000 [0056.625] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.625] GetProcessHeap () returned 0x630000 [0056.625] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0056.625] GetProcessHeap () returned 0x630000 [0056.625] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0056.625] GetProcessHeap () returned 0x630000 [0056.625] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.625] GetProcessHeap () returned 0x630000 [0056.625] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.625] GetProcessHeap () returned 0x630000 [0056.625] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.625] GetProcessHeap () returned 0x630000 [0056.625] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.625] GetProcessHeap () returned 0x630000 [0056.625] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0056.625] GetProcessHeap () returned 0x630000 [0056.625] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0056.626] GetProcessHeap () returned 0x630000 [0056.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.626] GetProcessHeap () returned 0x630000 [0056.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.626] GetProcessHeap () returned 0x630000 [0056.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.626] GetProcessHeap () returned 0x630000 [0056.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.626] GetProcessHeap () returned 0x630000 [0056.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.626] GetProcessHeap () returned 0x630000 [0056.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.626] GetProcessHeap () returned 0x630000 [0056.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0056.626] GetProcessHeap () returned 0x630000 [0056.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0056.626] GetProcessHeap () returned 0x630000 [0056.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.626] GetProcessHeap () returned 0x630000 [0056.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.626] GetProcessHeap () returned 0x630000 [0056.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0056.626] GetProcessHeap () returned 0x630000 [0056.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0056.626] GetProcessHeap () returned 0x630000 [0056.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.626] GetProcessHeap () returned 0x630000 [0056.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.626] GetProcessHeap () returned 0x630000 [0056.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0056.626] GetProcessHeap () returned 0x630000 [0056.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0056.626] GetProcessHeap () returned 0x630000 [0056.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.626] GetProcessHeap () returned 0x630000 [0056.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.626] GetProcessHeap () returned 0x630000 [0056.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.627] GetProcessHeap () returned 0x630000 [0056.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.627] GetProcessHeap () returned 0x630000 [0056.627] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.627] GetProcessHeap () returned 0x630000 [0056.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.627] GetProcessHeap () returned 0x630000 [0056.627] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.627] GetProcessHeap () returned 0x630000 [0056.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.627] GetProcessHeap () returned 0x630000 [0056.627] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0056.627] GetProcessHeap () returned 0x630000 [0056.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0056.627] GetProcessHeap () returned 0x630000 [0056.627] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0056.627] GetProcessHeap () returned 0x630000 [0056.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0056.627] GetProcessHeap () returned 0x630000 [0056.627] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.627] GetProcessHeap () returned 0x630000 [0056.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.627] GetProcessHeap () returned 0x630000 [0056.627] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.627] GetProcessHeap () returned 0x630000 [0056.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.627] GetProcessHeap () returned 0x630000 [0056.627] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.627] GetProcessHeap () returned 0x630000 [0056.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.627] GetProcessHeap () returned 0x630000 [0056.627] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0056.627] GetProcessHeap () returned 0x630000 [0056.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0056.627] GetProcessHeap () returned 0x630000 [0056.627] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0056.627] GetProcessHeap () returned 0x630000 [0056.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0056.627] GetProcessHeap () returned 0x630000 [0056.628] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0056.628] GetProcessHeap () returned 0x630000 [0056.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0056.628] GetProcessHeap () returned 0x630000 [0056.628] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0056.628] GetProcessHeap () returned 0x630000 [0056.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0056.628] GetProcessHeap () returned 0x630000 [0056.628] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.628] GetProcessHeap () returned 0x630000 [0056.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.628] GetProcessHeap () returned 0x630000 [0056.628] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0056.628] GetProcessHeap () returned 0x630000 [0056.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0056.628] GetProcessHeap () returned 0x630000 [0056.628] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0056.628] GetProcessHeap () returned 0x630000 [0056.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0056.628] GetProcessHeap () returned 0x630000 [0056.628] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0056.628] GetProcessHeap () returned 0x630000 [0056.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0056.628] GetProcessHeap () returned 0x630000 [0056.628] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0056.628] GetProcessHeap () returned 0x630000 [0056.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0056.628] GetProcessHeap () returned 0x630000 [0056.628] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.628] GetProcessHeap () returned 0x630000 [0056.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.628] GetProcessHeap () returned 0x630000 [0056.628] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0056.628] GetProcessHeap () returned 0x630000 [0056.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0056.628] GetProcessHeap () returned 0x630000 [0056.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0056.628] GetProcessHeap () returned 0x630000 [0056.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0056.629] GetProcessHeap () returned 0x630000 [0056.629] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0056.629] GetProcessHeap () returned 0x630000 [0056.629] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0056.629] GetProcessHeap () returned 0x630000 [0056.629] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0056.629] GetProcessHeap () returned 0x630000 [0056.629] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0056.629] GetProcessHeap () returned 0x630000 [0056.629] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0056.629] GetProcessHeap () returned 0x630000 [0056.629] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0056.629] GetProcessHeap () returned 0x630000 [0056.629] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0056.629] GetProcessHeap () returned 0x630000 [0056.629] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0056.629] GetProcessHeap () returned 0x630000 [0056.629] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0056.629] WriteFile (in: hFile=0x230, lpBuffer=0x6560e0*, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6560e0*, lpNumberOfBytesWritten=0x243d864*=0x389, lpOverlapped=0x0) returned 1 [0056.632] GetProcessHeap () returned 0x630000 [0056.632] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6560e0, Size=0x30) returned 0x6560e0 [0056.632] GetProcessHeap () returned 0x630000 [0056.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0056.632] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0056.632] GetProcessHeap () returned 0x630000 [0056.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5e0) returned 0x65f588 [0056.632] ReadFile (in: hFile=0x230, lpBuffer=0x65f588, nNumberOfBytesToRead=0x5e0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65f588*, lpNumberOfBytesRead=0x243d7e8*=0x5e0, lpOverlapped=0x0) returned 1 [0056.633] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0056.633] WriteFile (in: hFile=0x230, lpBuffer=0x65f588*, nNumberOfBytesToWrite=0x5e0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65f588*, lpNumberOfBytesWritten=0x243d7e4*=0x5e0, lpOverlapped=0x0) returned 1 [0056.634] GetProcessHeap () returned 0x630000 [0056.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65f588 | out: hHeap=0x630000) returned 1 [0056.634] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0056.634] WriteFile (in: hFile=0x230, lpBuffer=0x6560e0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6560e0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0056.635] CloseHandle (hObject=0x230) returned 1 [0056.637] GetProcessHeap () returned 0x630000 [0056.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0056.637] GetProcessHeap () returned 0x630000 [0056.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6558c8 | out: hHeap=0x630000) returned 1 [0056.637] GetProcessHeap () returned 0x630000 [0056.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0056.637] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf") returned="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf" [0056.637] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf.happythreechoose" [0056.637] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.inf"), lpNewFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.inf.happythreechoose"), dwFlags=0x1) returned 1 [0056.637] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf" | out: pszPath="C:\\Windows10Upgrade\\resources\\amd64") returned 1 [0056.637] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\amd64" | out: pszPath="C:\\Windows10Upgrade\\resources\\amd64\\") returned="" [0056.637] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\amd64\\Decryption INFO.html" [0056.637] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\amd64\\decryption info.html")) returned 0x20 [0056.638] GetProcessHeap () returned 0x630000 [0056.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0056.638] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3a652e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a652e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x50b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NXQuery.sys", cAlternateFileName="")) returned 1 [0056.638] lstrcmpiW (lpString1="NXQuery.sys", lpString2=".") returned 1 [0056.638] lstrcmpiW (lpString1="NXQuery.sys", lpString2="..") returned 1 [0056.638] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\", lpString2="NXQuery.sys" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys") returned="C:\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys" [0056.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NXQuery.sys", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0056.638] GetProcessHeap () returned 0x630000 [0056.638] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0056.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NXQuery.sys", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NXQuery.sys", lpUsedDefaultChar=0x0) returned 12 [0056.638] lstrlenA (lpString="NXQuery.sys") returned 11 [0056.638] lstrlenA (lpString=".happythreechoose") returned 17 [0056.638] lstrcmpiW (lpString1="NXQuery.sys", lpString2="Decryption INFO.html") returned 1 [0056.638] lstrcmpiW (lpString1="NXQuery.sys", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0056.638] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0056.638] lstrcmpiW (lpString1="NXQuery.sys", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0056.638] GetProcessHeap () returned 0x630000 [0056.638] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0056.638] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0056.638] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=20656) returned 1 [0056.638] GetProcessHeap () returned 0x630000 [0056.638] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6557d8 [0056.638] GetProcessHeap () returned 0x630000 [0056.639] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0056.639] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys") returned 47 [0056.639] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0056.639] GetProcessHeap () returned 0x630000 [0056.639] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0056.639] GetProcessHeap () returned 0x630000 [0056.639] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x656118 [0056.639] lstrlenA (lpString="rsa_encrypt") returned 11 [0056.639] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x6564a0) returned 1 [0056.639] CryptGenRandom (in: hProv=0x6564a0, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0056.639] CryptReleaseContext (hProv=0x6564a0, dwFlags=0x0) returned 1 [0056.639] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0056.639] GetProcessHeap () returned 0x630000 [0056.639] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6564a0 [0056.639] lstrlenA (lpString="010001") returned 6 [0056.639] GetProcessHeap () returned 0x630000 [0056.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2b8 [0056.640] GetProcessHeap () returned 0x630000 [0056.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0056.640] GetProcessHeap () returned 0x630000 [0056.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ec40 [0056.640] GetProcessHeap () returned 0x630000 [0056.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0056.640] GetProcessHeap () returned 0x630000 [0056.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e100 [0056.640] GetProcessHeap () returned 0x630000 [0056.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656a68 [0056.640] GetProcessHeap () returned 0x630000 [0056.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a368 [0056.640] GetProcessHeap () returned 0x630000 [0056.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0056.640] GetProcessHeap () returned 0x630000 [0056.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.640] GetProcessHeap () returned 0x630000 [0056.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0056.640] GetProcessHeap () returned 0x630000 [0056.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0056.640] GetProcessHeap () returned 0x630000 [0056.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657210 [0056.640] GetProcessHeap () returned 0x630000 [0056.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0056.640] GetProcessHeap () returned 0x630000 [0056.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0056.640] GetProcessHeap () returned 0x630000 [0056.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e730 [0056.640] GetProcessHeap () returned 0x630000 [0056.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0056.640] GetProcessHeap () returned 0x630000 [0056.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0056.640] GetProcessHeap () returned 0x630000 [0056.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0056.702] GetProcessHeap () returned 0x630000 [0056.702] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0056.702] GetProcessHeap () returned 0x630000 [0056.702] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65a780 [0056.702] GetProcessHeap () returned 0x630000 [0056.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0056.702] GetProcessHeap () returned 0x630000 [0056.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0056.702] GetProcessHeap () returned 0x630000 [0056.702] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0056.702] GetProcessHeap () returned 0x630000 [0056.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0056.702] GetProcessHeap () returned 0x630000 [0056.702] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e7c0 [0056.702] GetProcessHeap () returned 0x630000 [0056.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a780 | out: hHeap=0x630000) returned 1 [0056.702] GetProcessHeap () returned 0x630000 [0056.702] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0056.702] GetProcessHeap () returned 0x630000 [0056.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e7c0 | out: hHeap=0x630000) returned 1 [0056.702] GetProcessHeap () returned 0x630000 [0056.702] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.702] GetProcessHeap () returned 0x630000 [0056.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.703] GetProcessHeap () returned 0x630000 [0056.703] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.703] GetProcessHeap () returned 0x630000 [0056.703] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.703] GetProcessHeap () returned 0x630000 [0056.703] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.703] GetProcessHeap () returned 0x630000 [0056.703] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.703] GetProcessHeap () returned 0x630000 [0056.703] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.703] GetProcessHeap () returned 0x630000 [0056.703] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.703] GetProcessHeap () returned 0x630000 [0056.703] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.703] GetProcessHeap () returned 0x630000 [0056.703] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.703] GetProcessHeap () returned 0x630000 [0056.703] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0056.703] GetProcessHeap () returned 0x630000 [0056.703] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0056.703] GetProcessHeap () returned 0x630000 [0056.703] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0056.703] GetProcessHeap () returned 0x630000 [0056.703] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0056.703] GetProcessHeap () returned 0x630000 [0056.703] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0056.703] GetProcessHeap () returned 0x630000 [0056.703] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0056.704] GetProcessHeap () returned 0x630000 [0056.704] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.704] GetProcessHeap () returned 0x630000 [0056.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.704] GetProcessHeap () returned 0x630000 [0056.704] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0056.704] GetProcessHeap () returned 0x630000 [0056.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0056.704] GetProcessHeap () returned 0x630000 [0056.704] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.704] GetProcessHeap () returned 0x630000 [0056.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.704] GetProcessHeap () returned 0x630000 [0056.704] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0056.704] GetProcessHeap () returned 0x630000 [0056.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0056.704] GetProcessHeap () returned 0x630000 [0056.704] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0056.704] GetProcessHeap () returned 0x630000 [0056.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0056.704] GetProcessHeap () returned 0x630000 [0056.704] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.704] GetProcessHeap () returned 0x630000 [0056.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.704] GetProcessHeap () returned 0x630000 [0056.704] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.704] GetProcessHeap () returned 0x630000 [0056.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.704] GetProcessHeap () returned 0x630000 [0056.704] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0056.704] GetProcessHeap () returned 0x630000 [0056.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0056.704] GetProcessHeap () returned 0x630000 [0056.704] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0056.704] GetProcessHeap () returned 0x630000 [0056.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0056.704] GetProcessHeap () returned 0x630000 [0056.704] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0056.704] GetProcessHeap () returned 0x630000 [0056.705] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0056.705] GetProcessHeap () returned 0x630000 [0056.705] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.705] GetProcessHeap () returned 0x630000 [0056.705] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.705] GetProcessHeap () returned 0x630000 [0056.705] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.705] GetProcessHeap () returned 0x630000 [0056.705] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.705] GetProcessHeap () returned 0x630000 [0056.705] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0056.705] GetProcessHeap () returned 0x630000 [0056.705] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0056.705] GetProcessHeap () returned 0x630000 [0056.705] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.705] GetProcessHeap () returned 0x630000 [0056.705] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.705] GetProcessHeap () returned 0x630000 [0056.705] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0056.705] GetProcessHeap () returned 0x630000 [0056.705] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0056.705] GetProcessHeap () returned 0x630000 [0056.705] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.705] GetProcessHeap () returned 0x630000 [0056.705] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.705] GetProcessHeap () returned 0x630000 [0056.705] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0056.705] GetProcessHeap () returned 0x630000 [0056.705] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0056.705] GetProcessHeap () returned 0x630000 [0056.705] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.705] GetProcessHeap () returned 0x630000 [0056.705] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.705] GetProcessHeap () returned 0x630000 [0056.705] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0056.705] GetProcessHeap () returned 0x630000 [0056.705] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0056.705] GetProcessHeap () returned 0x630000 [0056.706] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0056.706] GetProcessHeap () returned 0x630000 [0056.706] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0056.706] GetProcessHeap () returned 0x630000 [0056.706] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0056.706] GetProcessHeap () returned 0x630000 [0056.706] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0056.706] GetProcessHeap () returned 0x630000 [0056.706] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.706] GetProcessHeap () returned 0x630000 [0056.706] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.706] GetProcessHeap () returned 0x630000 [0056.706] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0056.706] GetProcessHeap () returned 0x630000 [0056.706] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0056.706] GetProcessHeap () returned 0x630000 [0056.706] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0056.706] GetProcessHeap () returned 0x630000 [0056.706] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0056.706] GetProcessHeap () returned 0x630000 [0056.706] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.706] GetProcessHeap () returned 0x630000 [0056.706] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.706] GetProcessHeap () returned 0x630000 [0056.706] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0056.706] GetProcessHeap () returned 0x630000 [0056.706] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0056.706] GetProcessHeap () returned 0x630000 [0056.706] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.706] GetProcessHeap () returned 0x630000 [0056.706] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.706] GetProcessHeap () returned 0x630000 [0056.706] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0056.706] GetProcessHeap () returned 0x630000 [0056.706] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0056.706] GetProcessHeap () returned 0x630000 [0056.706] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.706] GetProcessHeap () returned 0x630000 [0056.706] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.707] GetProcessHeap () returned 0x630000 [0056.707] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.707] GetProcessHeap () returned 0x630000 [0056.707] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.707] GetProcessHeap () returned 0x630000 [0056.707] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0056.707] GetProcessHeap () returned 0x630000 [0056.707] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0056.707] GetProcessHeap () returned 0x630000 [0056.707] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.707] GetProcessHeap () returned 0x630000 [0056.707] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.707] GetProcessHeap () returned 0x630000 [0056.707] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.707] GetProcessHeap () returned 0x630000 [0056.707] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.707] GetProcessHeap () returned 0x630000 [0056.707] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0056.707] GetProcessHeap () returned 0x630000 [0056.707] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0056.707] GetProcessHeap () returned 0x630000 [0056.707] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0056.707] GetProcessHeap () returned 0x630000 [0056.707] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0056.707] GetProcessHeap () returned 0x630000 [0056.707] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0056.707] GetProcessHeap () returned 0x630000 [0056.707] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0056.707] GetProcessHeap () returned 0x630000 [0056.707] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0056.707] GetProcessHeap () returned 0x630000 [0056.707] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ec40 | out: hHeap=0x630000) returned 1 [0056.707] GetProcessHeap () returned 0x630000 [0056.707] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0056.707] GetProcessHeap () returned 0x630000 [0056.707] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0056.707] GetProcessHeap () returned 0x630000 [0056.708] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6564a0 | out: hHeap=0x630000) returned 1 [0056.708] WriteFile (in: hFile=0x230, lpBuffer=0x656118*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x656118*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0056.715] GetProcessHeap () returned 0x630000 [0056.715] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x656118, Size=0x30) returned 0x656118 [0056.715] GetProcessHeap () returned 0x630000 [0056.715] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0056.715] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0056.715] GetProcessHeap () returned 0x630000 [0056.715] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x50b0) returned 0x65f588 [0056.716] ReadFile (in: hFile=0x230, lpBuffer=0x65f588, nNumberOfBytesToRead=0x50b0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65f588*, lpNumberOfBytesRead=0x243d7e8*=0x50b0, lpOverlapped=0x0) returned 1 [0056.717] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0056.717] WriteFile (in: hFile=0x230, lpBuffer=0x65f588*, nNumberOfBytesToWrite=0x50b0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65f588*, lpNumberOfBytesWritten=0x243d7e4*=0x50b0, lpOverlapped=0x0) returned 1 [0056.825] GetProcessHeap () returned 0x630000 [0056.825] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65f588 | out: hHeap=0x630000) returned 1 [0056.826] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0056.826] WriteFile (in: hFile=0x230, lpBuffer=0x656118*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x656118*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0056.827] CloseHandle (hObject=0x230) returned 1 [0056.829] GetProcessHeap () returned 0x630000 [0056.829] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0056.829] GetProcessHeap () returned 0x630000 [0056.829] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6557d8 | out: hHeap=0x630000) returned 1 [0056.829] GetProcessHeap () returned 0x630000 [0056.829] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0056.829] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys") returned="C:\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys" [0056.829] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys.happythreechoose") returned="C:\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys.happythreechoose" [0056.829] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.sys"), lpNewFileName="C:\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys.happythreechoose" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.sys.happythreechoose"), dwFlags=0x1) returned 1 [0056.830] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys" | out: pszPath="C:\\Windows10Upgrade\\resources\\amd64") returned 1 [0056.830] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\amd64" | out: pszPath="C:\\Windows10Upgrade\\resources\\amd64\\") returned="" [0056.830] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\resources\\amd64\\Decryption INFO.html" [0056.830] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\resources\\amd64\\decryption info.html")) returned 0x20 [0056.830] GetProcessHeap () returned 0x630000 [0056.830] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0056.830] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3a652e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a652e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x50b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NXQuery.sys", cAlternateFileName="")) returned 0 [0056.830] FindClose (in: hFindFile=0x648a90 | out: hFindFile=0x648a90) returned 1 [0056.830] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Windows10Upgrade\\dll2\\" | out: lpString1="C:\\Windows10Upgrade\\dll2\\") returned="C:\\Windows10Upgrade\\dll2\\" [0056.830] GetProcessHeap () returned 0x630000 [0056.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6487d0 | out: hHeap=0x630000) returned 1 [0056.831] GetProcessHeap () returned 0x630000 [0056.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0056.831] lstrlenW (lpString="C:\\Windows10Upgrade\\dll2\\") returned 25 [0056.831] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\dll2\\", lpString2="*" | out: lpString1="C:\\Windows10Upgrade\\dll2\\*") returned="C:\\Windows10Upgrade\\dll2\\*" [0056.831] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\dll2\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea37cd05, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37cd05, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea37e09b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648710 [0056.831] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0056.831] FindNextFileW (in: hFindFile=0x648710, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea37cd05, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37cd05, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea37e09b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.831] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0056.831] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0056.831] FindNextFileW (in: hFindFile=0x648710, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea37e09b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37e09b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xb8400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="webservices.dll", cAlternateFileName="WEBSER~1.DLL")) returned 1 [0056.831] lstrcmpiW (lpString1="webservices.dll", lpString2=".") returned 1 [0056.831] lstrcmpiW (lpString1="webservices.dll", lpString2="..") returned 1 [0056.831] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\dll2\\", lpString2="webservices.dll" | out: lpString1="C:\\Windows10Upgrade\\dll2\\webservices.dll") returned="C:\\Windows10Upgrade\\dll2\\webservices.dll" [0056.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="webservices.dll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0056.831] GetProcessHeap () returned 0x630000 [0056.831] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x64ca20 [0056.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="webservices.dll", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="webservices.dll", lpUsedDefaultChar=0x0) returned 16 [0056.831] lstrlenA (lpString="webservices.dll") returned 15 [0056.831] lstrlenA (lpString=".happythreechoose") returned 17 [0056.831] lstrcmpiW (lpString1="webservices.dll", lpString2="Decryption INFO.html") returned 1 [0056.831] lstrcmpiW (lpString1="webservices.dll", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0056.831] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0056.831] lstrcmpiW (lpString1="webservices.dll", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0056.831] GetProcessHeap () returned 0x630000 [0056.831] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x652000 [0056.832] CreateFileW (lpFileName="C:\\Windows10Upgrade\\dll2\\webservices.dll" (normalized: "c:\\windows10upgrade\\dll2\\webservices.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0056.832] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=754688) returned 1 [0056.832] GetProcessHeap () returned 0x630000 [0056.832] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6555f8 [0056.832] GetProcessHeap () returned 0x630000 [0056.832] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0056.832] lstrlenW (lpString="C:\\Windows10Upgrade\\dll2\\webservices.dll") returned 40 [0056.832] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0056.832] GetProcessHeap () returned 0x630000 [0056.832] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0056.832] GetProcessHeap () returned 0x630000 [0056.832] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x656150 [0056.832] lstrlenA (lpString="rsa_encrypt") returned 11 [0056.832] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0056.833] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0056.833] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0056.833] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0056.833] GetProcessHeap () returned 0x630000 [0056.833] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0056.833] lstrlenA (lpString="010001") returned 6 [0056.833] GetProcessHeap () returned 0x630000 [0056.833] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0056.833] GetProcessHeap () returned 0x630000 [0056.833] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0056.833] GetProcessHeap () returned 0x630000 [0056.833] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e100 [0056.833] GetProcessHeap () returned 0x630000 [0056.833] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0056.833] GetProcessHeap () returned 0x630000 [0056.833] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e6a0 [0056.833] GetProcessHeap () returned 0x630000 [0056.833] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657670 [0056.833] GetProcessHeap () returned 0x630000 [0056.833] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a298 [0056.833] GetProcessHeap () returned 0x630000 [0056.833] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0056.833] GetProcessHeap () returned 0x630000 [0056.834] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.834] GetProcessHeap () returned 0x630000 [0056.834] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0056.834] GetProcessHeap () returned 0x630000 [0056.834] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0056.834] GetProcessHeap () returned 0x630000 [0056.834] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657440 [0056.834] GetProcessHeap () returned 0x630000 [0056.834] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.834] GetProcessHeap () returned 0x630000 [0056.834] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0056.834] GetProcessHeap () returned 0x630000 [0056.834] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea00 [0056.834] GetProcessHeap () returned 0x630000 [0056.834] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0056.834] GetProcessHeap () returned 0x630000 [0056.834] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0056.834] GetProcessHeap () returned 0x630000 [0056.834] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0056.834] GetProcessHeap () returned 0x630000 [0056.834] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.834] GetProcessHeap () returned 0x630000 [0056.834] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65a798 [0056.834] GetProcessHeap () returned 0x630000 [0056.834] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.834] GetProcessHeap () returned 0x630000 [0056.834] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.834] GetProcessHeap () returned 0x630000 [0056.834] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0056.834] GetProcessHeap () returned 0x630000 [0056.834] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0056.834] GetProcessHeap () returned 0x630000 [0056.834] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ec40 [0056.834] GetProcessHeap () returned 0x630000 [0056.834] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a798 | out: hHeap=0x630000) returned 1 [0056.834] GetProcessHeap () returned 0x630000 [0056.834] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0056.834] GetProcessHeap () returned 0x630000 [0056.834] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ec40 | out: hHeap=0x630000) returned 1 [0056.835] GetProcessHeap () returned 0x630000 [0056.835] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0056.835] GetProcessHeap () returned 0x630000 [0056.835] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0056.835] GetProcessHeap () returned 0x630000 [0056.835] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0056.835] GetProcessHeap () returned 0x630000 [0056.835] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0056.835] GetProcessHeap () returned 0x630000 [0056.835] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0056.835] GetProcessHeap () returned 0x630000 [0056.835] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0056.835] GetProcessHeap () returned 0x630000 [0056.835] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.835] GetProcessHeap () returned 0x630000 [0056.835] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.835] GetProcessHeap () returned 0x630000 [0056.835] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0056.835] GetProcessHeap () returned 0x630000 [0056.835] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0056.835] GetProcessHeap () returned 0x630000 [0056.835] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0056.835] GetProcessHeap () returned 0x630000 [0056.835] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0056.835] GetProcessHeap () returned 0x630000 [0056.835] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0056.835] GetProcessHeap () returned 0x630000 [0056.835] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0056.835] GetProcessHeap () returned 0x630000 [0056.835] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.835] GetProcessHeap () returned 0x630000 [0056.835] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.835] GetProcessHeap () returned 0x630000 [0056.835] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0056.835] GetProcessHeap () returned 0x630000 [0056.835] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0056.835] GetProcessHeap () returned 0x630000 [0056.835] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0056.835] GetProcessHeap () returned 0x630000 [0056.836] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0056.836] GetProcessHeap () returned 0x630000 [0056.836] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.836] GetProcessHeap () returned 0x630000 [0056.836] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.836] GetProcessHeap () returned 0x630000 [0056.836] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.836] GetProcessHeap () returned 0x630000 [0056.836] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.836] GetProcessHeap () returned 0x630000 [0056.836] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.836] GetProcessHeap () returned 0x630000 [0056.836] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.836] GetProcessHeap () returned 0x630000 [0056.836] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0056.836] GetProcessHeap () returned 0x630000 [0056.836] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0056.836] GetProcessHeap () returned 0x630000 [0056.836] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.836] GetProcessHeap () returned 0x630000 [0056.836] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.836] GetProcessHeap () returned 0x630000 [0056.836] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0056.836] GetProcessHeap () returned 0x630000 [0056.836] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0056.836] GetProcessHeap () returned 0x630000 [0056.836] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.836] GetProcessHeap () returned 0x630000 [0056.836] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.836] GetProcessHeap () returned 0x630000 [0056.836] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0056.836] GetProcessHeap () returned 0x630000 [0056.836] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0056.836] GetProcessHeap () returned 0x630000 [0056.836] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0056.836] GetProcessHeap () returned 0x630000 [0056.836] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0056.836] GetProcessHeap () returned 0x630000 [0056.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0056.837] GetProcessHeap () returned 0x630000 [0056.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0056.837] GetProcessHeap () returned 0x630000 [0056.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.837] GetProcessHeap () returned 0x630000 [0056.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.837] GetProcessHeap () returned 0x630000 [0056.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.837] GetProcessHeap () returned 0x630000 [0056.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.837] GetProcessHeap () returned 0x630000 [0056.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.837] GetProcessHeap () returned 0x630000 [0056.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.837] GetProcessHeap () returned 0x630000 [0056.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0056.837] GetProcessHeap () returned 0x630000 [0056.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0056.837] GetProcessHeap () returned 0x630000 [0056.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0056.837] GetProcessHeap () returned 0x630000 [0056.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0056.837] GetProcessHeap () returned 0x630000 [0056.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0056.837] GetProcessHeap () returned 0x630000 [0056.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0056.837] GetProcessHeap () returned 0x630000 [0056.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0056.837] GetProcessHeap () returned 0x630000 [0056.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0056.837] GetProcessHeap () returned 0x630000 [0056.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0056.837] GetProcessHeap () returned 0x630000 [0056.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0056.837] GetProcessHeap () returned 0x630000 [0056.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.837] GetProcessHeap () returned 0x630000 [0056.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.838] GetProcessHeap () returned 0x630000 [0056.838] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0056.838] GetProcessHeap () returned 0x630000 [0056.838] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0056.838] GetProcessHeap () returned 0x630000 [0056.838] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.838] GetProcessHeap () returned 0x630000 [0056.838] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.838] GetProcessHeap () returned 0x630000 [0056.838] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0056.838] GetProcessHeap () returned 0x630000 [0056.838] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0056.838] GetProcessHeap () returned 0x630000 [0056.838] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0056.838] GetProcessHeap () returned 0x630000 [0056.838] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0056.838] GetProcessHeap () returned 0x630000 [0056.838] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.838] GetProcessHeap () returned 0x630000 [0056.838] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.838] GetProcessHeap () returned 0x630000 [0056.838] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.838] GetProcessHeap () returned 0x630000 [0056.838] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.838] GetProcessHeap () returned 0x630000 [0056.838] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0056.838] GetProcessHeap () returned 0x630000 [0056.838] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0056.838] GetProcessHeap () returned 0x630000 [0056.838] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.838] GetProcessHeap () returned 0x630000 [0056.838] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.838] GetProcessHeap () returned 0x630000 [0056.838] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0056.838] GetProcessHeap () returned 0x630000 [0056.838] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0056.838] GetProcessHeap () returned 0x630000 [0056.838] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0056.838] GetProcessHeap () returned 0x630000 [0056.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0056.839] GetProcessHeap () returned 0x630000 [0056.839] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0056.839] GetProcessHeap () returned 0x630000 [0056.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0056.839] GetProcessHeap () returned 0x630000 [0056.839] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0056.839] GetProcessHeap () returned 0x630000 [0056.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0056.839] GetProcessHeap () returned 0x630000 [0056.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0056.839] GetProcessHeap () returned 0x630000 [0056.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0056.839] GetProcessHeap () returned 0x630000 [0056.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0056.839] GetProcessHeap () returned 0x630000 [0056.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0056.839] GetProcessHeap () returned 0x630000 [0056.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0056.839] GetProcessHeap () returned 0x630000 [0056.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e6a0 | out: hHeap=0x630000) returned 1 [0056.839] GetProcessHeap () returned 0x630000 [0056.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0056.839] GetProcessHeap () returned 0x630000 [0056.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0056.839] GetProcessHeap () returned 0x630000 [0056.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0056.839] GetProcessHeap () returned 0x630000 [0056.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0056.839] GetProcessHeap () returned 0x630000 [0056.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0056.839] WriteFile (in: hFile=0x230, lpBuffer=0x656150*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x656150*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0056.843] GetProcessHeap () returned 0x630000 [0056.843] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x656150, Size=0x30) returned 0x656150 [0056.843] GetProcessHeap () returned 0x630000 [0056.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0056.843] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0056.843] GetProcessHeap () returned 0x630000 [0056.843] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb8400) returned 0x1f36020 [0056.857] ReadFile (in: hFile=0x230, lpBuffer=0x1f36020, nNumberOfBytesToRead=0xb8400, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x1f36020*, lpNumberOfBytesRead=0x243d7e8*=0xb8400, lpOverlapped=0x0) returned 1 [0056.867] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0056.868] WriteFile (in: hFile=0x230, lpBuffer=0x1f36020*, nNumberOfBytesToWrite=0xb8400, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x1f36020*, lpNumberOfBytesWritten=0x243d7e4*=0xb8400, lpOverlapped=0x0) returned 1 [0056.979] GetProcessHeap () returned 0x630000 [0056.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x1f36020 | out: hHeap=0x630000) returned 1 [0056.983] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0056.983] WriteFile (in: hFile=0x230, lpBuffer=0x656150*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x656150*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0056.984] CloseHandle (hObject=0x230) returned 1 [0056.998] GetProcessHeap () returned 0x630000 [0056.998] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x652000 | out: hHeap=0x630000) returned 1 [0056.998] GetProcessHeap () returned 0x630000 [0056.998] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6555f8 | out: hHeap=0x630000) returned 1 [0056.998] GetProcessHeap () returned 0x630000 [0056.998] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0056.998] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\dll2\\webservices.dll" | out: lpString1="C:\\Windows10Upgrade\\dll2\\webservices.dll") returned="C:\\Windows10Upgrade\\dll2\\webservices.dll" [0056.998] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\dll2\\webservices.dll", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\dll2\\webservices.dll.happythreechoose") returned="C:\\Windows10Upgrade\\dll2\\webservices.dll.happythreechoose" [0056.998] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\dll2\\webservices.dll" (normalized: "c:\\windows10upgrade\\dll2\\webservices.dll"), lpNewFileName="C:\\Windows10Upgrade\\dll2\\webservices.dll.happythreechoose" (normalized: "c:\\windows10upgrade\\dll2\\webservices.dll.happythreechoose"), dwFlags=0x1) returned 1 [0056.999] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\dll2\\webservices.dll" | out: pszPath="C:\\Windows10Upgrade\\dll2") returned 1 [0056.999] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\dll2" | out: pszPath="C:\\Windows10Upgrade\\dll2\\") returned="" [0056.999] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\dll2\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\dll2\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\dll2\\Decryption INFO.html" [0056.999] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\dll2\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\dll2\\decryption info.html")) returned 0xffffffff [0056.999] CreateFileW (lpFileName="C:\\Windows10Upgrade\\dll2\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\dll2\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0056.999] GetProcessHeap () returned 0x630000 [0056.999] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6558c8 [0056.999] GetProcessHeap () returned 0x630000 [0056.999] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0057.007] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.012] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.012] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.012] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.012] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.012] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.014] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.014] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.014] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.014] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.014] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.014] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.014] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.014] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.014] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.014] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.014] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.014] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.014] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.014] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.015] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.015] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.015] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.015] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.016] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.017] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.017] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.017] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.017] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.017] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.017] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.017] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.017] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.017] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.017] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.017] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.017] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.018] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.018] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.018] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.018] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.018] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.018] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.018] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.018] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.018] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.018] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.018] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.018] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.018] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.018] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.019] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.019] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.019] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.019] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.019] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.019] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.019] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.019] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.019] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.019] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.019] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.019] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.019] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.019] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.019] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.020] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.020] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.020] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.020] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.020] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.020] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.020] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.020] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.020] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.020] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.020] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.020] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.020] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.020] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.021] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.021] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.021] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.021] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.021] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.021] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.021] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.021] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.021] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.021] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.021] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.021] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.021] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.021] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.022] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.022] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.022] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.022] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.022] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.022] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.022] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.022] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.022] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.022] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.022] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.022] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.022] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.022] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.023] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.023] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.023] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.023] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.023] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.023] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.023] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.023] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.023] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.023] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.023] GetProcessHeap () returned 0x630000 [0057.023] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6558c8 | out: hHeap=0x630000) returned 1 [0057.023] GetProcessHeap () returned 0x630000 [0057.023] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0057.023] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0057.023] GetProcessHeap () returned 0x630000 [0057.023] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655508 [0057.023] GetProcessHeap () returned 0x630000 [0057.023] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0057.030] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.030] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.031] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.031] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.031] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.031] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.031] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.031] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.031] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.031] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.031] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.031] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.048] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.048] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.048] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.048] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.048] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.048] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.048] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.048] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.048] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.048] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.048] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.048] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.048] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.048] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.049] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.049] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.049] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.049] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.049] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.049] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.049] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.049] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.049] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.049] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.049] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.049] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.049] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.049] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.050] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.050] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.050] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.050] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.050] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.050] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.050] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.050] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.050] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.050] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.050] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.050] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.050] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.050] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.050] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.051] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.051] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.051] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.051] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.051] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.051] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.051] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.051] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.051] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.051] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.051] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.051] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.051] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.051] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.052] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.052] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.052] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.052] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.052] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.052] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.052] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.052] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.052] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.052] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.052] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.052] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.053] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.053] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.053] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.053] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.053] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.053] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.053] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.053] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.053] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.053] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.053] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.053] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.053] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.053] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.053] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.054] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.054] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.054] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.054] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.054] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.054] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.054] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.054] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.054] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.054] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.054] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.054] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.054] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.054] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.055] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.055] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.055] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.055] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.055] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.055] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.055] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.055] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.056] GetProcessHeap () returned 0x630000 [0057.056] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655508 | out: hHeap=0x630000) returned 1 [0057.056] GetProcessHeap () returned 0x630000 [0057.056] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0057.056] CloseHandle (hObject=0x230) returned 1 [0057.056] GetProcessHeap () returned 0x630000 [0057.056] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0057.056] FindNextFileW (in: hFindFile=0x648710, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea37e09b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37e09b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xb8400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="webservices.dll", cAlternateFileName="WEBSER~1.DLL")) returned 0 [0057.056] FindClose (in: hFindFile=0x648710 | out: hFindFile=0x648710) returned 1 [0057.056] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Windows10Upgrade\\dll1\\" | out: lpString1="C:\\Windows10Upgrade\\dll1\\") returned="C:\\Windows10Upgrade\\dll1\\" [0057.056] GetProcessHeap () returned 0x630000 [0057.056] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x648a10 | out: hHeap=0x630000) returned 1 [0057.057] GetProcessHeap () returned 0x630000 [0057.057] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2e8 | out: hHeap=0x630000) returned 1 [0057.057] lstrlenW (lpString="C:\\Windows10Upgrade\\dll1\\") returned 25 [0057.057] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\dll1\\", lpString2="*" | out: lpString1="C:\\Windows10Upgrade\\dll1\\*") returned="C:\\Windows10Upgrade\\dll1\\*" [0057.057] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\dll1\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3757e9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea377ed3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea37926f, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6486d0 [0057.057] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0057.058] FindNextFileW (in: hFindFile=0x6486d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3757e9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea377ed3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea37926f, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.058] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0057.058] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0057.058] FindNextFileW (in: hFindFile=0x6486d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea376b75, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea376b75, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x204c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cosqueryxp.dll", cAlternateFileName="COSQUE~1.DLL")) returned 1 [0057.058] lstrcmpiW (lpString1="cosqueryxp.dll", lpString2=".") returned 1 [0057.058] lstrcmpiW (lpString1="cosqueryxp.dll", lpString2="..") returned 1 [0057.058] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\dll1\\", lpString2="cosqueryxp.dll" | out: lpString1="C:\\Windows10Upgrade\\dll1\\cosqueryxp.dll") returned="C:\\Windows10Upgrade\\dll1\\cosqueryxp.dll" [0057.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cosqueryxp.dll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0057.058] GetProcessHeap () returned 0x630000 [0057.058] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0057.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cosqueryxp.dll", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cosqueryxp.dll", lpUsedDefaultChar=0x0) returned 15 [0057.058] lstrlenA (lpString="cosqueryxp.dll") returned 14 [0057.058] lstrlenA (lpString=".happythreechoose") returned 17 [0057.058] lstrcmpiW (lpString1="cosqueryxp.dll", lpString2="Decryption INFO.html") returned -1 [0057.058] lstrcmpiW (lpString1="cosqueryxp.dll", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0057.058] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0057.058] lstrcmpiW (lpString1="cosqueryxp.dll", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0057.058] GetProcessHeap () returned 0x630000 [0057.058] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0057.058] CreateFileW (lpFileName="C:\\Windows10Upgrade\\dll1\\cosqueryxp.dll" (normalized: "c:\\windows10upgrade\\dll1\\cosqueryxp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0057.058] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=132296) returned 1 [0057.059] GetProcessHeap () returned 0x630000 [0057.059] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655580 [0057.059] GetProcessHeap () returned 0x630000 [0057.059] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0057.059] lstrlenW (lpString="C:\\Windows10Upgrade\\dll1\\cosqueryxp.dll") returned 39 [0057.059] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0057.059] GetProcessHeap () returned 0x630000 [0057.059] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0057.059] GetProcessHeap () returned 0x630000 [0057.059] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x388) returned 0x656188 [0057.059] lstrlenA (lpString="rsa_encrypt") returned 11 [0057.059] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0057.059] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0057.059] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0057.060] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0057.060] GetProcessHeap () returned 0x630000 [0057.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0057.060] lstrlenA (lpString="010001") returned 6 [0057.060] GetProcessHeap () returned 0x630000 [0057.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a308 [0057.060] GetProcessHeap () returned 0x630000 [0057.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0057.060] GetProcessHeap () returned 0x630000 [0057.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65df50 [0057.060] GetProcessHeap () returned 0x630000 [0057.060] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0057.060] GetProcessHeap () returned 0x630000 [0057.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0057.060] GetProcessHeap () returned 0x630000 [0057.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656950 [0057.060] GetProcessHeap () returned 0x630000 [0057.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a328 [0057.060] GetProcessHeap () returned 0x630000 [0057.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0057.060] GetProcessHeap () returned 0x630000 [0057.060] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0057.060] GetProcessHeap () returned 0x630000 [0057.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0057.060] GetProcessHeap () returned 0x630000 [0057.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0057.060] GetProcessHeap () returned 0x630000 [0057.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657788 [0057.060] GetProcessHeap () returned 0x630000 [0057.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0057.060] GetProcessHeap () returned 0x630000 [0057.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0057.060] GetProcessHeap () returned 0x630000 [0057.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e970 [0057.060] GetProcessHeap () returned 0x630000 [0057.060] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0057.060] GetProcessHeap () returned 0x630000 [0057.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0057.061] GetProcessHeap () returned 0x630000 [0057.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0057.061] GetProcessHeap () returned 0x630000 [0057.061] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.061] GetProcessHeap () returned 0x630000 [0057.061] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65a900 [0057.061] GetProcessHeap () returned 0x630000 [0057.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0057.061] GetProcessHeap () returned 0x630000 [0057.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.061] GetProcessHeap () returned 0x630000 [0057.061] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.061] GetProcessHeap () returned 0x630000 [0057.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.061] GetProcessHeap () returned 0x630000 [0057.061] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e970 [0057.061] GetProcessHeap () returned 0x630000 [0057.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a900 | out: hHeap=0x630000) returned 1 [0057.061] GetProcessHeap () returned 0x630000 [0057.061] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0057.061] GetProcessHeap () returned 0x630000 [0057.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0057.061] GetProcessHeap () returned 0x630000 [0057.061] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2e8 [0057.061] GetProcessHeap () returned 0x630000 [0057.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2e8 | out: hHeap=0x630000) returned 1 [0057.061] GetProcessHeap () returned 0x630000 [0057.061] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.061] GetProcessHeap () returned 0x630000 [0057.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.061] GetProcessHeap () returned 0x630000 [0057.061] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.061] GetProcessHeap () returned 0x630000 [0057.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.061] GetProcessHeap () returned 0x630000 [0057.061] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0057.061] GetProcessHeap () returned 0x630000 [0057.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0057.061] GetProcessHeap () returned 0x630000 [0057.062] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0057.062] GetProcessHeap () returned 0x630000 [0057.062] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0057.062] GetProcessHeap () returned 0x630000 [0057.062] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.062] GetProcessHeap () returned 0x630000 [0057.062] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.062] GetProcessHeap () returned 0x630000 [0057.062] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2e8 [0057.062] GetProcessHeap () returned 0x630000 [0057.062] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2e8 | out: hHeap=0x630000) returned 1 [0057.062] GetProcessHeap () returned 0x630000 [0057.062] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0057.062] GetProcessHeap () returned 0x630000 [0057.062] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0057.062] GetProcessHeap () returned 0x630000 [0057.062] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0057.062] GetProcessHeap () returned 0x630000 [0057.062] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0057.062] GetProcessHeap () returned 0x630000 [0057.062] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0057.062] GetProcessHeap () returned 0x630000 [0057.062] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0057.062] GetProcessHeap () returned 0x630000 [0057.062] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2e8 [0057.062] GetProcessHeap () returned 0x630000 [0057.062] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2e8 | out: hHeap=0x630000) returned 1 [0057.062] GetProcessHeap () returned 0x630000 [0057.062] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0057.062] GetProcessHeap () returned 0x630000 [0057.062] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0057.062] GetProcessHeap () returned 0x630000 [0057.062] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0057.062] GetProcessHeap () returned 0x630000 [0057.062] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0057.063] GetProcessHeap () returned 0x630000 [0057.063] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0057.063] GetProcessHeap () returned 0x630000 [0057.063] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0057.063] GetProcessHeap () returned 0x630000 [0057.063] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0057.063] GetProcessHeap () returned 0x630000 [0057.063] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0057.063] GetProcessHeap () returned 0x630000 [0057.063] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2e8 [0057.063] GetProcessHeap () returned 0x630000 [0057.063] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2e8 | out: hHeap=0x630000) returned 1 [0057.063] GetProcessHeap () returned 0x630000 [0057.063] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0057.063] GetProcessHeap () returned 0x630000 [0057.063] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0057.063] GetProcessHeap () returned 0x630000 [0057.063] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0057.063] GetProcessHeap () returned 0x630000 [0057.063] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0057.063] GetProcessHeap () returned 0x630000 [0057.063] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.063] GetProcessHeap () returned 0x630000 [0057.063] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.063] GetProcessHeap () returned 0x630000 [0057.063] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0057.063] GetProcessHeap () returned 0x630000 [0057.063] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0057.063] GetProcessHeap () returned 0x630000 [0057.063] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0057.063] GetProcessHeap () returned 0x630000 [0057.063] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0057.063] GetProcessHeap () returned 0x630000 [0057.063] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0057.063] GetProcessHeap () returned 0x630000 [0057.063] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0057.063] GetProcessHeap () returned 0x630000 [0057.063] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2e8 [0057.064] GetProcessHeap () returned 0x630000 [0057.064] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2e8 | out: hHeap=0x630000) returned 1 [0057.064] GetProcessHeap () returned 0x630000 [0057.064] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0057.064] GetProcessHeap () returned 0x630000 [0057.064] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0057.064] GetProcessHeap () returned 0x630000 [0057.064] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0057.064] GetProcessHeap () returned 0x630000 [0057.064] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0057.064] GetProcessHeap () returned 0x630000 [0057.064] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0057.064] GetProcessHeap () returned 0x630000 [0057.064] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0057.064] GetProcessHeap () returned 0x630000 [0057.064] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0057.064] GetProcessHeap () returned 0x630000 [0057.064] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0057.064] GetProcessHeap () returned 0x630000 [0057.064] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0057.064] GetProcessHeap () returned 0x630000 [0057.064] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0057.064] GetProcessHeap () returned 0x630000 [0057.064] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0057.064] GetProcessHeap () returned 0x630000 [0057.064] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0057.064] GetProcessHeap () returned 0x630000 [0057.064] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.064] GetProcessHeap () returned 0x630000 [0057.064] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.064] GetProcessHeap () returned 0x630000 [0057.064] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0057.064] GetProcessHeap () returned 0x630000 [0057.064] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0057.064] GetProcessHeap () returned 0x630000 [0057.064] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0057.064] GetProcessHeap () returned 0x630000 [0057.064] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0057.064] GetProcessHeap () returned 0x630000 [0057.065] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0057.065] GetProcessHeap () returned 0x630000 [0057.065] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0057.065] GetProcessHeap () returned 0x630000 [0057.065] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0057.065] GetProcessHeap () returned 0x630000 [0057.065] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0057.065] GetProcessHeap () returned 0x630000 [0057.065] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0057.065] GetProcessHeap () returned 0x630000 [0057.065] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0057.065] GetProcessHeap () returned 0x630000 [0057.065] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0057.065] GetProcessHeap () returned 0x630000 [0057.065] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0057.065] GetProcessHeap () returned 0x630000 [0057.065] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0057.065] GetProcessHeap () returned 0x630000 [0057.065] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0057.065] GetProcessHeap () returned 0x630000 [0057.065] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0057.065] GetProcessHeap () returned 0x630000 [0057.065] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0057.065] GetProcessHeap () returned 0x630000 [0057.065] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0057.065] GetProcessHeap () returned 0x630000 [0057.065] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0057.065] GetProcessHeap () returned 0x630000 [0057.065] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0057.065] GetProcessHeap () returned 0x630000 [0057.065] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0057.065] GetProcessHeap () returned 0x630000 [0057.065] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2e8 [0057.065] GetProcessHeap () returned 0x630000 [0057.065] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2e8 | out: hHeap=0x630000) returned 1 [0057.065] GetProcessHeap () returned 0x630000 [0057.065] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0057.065] GetProcessHeap () returned 0x630000 [0057.065] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0057.066] GetProcessHeap () returned 0x630000 [0057.066] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0057.066] GetProcessHeap () returned 0x630000 [0057.066] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0057.066] GetProcessHeap () returned 0x630000 [0057.066] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0057.066] GetProcessHeap () returned 0x630000 [0057.066] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0057.066] GetProcessHeap () returned 0x630000 [0057.066] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0057.066] GetProcessHeap () returned 0x630000 [0057.066] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0057.066] GetProcessHeap () returned 0x630000 [0057.066] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0057.066] GetProcessHeap () returned 0x630000 [0057.066] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0057.066] GetProcessHeap () returned 0x630000 [0057.066] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0057.066] WriteFile (in: hFile=0x230, lpBuffer=0x656188*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x656188*, lpNumberOfBytesWritten=0x243d864*=0x388, lpOverlapped=0x0) returned 1 [0057.069] GetProcessHeap () returned 0x630000 [0057.069] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x656188, Size=0x30) returned 0x656188 [0057.069] GetProcessHeap () returned 0x630000 [0057.069] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0057.069] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0057.069] GetProcessHeap () returned 0x630000 [0057.069] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x204d0) returned 0x65f588 [0057.072] ReadFile (in: hFile=0x230, lpBuffer=0x65f588, nNumberOfBytesToRead=0x204d0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65f588*, lpNumberOfBytesRead=0x243d7e8*=0x204d0, lpOverlapped=0x0) returned 1 [0057.074] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0057.074] WriteFile (in: hFile=0x230, lpBuffer=0x65f588*, nNumberOfBytesToWrite=0x204d0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65f588*, lpNumberOfBytesWritten=0x243d7e4*=0x204d0, lpOverlapped=0x0) returned 1 [0057.107] GetProcessHeap () returned 0x630000 [0057.107] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65f588 | out: hHeap=0x630000) returned 1 [0057.107] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0057.107] WriteFile (in: hFile=0x230, lpBuffer=0x656188*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x656188*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0057.108] CloseHandle (hObject=0x230) returned 1 [0057.113] GetProcessHeap () returned 0x630000 [0057.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0057.113] GetProcessHeap () returned 0x630000 [0057.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655580 | out: hHeap=0x630000) returned 1 [0057.113] GetProcessHeap () returned 0x630000 [0057.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0057.113] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\dll1\\cosqueryxp.dll" | out: lpString1="C:\\Windows10Upgrade\\dll1\\cosqueryxp.dll") returned="C:\\Windows10Upgrade\\dll1\\cosqueryxp.dll" [0057.113] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\dll1\\cosqueryxp.dll", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\dll1\\cosqueryxp.dll.happythreechoose") returned="C:\\Windows10Upgrade\\dll1\\cosqueryxp.dll.happythreechoose" [0057.113] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\dll1\\cosqueryxp.dll" (normalized: "c:\\windows10upgrade\\dll1\\cosqueryxp.dll"), lpNewFileName="C:\\Windows10Upgrade\\dll1\\cosqueryxp.dll.happythreechoose" (normalized: "c:\\windows10upgrade\\dll1\\cosqueryxp.dll.happythreechoose"), dwFlags=0x1) returned 1 [0057.114] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\dll1\\cosqueryxp.dll" | out: pszPath="C:\\Windows10Upgrade\\dll1") returned 1 [0057.114] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\dll1" | out: pszPath="C:\\Windows10Upgrade\\dll1\\") returned="" [0057.114] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\dll1\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\dll1\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\dll1\\Decryption INFO.html" [0057.114] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\dll1\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\dll1\\decryption info.html")) returned 0xffffffff [0057.114] CreateFileW (lpFileName="C:\\Windows10Upgrade\\dll1\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\dll1\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0057.115] GetProcessHeap () returned 0x630000 [0057.115] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6559b8 [0057.116] GetProcessHeap () returned 0x630000 [0057.116] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0057.122] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.123] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.123] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.123] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.124] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.124] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.124] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.124] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.124] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.124] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.124] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.124] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.124] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.124] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.124] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.124] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.124] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.125] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.125] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.125] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.125] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.125] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.125] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.125] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.125] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.125] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.125] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.125] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.125] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.126] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.126] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.126] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.126] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.126] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.126] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.126] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.126] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.127] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.127] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.127] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.127] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.127] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.127] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.127] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.127] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.127] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.127] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.127] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.128] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.128] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.128] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.128] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.128] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.128] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.128] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.128] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.128] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.128] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.128] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.128] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.128] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.128] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.128] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.129] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.129] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.129] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.129] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.129] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.129] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.129] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.129] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.129] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.129] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.129] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.129] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.129] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.129] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.130] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.130] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.130] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.130] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.130] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.130] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.130] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.130] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.130] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.130] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.130] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.130] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.130] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.130] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.130] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.131] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.131] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.131] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.131] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.131] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.131] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.131] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.131] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.131] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.131] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.131] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.131] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.131] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.131] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.132] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.132] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.132] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.132] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.132] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.132] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.132] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.132] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.132] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.132] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.132] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.132] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.132] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.132] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.133] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.133] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.133] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.133] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.133] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.133] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.133] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.133] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.133] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.133] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.133] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.133] GetProcessHeap () returned 0x630000 [0057.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6559b8 | out: hHeap=0x630000) returned 1 [0057.133] GetProcessHeap () returned 0x630000 [0057.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0057.133] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0057.134] GetProcessHeap () returned 0x630000 [0057.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655580 [0057.134] GetProcessHeap () returned 0x630000 [0057.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0057.140] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.141] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.141] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.141] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.141] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.141] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.141] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.141] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.141] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.141] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.141] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.142] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.142] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.142] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.142] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.142] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.142] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.142] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.142] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.142] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.142] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.142] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.142] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.142] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.142] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.143] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.143] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.143] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.143] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.143] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.143] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.143] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.143] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.143] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.143] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.143] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.143] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.143] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.143] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.144] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.144] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.144] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.144] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.144] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.144] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.144] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.144] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.144] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.144] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.144] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.144] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.144] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.144] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.144] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.145] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.145] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.145] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.145] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.145] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.145] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.145] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.145] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.145] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.145] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.145] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.145] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.145] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.145] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.146] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.146] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.146] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.146] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.146] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.146] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.146] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.146] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.146] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.146] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.146] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.146] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.147] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.147] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.147] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.147] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.147] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.147] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.147] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.147] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.147] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.147] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.147] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.147] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.147] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.147] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.147] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.148] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.148] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.148] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.148] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.148] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.148] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.148] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.148] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.148] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.148] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.148] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.148] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.148] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.148] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.148] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.149] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.149] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.149] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.149] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.149] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.149] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.149] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.149] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.150] GetProcessHeap () returned 0x630000 [0057.150] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655580 | out: hHeap=0x630000) returned 1 [0057.150] GetProcessHeap () returned 0x630000 [0057.150] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0057.150] CloseHandle (hObject=0x230) returned 1 [0057.150] GetProcessHeap () returned 0x630000 [0057.150] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0057.150] FindNextFileW (in: hFindFile=0x6486d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea377ed3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea377ed3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x3b0c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wdscore.dll", cAlternateFileName="")) returned 1 [0057.150] lstrcmpiW (lpString1="wdscore.dll", lpString2=".") returned 1 [0057.150] lstrcmpiW (lpString1="wdscore.dll", lpString2="..") returned 1 [0057.150] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\dll1\\", lpString2="wdscore.dll" | out: lpString1="C:\\Windows10Upgrade\\dll1\\wdscore.dll") returned="C:\\Windows10Upgrade\\dll1\\wdscore.dll" [0057.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wdscore.dll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0057.150] GetProcessHeap () returned 0x630000 [0057.150] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0057.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wdscore.dll", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wdscore.dll", lpUsedDefaultChar=0x0) returned 12 [0057.151] lstrlenA (lpString="wdscore.dll") returned 11 [0057.151] lstrlenA (lpString=".happythreechoose") returned 17 [0057.151] lstrcmpiW (lpString1="wdscore.dll", lpString2="Decryption INFO.html") returned 1 [0057.151] lstrcmpiW (lpString1="wdscore.dll", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0057.151] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0057.151] lstrcmpiW (lpString1="wdscore.dll", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0057.151] GetProcessHeap () returned 0x630000 [0057.151] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x652000 [0057.151] CreateFileW (lpFileName="C:\\Windows10Upgrade\\dll1\\wdscore.dll" (normalized: "c:\\windows10upgrade\\dll1\\wdscore.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0057.151] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=241864) returned 1 [0057.151] GetProcessHeap () returned 0x630000 [0057.151] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655490 [0057.151] GetProcessHeap () returned 0x630000 [0057.151] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0057.151] lstrlenW (lpString="C:\\Windows10Upgrade\\dll1\\wdscore.dll") returned 36 [0057.151] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0057.152] GetProcessHeap () returned 0x630000 [0057.152] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0057.152] GetProcessHeap () returned 0x630000 [0057.152] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x65f588 [0057.152] lstrlenA (lpString="rsa_encrypt") returned 11 [0057.152] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0057.152] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0057.152] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0057.152] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0057.152] GetProcessHeap () returned 0x630000 [0057.152] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0057.152] lstrlenA (lpString="010001") returned 6 [0057.152] GetProcessHeap () returned 0x630000 [0057.152] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0057.152] GetProcessHeap () returned 0x630000 [0057.152] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0057.153] GetProcessHeap () returned 0x630000 [0057.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0057.153] GetProcessHeap () returned 0x630000 [0057.153] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0057.153] GetProcessHeap () returned 0x630000 [0057.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e610 [0057.153] GetProcessHeap () returned 0x630000 [0057.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656c98 [0057.153] GetProcessHeap () returned 0x630000 [0057.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a298 [0057.153] GetProcessHeap () returned 0x630000 [0057.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0057.153] GetProcessHeap () returned 0x630000 [0057.153] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0057.153] GetProcessHeap () returned 0x630000 [0057.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0057.153] GetProcessHeap () returned 0x630000 [0057.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0057.153] GetProcessHeap () returned 0x630000 [0057.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x6570f8 [0057.153] GetProcessHeap () returned 0x630000 [0057.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0057.153] GetProcessHeap () returned 0x630000 [0057.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0057.153] GetProcessHeap () returned 0x630000 [0057.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dec0 [0057.153] GetProcessHeap () returned 0x630000 [0057.153] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0057.153] GetProcessHeap () returned 0x630000 [0057.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0057.153] GetProcessHeap () returned 0x630000 [0057.153] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0057.153] GetProcessHeap () returned 0x630000 [0057.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.153] GetProcessHeap () returned 0x630000 [0057.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65a7c8 [0057.153] GetProcessHeap () returned 0x630000 [0057.153] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0057.153] GetProcessHeap () returned 0x630000 [0057.153] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.154] GetProcessHeap () returned 0x630000 [0057.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2e8 [0057.154] GetProcessHeap () returned 0x630000 [0057.154] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2e8 | out: hHeap=0x630000) returned 1 [0057.154] GetProcessHeap () returned 0x630000 [0057.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e220 [0057.154] GetProcessHeap () returned 0x630000 [0057.154] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a7c8 | out: hHeap=0x630000) returned 1 [0057.154] GetProcessHeap () returned 0x630000 [0057.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0057.154] GetProcessHeap () returned 0x630000 [0057.154] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0057.154] GetProcessHeap () returned 0x630000 [0057.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0057.154] GetProcessHeap () returned 0x630000 [0057.154] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0057.154] GetProcessHeap () returned 0x630000 [0057.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0057.154] GetProcessHeap () returned 0x630000 [0057.154] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0057.154] GetProcessHeap () returned 0x630000 [0057.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0057.154] GetProcessHeap () returned 0x630000 [0057.154] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0057.154] GetProcessHeap () returned 0x630000 [0057.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0057.154] GetProcessHeap () returned 0x630000 [0057.154] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0057.154] GetProcessHeap () returned 0x630000 [0057.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0057.154] GetProcessHeap () returned 0x630000 [0057.154] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0057.154] GetProcessHeap () returned 0x630000 [0057.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0057.154] GetProcessHeap () returned 0x630000 [0057.154] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0057.154] GetProcessHeap () returned 0x630000 [0057.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0057.155] GetProcessHeap () returned 0x630000 [0057.155] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0057.155] GetProcessHeap () returned 0x630000 [0057.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0057.155] GetProcessHeap () returned 0x630000 [0057.155] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0057.155] GetProcessHeap () returned 0x630000 [0057.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0057.155] GetProcessHeap () returned 0x630000 [0057.155] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0057.155] GetProcessHeap () returned 0x630000 [0057.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0057.155] GetProcessHeap () returned 0x630000 [0057.155] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0057.155] GetProcessHeap () returned 0x630000 [0057.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0057.155] GetProcessHeap () returned 0x630000 [0057.155] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0057.155] GetProcessHeap () returned 0x630000 [0057.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0057.155] GetProcessHeap () returned 0x630000 [0057.155] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0057.155] GetProcessHeap () returned 0x630000 [0057.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.155] GetProcessHeap () returned 0x630000 [0057.155] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.155] GetProcessHeap () returned 0x630000 [0057.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.155] GetProcessHeap () returned 0x630000 [0057.155] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.155] GetProcessHeap () returned 0x630000 [0057.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0057.155] GetProcessHeap () returned 0x630000 [0057.155] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0057.155] GetProcessHeap () returned 0x630000 [0057.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0057.155] GetProcessHeap () returned 0x630000 [0057.155] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0057.156] GetProcessHeap () returned 0x630000 [0057.156] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0057.156] GetProcessHeap () returned 0x630000 [0057.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0057.156] GetProcessHeap () returned 0x630000 [0057.156] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0057.156] GetProcessHeap () returned 0x630000 [0057.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0057.156] GetProcessHeap () returned 0x630000 [0057.156] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0057.156] GetProcessHeap () returned 0x630000 [0057.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0057.156] GetProcessHeap () returned 0x630000 [0057.156] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.156] GetProcessHeap () returned 0x630000 [0057.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.156] GetProcessHeap () returned 0x630000 [0057.156] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0057.156] GetProcessHeap () returned 0x630000 [0057.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0057.156] GetProcessHeap () returned 0x630000 [0057.156] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.156] GetProcessHeap () returned 0x630000 [0057.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.156] GetProcessHeap () returned 0x630000 [0057.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0057.171] GetProcessHeap () returned 0x630000 [0057.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0057.171] GetProcessHeap () returned 0x630000 [0057.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0057.171] GetProcessHeap () returned 0x630000 [0057.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0057.171] GetProcessHeap () returned 0x630000 [0057.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0057.171] GetProcessHeap () returned 0x630000 [0057.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0057.171] GetProcessHeap () returned 0x630000 [0057.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.171] GetProcessHeap () returned 0x630000 [0057.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.171] GetProcessHeap () returned 0x630000 [0057.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2e8 [0057.171] GetProcessHeap () returned 0x630000 [0057.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2e8 | out: hHeap=0x630000) returned 1 [0057.171] GetProcessHeap () returned 0x630000 [0057.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0057.171] GetProcessHeap () returned 0x630000 [0057.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0057.171] GetProcessHeap () returned 0x630000 [0057.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0057.171] GetProcessHeap () returned 0x630000 [0057.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0057.171] GetProcessHeap () returned 0x630000 [0057.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0057.171] GetProcessHeap () returned 0x630000 [0057.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0057.171] GetProcessHeap () returned 0x630000 [0057.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0057.172] GetProcessHeap () returned 0x630000 [0057.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0057.172] GetProcessHeap () returned 0x630000 [0057.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.172] GetProcessHeap () returned 0x630000 [0057.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.172] GetProcessHeap () returned 0x630000 [0057.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0057.172] GetProcessHeap () returned 0x630000 [0057.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0057.172] GetProcessHeap () returned 0x630000 [0057.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0057.172] GetProcessHeap () returned 0x630000 [0057.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0057.172] GetProcessHeap () returned 0x630000 [0057.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0057.172] GetProcessHeap () returned 0x630000 [0057.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0057.172] GetProcessHeap () returned 0x630000 [0057.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.172] GetProcessHeap () returned 0x630000 [0057.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.172] GetProcessHeap () returned 0x630000 [0057.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2e8 [0057.172] GetProcessHeap () returned 0x630000 [0057.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2e8 | out: hHeap=0x630000) returned 1 [0057.172] GetProcessHeap () returned 0x630000 [0057.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0057.172] GetProcessHeap () returned 0x630000 [0057.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0057.173] GetProcessHeap () returned 0x630000 [0057.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0057.173] GetProcessHeap () returned 0x630000 [0057.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0057.173] GetProcessHeap () returned 0x630000 [0057.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.173] GetProcessHeap () returned 0x630000 [0057.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.173] GetProcessHeap () returned 0x630000 [0057.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0057.173] GetProcessHeap () returned 0x630000 [0057.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0057.173] GetProcessHeap () returned 0x630000 [0057.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0057.173] GetProcessHeap () returned 0x630000 [0057.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0057.173] GetProcessHeap () returned 0x630000 [0057.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0057.173] GetProcessHeap () returned 0x630000 [0057.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0057.173] GetProcessHeap () returned 0x630000 [0057.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0057.173] GetProcessHeap () returned 0x630000 [0057.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0057.173] GetProcessHeap () returned 0x630000 [0057.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0057.173] GetProcessHeap () returned 0x630000 [0057.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0057.173] GetProcessHeap () returned 0x630000 [0057.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0057.173] GetProcessHeap () returned 0x630000 [0057.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0057.174] GetProcessHeap () returned 0x630000 [0057.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0057.174] WriteFile (in: hFile=0x230, lpBuffer=0x65f588*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65f588*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0057.195] GetProcessHeap () returned 0x630000 [0057.195] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65f588, Size=0x30) returned 0x65f588 [0057.195] GetProcessHeap () returned 0x630000 [0057.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0057.195] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0057.195] GetProcessHeap () returned 0x630000 [0057.195] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3b0c8) returned 0x65f5c0 [0057.197] ReadFile (in: hFile=0x230, lpBuffer=0x65f5c0, nNumberOfBytesToRead=0x3b0c8, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65f5c0*, lpNumberOfBytesRead=0x243d7e8*=0x3b0c8, lpOverlapped=0x0) returned 1 [0057.200] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0057.201] WriteFile (in: hFile=0x230, lpBuffer=0x65f5c0*, nNumberOfBytesToWrite=0x3b0c8, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65f5c0*, lpNumberOfBytesWritten=0x243d7e4*=0x3b0c8, lpOverlapped=0x0) returned 1 [0057.221] GetProcessHeap () returned 0x630000 [0057.221] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65f5c0 | out: hHeap=0x630000) returned 1 [0057.223] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0057.223] WriteFile (in: hFile=0x230, lpBuffer=0x65f588*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65f588*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0057.224] CloseHandle (hObject=0x230) returned 1 [0057.229] GetProcessHeap () returned 0x630000 [0057.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x652000 | out: hHeap=0x630000) returned 1 [0057.229] GetProcessHeap () returned 0x630000 [0057.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655490 | out: hHeap=0x630000) returned 1 [0057.229] GetProcessHeap () returned 0x630000 [0057.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0057.229] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\dll1\\wdscore.dll" | out: lpString1="C:\\Windows10Upgrade\\dll1\\wdscore.dll") returned="C:\\Windows10Upgrade\\dll1\\wdscore.dll" [0057.230] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\dll1\\wdscore.dll", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\dll1\\wdscore.dll.happythreechoose") returned="C:\\Windows10Upgrade\\dll1\\wdscore.dll.happythreechoose" [0057.230] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\dll1\\wdscore.dll" (normalized: "c:\\windows10upgrade\\dll1\\wdscore.dll"), lpNewFileName="C:\\Windows10Upgrade\\dll1\\wdscore.dll.happythreechoose" (normalized: "c:\\windows10upgrade\\dll1\\wdscore.dll.happythreechoose"), dwFlags=0x1) returned 1 [0057.230] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\dll1\\wdscore.dll" | out: pszPath="C:\\Windows10Upgrade\\dll1") returned 1 [0057.230] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\dll1" | out: pszPath="C:\\Windows10Upgrade\\dll1\\") returned="" [0057.230] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\dll1\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\dll1\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\dll1\\Decryption INFO.html" [0057.230] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\dll1\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\dll1\\decryption info.html")) returned 0x20 [0057.230] GetProcessHeap () returned 0x630000 [0057.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0057.230] FindNextFileW (in: hFindFile=0x6486d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea37926f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37926f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xe9ec8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="webservices.dll", cAlternateFileName="WEBSER~1.DLL")) returned 1 [0057.231] lstrcmpiW (lpString1="webservices.dll", lpString2=".") returned 1 [0057.231] lstrcmpiW (lpString1="webservices.dll", lpString2="..") returned 1 [0057.231] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\dll1\\", lpString2="webservices.dll" | out: lpString1="C:\\Windows10Upgrade\\dll1\\webservices.dll") returned="C:\\Windows10Upgrade\\dll1\\webservices.dll" [0057.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="webservices.dll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0057.231] GetProcessHeap () returned 0x630000 [0057.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x64c9f0 [0057.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="webservices.dll", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="webservices.dll", lpUsedDefaultChar=0x0) returned 16 [0057.231] lstrlenA (lpString="webservices.dll") returned 15 [0057.231] lstrlenA (lpString=".happythreechoose") returned 17 [0057.231] lstrcmpiW (lpString1="webservices.dll", lpString2="Decryption INFO.html") returned 1 [0057.231] lstrcmpiW (lpString1="webservices.dll", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0057.231] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0057.231] lstrcmpiW (lpString1="webservices.dll", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0057.231] GetProcessHeap () returned 0x630000 [0057.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0057.231] CreateFileW (lpFileName="C:\\Windows10Upgrade\\dll1\\webservices.dll" (normalized: "c:\\windows10upgrade\\dll1\\webservices.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0057.231] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=958152) returned 1 [0057.231] GetProcessHeap () returned 0x630000 [0057.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6559b8 [0057.231] GetProcessHeap () returned 0x630000 [0057.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0057.231] lstrlenW (lpString="C:\\Windows10Upgrade\\dll1\\webservices.dll") returned 40 [0057.231] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0057.232] GetProcessHeap () returned 0x630000 [0057.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0057.232] GetProcessHeap () returned 0x630000 [0057.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x388) returned 0x65f5c0 [0057.233] lstrlenA (lpString="rsa_encrypt") returned 11 [0057.233] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0057.233] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0057.233] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0057.233] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0057.233] GetProcessHeap () returned 0x630000 [0057.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0057.234] lstrlenA (lpString="010001") returned 6 [0057.234] GetProcessHeap () returned 0x630000 [0057.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a368 [0057.234] GetProcessHeap () returned 0x630000 [0057.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0057.234] GetProcessHeap () returned 0x630000 [0057.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e190 [0057.234] GetProcessHeap () returned 0x630000 [0057.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0057.234] GetProcessHeap () returned 0x630000 [0057.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0057.234] GetProcessHeap () returned 0x630000 [0057.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657210 [0057.234] GetProcessHeap () returned 0x630000 [0057.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2e8 [0057.234] GetProcessHeap () returned 0x630000 [0057.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0057.234] GetProcessHeap () returned 0x630000 [0057.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2e8 | out: hHeap=0x630000) returned 1 [0057.234] GetProcessHeap () returned 0x630000 [0057.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0057.234] GetProcessHeap () returned 0x630000 [0057.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0057.234] GetProcessHeap () returned 0x630000 [0057.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657558 [0057.234] GetProcessHeap () returned 0x630000 [0057.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0057.234] GetProcessHeap () returned 0x630000 [0057.237] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0057.237] GetProcessHeap () returned 0x630000 [0057.238] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0057.238] GetProcessHeap () returned 0x630000 [0057.238] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0057.238] GetProcessHeap () returned 0x630000 [0057.238] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0057.238] GetProcessHeap () returned 0x630000 [0057.238] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0057.238] GetProcessHeap () returned 0x630000 [0057.238] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0057.238] GetProcessHeap () returned 0x630000 [0057.238] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65a978 [0057.238] GetProcessHeap () returned 0x630000 [0057.238] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0057.238] GetProcessHeap () returned 0x630000 [0057.238] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0057.238] GetProcessHeap () returned 0x630000 [0057.238] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0057.238] GetProcessHeap () returned 0x630000 [0057.238] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0057.238] GetProcessHeap () returned 0x630000 [0057.238] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65df50 [0057.238] GetProcessHeap () returned 0x630000 [0057.238] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a978 | out: hHeap=0x630000) returned 1 [0057.238] GetProcessHeap () returned 0x630000 [0057.238] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0057.238] GetProcessHeap () returned 0x630000 [0057.238] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0057.238] GetProcessHeap () returned 0x630000 [0057.238] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2e8 [0057.238] GetProcessHeap () returned 0x630000 [0057.238] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2e8 | out: hHeap=0x630000) returned 1 [0057.238] GetProcessHeap () returned 0x630000 [0057.238] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0057.238] GetProcessHeap () returned 0x630000 [0057.238] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0057.238] GetProcessHeap () returned 0x630000 [0057.238] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2e8 [0057.238] GetProcessHeap () returned 0x630000 [0057.239] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2e8 | out: hHeap=0x630000) returned 1 [0057.239] GetProcessHeap () returned 0x630000 [0057.239] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0057.239] GetProcessHeap () returned 0x630000 [0057.239] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0057.239] GetProcessHeap () returned 0x630000 [0057.239] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0057.239] GetProcessHeap () returned 0x630000 [0057.239] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0057.239] GetProcessHeap () returned 0x630000 [0057.239] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0057.239] GetProcessHeap () returned 0x630000 [0057.239] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0057.239] GetProcessHeap () returned 0x630000 [0057.239] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0057.239] GetProcessHeap () returned 0x630000 [0057.239] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0057.239] GetProcessHeap () returned 0x630000 [0057.239] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0057.239] GetProcessHeap () returned 0x630000 [0057.239] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0057.239] GetProcessHeap () returned 0x630000 [0057.239] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.239] GetProcessHeap () returned 0x630000 [0057.239] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.239] GetProcessHeap () returned 0x630000 [0057.239] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0057.239] GetProcessHeap () returned 0x630000 [0057.239] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0057.239] GetProcessHeap () returned 0x630000 [0057.239] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0057.239] GetProcessHeap () returned 0x630000 [0057.239] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0057.239] GetProcessHeap () returned 0x630000 [0057.239] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0057.239] GetProcessHeap () returned 0x630000 [0057.239] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0057.240] GetProcessHeap () returned 0x630000 [0057.240] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0057.240] GetProcessHeap () returned 0x630000 [0057.240] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0057.240] GetProcessHeap () returned 0x630000 [0057.240] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0057.240] GetProcessHeap () returned 0x630000 [0057.240] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0057.240] GetProcessHeap () returned 0x630000 [0057.240] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0057.240] GetProcessHeap () returned 0x630000 [0057.240] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0057.240] GetProcessHeap () returned 0x630000 [0057.240] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0057.240] GetProcessHeap () returned 0x630000 [0057.240] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0057.240] GetProcessHeap () returned 0x630000 [0057.240] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0057.240] GetProcessHeap () returned 0x630000 [0057.240] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0057.240] GetProcessHeap () returned 0x630000 [0057.240] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0057.240] GetProcessHeap () returned 0x630000 [0057.240] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0057.240] GetProcessHeap () returned 0x630000 [0057.240] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0057.240] GetProcessHeap () returned 0x630000 [0057.240] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0057.240] GetProcessHeap () returned 0x630000 [0057.240] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0057.240] GetProcessHeap () returned 0x630000 [0057.240] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0057.240] GetProcessHeap () returned 0x630000 [0057.240] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0057.240] GetProcessHeap () returned 0x630000 [0057.240] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0057.240] GetProcessHeap () returned 0x630000 [0057.241] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0057.241] GetProcessHeap () returned 0x630000 [0057.241] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0057.241] GetProcessHeap () returned 0x630000 [0057.241] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0057.241] GetProcessHeap () returned 0x630000 [0057.241] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0057.241] GetProcessHeap () returned 0x630000 [0057.241] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0057.241] GetProcessHeap () returned 0x630000 [0057.241] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0057.241] GetProcessHeap () returned 0x630000 [0057.241] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0057.241] GetProcessHeap () returned 0x630000 [0057.241] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0057.241] GetProcessHeap () returned 0x630000 [0057.241] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0057.241] GetProcessHeap () returned 0x630000 [0057.241] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0057.241] GetProcessHeap () returned 0x630000 [0057.241] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0057.241] GetProcessHeap () returned 0x630000 [0057.241] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0057.241] GetProcessHeap () returned 0x630000 [0057.241] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0057.241] GetProcessHeap () returned 0x630000 [0057.241] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0057.241] GetProcessHeap () returned 0x630000 [0057.241] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0057.241] GetProcessHeap () returned 0x630000 [0057.241] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0057.241] GetProcessHeap () returned 0x630000 [0057.241] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0057.241] GetProcessHeap () returned 0x630000 [0057.241] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0057.241] GetProcessHeap () returned 0x630000 [0057.241] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.242] GetProcessHeap () returned 0x630000 [0057.242] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.242] GetProcessHeap () returned 0x630000 [0057.242] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.242] GetProcessHeap () returned 0x630000 [0057.242] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.242] GetProcessHeap () returned 0x630000 [0057.242] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2e8 [0057.242] GetProcessHeap () returned 0x630000 [0057.242] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2e8 | out: hHeap=0x630000) returned 1 [0057.242] GetProcessHeap () returned 0x630000 [0057.242] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0057.242] GetProcessHeap () returned 0x630000 [0057.242] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0057.242] GetProcessHeap () returned 0x630000 [0057.242] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0057.242] GetProcessHeap () returned 0x630000 [0057.242] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0057.242] GetProcessHeap () returned 0x630000 [0057.242] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0057.242] GetProcessHeap () returned 0x630000 [0057.242] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0057.242] GetProcessHeap () returned 0x630000 [0057.242] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0057.242] GetProcessHeap () returned 0x630000 [0057.242] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0057.242] GetProcessHeap () returned 0x630000 [0057.242] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0057.242] GetProcessHeap () returned 0x630000 [0057.242] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0057.242] GetProcessHeap () returned 0x630000 [0057.242] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0057.242] GetProcessHeap () returned 0x630000 [0057.242] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0057.242] GetProcessHeap () returned 0x630000 [0057.242] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0057.243] GetProcessHeap () returned 0x630000 [0057.243] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0057.243] GetProcessHeap () returned 0x630000 [0057.243] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0057.243] GetProcessHeap () returned 0x630000 [0057.243] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0057.243] GetProcessHeap () returned 0x630000 [0057.243] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0057.243] GetProcessHeap () returned 0x630000 [0057.243] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0057.243] GetProcessHeap () returned 0x630000 [0057.243] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0057.243] GetProcessHeap () returned 0x630000 [0057.243] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0057.243] GetProcessHeap () returned 0x630000 [0057.243] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0057.243] GetProcessHeap () returned 0x630000 [0057.243] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0057.243] GetProcessHeap () returned 0x630000 [0057.243] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0057.243] GetProcessHeap () returned 0x630000 [0057.243] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0057.243] GetProcessHeap () returned 0x630000 [0057.243] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0057.243] GetProcessHeap () returned 0x630000 [0057.243] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0057.243] GetProcessHeap () returned 0x630000 [0057.243] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0057.243] WriteFile (in: hFile=0x230, lpBuffer=0x65f5c0*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65f5c0*, lpNumberOfBytesWritten=0x243d864*=0x388, lpOverlapped=0x0) returned 1 [0057.248] GetProcessHeap () returned 0x630000 [0057.248] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65f5c0, Size=0x30) returned 0x65f5c0 [0057.248] GetProcessHeap () returned 0x630000 [0057.248] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0057.248] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0057.248] GetProcessHeap () returned 0x630000 [0057.248] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe9ed0) returned 0x2447020 [0057.265] ReadFile (in: hFile=0x230, lpBuffer=0x2447020, nNumberOfBytesToRead=0xe9ed0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x2447020*, lpNumberOfBytesRead=0x243d7e8*=0xe9ed0, lpOverlapped=0x0) returned 1 [0057.280] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0057.280] WriteFile (in: hFile=0x230, lpBuffer=0x2447020*, nNumberOfBytesToWrite=0xe9ed0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x2447020*, lpNumberOfBytesWritten=0x243d7e4*=0xe9ed0, lpOverlapped=0x0) returned 1 [0057.341] GetProcessHeap () returned 0x630000 [0057.341] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x2447020 | out: hHeap=0x630000) returned 1 [0057.346] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0057.346] WriteFile (in: hFile=0x230, lpBuffer=0x65f5c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65f5c0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0057.347] CloseHandle (hObject=0x230) returned 1 [0057.365] GetProcessHeap () returned 0x630000 [0057.365] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0057.365] GetProcessHeap () returned 0x630000 [0057.365] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6559b8 | out: hHeap=0x630000) returned 1 [0057.365] GetProcessHeap () returned 0x630000 [0057.365] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0057.366] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\dll1\\webservices.dll" | out: lpString1="C:\\Windows10Upgrade\\dll1\\webservices.dll") returned="C:\\Windows10Upgrade\\dll1\\webservices.dll" [0057.366] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\dll1\\webservices.dll", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\dll1\\webservices.dll.happythreechoose") returned="C:\\Windows10Upgrade\\dll1\\webservices.dll.happythreechoose" [0057.366] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\dll1\\webservices.dll" (normalized: "c:\\windows10upgrade\\dll1\\webservices.dll"), lpNewFileName="C:\\Windows10Upgrade\\dll1\\webservices.dll.happythreechoose" (normalized: "c:\\windows10upgrade\\dll1\\webservices.dll.happythreechoose"), dwFlags=0x1) returned 1 [0057.366] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\dll1\\webservices.dll" | out: pszPath="C:\\Windows10Upgrade\\dll1") returned 1 [0057.366] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\dll1" | out: pszPath="C:\\Windows10Upgrade\\dll1\\") returned="" [0057.366] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\dll1\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\dll1\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\dll1\\Decryption INFO.html" [0057.366] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\dll1\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\dll1\\decryption info.html")) returned 0x20 [0057.366] GetProcessHeap () returned 0x630000 [0057.366] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0057.367] FindNextFileW (in: hFindFile=0x6486d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea37926f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37926f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xe9ec8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="webservices.dll", cAlternateFileName="WEBSER~1.DLL")) returned 0 [0057.367] FindClose (in: hFindFile=0x6486d0 | out: hFindFile=0x6486d0) returned 1 [0057.367] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Windows10Upgrade\\2052\\" | out: lpString1="C:\\Windows10Upgrade\\2052\\") returned="C:\\Windows10Upgrade\\2052\\" [0057.367] GetProcessHeap () returned 0x630000 [0057.367] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x648c90 | out: hHeap=0x630000) returned 1 [0057.367] GetProcessHeap () returned 0x630000 [0057.367] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0057.367] lstrlenW (lpString="C:\\Windows10Upgrade\\2052\\") returned 25 [0057.367] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\2052\\", lpString2="*" | out: lpString1="C:\\Windows10Upgrade\\2052\\*") returned="C:\\Windows10Upgrade\\2052\\*" [0057.367] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\2052\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea35483d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea355be9, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6487d0 [0057.367] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0057.367] FindNextFileW (in: hFindFile=0x6487d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea35483d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea355be9, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.367] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0057.367] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0057.367] FindNextFileW (in: hFindFile=0x6487d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea355be9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x1cec8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DWINTL20.DLL", cAlternateFileName="")) returned 1 [0057.367] lstrcmpiW (lpString1="DWINTL20.DLL", lpString2=".") returned 1 [0057.367] lstrcmpiW (lpString1="DWINTL20.DLL", lpString2="..") returned 1 [0057.367] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\2052\\", lpString2="DWINTL20.DLL" | out: lpString1="C:\\Windows10Upgrade\\2052\\DWINTL20.DLL") returned="C:\\Windows10Upgrade\\2052\\DWINTL20.DLL" [0057.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DWINTL20.DLL", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.367] GetProcessHeap () returned 0x630000 [0057.367] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd) returned 0x64c9f0 [0057.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DWINTL20.DLL", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DWINTL20.DLL", lpUsedDefaultChar=0x0) returned 13 [0057.367] lstrlenA (lpString="DWINTL20.DLL") returned 12 [0057.367] lstrlenA (lpString=".happythreechoose") returned 17 [0057.367] lstrcmpiW (lpString1="DWINTL20.DLL", lpString2="Decryption INFO.html") returned 1 [0057.368] lstrcmpiW (lpString1="DWINTL20.DLL", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0057.368] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0057.368] lstrcmpiW (lpString1="DWINTL20.DLL", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0057.368] GetProcessHeap () returned 0x630000 [0057.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651ec0 [0057.368] CreateFileW (lpFileName="C:\\Windows10Upgrade\\2052\\DWINTL20.DLL" (normalized: "c:\\windows10upgrade\\2052\\dwintl20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0057.368] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=118472) returned 1 [0057.368] GetProcessHeap () returned 0x630000 [0057.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655490 [0057.368] GetProcessHeap () returned 0x630000 [0057.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0057.368] lstrlenW (lpString="C:\\Windows10Upgrade\\2052\\DWINTL20.DLL") returned 37 [0057.368] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0057.368] GetProcessHeap () returned 0x630000 [0057.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0057.368] GetProcessHeap () returned 0x630000 [0057.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x388) returned 0x65f5f8 [0057.368] lstrlenA (lpString="rsa_encrypt") returned 11 [0057.368] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0057.369] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0057.369] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0057.369] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0057.369] GetProcessHeap () returned 0x630000 [0057.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0057.369] lstrlenA (lpString="010001") returned 6 [0057.369] GetProcessHeap () returned 0x630000 [0057.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0057.369] GetProcessHeap () returned 0x630000 [0057.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0057.369] GetProcessHeap () returned 0x630000 [0057.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e7c0 [0057.369] GetProcessHeap () returned 0x630000 [0057.369] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0057.369] GetProcessHeap () returned 0x630000 [0057.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e610 [0057.369] GetProcessHeap () returned 0x630000 [0057.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656b80 [0057.369] GetProcessHeap () returned 0x630000 [0057.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0057.370] GetProcessHeap () returned 0x630000 [0057.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0057.370] GetProcessHeap () returned 0x630000 [0057.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0057.370] GetProcessHeap () returned 0x630000 [0057.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0057.370] GetProcessHeap () returned 0x630000 [0057.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0057.370] GetProcessHeap () returned 0x630000 [0057.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657210 [0057.370] GetProcessHeap () returned 0x630000 [0057.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0057.370] GetProcessHeap () returned 0x630000 [0057.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0057.370] GetProcessHeap () returned 0x630000 [0057.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e6a0 [0057.370] GetProcessHeap () returned 0x630000 [0057.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0057.370] GetProcessHeap () returned 0x630000 [0057.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0057.370] GetProcessHeap () returned 0x630000 [0057.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e6a0 | out: hHeap=0x630000) returned 1 [0057.370] GetProcessHeap () returned 0x630000 [0057.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2e8 [0057.370] GetProcessHeap () returned 0x630000 [0057.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65a810 [0057.370] GetProcessHeap () returned 0x630000 [0057.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0057.370] GetProcessHeap () returned 0x630000 [0057.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2e8 | out: hHeap=0x630000) returned 1 [0057.370] GetProcessHeap () returned 0x630000 [0057.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0057.370] GetProcessHeap () returned 0x630000 [0057.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0057.370] GetProcessHeap () returned 0x630000 [0057.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e220 [0057.370] GetProcessHeap () returned 0x630000 [0057.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a810 | out: hHeap=0x630000) returned 1 [0057.370] GetProcessHeap () returned 0x630000 [0057.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0057.370] GetProcessHeap () returned 0x630000 [0057.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0057.371] GetProcessHeap () returned 0x630000 [0057.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0057.371] GetProcessHeap () returned 0x630000 [0057.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0057.371] GetProcessHeap () returned 0x630000 [0057.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0057.371] GetProcessHeap () returned 0x630000 [0057.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0057.371] GetProcessHeap () returned 0x630000 [0057.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.371] GetProcessHeap () returned 0x630000 [0057.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.371] GetProcessHeap () returned 0x630000 [0057.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0057.371] GetProcessHeap () returned 0x630000 [0057.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0057.371] GetProcessHeap () returned 0x630000 [0057.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0057.371] GetProcessHeap () returned 0x630000 [0057.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0057.371] GetProcessHeap () returned 0x630000 [0057.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0057.371] GetProcessHeap () returned 0x630000 [0057.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0057.371] GetProcessHeap () returned 0x630000 [0057.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a308 [0057.371] GetProcessHeap () returned 0x630000 [0057.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a308 | out: hHeap=0x630000) returned 1 [0057.371] GetProcessHeap () returned 0x630000 [0057.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0057.371] GetProcessHeap () returned 0x630000 [0057.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0057.371] GetProcessHeap () returned 0x630000 [0057.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.371] GetProcessHeap () returned 0x630000 [0057.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.371] GetProcessHeap () returned 0x630000 [0057.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.372] GetProcessHeap () returned 0x630000 [0057.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.372] GetProcessHeap () returned 0x630000 [0057.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0057.372] GetProcessHeap () returned 0x630000 [0057.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0057.372] GetProcessHeap () returned 0x630000 [0057.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0057.372] GetProcessHeap () returned 0x630000 [0057.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0057.372] GetProcessHeap () returned 0x630000 [0057.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0057.372] GetProcessHeap () returned 0x630000 [0057.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0057.372] GetProcessHeap () returned 0x630000 [0057.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0057.372] GetProcessHeap () returned 0x630000 [0057.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0057.372] GetProcessHeap () returned 0x630000 [0057.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0057.372] GetProcessHeap () returned 0x630000 [0057.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0057.372] GetProcessHeap () returned 0x630000 [0057.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0057.372] GetProcessHeap () returned 0x630000 [0057.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0057.372] GetProcessHeap () returned 0x630000 [0057.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0057.372] GetProcessHeap () returned 0x630000 [0057.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0057.372] GetProcessHeap () returned 0x630000 [0057.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2e8 [0057.372] GetProcessHeap () returned 0x630000 [0057.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2e8 | out: hHeap=0x630000) returned 1 [0057.372] GetProcessHeap () returned 0x630000 [0057.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0057.373] GetProcessHeap () returned 0x630000 [0057.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0057.373] GetProcessHeap () returned 0x630000 [0057.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.373] GetProcessHeap () returned 0x630000 [0057.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.373] GetProcessHeap () returned 0x630000 [0057.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0057.373] GetProcessHeap () returned 0x630000 [0057.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0057.373] GetProcessHeap () returned 0x630000 [0057.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0057.373] GetProcessHeap () returned 0x630000 [0057.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0057.373] GetProcessHeap () returned 0x630000 [0057.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0057.373] GetProcessHeap () returned 0x630000 [0057.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0057.373] GetProcessHeap () returned 0x630000 [0057.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0057.373] GetProcessHeap () returned 0x630000 [0057.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0057.373] GetProcessHeap () returned 0x630000 [0057.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2e8 [0057.373] GetProcessHeap () returned 0x630000 [0057.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2e8 | out: hHeap=0x630000) returned 1 [0057.373] GetProcessHeap () returned 0x630000 [0057.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0057.373] GetProcessHeap () returned 0x630000 [0057.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0057.373] GetProcessHeap () returned 0x630000 [0057.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0057.373] GetProcessHeap () returned 0x630000 [0057.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0057.373] GetProcessHeap () returned 0x630000 [0057.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0057.373] GetProcessHeap () returned 0x630000 [0057.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0057.374] GetProcessHeap () returned 0x630000 [0057.374] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0057.374] GetProcessHeap () returned 0x630000 [0057.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0057.374] GetProcessHeap () returned 0x630000 [0057.374] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0057.374] GetProcessHeap () returned 0x630000 [0057.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0057.374] GetProcessHeap () returned 0x630000 [0057.374] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3c8 [0057.374] GetProcessHeap () returned 0x630000 [0057.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3c8 | out: hHeap=0x630000) returned 1 [0057.374] GetProcessHeap () returned 0x630000 [0057.374] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0057.374] GetProcessHeap () returned 0x630000 [0057.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0057.374] GetProcessHeap () returned 0x630000 [0057.374] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0057.374] GetProcessHeap () returned 0x630000 [0057.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0057.374] GetProcessHeap () returned 0x630000 [0057.374] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0057.374] GetProcessHeap () returned 0x630000 [0057.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0057.374] GetProcessHeap () returned 0x630000 [0057.374] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.374] GetProcessHeap () returned 0x630000 [0057.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.374] GetProcessHeap () returned 0x630000 [0057.374] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a368 [0057.374] GetProcessHeap () returned 0x630000 [0057.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a368 | out: hHeap=0x630000) returned 1 [0057.374] GetProcessHeap () returned 0x630000 [0057.374] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0057.374] GetProcessHeap () returned 0x630000 [0057.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0057.374] GetProcessHeap () returned 0x630000 [0057.375] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0057.375] GetProcessHeap () returned 0x630000 [0057.375] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0057.375] GetProcessHeap () returned 0x630000 [0057.375] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0057.375] GetProcessHeap () returned 0x630000 [0057.375] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0057.375] GetProcessHeap () returned 0x630000 [0057.375] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0057.375] GetProcessHeap () returned 0x630000 [0057.375] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0057.375] GetProcessHeap () returned 0x630000 [0057.375] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0057.375] GetProcessHeap () returned 0x630000 [0057.375] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0057.375] GetProcessHeap () returned 0x630000 [0057.375] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0057.375] GetProcessHeap () returned 0x630000 [0057.375] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0057.375] GetProcessHeap () returned 0x630000 [0057.375] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0057.375] GetProcessHeap () returned 0x630000 [0057.375] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0057.375] GetProcessHeap () returned 0x630000 [0057.375] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0057.376] GetProcessHeap () returned 0x630000 [0057.376] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0057.376] GetProcessHeap () returned 0x630000 [0057.376] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0057.376] GetProcessHeap () returned 0x630000 [0057.376] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e7c0 | out: hHeap=0x630000) returned 1 [0057.376] GetProcessHeap () returned 0x630000 [0057.376] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0057.376] GetProcessHeap () returned 0x630000 [0057.376] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0057.376] GetProcessHeap () returned 0x630000 [0057.376] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0057.376] WriteFile (in: hFile=0x230, lpBuffer=0x65f5f8*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65f5f8*, lpNumberOfBytesWritten=0x243d864*=0x388, lpOverlapped=0x0) returned 1 [0057.379] GetProcessHeap () returned 0x630000 [0057.379] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65f5f8, Size=0x30) returned 0x65f5f8 [0057.379] GetProcessHeap () returned 0x630000 [0057.379] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0057.379] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0057.379] GetProcessHeap () returned 0x630000 [0057.379] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1ced0) returned 0x65f630 [0057.381] ReadFile (in: hFile=0x230, lpBuffer=0x65f630, nNumberOfBytesToRead=0x1ced0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65f630*, lpNumberOfBytesRead=0x243d7e8*=0x1ced0, lpOverlapped=0x0) returned 1 [0057.383] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0057.383] WriteFile (in: hFile=0x230, lpBuffer=0x65f630*, nNumberOfBytesToWrite=0x1ced0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65f630*, lpNumberOfBytesWritten=0x243d7e4*=0x1ced0, lpOverlapped=0x0) returned 1 [0057.469] GetProcessHeap () returned 0x630000 [0057.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65f630 | out: hHeap=0x630000) returned 1 [0057.470] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0057.470] WriteFile (in: hFile=0x230, lpBuffer=0x65f5f8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65f5f8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0057.472] CloseHandle (hObject=0x230) returned 1 [0057.493] GetProcessHeap () returned 0x630000 [0057.493] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651ec0 | out: hHeap=0x630000) returned 1 [0057.493] GetProcessHeap () returned 0x630000 [0057.493] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655490 | out: hHeap=0x630000) returned 1 [0057.494] GetProcessHeap () returned 0x630000 [0057.494] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0057.494] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Windows10Upgrade\\2052\\DWINTL20.DLL" | out: lpString1="C:\\Windows10Upgrade\\2052\\DWINTL20.DLL") returned="C:\\Windows10Upgrade\\2052\\DWINTL20.DLL" [0057.494] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\2052\\DWINTL20.DLL", lpString2=".happythreechoose" | out: lpString1="C:\\Windows10Upgrade\\2052\\DWINTL20.DLL.happythreechoose") returned="C:\\Windows10Upgrade\\2052\\DWINTL20.DLL.happythreechoose" [0057.494] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\2052\\DWINTL20.DLL" (normalized: "c:\\windows10upgrade\\2052\\dwintl20.dll"), lpNewFileName="C:\\Windows10Upgrade\\2052\\DWINTL20.DLL.happythreechoose" (normalized: "c:\\windows10upgrade\\2052\\dwintl20.dll.happythreechoose"), dwFlags=0x1) returned 1 [0057.494] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\2052\\DWINTL20.DLL" | out: pszPath="C:\\Windows10Upgrade\\2052") returned 1 [0057.494] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\2052" | out: pszPath="C:\\Windows10Upgrade\\2052\\") returned="" [0057.494] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\2052\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Windows10Upgrade\\2052\\Decryption INFO.html") returned="C:\\Windows10Upgrade\\2052\\Decryption INFO.html" [0057.494] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\2052\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\2052\\decryption info.html")) returned 0xffffffff [0057.494] CreateFileW (lpFileName="C:\\Windows10Upgrade\\2052\\Decryption INFO.html" (normalized: "c:\\windows10upgrade\\2052\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0057.495] GetProcessHeap () returned 0x630000 [0057.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655580 [0057.495] GetProcessHeap () returned 0x630000 [0057.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0057.503] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.504] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.504] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.504] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.504] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.504] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.504] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.504] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.504] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.505] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.505] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.505] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.505] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.505] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.505] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.505] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.505] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.505] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.505] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.505] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.505] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.505] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.506] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.506] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.506] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.506] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.506] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.506] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.506] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.506] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.506] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.506] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.506] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.506] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.506] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.507] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.507] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.507] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.507] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.507] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.508] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.508] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.508] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.508] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.508] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.508] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.508] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.508] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.508] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.508] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.508] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.508] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.508] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.508] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.509] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.509] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.509] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.509] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.509] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.509] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.509] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.509] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.509] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.509] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.509] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.509] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.509] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.509] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.509] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.510] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.510] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.510] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.510] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.510] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.510] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.510] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.510] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.510] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.510] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.510] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.510] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.510] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.510] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.511] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.511] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.511] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.511] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.511] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.511] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.511] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.511] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.511] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.511] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.511] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.511] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.511] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.511] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.514] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.514] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.514] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.514] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.514] GetProcessHeap () returned 0x630000 [0057.514] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655580 | out: hHeap=0x630000) returned 1 [0057.514] GetProcessHeap () returned 0x630000 [0057.514] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0057.514] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0057.514] GetProcessHeap () returned 0x630000 [0057.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655a30 [0057.514] GetProcessHeap () returned 0x630000 [0057.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0057.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.523] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.523] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.523] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.523] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.523] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.523] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.523] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.523] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.523] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.523] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.523] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.523] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.523] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.523] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.523] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.524] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.524] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.524] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.524] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.524] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.524] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.524] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.524] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.524] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.524] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.524] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.524] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.524] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.524] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.525] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.525] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.525] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.525] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.525] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.525] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.525] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.525] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.525] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.525] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.525] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.525] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.525] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.525] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.525] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.526] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.526] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.526] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.526] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.526] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.526] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.526] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.526] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.526] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.526] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.526] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.526] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.526] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.526] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.527] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.527] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.527] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.527] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.527] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.527] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.527] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.527] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.527] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.527] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.527] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.527] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.527] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.528] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.528] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.528] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.528] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.528] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.528] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.528] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.528] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.528] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.528] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.528] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.528] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.528] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.528] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.529] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.529] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.529] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.529] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.529] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.529] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.529] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.529] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.529] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.529] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.529] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.529] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.529] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.529] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.529] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.530] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.530] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.530] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.530] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.530] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.530] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.531] GetProcessHeap () returned 0x630000 [0057.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655a30 | out: hHeap=0x630000) returned 1 [0057.531] GetProcessHeap () returned 0x630000 [0057.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0057.531] CloseHandle (hObject=0x230) returned 1 [0057.531] GetProcessHeap () returned 0x630000 [0057.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0057.531] FindNextFileW (in: hFindFile=0x6487d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea355be9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x1cec8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DWINTL20.DLL", cAlternateFileName="")) returned 0 [0057.533] FindClose (in: hFindFile=0x6487d0 | out: hFindFile=0x6487d0) returned 1 [0057.533] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0057.533] GetProcessHeap () returned 0x630000 [0057.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645e58 | out: hHeap=0x630000) returned 1 [0057.533] GetProcessHeap () returned 0x630000 [0057.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.533] lstrlenW (lpString="C:\\Users\\") returned 9 [0057.533] lstrcatW (in: lpString1="C:\\Users\\", lpString2="*" | out: lpString1="C:\\Users\\*") returned="C:\\Users\\*" [0057.533] FindFirstFileW (in: lpFileName="C:\\Users\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648890 [0057.534] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0057.534] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.534] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0057.534] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0057.534] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xd7b844b1, ftCreationTime.dwHighDateTime=0x1d2a02f, ftLastAccessTime.dwLowDateTime=0xd7b844b1, ftLastAccessTime.dwHighDateTime=0x1d2a02f, ftLastWriteTime.dwLowDateTime=0xd7b844b1, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0057.534] lstrcmpiW (lpString1="All Users", lpString2=".") returned 1 [0057.534] lstrcmpiW (lpString1="All Users", lpString2="..") returned 1 [0057.534] lstrcatW (in: lpString1="C:\\Users\\", lpString2="All Users" | out: lpString1="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0057.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="All Users", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0057.534] GetProcessHeap () returned 0x630000 [0057.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x64c9f0 [0057.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="All Users", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="All Users", lpUsedDefaultChar=0x0) returned 10 [0057.534] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0057.534] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0057.534] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0057.534] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0057.534] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0057.534] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0057.534] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0057.534] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0057.534] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0057.534] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0057.534] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0057.534] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0057.534] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0057.534] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0057.534] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0057.534] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0057.534] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0057.534] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0057.534] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0057.534] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0057.535] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0057.535] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0057.535] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0057.535] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 1 [0057.535] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0057.535] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0057.535] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 1 [0057.535] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0057.535] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0057.535] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0057.535] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0057.535] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 1 [0057.535] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0057.535] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0057.535] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0057.535] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0057.535] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0057.535] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0057.535] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0057.535] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0057.535] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0057.535] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0057.535] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0057.535] lstrcatW (in: lpString1="C:\\Users\\All Users", lpString2="\\" | out: lpString1="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0057.535] GetProcessHeap () returned 0x630000 [0057.535] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a2e8 [0057.535] lstrlenW (lpString="C:\\Users\\All Users\\") returned 19 [0057.535] GetProcessHeap () returned 0x630000 [0057.535] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x28) returned 0x6449f0 [0057.535] lstrcpyW (in: lpString1=0x6449f0, lpString2="C:\\Users\\All Users\\" | out: lpString1="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0057.535] GetProcessHeap () returned 0x630000 [0057.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0057.535] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0057.535] lstrcmpiW (lpString1="Default", lpString2=".") returned 1 [0057.536] lstrcmpiW (lpString1="Default", lpString2="..") returned 1 [0057.536] lstrcatW (in: lpString1="C:\\Users\\", lpString2="Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0057.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Default", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0057.536] GetProcessHeap () returned 0x630000 [0057.536] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a2f8 [0057.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Default", cchWideChar=-1, lpMultiByteStr=0x65a2f8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Default", lpUsedDefaultChar=0x0) returned 8 [0057.536] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0057.536] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0057.536] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0057.536] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0057.536] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0057.536] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0057.536] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0057.536] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0057.536] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0057.536] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0057.536] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0057.536] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0057.536] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0057.536] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0057.536] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0057.536] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0057.536] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0057.536] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0057.536] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0057.536] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0057.536] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0057.536] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0057.536] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0057.536] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0057.536] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0057.536] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0057.536] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0057.536] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0057.537] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0057.537] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0057.537] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0057.537] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0057.537] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0057.537] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0057.537] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0057.537] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0057.537] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0057.537] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0057.537] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0057.537] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0057.537] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0057.537] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0057.537] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0057.537] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0057.537] GetProcessHeap () returned 0x630000 [0057.537] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a308 [0057.537] lstrlenW (lpString="C:\\Users\\Default\\") returned 17 [0057.537] GetProcessHeap () returned 0x630000 [0057.537] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x24) returned 0x644a80 [0057.537] lstrcpyW (in: lpString1=0x644a80, lpString2="C:\\Users\\Default\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0057.537] GetProcessHeap () returned 0x630000 [0057.537] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.537] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xd7b844b1, ftCreationTime.dwHighDateTime=0x1d2a02f, ftLastAccessTime.dwLowDateTime=0xd7b844b1, ftLastAccessTime.dwHighDateTime=0x1d2a02f, ftLastWriteTime.dwLowDateTime=0xd7b844b1, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0057.537] lstrcmpiW (lpString1="Default User", lpString2=".") returned 1 [0057.537] lstrcmpiW (lpString1="Default User", lpString2="..") returned 1 [0057.537] lstrcatW (in: lpString1="C:\\Users\\", lpString2="Default User" | out: lpString1="C:\\Users\\Default User") returned="C:\\Users\\Default User" [0057.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Default User", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0057.537] GetProcessHeap () returned 0x630000 [0057.537] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd) returned 0x64c9f0 [0057.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Default User", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Default User", lpUsedDefaultChar=0x0) returned 13 [0057.537] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0057.537] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0057.537] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0057.537] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0057.538] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0057.538] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0057.538] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0057.538] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0057.538] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0057.538] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0057.538] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0057.538] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0057.538] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0057.538] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0057.538] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0057.538] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0057.538] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0057.538] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0057.538] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0057.538] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0057.538] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0057.538] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0057.538] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0057.538] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0057.538] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0057.538] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0057.538] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0057.538] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0057.538] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0057.538] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0057.538] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0057.538] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0057.538] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0057.538] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0057.538] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0057.538] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0057.538] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0057.538] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0057.539] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0057.539] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0057.539] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0057.539] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0057.539] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0057.539] lstrcatW (in: lpString1="C:\\Users\\Default User", lpString2="\\" | out: lpString1="C:\\Users\\Default User\\") returned="C:\\Users\\Default User\\" [0057.539] GetProcessHeap () returned 0x630000 [0057.539] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a3c8 [0057.539] lstrlenW (lpString="C:\\Users\\Default User\\") returned 22 [0057.539] GetProcessHeap () returned 0x630000 [0057.539] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2e) returned 0x6527b8 [0057.539] lstrcpyW (in: lpString1=0x6527b8, lpString2="C:\\Users\\Default User\\" | out: lpString1="C:\\Users\\Default User\\") returned="C:\\Users\\Default User\\" [0057.539] GetProcessHeap () returned 0x630000 [0057.539] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0057.539] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc40864ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default.migrated", cAlternateFileName="DEFAUL~1.MIG")) returned 1 [0057.539] lstrcmpiW (lpString1="Default.migrated", lpString2=".") returned 1 [0057.539] lstrcmpiW (lpString1="Default.migrated", lpString2="..") returned 1 [0057.539] lstrcatW (in: lpString1="C:\\Users\\", lpString2="Default.migrated" | out: lpString1="C:\\Users\\Default.migrated") returned="C:\\Users\\Default.migrated" [0057.539] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Default.migrated", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0057.539] GetProcessHeap () returned 0x630000 [0057.539] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11) returned 0x645e58 [0057.539] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Default.migrated", cchWideChar=-1, lpMultiByteStr=0x645e58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Default.migrated", lpUsedDefaultChar=0x0) returned 17 [0057.539] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0057.539] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0057.539] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0057.539] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0057.539] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0057.539] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0057.539] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0057.539] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0057.539] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0057.539] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0057.539] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0057.539] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0057.539] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0057.539] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0057.540] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0057.540] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0057.540] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0057.540] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0057.540] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0057.540] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0057.540] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0057.540] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0057.540] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0057.540] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0057.540] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0057.540] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0057.540] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0057.540] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0057.540] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0057.540] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0057.540] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0057.540] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0057.540] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0057.540] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0057.540] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0057.540] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0057.540] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0057.540] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0057.540] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0057.540] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0057.540] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0057.540] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0057.540] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0057.540] lstrcatW (in: lpString1="C:\\Users\\Default.migrated", lpString2="\\" | out: lpString1="C:\\Users\\Default.migrated\\") returned="C:\\Users\\Default.migrated\\" [0057.540] GetProcessHeap () returned 0x630000 [0057.540] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a368 [0057.540] lstrlenW (lpString="C:\\Users\\Default.migrated\\") returned 26 [0057.540] GetProcessHeap () returned 0x630000 [0057.540] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x36) returned 0x6486d0 [0057.541] lstrcpyW (in: lpString1=0x6486d0, lpString2="C:\\Users\\Default.migrated\\" | out: lpString1="C:\\Users\\Default.migrated\\") returned="C:\\Users\\Default.migrated\\" [0057.541] GetProcessHeap () returned 0x630000 [0057.541] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645e58 | out: hHeap=0x630000) returned 1 [0057.541] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9bc987, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0057.541] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0057.541] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0057.541] lstrcatW (in: lpString1="C:\\Users\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\desktop.ini") returned="C:\\Users\\desktop.ini" [0057.541] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0057.541] GetProcessHeap () returned 0x630000 [0057.541] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0057.541] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0057.541] lstrlenA (lpString="desktop.ini") returned 11 [0057.541] lstrlenA (lpString=".happythreechoose") returned 17 [0057.541] lstrcmpiW (lpString1="desktop.ini", lpString2="Decryption INFO.html") returned 1 [0057.541] lstrcmpiW (lpString1="desktop.ini", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0057.541] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0057.541] lstrcmpiW (lpString1="desktop.ini", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0057.541] GetProcessHeap () returned 0x630000 [0057.541] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0057.541] CreateFileW (lpFileName="C:\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0057.541] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=174) returned 1 [0057.541] GetProcessHeap () returned 0x630000 [0057.541] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655850 [0057.541] GetProcessHeap () returned 0x630000 [0057.541] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0057.541] lstrlenW (lpString="C:\\Users\\desktop.ini") returned 20 [0057.541] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0057.541] GetProcessHeap () returned 0x630000 [0057.542] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0057.542] GetProcessHeap () returned 0x630000 [0057.542] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x382) returned 0x65f630 [0057.542] lstrlenA (lpString="rsa_encrypt") returned 11 [0057.542] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0057.542] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0057.542] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0057.542] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0057.542] GetProcessHeap () returned 0x630000 [0057.542] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0057.542] lstrlenA (lpString="010001") returned 6 [0057.542] GetProcessHeap () returned 0x630000 [0057.542] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a378 [0057.542] GetProcessHeap () returned 0x630000 [0057.542] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0057.543] GetProcessHeap () returned 0x630000 [0057.543] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e100 [0057.543] GetProcessHeap () returned 0x630000 [0057.543] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0057.543] GetProcessHeap () returned 0x630000 [0057.543] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ec40 [0057.543] GetProcessHeap () returned 0x630000 [0057.543] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657788 [0057.543] GetProcessHeap () returned 0x630000 [0057.543] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0057.543] GetProcessHeap () returned 0x630000 [0057.543] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0057.543] GetProcessHeap () returned 0x630000 [0057.543] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0057.543] GetProcessHeap () returned 0x630000 [0057.543] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0057.543] GetProcessHeap () returned 0x630000 [0057.543] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0057.543] GetProcessHeap () returned 0x630000 [0057.543] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657440 [0057.543] GetProcessHeap () returned 0x630000 [0057.543] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0057.543] GetProcessHeap () returned 0x630000 [0057.543] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0057.543] GetProcessHeap () returned 0x630000 [0057.543] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e850 [0057.543] GetProcessHeap () returned 0x630000 [0057.543] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0057.543] GetProcessHeap () returned 0x630000 [0057.543] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0057.543] GetProcessHeap () returned 0x630000 [0057.543] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0057.543] GetProcessHeap () returned 0x630000 [0057.543] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.543] GetProcessHeap () returned 0x630000 [0057.543] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65a858 [0057.543] GetProcessHeap () returned 0x630000 [0057.543] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0057.543] GetProcessHeap () returned 0x630000 [0057.543] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.544] GetProcessHeap () returned 0x630000 [0057.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0057.544] GetProcessHeap () returned 0x630000 [0057.544] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0057.544] GetProcessHeap () returned 0x630000 [0057.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e730 [0057.544] GetProcessHeap () returned 0x630000 [0057.544] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a858 | out: hHeap=0x630000) returned 1 [0057.544] GetProcessHeap () returned 0x630000 [0057.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0057.544] GetProcessHeap () returned 0x630000 [0057.544] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0057.544] GetProcessHeap () returned 0x630000 [0057.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0057.544] GetProcessHeap () returned 0x630000 [0057.544] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0057.544] GetProcessHeap () returned 0x630000 [0057.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0057.544] GetProcessHeap () returned 0x630000 [0057.544] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0057.544] GetProcessHeap () returned 0x630000 [0057.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.544] GetProcessHeap () returned 0x630000 [0057.544] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.544] GetProcessHeap () returned 0x630000 [0057.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.544] GetProcessHeap () returned 0x630000 [0057.544] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.544] GetProcessHeap () returned 0x630000 [0057.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0057.544] GetProcessHeap () returned 0x630000 [0057.544] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0057.544] GetProcessHeap () returned 0x630000 [0057.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0057.544] GetProcessHeap () returned 0x630000 [0057.544] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0057.544] GetProcessHeap () returned 0x630000 [0057.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0057.544] GetProcessHeap () returned 0x630000 [0057.544] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0057.545] GetProcessHeap () returned 0x630000 [0057.545] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0057.545] GetProcessHeap () returned 0x630000 [0057.545] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0057.545] GetProcessHeap () returned 0x630000 [0057.545] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0057.545] GetProcessHeap () returned 0x630000 [0057.545] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0057.545] GetProcessHeap () returned 0x630000 [0057.545] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0057.545] GetProcessHeap () returned 0x630000 [0057.545] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0057.545] GetProcessHeap () returned 0x630000 [0057.545] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0057.545] GetProcessHeap () returned 0x630000 [0057.545] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0057.545] GetProcessHeap () returned 0x630000 [0057.545] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.545] GetProcessHeap () returned 0x630000 [0057.545] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.545] GetProcessHeap () returned 0x630000 [0057.545] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0057.545] GetProcessHeap () returned 0x630000 [0057.545] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0057.545] GetProcessHeap () returned 0x630000 [0057.545] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0057.545] GetProcessHeap () returned 0x630000 [0057.545] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0057.545] GetProcessHeap () returned 0x630000 [0057.545] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.545] GetProcessHeap () returned 0x630000 [0057.545] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.545] GetProcessHeap () returned 0x630000 [0057.545] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0057.545] GetProcessHeap () returned 0x630000 [0057.545] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0057.545] GetProcessHeap () returned 0x630000 [0057.545] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.545] GetProcessHeap () returned 0x630000 [0057.546] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.546] GetProcessHeap () returned 0x630000 [0057.546] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0057.546] GetProcessHeap () returned 0x630000 [0057.546] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0057.546] GetProcessHeap () returned 0x630000 [0057.546] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0057.546] GetProcessHeap () returned 0x630000 [0057.546] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0057.546] GetProcessHeap () returned 0x630000 [0057.546] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.546] GetProcessHeap () returned 0x630000 [0057.546] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.546] GetProcessHeap () returned 0x630000 [0057.546] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.546] GetProcessHeap () returned 0x630000 [0057.546] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.546] GetProcessHeap () returned 0x630000 [0057.546] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0057.546] GetProcessHeap () returned 0x630000 [0057.546] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0057.546] GetProcessHeap () returned 0x630000 [0057.546] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.546] GetProcessHeap () returned 0x630000 [0057.546] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.546] GetProcessHeap () returned 0x630000 [0057.546] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.546] GetProcessHeap () returned 0x630000 [0057.546] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.546] GetProcessHeap () returned 0x630000 [0057.546] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.546] GetProcessHeap () returned 0x630000 [0057.546] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.546] GetProcessHeap () returned 0x630000 [0057.546] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0057.546] GetProcessHeap () returned 0x630000 [0057.546] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0057.546] GetProcessHeap () returned 0x630000 [0057.547] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.547] GetProcessHeap () returned 0x630000 [0057.547] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.547] GetProcessHeap () returned 0x630000 [0057.547] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.547] GetProcessHeap () returned 0x630000 [0057.547] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.547] GetProcessHeap () returned 0x630000 [0057.547] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0057.547] GetProcessHeap () returned 0x630000 [0057.555] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0057.556] GetProcessHeap () returned 0x630000 [0057.556] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0057.556] GetProcessHeap () returned 0x630000 [0057.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0057.556] GetProcessHeap () returned 0x630000 [0057.556] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0057.556] GetProcessHeap () returned 0x630000 [0057.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0057.556] GetProcessHeap () returned 0x630000 [0057.556] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.556] GetProcessHeap () returned 0x630000 [0057.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.556] GetProcessHeap () returned 0x630000 [0057.556] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.556] GetProcessHeap () returned 0x630000 [0057.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.556] GetProcessHeap () returned 0x630000 [0057.556] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0057.556] GetProcessHeap () returned 0x630000 [0057.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0057.556] GetProcessHeap () returned 0x630000 [0057.556] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.556] GetProcessHeap () returned 0x630000 [0057.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.556] GetProcessHeap () returned 0x630000 [0057.556] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.556] GetProcessHeap () returned 0x630000 [0057.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.556] GetProcessHeap () returned 0x630000 [0057.556] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0057.556] GetProcessHeap () returned 0x630000 [0057.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0057.556] GetProcessHeap () returned 0x630000 [0057.556] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.556] GetProcessHeap () returned 0x630000 [0057.557] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.557] GetProcessHeap () returned 0x630000 [0057.557] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.557] GetProcessHeap () returned 0x630000 [0057.557] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.557] GetProcessHeap () returned 0x630000 [0057.557] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0057.557] GetProcessHeap () returned 0x630000 [0057.557] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0057.557] GetProcessHeap () returned 0x630000 [0057.557] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.557] GetProcessHeap () returned 0x630000 [0057.557] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.557] GetProcessHeap () returned 0x630000 [0057.557] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0057.557] GetProcessHeap () returned 0x630000 [0057.557] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0057.557] GetProcessHeap () returned 0x630000 [0057.557] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0057.557] GetProcessHeap () returned 0x630000 [0057.557] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0057.557] GetProcessHeap () returned 0x630000 [0057.557] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0057.557] GetProcessHeap () returned 0x630000 [0057.557] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ec40 | out: hHeap=0x630000) returned 1 [0057.557] GetProcessHeap () returned 0x630000 [0057.557] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0057.557] GetProcessHeap () returned 0x630000 [0057.557] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0057.557] GetProcessHeap () returned 0x630000 [0057.557] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0057.557] GetProcessHeap () returned 0x630000 [0057.557] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0057.557] GetProcessHeap () returned 0x630000 [0057.557] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0057.557] WriteFile (in: hFile=0x230, lpBuffer=0x65f630*, nNumberOfBytesToWrite=0x382, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65f630*, lpNumberOfBytesWritten=0x243d864*=0x382, lpOverlapped=0x0) returned 1 [0057.567] GetProcessHeap () returned 0x630000 [0057.567] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65f630, Size=0x30) returned 0x65f630 [0057.567] GetProcessHeap () returned 0x630000 [0057.567] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0057.567] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0057.567] GetProcessHeap () returned 0x630000 [0057.567] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb0) returned 0x640c90 [0057.567] ReadFile (in: hFile=0x230, lpBuffer=0x640c90, nNumberOfBytesToRead=0xb0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x640c90*, lpNumberOfBytesRead=0x243d7e8*=0xb0, lpOverlapped=0x0) returned 1 [0057.567] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0057.567] WriteFile (in: hFile=0x230, lpBuffer=0x640c90*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x640c90*, lpNumberOfBytesWritten=0x243d7e4*=0xb0, lpOverlapped=0x0) returned 1 [0057.568] GetProcessHeap () returned 0x630000 [0057.568] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0057.568] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0057.568] WriteFile (in: hFile=0x230, lpBuffer=0x65f630*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65f630*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0057.569] CloseHandle (hObject=0x230) returned 1 [0057.571] GetProcessHeap () returned 0x630000 [0057.571] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0057.571] GetProcessHeap () returned 0x630000 [0057.571] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655850 | out: hHeap=0x630000) returned 1 [0057.571] GetProcessHeap () returned 0x630000 [0057.571] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0057.571] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\desktop.ini" | out: lpString1="C:\\Users\\desktop.ini") returned="C:\\Users\\desktop.ini" [0057.571] lstrcatW (in: lpString1="C:\\Users\\desktop.ini", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\desktop.ini.happythreechoose") returned="C:\\Users\\desktop.ini.happythreechoose" [0057.571] MoveFileExW (lpExistingFileName="C:\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini"), lpNewFileName="C:\\Users\\desktop.ini.happythreechoose" (normalized: "c:\\users\\desktop.ini.happythreechoose"), dwFlags=0x1) returned 1 [0057.572] PathRemoveFileSpecW (in: pszPath="C:\\Users\\desktop.ini" | out: pszPath="C:\\Users") returned 1 [0057.572] PathAddBackslashW (in: pszPath="C:\\Users" | out: pszPath="C:\\Users\\") returned="" [0057.572] lstrcatW (in: lpString1="C:\\Users\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\Decryption INFO.html") returned="C:\\Users\\Decryption INFO.html" [0057.572] GetFileAttributesW (lpFileName="C:\\Users\\Decryption INFO.html" (normalized: "c:\\users\\decryption info.html")) returned 0xffffffff [0057.572] CreateFileW (lpFileName="C:\\Users\\Decryption INFO.html" (normalized: "c:\\users\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0057.572] GetProcessHeap () returned 0x630000 [0057.572] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655aa8 [0057.572] GetProcessHeap () returned 0x630000 [0057.572] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0057.579] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.580] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.580] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.580] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.581] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.581] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.581] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.581] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.581] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.581] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.581] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.581] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.581] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.581] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.581] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.581] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.581] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.581] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.582] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.582] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.582] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.582] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.582] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.582] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.582] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.582] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.582] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.582] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.582] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.582] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.582] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.583] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.583] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.583] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.583] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.583] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.583] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.584] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.584] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.584] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.584] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.584] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.584] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.584] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.584] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.584] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.584] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.584] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.584] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.584] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.584] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.584] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.585] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.585] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.585] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.585] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.585] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.585] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.585] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.585] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.585] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.585] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.585] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.585] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.585] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.585] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.585] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.586] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.586] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.586] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.586] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.586] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.586] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.586] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.586] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.586] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.586] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.586] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.586] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.586] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.586] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.586] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.587] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.587] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.587] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.587] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.587] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.587] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.587] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.587] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.587] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.587] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.587] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.587] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.587] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.587] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.587] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.588] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.588] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.588] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.588] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.588] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.588] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.588] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.588] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.588] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.588] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.588] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.588] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.588] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.588] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.588] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.589] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.589] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.589] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.589] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.589] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.589] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.589] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.589] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.589] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.589] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.589] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.589] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.589] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.589] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.589] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.590] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.590] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.590] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.590] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.590] GetProcessHeap () returned 0x630000 [0057.590] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655aa8 | out: hHeap=0x630000) returned 1 [0057.590] GetProcessHeap () returned 0x630000 [0057.590] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0057.590] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0057.590] GetProcessHeap () returned 0x630000 [0057.590] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655b20 [0057.590] GetProcessHeap () returned 0x630000 [0057.590] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0057.597] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.597] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.598] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.598] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.598] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.598] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.598] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.598] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.598] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.598] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.598] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.598] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.598] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.598] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.598] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.598] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.599] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.599] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.599] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.599] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.599] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.599] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.599] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.599] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.599] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.599] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.599] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.599] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.599] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.599] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.599] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.600] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.600] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.600] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.600] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.600] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.600] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.600] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.600] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.600] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.600] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.600] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.600] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.600] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.600] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.601] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.601] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.601] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.601] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.601] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.601] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.601] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.601] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.601] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.601] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.601] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.601] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.601] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.601] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.601] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.602] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.602] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.602] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.602] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.602] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.602] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.602] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.602] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.602] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.602] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.602] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.602] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.602] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.602] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.602] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.603] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.603] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.603] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.603] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.603] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.603] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.603] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.603] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.603] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.603] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.603] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.603] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.604] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.604] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.604] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.604] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.604] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.604] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.604] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.604] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.604] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.604] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.604] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.604] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.604] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.604] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.604] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.605] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.605] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.605] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.605] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.605] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.605] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.605] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.605] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.605] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.605] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.605] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.605] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.605] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.605] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.605] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.606] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.606] GetProcessHeap () returned 0x630000 [0057.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655b20 | out: hHeap=0x630000) returned 1 [0057.606] GetProcessHeap () returned 0x630000 [0057.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0057.606] CloseHandle (hObject=0x230) returned 1 [0057.607] GetProcessHeap () returned 0x630000 [0057.607] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0057.607] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 1 [0057.607] lstrcmpiW (lpString1="FD1HVy", lpString2=".") returned 1 [0057.607] lstrcmpiW (lpString1="FD1HVy", lpString2="..") returned 1 [0057.607] lstrcatW (in: lpString1="C:\\Users\\", lpString2="FD1HVy" | out: lpString1="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0057.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FD1HVy", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0057.607] GetProcessHeap () returned 0x630000 [0057.607] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7) returned 0x65a3a8 [0057.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FD1HVy", cchWideChar=-1, lpMultiByteStr=0x65a3a8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FD1HVy", lpUsedDefaultChar=0x0) returned 7 [0057.607] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0057.607] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0057.607] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0057.607] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0057.607] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0057.607] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0057.607] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0057.607] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0057.607] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0057.607] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0057.607] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0057.607] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0057.607] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0057.607] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0057.607] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0057.607] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0057.607] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0057.608] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0057.608] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0057.608] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0057.608] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0057.608] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0057.608] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0057.608] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0057.608] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0057.608] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0057.608] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0057.608] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0057.608] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0057.608] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0057.608] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0057.608] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0057.608] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0057.608] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0057.608] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0057.608] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0057.608] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0057.608] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0057.608] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0057.608] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0057.608] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0057.608] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0057.608] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0057.608] lstrcatW (in: lpString1="C:\\Users\\FD1HVy", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0057.608] GetProcessHeap () returned 0x630000 [0057.608] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a318 [0057.608] lstrlenW (lpString="C:\\Users\\FD1HVy\\") returned 16 [0057.608] GetProcessHeap () returned 0x630000 [0057.608] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x22) returned 0x644ab0 [0057.608] lstrcpyW (in: lpString1=0x644ab0, lpString2="C:\\Users\\FD1HVy\\" | out: lpString1="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0057.609] GetProcessHeap () returned 0x630000 [0057.609] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0057.609] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x48854d70, ftLastAccessTime.dwHighDateTime=0x1d5dbe3, ftLastWriteTime.dwLowDateTime=0x48854d70, ftLastWriteTime.dwHighDateTime=0x1d5dbe3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 1 [0057.609] lstrcmpiW (lpString1="Public", lpString2=".") returned 1 [0057.609] lstrcmpiW (lpString1="Public", lpString2="..") returned 1 [0057.609] lstrcatW (in: lpString1="C:\\Users\\", lpString2="Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0057.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Public", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0057.609] GetProcessHeap () returned 0x630000 [0057.609] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7) returned 0x65a378 [0057.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Public", cchWideChar=-1, lpMultiByteStr=0x65a378, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Public", lpUsedDefaultChar=0x0) returned 7 [0057.609] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0057.609] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0057.609] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0057.609] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0057.609] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0057.609] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0057.609] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0057.609] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0057.609] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0057.609] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0057.609] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0057.609] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0057.609] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0057.609] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0057.609] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0057.612] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0057.612] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0057.612] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0057.612] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0057.612] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0057.612] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0057.612] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0057.612] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0057.612] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0057.612] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0057.613] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0057.613] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0057.613] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0057.613] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0057.613] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0057.613] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0057.613] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0057.613] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0057.613] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0057.613] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0057.613] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0057.613] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0057.613] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0057.613] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0057.613] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0057.613] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0057.613] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0057.613] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0057.613] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0057.613] GetProcessHeap () returned 0x630000 [0057.613] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a328 [0057.613] lstrlenW (lpString="C:\\Users\\Public\\") returned 16 [0057.613] GetProcessHeap () returned 0x630000 [0057.613] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x22) returned 0x644b10 [0057.613] lstrcpyW (in: lpString1=0x644b10, lpString2="C:\\Users\\Public\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0057.613] GetProcessHeap () returned 0x630000 [0057.613] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0057.613] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x48854d70, ftLastAccessTime.dwHighDateTime=0x1d5dbe3, ftLastWriteTime.dwLowDateTime=0x48854d70, ftLastWriteTime.dwHighDateTime=0x1d5dbe3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 0 [0057.613] FindClose (in: hFindFile=0x648890 | out: hFindFile=0x648890) returned 1 [0057.614] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\Public\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0057.614] GetProcessHeap () returned 0x630000 [0057.614] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x644b10 | out: hHeap=0x630000) returned 1 [0057.614] GetProcessHeap () returned 0x630000 [0057.614] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0057.614] lstrlenW (lpString="C:\\Users\\Public\\") returned 16 [0057.614] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="*" | out: lpString1="C:\\Users\\Public\\*") returned="C:\\Users\\Public\\*" [0057.614] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x48854d70, ftLastAccessTime.dwHighDateTime=0x1d5dbe3, ftLastWriteTime.dwLowDateTime=0x48854d70, ftLastWriteTime.dwHighDateTime=0x1d5dbe3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648890 [0057.614] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0057.614] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x48854d70, ftLastAccessTime.dwHighDateTime=0x1d5dbe3, ftLastWriteTime.dwLowDateTime=0x48854d70, ftLastWriteTime.dwHighDateTime=0x1d5dbe3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.614] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0057.614] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0057.614] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48854d70, ftCreationTime.dwHighDateTime=0x1d5dbe3, ftLastAccessTime.dwLowDateTime=0x48854d70, ftLastAccessTime.dwHighDateTime=0x1d5dbe3, ftLastWriteTime.dwLowDateTime=0x49178cdd, ftLastWriteTime.dwHighDateTime=0x1d5dbe3, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF", cAlternateFileName="5D64CC~1")) returned 1 [0057.614] lstrcmpiW (lpString1="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF", lpString2=".") returned 1 [0057.614] lstrcmpiW (lpString1="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF", lpString2="..") returned 1 [0057.614] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF" | out: lpString1="C:\\Users\\Public\\5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned="C:\\Users\\Public\\5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF" [0057.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0057.614] GetProcessHeap () returned 0x630000 [0057.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x41) returned 0x655e00 [0057.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF", cchWideChar=-1, lpMultiByteStr=0x655e00, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF", lpUsedDefaultChar=0x0) returned 65 [0057.614] lstrlenA (lpString="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 64 [0057.614] lstrlenA (lpString=".happythreechoose") returned 17 [0057.614] lstrlenA (lpString=".happythreechoose") returned 17 [0057.614] lstrlenA (lpString="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 64 [0057.614] lstrcmpiA (lpString1="C3B1FABE9EF4413FF", lpString2=".happythreechoose") returned 1 [0057.614] lstrcmpiW (lpString1="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF", lpString2="Decryption INFO.html") returned -1 [0057.614] lstrcmpiW (lpString1="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 0 [0057.614] GetProcessHeap () returned 0x630000 [0057.614] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655e00 | out: hHeap=0x630000) returned 1 [0057.615] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3079b77, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AccountPictures", cAlternateFileName="ACCOUN~1")) returned 1 [0057.615] lstrcmpiW (lpString1="AccountPictures", lpString2=".") returned 1 [0057.615] lstrcmpiW (lpString1="AccountPictures", lpString2="..") returned 1 [0057.615] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="AccountPictures" | out: lpString1="C:\\Users\\Public\\AccountPictures") returned="C:\\Users\\Public\\AccountPictures" [0057.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AccountPictures", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0057.615] GetProcessHeap () returned 0x630000 [0057.615] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x64c9f0 [0057.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AccountPictures", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccountPictures", lpUsedDefaultChar=0x0) returned 16 [0057.615] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0057.615] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0057.615] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0057.615] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0057.615] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0057.615] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0057.615] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0057.615] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0057.615] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0057.615] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0057.615] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0057.615] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0057.615] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0057.615] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0057.615] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0057.615] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0057.615] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0057.615] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0057.615] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0057.615] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0057.615] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0057.615] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0057.615] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0057.615] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 1 [0057.615] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0057.616] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0057.616] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 1 [0057.616] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0057.616] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0057.616] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0057.616] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0057.616] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 1 [0057.616] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0057.616] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0057.616] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0057.616] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0057.616] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0057.616] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0057.616] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0057.616] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0057.616] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0057.616] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0057.616] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0057.616] lstrcatW (in: lpString1="C:\\Users\\Public\\AccountPictures", lpString2="\\" | out: lpString1="C:\\Users\\Public\\AccountPictures\\") returned="C:\\Users\\Public\\AccountPictures\\" [0057.616] GetProcessHeap () returned 0x630000 [0057.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a328 [0057.616] lstrlenW (lpString="C:\\Users\\Public\\AccountPictures\\") returned 32 [0057.616] GetProcessHeap () returned 0x630000 [0057.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x42) returned 0x655ef0 [0057.616] lstrcpyW (in: lpString1=0x655ef0, lpString2="C:\\Users\\Public\\AccountPictures\\" | out: lpString1="C:\\Users\\Public\\AccountPictures\\") returned="C:\\Users\\Public\\AccountPictures\\" [0057.616] GetProcessHeap () returned 0x630000 [0057.616] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0057.616] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c3ce2c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0057.616] lstrcmpiW (lpString1="Desktop", lpString2=".") returned 1 [0057.616] lstrcmpiW (lpString1="Desktop", lpString2="..") returned 1 [0057.616] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Desktop" | out: lpString1="C:\\Users\\Public\\Desktop") returned="C:\\Users\\Public\\Desktop" [0057.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Desktop", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0057.616] GetProcessHeap () returned 0x630000 [0057.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a378 [0057.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Desktop", cchWideChar=-1, lpMultiByteStr=0x65a378, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Desktop", lpUsedDefaultChar=0x0) returned 8 [0057.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0057.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0057.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0057.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0057.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0057.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0057.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0057.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0057.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0057.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0057.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0057.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0057.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0057.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0057.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0057.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0057.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0057.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0057.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0057.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0057.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0057.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0057.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0057.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0057.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0057.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0057.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0057.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0057.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0057.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0057.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0057.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0057.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0057.618] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0057.618] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0057.618] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0057.618] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0057.618] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0057.618] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0057.618] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0057.618] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0057.618] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0057.618] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0057.618] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Desktop\\") returned="C:\\Users\\Public\\Desktop\\" [0057.618] GetProcessHeap () returned 0x630000 [0057.618] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a3a8 [0057.618] lstrlenW (lpString="C:\\Users\\Public\\Desktop\\") returned 24 [0057.618] GetProcessHeap () returned 0x630000 [0057.618] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x32) returned 0x648a10 [0057.618] lstrcpyW (in: lpString1=0x648a10, lpString2="C:\\Users\\Public\\Desktop\\" | out: lpString1="C:\\Users\\Public\\Desktop\\") returned="C:\\Users\\Public\\Desktop\\" [0057.618] GetProcessHeap () returned 0x630000 [0057.618] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0057.618] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0057.618] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0057.618] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0057.618] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\Public\\desktop.ini") returned="C:\\Users\\Public\\desktop.ini" [0057.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0057.618] GetProcessHeap () returned 0x630000 [0057.618] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0057.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0057.618] lstrlenA (lpString="desktop.ini") returned 11 [0057.618] lstrlenA (lpString=".happythreechoose") returned 17 [0057.618] lstrcmpiW (lpString1="desktop.ini", lpString2="Decryption INFO.html") returned 1 [0057.618] lstrcmpiW (lpString1="desktop.ini", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0057.618] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0057.618] lstrcmpiW (lpString1="desktop.ini", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0057.618] GetProcessHeap () returned 0x630000 [0057.618] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f10 [0057.619] CreateFileW (lpFileName="C:\\Users\\Public\\desktop.ini" (normalized: "c:\\users\\public\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0057.619] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=174) returned 1 [0057.619] GetProcessHeap () returned 0x630000 [0057.619] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655490 [0057.619] GetProcessHeap () returned 0x630000 [0057.619] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0057.619] lstrlenW (lpString="C:\\Users\\Public\\desktop.ini") returned 27 [0057.619] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0057.619] GetProcessHeap () returned 0x630000 [0057.619] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0057.619] GetProcessHeap () returned 0x630000 [0057.619] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x382) returned 0x65f668 [0057.619] lstrlenA (lpString="rsa_encrypt") returned 11 [0057.619] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0057.620] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0057.620] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0057.620] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0057.620] GetProcessHeap () returned 0x630000 [0057.620] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0057.620] lstrlenA (lpString="010001") returned 6 [0057.620] GetProcessHeap () returned 0x630000 [0057.620] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2b8 [0057.621] GetProcessHeap () returned 0x630000 [0057.621] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0057.621] GetProcessHeap () returned 0x630000 [0057.621] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e460 [0057.621] GetProcessHeap () returned 0x630000 [0057.621] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0057.621] GetProcessHeap () returned 0x630000 [0057.621] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e2b0 [0057.621] GetProcessHeap () returned 0x630000 [0057.621] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x6570f8 [0057.621] GetProcessHeap () returned 0x630000 [0057.621] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a298 [0057.621] GetProcessHeap () returned 0x630000 [0057.621] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0057.621] GetProcessHeap () returned 0x630000 [0057.621] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0057.621] GetProcessHeap () returned 0x630000 [0057.621] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0057.621] GetProcessHeap () returned 0x630000 [0057.621] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0057.621] GetProcessHeap () returned 0x630000 [0057.621] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656c98 [0057.621] GetProcessHeap () returned 0x630000 [0057.621] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0057.621] GetProcessHeap () returned 0x630000 [0057.621] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0057.621] GetProcessHeap () returned 0x630000 [0057.621] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea90 [0057.621] GetProcessHeap () returned 0x630000 [0057.621] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0057.621] GetProcessHeap () returned 0x630000 [0057.621] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0057.621] GetProcessHeap () returned 0x630000 [0057.621] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea90 | out: hHeap=0x630000) returned 1 [0057.621] GetProcessHeap () returned 0x630000 [0057.621] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0057.621] GetProcessHeap () returned 0x630000 [0057.621] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65a900 [0057.621] GetProcessHeap () returned 0x630000 [0057.622] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0057.622] GetProcessHeap () returned 0x630000 [0057.622] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0057.622] GetProcessHeap () returned 0x630000 [0057.622] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0057.622] GetProcessHeap () returned 0x630000 [0057.622] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0057.622] GetProcessHeap () returned 0x630000 [0057.622] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e610 [0057.622] GetProcessHeap () returned 0x630000 [0057.622] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a900 | out: hHeap=0x630000) returned 1 [0057.622] GetProcessHeap () returned 0x630000 [0057.622] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0057.622] GetProcessHeap () returned 0x630000 [0057.622] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0057.622] GetProcessHeap () returned 0x630000 [0057.622] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0057.622] GetProcessHeap () returned 0x630000 [0057.622] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0057.622] GetProcessHeap () returned 0x630000 [0057.622] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0057.622] GetProcessHeap () returned 0x630000 [0057.622] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0057.622] GetProcessHeap () returned 0x630000 [0057.622] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.622] GetProcessHeap () returned 0x630000 [0057.622] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.622] GetProcessHeap () returned 0x630000 [0057.622] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0057.622] GetProcessHeap () returned 0x630000 [0057.622] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0057.622] GetProcessHeap () returned 0x630000 [0057.622] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0057.622] GetProcessHeap () returned 0x630000 [0057.622] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0057.622] GetProcessHeap () returned 0x630000 [0057.622] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0057.622] GetProcessHeap () returned 0x630000 [0057.623] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0057.623] GetProcessHeap () returned 0x630000 [0057.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.623] GetProcessHeap () returned 0x630000 [0057.623] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.623] GetProcessHeap () returned 0x630000 [0057.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0057.623] GetProcessHeap () returned 0x630000 [0057.623] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0057.623] GetProcessHeap () returned 0x630000 [0057.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0057.623] GetProcessHeap () returned 0x630000 [0057.623] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0057.623] GetProcessHeap () returned 0x630000 [0057.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0057.623] GetProcessHeap () returned 0x630000 [0057.623] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0057.623] GetProcessHeap () returned 0x630000 [0057.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0057.623] GetProcessHeap () returned 0x630000 [0057.623] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0057.623] GetProcessHeap () returned 0x630000 [0057.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0057.623] GetProcessHeap () returned 0x630000 [0057.623] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0057.623] GetProcessHeap () returned 0x630000 [0057.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0057.623] GetProcessHeap () returned 0x630000 [0057.623] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0057.623] GetProcessHeap () returned 0x630000 [0057.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.623] GetProcessHeap () returned 0x630000 [0057.623] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.623] GetProcessHeap () returned 0x630000 [0057.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0057.623] GetProcessHeap () returned 0x630000 [0057.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0057.624] GetProcessHeap () returned 0x630000 [0057.624] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.624] GetProcessHeap () returned 0x630000 [0057.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.624] GetProcessHeap () returned 0x630000 [0057.624] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0057.624] GetProcessHeap () returned 0x630000 [0057.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0057.624] GetProcessHeap () returned 0x630000 [0057.624] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0057.624] GetProcessHeap () returned 0x630000 [0057.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0057.624] GetProcessHeap () returned 0x630000 [0057.624] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.624] GetProcessHeap () returned 0x630000 [0057.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.624] GetProcessHeap () returned 0x630000 [0057.624] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0057.624] GetProcessHeap () returned 0x630000 [0057.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0057.624] GetProcessHeap () returned 0x630000 [0057.624] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0057.624] GetProcessHeap () returned 0x630000 [0057.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0057.624] GetProcessHeap () returned 0x630000 [0057.624] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0057.624] GetProcessHeap () returned 0x630000 [0057.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0057.624] GetProcessHeap () returned 0x630000 [0057.624] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.624] GetProcessHeap () returned 0x630000 [0057.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.624] GetProcessHeap () returned 0x630000 [0057.624] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0057.624] GetProcessHeap () returned 0x630000 [0057.625] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0057.625] GetProcessHeap () returned 0x630000 [0057.625] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0057.625] GetProcessHeap () returned 0x630000 [0057.625] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0057.625] GetProcessHeap () returned 0x630000 [0057.625] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0057.625] GetProcessHeap () returned 0x630000 [0057.625] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0057.625] GetProcessHeap () returned 0x630000 [0057.625] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.625] GetProcessHeap () returned 0x630000 [0057.625] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.625] GetProcessHeap () returned 0x630000 [0057.625] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0057.625] GetProcessHeap () returned 0x630000 [0057.625] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0057.625] GetProcessHeap () returned 0x630000 [0057.625] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.625] GetProcessHeap () returned 0x630000 [0057.625] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.625] GetProcessHeap () returned 0x630000 [0057.625] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.625] GetProcessHeap () returned 0x630000 [0057.625] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.625] GetProcessHeap () returned 0x630000 [0057.625] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0057.625] GetProcessHeap () returned 0x630000 [0057.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0057.626] GetProcessHeap () returned 0x630000 [0057.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.626] GetProcessHeap () returned 0x630000 [0057.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.626] GetProcessHeap () returned 0x630000 [0057.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0057.626] GetProcessHeap () returned 0x630000 [0057.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0057.626] GetProcessHeap () returned 0x630000 [0057.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0057.626] GetProcessHeap () returned 0x630000 [0057.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0057.626] GetProcessHeap () returned 0x630000 [0057.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0057.626] GetProcessHeap () returned 0x630000 [0057.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0057.626] GetProcessHeap () returned 0x630000 [0057.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0057.626] GetProcessHeap () returned 0x630000 [0057.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0057.626] GetProcessHeap () returned 0x630000 [0057.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0057.626] GetProcessHeap () returned 0x630000 [0057.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0057.626] GetProcessHeap () returned 0x630000 [0057.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.626] GetProcessHeap () returned 0x630000 [0057.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.626] GetProcessHeap () returned 0x630000 [0057.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0057.626] GetProcessHeap () returned 0x630000 [0057.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0057.626] GetProcessHeap () returned 0x630000 [0057.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.626] GetProcessHeap () returned 0x630000 [0057.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.627] GetProcessHeap () returned 0x630000 [0057.627] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0057.627] GetProcessHeap () returned 0x630000 [0057.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0057.627] GetProcessHeap () returned 0x630000 [0057.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0057.627] GetProcessHeap () returned 0x630000 [0057.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0057.627] GetProcessHeap () returned 0x630000 [0057.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0057.627] GetProcessHeap () returned 0x630000 [0057.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0057.627] GetProcessHeap () returned 0x630000 [0057.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0057.627] GetProcessHeap () returned 0x630000 [0057.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e2b0 | out: hHeap=0x630000) returned 1 [0057.627] GetProcessHeap () returned 0x630000 [0057.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0057.627] GetProcessHeap () returned 0x630000 [0057.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e460 | out: hHeap=0x630000) returned 1 [0057.627] GetProcessHeap () returned 0x630000 [0057.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0057.627] GetProcessHeap () returned 0x630000 [0057.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0057.627] GetProcessHeap () returned 0x630000 [0057.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0057.627] WriteFile (in: hFile=0x230, lpBuffer=0x65f668*, nNumberOfBytesToWrite=0x382, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65f668*, lpNumberOfBytesWritten=0x243d864*=0x382, lpOverlapped=0x0) returned 1 [0057.630] GetProcessHeap () returned 0x630000 [0057.630] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65f668, Size=0x30) returned 0x65f668 [0057.631] GetProcessHeap () returned 0x630000 [0057.631] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0057.631] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0057.631] GetProcessHeap () returned 0x630000 [0057.631] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb0) returned 0x640c90 [0057.631] ReadFile (in: hFile=0x230, lpBuffer=0x640c90, nNumberOfBytesToRead=0xb0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x640c90*, lpNumberOfBytesRead=0x243d7e8*=0xb0, lpOverlapped=0x0) returned 1 [0057.631] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0057.631] WriteFile (in: hFile=0x230, lpBuffer=0x640c90*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x640c90*, lpNumberOfBytesWritten=0x243d7e4*=0xb0, lpOverlapped=0x0) returned 1 [0057.632] GetProcessHeap () returned 0x630000 [0057.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0057.632] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0057.632] WriteFile (in: hFile=0x230, lpBuffer=0x65f668*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65f668*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0057.633] CloseHandle (hObject=0x230) returned 1 [0057.634] GetProcessHeap () returned 0x630000 [0057.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f10 | out: hHeap=0x630000) returned 1 [0057.634] GetProcessHeap () returned 0x630000 [0057.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655490 | out: hHeap=0x630000) returned 1 [0057.634] GetProcessHeap () returned 0x630000 [0057.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0057.634] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\Public\\desktop.ini" | out: lpString1="C:\\Users\\Public\\desktop.ini") returned="C:\\Users\\Public\\desktop.ini" [0057.634] lstrcatW (in: lpString1="C:\\Users\\Public\\desktop.ini", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\Public\\desktop.ini.happythreechoose") returned="C:\\Users\\Public\\desktop.ini.happythreechoose" [0057.634] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\desktop.ini" (normalized: "c:\\users\\public\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\desktop.ini.happythreechoose" (normalized: "c:\\users\\public\\desktop.ini.happythreechoose"), dwFlags=0x1) returned 1 [0057.635] PathRemoveFileSpecW (in: pszPath="C:\\Users\\Public\\desktop.ini" | out: pszPath="C:\\Users\\Public") returned 1 [0057.635] PathAddBackslashW (in: pszPath="C:\\Users\\Public" | out: pszPath="C:\\Users\\Public\\") returned="" [0057.635] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\Public\\Decryption INFO.html") returned="C:\\Users\\Public\\Decryption INFO.html" [0057.635] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Decryption INFO.html" (normalized: "c:\\users\\public\\decryption info.html")) returned 0xffffffff [0057.635] CreateFileW (lpFileName="C:\\Users\\Public\\Decryption INFO.html" (normalized: "c:\\users\\public\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0057.635] GetProcessHeap () returned 0x630000 [0057.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655580 [0057.635] GetProcessHeap () returned 0x630000 [0057.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0057.643] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.643] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.644] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.644] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.644] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.644] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.644] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.644] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.644] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.644] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.644] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.644] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.644] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.644] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.644] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.645] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.645] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.645] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.645] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.645] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.645] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.645] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.645] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.645] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.645] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.645] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.645] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.645] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.646] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.646] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.646] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.646] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.646] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.646] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.646] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.646] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.646] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.647] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.647] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.647] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.647] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.647] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.647] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.647] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.647] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.647] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.647] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.647] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.647] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.648] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.648] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.648] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.648] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.648] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.648] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.648] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.648] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.648] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.648] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.648] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.648] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.648] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.648] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.648] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.649] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.649] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.649] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.649] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.649] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.649] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.649] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.649] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.649] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.649] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.649] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.649] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.649] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.649] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.650] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.650] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.650] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.650] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.650] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.650] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.650] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.650] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.650] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.650] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.650] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.650] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.650] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.650] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.651] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.651] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.651] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.651] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.651] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.651] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.651] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.651] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.651] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.651] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.651] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.651] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.651] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.651] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.652] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.652] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.652] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.652] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.652] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.652] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.652] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.652] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.652] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.652] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.652] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.652] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.652] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.652] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.652] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.653] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.653] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.653] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.653] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.653] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.653] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.653] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.653] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.653] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.653] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.653] GetProcessHeap () returned 0x630000 [0057.653] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655580 | out: hHeap=0x630000) returned 1 [0057.653] GetProcessHeap () returned 0x630000 [0057.653] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0057.653] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0057.653] GetProcessHeap () returned 0x630000 [0057.653] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655508 [0057.653] GetProcessHeap () returned 0x630000 [0057.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0057.661] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.661] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.661] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.661] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.661] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.661] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.661] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.661] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.661] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.661] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.661] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.661] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.661] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.662] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.662] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.662] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.662] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.662] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.662] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.662] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.662] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.662] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.662] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.662] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.662] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.662] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.662] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.663] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.663] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.663] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.663] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.663] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.663] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.663] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.663] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.663] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.663] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.663] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.663] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.663] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.663] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.663] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.664] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.664] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.664] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.664] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.664] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.664] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.664] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.664] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.664] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.664] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.664] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.664] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.664] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.664] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.664] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.665] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.665] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.665] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.665] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.665] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.665] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.665] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.665] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.665] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.665] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.665] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.665] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.665] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.665] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.665] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.666] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.666] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.666] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.666] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.666] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.666] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.666] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.666] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.666] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.666] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.666] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.666] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.666] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.667] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.667] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.667] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.667] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.667] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.667] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.667] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.667] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.667] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.667] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.667] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.667] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.667] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.667] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.668] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.668] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.668] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.668] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.668] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.668] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.668] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.668] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.668] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.668] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.668] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.668] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.668] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.668] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.668] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.669] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.669] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.669] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.669] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.670] GetProcessHeap () returned 0x630000 [0057.670] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655508 | out: hHeap=0x630000) returned 1 [0057.670] GetProcessHeap () returned 0x630000 [0057.670] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0057.670] CloseHandle (hObject=0x230) returned 1 [0057.670] GetProcessHeap () returned 0x630000 [0057.670] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0057.670] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb1fb672c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0057.670] lstrcmpiW (lpString1="Documents", lpString2=".") returned 1 [0057.670] lstrcmpiW (lpString1="Documents", lpString2="..") returned 1 [0057.670] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Documents" | out: lpString1="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0057.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Documents", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0057.670] GetProcessHeap () returned 0x630000 [0057.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x64c9f0 [0057.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Documents", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Documents", lpUsedDefaultChar=0x0) returned 10 [0057.670] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0057.670] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0057.670] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0057.670] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0057.670] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0057.670] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0057.670] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0057.670] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0057.670] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0057.670] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0057.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0057.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0057.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0057.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0057.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0057.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0057.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0057.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0057.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0057.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0057.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0057.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0057.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0057.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0057.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0057.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0057.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0057.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0057.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0057.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0057.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0057.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0057.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0057.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0057.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0057.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0057.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0057.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0057.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0057.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0057.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0057.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0057.671] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0057.671] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0057.672] GetProcessHeap () returned 0x630000 [0057.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a3b8 [0057.672] lstrlenW (lpString="C:\\Users\\Public\\Documents\\") returned 26 [0057.672] GetProcessHeap () returned 0x630000 [0057.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x36) returned 0x648710 [0057.672] lstrcpyW (in: lpString1=0x648710, lpString2="C:\\Users\\Public\\Documents\\" | out: lpString1="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0057.672] GetProcessHeap () returned 0x630000 [0057.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0057.677] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0057.677] lstrcmpiW (lpString1="Downloads", lpString2=".") returned 1 [0057.677] lstrcmpiW (lpString1="Downloads", lpString2="..") returned 1 [0057.677] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Downloads" | out: lpString1="C:\\Users\\Public\\Downloads") returned="C:\\Users\\Public\\Downloads" [0057.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Downloads", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0057.677] GetProcessHeap () returned 0x630000 [0057.677] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x64c9f0 [0057.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Downloads", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Downloads", lpUsedDefaultChar=0x0) returned 10 [0057.677] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0057.677] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0057.677] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0057.678] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0057.678] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0057.678] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0057.678] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0057.678] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0057.678] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0057.678] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0057.678] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0057.678] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0057.678] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0057.678] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0057.678] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0057.678] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0057.678] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0057.678] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0057.678] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0057.678] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0057.678] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0057.678] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0057.678] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0057.678] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0057.678] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0057.678] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0057.678] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0057.678] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0057.678] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0057.678] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0057.678] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0057.678] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0057.678] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0057.678] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0057.678] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0057.678] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0057.679] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0057.679] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0057.679] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0057.679] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0057.679] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0057.679] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0057.679] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0057.679] lstrcatW (in: lpString1="C:\\Users\\Public\\Downloads", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Downloads\\") returned="C:\\Users\\Public\\Downloads\\" [0057.679] GetProcessHeap () returned 0x630000 [0057.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a298 [0057.679] lstrlenW (lpString="C:\\Users\\Public\\Downloads\\") returned 26 [0057.679] GetProcessHeap () returned 0x630000 [0057.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x36) returned 0x648b50 [0057.679] lstrcpyW (in: lpString1=0x648b50, lpString2="C:\\Users\\Public\\Downloads\\" | out: lpString1="C:\\Users\\Public\\Downloads\\") returned="C:\\Users\\Public\\Downloads\\" [0057.679] GetProcessHeap () returned 0x630000 [0057.679] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0057.679] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb207547d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb207547d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0057.679] lstrcmpiW (lpString1="Libraries", lpString2=".") returned 1 [0057.679] lstrcmpiW (lpString1="Libraries", lpString2="..") returned 1 [0057.679] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Libraries" | out: lpString1="C:\\Users\\Public\\Libraries") returned="C:\\Users\\Public\\Libraries" [0057.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Libraries", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0057.679] GetProcessHeap () returned 0x630000 [0057.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x64c9f0 [0057.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Libraries", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Libraries", lpUsedDefaultChar=0x0) returned 10 [0057.679] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0057.679] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0057.679] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0057.679] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0057.679] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0057.679] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0057.679] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0057.679] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0057.679] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0057.679] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0057.680] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0057.680] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0057.680] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0057.680] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0057.680] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0057.680] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0057.680] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0057.680] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0057.680] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0057.680] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0057.680] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0057.680] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0057.680] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0057.680] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0057.680] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0057.680] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0057.680] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0057.680] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0057.680] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0057.680] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0057.680] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0057.680] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0057.680] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0057.680] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0057.680] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0057.680] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0057.680] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0057.680] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0057.680] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0057.680] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0057.680] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0057.680] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0057.680] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0057.681] lstrcatW (in: lpString1="C:\\Users\\Public\\Libraries", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Libraries\\") returned="C:\\Users\\Public\\Libraries\\" [0057.681] GetProcessHeap () returned 0x630000 [0057.681] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a378 [0057.681] lstrlenW (lpString="C:\\Users\\Public\\Libraries\\") returned 26 [0057.681] GetProcessHeap () returned 0x630000 [0057.681] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x36) returned 0x648810 [0057.681] lstrcpyW (in: lpString1=0x648810, lpString2="C:\\Users\\Public\\Libraries\\" | out: lpString1="C:\\Users\\Public\\Libraries\\") returned="C:\\Users\\Public\\Libraries\\" [0057.681] GetProcessHeap () returned 0x630000 [0057.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0057.681] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0057.681] lstrcmpiW (lpString1="Music", lpString2=".") returned 1 [0057.681] lstrcmpiW (lpString1="Music", lpString2="..") returned 1 [0057.681] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Music" | out: lpString1="C:\\Users\\Public\\Music") returned="C:\\Users\\Public\\Music" [0057.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Music", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0057.681] GetProcessHeap () returned 0x630000 [0057.681] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6) returned 0x65a278 [0057.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Music", cchWideChar=-1, lpMultiByteStr=0x65a278, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Music", lpUsedDefaultChar=0x0) returned 6 [0057.681] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0057.681] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0057.681] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0057.681] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0057.681] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0057.681] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0057.681] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0057.681] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0057.681] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0057.681] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0057.681] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0057.681] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0057.681] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0057.681] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0057.681] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0057.681] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0057.681] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0057.682] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0057.682] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0057.682] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0057.682] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0057.682] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0057.682] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0057.682] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0057.682] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0057.682] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0057.682] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0057.682] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0057.682] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0057.682] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0057.682] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0057.682] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0057.682] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0057.682] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0057.682] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0057.682] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0057.682] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0057.682] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0057.682] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0057.682] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0057.682] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0057.682] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0057.682] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0057.682] lstrcatW (in: lpString1="C:\\Users\\Public\\Music", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Music\\") returned="C:\\Users\\Public\\Music\\" [0057.682] GetProcessHeap () returned 0x630000 [0057.682] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a268 [0057.682] lstrlenW (lpString="C:\\Users\\Public\\Music\\") returned 22 [0057.682] GetProcessHeap () returned 0x630000 [0057.682] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2e) returned 0x652518 [0057.682] lstrcpyW (in: lpString1=0x652518, lpString2="C:\\Users\\Public\\Music\\" | out: lpString1="C:\\Users\\Public\\Music\\") returned="C:\\Users\\Public\\Music\\" [0057.682] GetProcessHeap () returned 0x630000 [0057.683] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0057.683] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0057.683] lstrcmpiW (lpString1="Pictures", lpString2=".") returned 1 [0057.683] lstrcmpiW (lpString1="Pictures", lpString2="..") returned 1 [0057.683] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Pictures" | out: lpString1="C:\\Users\\Public\\Pictures") returned="C:\\Users\\Public\\Pictures" [0057.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Pictures", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0057.683] GetProcessHeap () returned 0x630000 [0057.683] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9) returned 0x64ca20 [0057.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Pictures", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pictures", lpUsedDefaultChar=0x0) returned 9 [0057.683] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0057.683] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0057.683] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0057.683] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0057.683] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0057.683] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0057.683] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0057.683] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0057.683] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0057.683] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0057.683] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0057.683] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0057.683] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0057.683] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0057.683] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0057.683] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0057.683] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0057.683] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0057.683] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0057.683] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0057.683] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0057.683] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0057.683] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0057.683] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0057.684] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0057.684] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0057.684] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0057.684] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0057.684] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0057.684] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0057.684] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0057.684] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0057.684] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0057.684] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0057.684] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0057.684] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0057.684] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0057.684] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0057.684] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0057.684] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0057.684] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0057.684] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0057.684] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0057.684] lstrcatW (in: lpString1="C:\\Users\\Public\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Pictures\\") returned="C:\\Users\\Public\\Pictures\\" [0057.684] GetProcessHeap () returned 0x630000 [0057.684] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a2a8 [0057.684] lstrlenW (lpString="C:\\Users\\Public\\Pictures\\") returned 25 [0057.684] GetProcessHeap () returned 0x630000 [0057.684] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x34) returned 0x648a90 [0057.684] lstrcpyW (in: lpString1=0x648a90, lpString2="C:\\Users\\Public\\Pictures\\" | out: lpString1="C:\\Users\\Public\\Pictures\\") returned="C:\\Users\\Public\\Pictures\\" [0057.684] GetProcessHeap () returned 0x630000 [0057.684] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0057.684] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0057.684] lstrcmpiW (lpString1="Videos", lpString2=".") returned 1 [0057.684] lstrcmpiW (lpString1="Videos", lpString2="..") returned 1 [0057.684] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Videos" | out: lpString1="C:\\Users\\Public\\Videos") returned="C:\\Users\\Public\\Videos" [0057.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Videos", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0057.684] GetProcessHeap () returned 0x630000 [0057.684] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7) returned 0x65a2f8 [0057.685] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Videos", cchWideChar=-1, lpMultiByteStr=0x65a2f8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Videos", lpUsedDefaultChar=0x0) returned 7 [0057.685] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0057.685] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0057.685] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0057.685] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0057.685] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0057.685] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0057.685] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0057.685] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0057.685] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0057.685] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0057.685] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0057.685] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0057.685] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0057.685] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0057.685] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0057.685] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0057.685] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0057.685] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0057.685] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0057.685] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0057.685] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0057.685] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0057.685] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0057.685] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0057.685] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 3 [0057.685] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 3 [0057.685] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0057.685] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0057.685] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 3 [0057.685] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 3 [0057.685] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 3 [0057.685] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0057.685] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0057.685] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0057.686] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0057.686] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0057.686] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0057.686] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0057.686] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0057.686] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0057.686] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0057.686] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0057.686] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0057.686] lstrcatW (in: lpString1="C:\\Users\\Public\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Videos\\") returned="C:\\Users\\Public\\Videos\\" [0057.686] GetProcessHeap () returned 0x630000 [0057.686] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a338 [0057.686] lstrlenW (lpString="C:\\Users\\Public\\Videos\\") returned 23 [0057.686] GetProcessHeap () returned 0x630000 [0057.686] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x30) returned 0x6522b0 [0057.686] lstrcpyW (in: lpString1=0x6522b0, lpString2="C:\\Users\\Public\\Videos\\" | out: lpString1="C:\\Users\\Public\\Videos\\") returned="C:\\Users\\Public\\Videos\\" [0057.686] GetProcessHeap () returned 0x630000 [0057.686] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.686] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0057.686] FindClose (in: hFindFile=0x648890 | out: hFindFile=0x648890) returned 1 [0057.686] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\Public\\Videos\\" | out: lpString1="C:\\Users\\Public\\Videos\\") returned="C:\\Users\\Public\\Videos\\" [0057.686] GetProcessHeap () returned 0x630000 [0057.686] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6522b0 | out: hHeap=0x630000) returned 1 [0057.686] GetProcessHeap () returned 0x630000 [0057.686] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0057.686] lstrlenW (lpString="C:\\Users\\Public\\Videos\\") returned 23 [0057.686] lstrcatW (in: lpString1="C:\\Users\\Public\\Videos\\", lpString2="*" | out: lpString1="C:\\Users\\Public\\Videos\\*") returned="C:\\Users\\Public\\Videos\\*" [0057.686] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648850 [0057.687] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0057.687] FindNextFileW (in: hFindFile=0x648850, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.687] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0057.687] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0057.687] FindNextFileW (in: hFindFile=0x648850, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0057.687] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0057.687] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0057.687] lstrcatW (in: lpString1="C:\\Users\\Public\\Videos\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\Public\\Videos\\desktop.ini") returned="C:\\Users\\Public\\Videos\\desktop.ini" [0057.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0057.687] GetProcessHeap () returned 0x630000 [0057.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64ca20 [0057.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0057.687] lstrlenA (lpString="desktop.ini") returned 11 [0057.687] lstrlenA (lpString=".happythreechoose") returned 17 [0057.687] lstrcmpiW (lpString1="desktop.ini", lpString2="Decryption INFO.html") returned 1 [0057.687] lstrcmpiW (lpString1="desktop.ini", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0057.687] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0057.687] lstrcmpiW (lpString1="desktop.ini", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0057.687] GetProcessHeap () returned 0x630000 [0057.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x652000 [0057.688] CreateFileW (lpFileName="C:\\Users\\Public\\Videos\\desktop.ini" (normalized: "c:\\users\\public\\videos\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0057.688] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=380) returned 1 [0057.688] GetProcessHeap () returned 0x630000 [0057.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655490 [0057.688] GetProcessHeap () returned 0x630000 [0057.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0057.688] lstrlenW (lpString="C:\\Users\\Public\\Videos\\desktop.ini") returned 34 [0057.688] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0057.688] GetProcessHeap () returned 0x630000 [0057.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0057.688] GetProcessHeap () returned 0x630000 [0057.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x384) returned 0x65f6a0 [0057.688] lstrlenA (lpString="rsa_encrypt") returned 11 [0057.688] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0057.689] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0057.689] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0057.689] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0057.689] GetProcessHeap () returned 0x630000 [0057.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0057.689] lstrlenA (lpString="010001") returned 6 [0057.689] GetProcessHeap () returned 0x630000 [0057.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2b8 [0057.689] GetProcessHeap () returned 0x630000 [0057.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0057.689] GetProcessHeap () returned 0x630000 [0057.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e6a0 [0057.689] GetProcessHeap () returned 0x630000 [0057.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0057.689] GetProcessHeap () returned 0x630000 [0057.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65eb20 [0057.689] GetProcessHeap () returned 0x630000 [0057.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656a68 [0057.689] GetProcessHeap () returned 0x630000 [0057.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0057.690] GetProcessHeap () returned 0x630000 [0057.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0057.690] GetProcessHeap () returned 0x630000 [0057.690] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0057.690] GetProcessHeap () returned 0x630000 [0057.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0057.690] GetProcessHeap () returned 0x630000 [0057.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0057.690] GetProcessHeap () returned 0x630000 [0057.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656db0 [0057.690] GetProcessHeap () returned 0x630000 [0057.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.690] GetProcessHeap () returned 0x630000 [0057.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0057.690] GetProcessHeap () returned 0x630000 [0057.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e7c0 [0057.690] GetProcessHeap () returned 0x630000 [0057.690] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0057.690] GetProcessHeap () returned 0x630000 [0057.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0057.690] GetProcessHeap () returned 0x630000 [0057.690] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e7c0 | out: hHeap=0x630000) returned 1 [0057.690] GetProcessHeap () returned 0x630000 [0057.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.690] GetProcessHeap () returned 0x630000 [0057.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65a720 [0057.690] GetProcessHeap () returned 0x630000 [0057.690] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.690] GetProcessHeap () returned 0x630000 [0057.690] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.690] GetProcessHeap () returned 0x630000 [0057.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.690] GetProcessHeap () returned 0x630000 [0057.690] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.690] GetProcessHeap () returned 0x630000 [0057.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65dfe0 [0057.690] GetProcessHeap () returned 0x630000 [0057.690] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a720 | out: hHeap=0x630000) returned 1 [0057.690] GetProcessHeap () returned 0x630000 [0057.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0057.691] GetProcessHeap () returned 0x630000 [0057.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0057.691] GetProcessHeap () returned 0x630000 [0057.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0057.691] GetProcessHeap () returned 0x630000 [0057.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0057.691] GetProcessHeap () returned 0x630000 [0057.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.691] GetProcessHeap () returned 0x630000 [0057.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.691] GetProcessHeap () returned 0x630000 [0057.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.691] GetProcessHeap () returned 0x630000 [0057.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.691] GetProcessHeap () returned 0x630000 [0057.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0057.691] GetProcessHeap () returned 0x630000 [0057.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0057.691] GetProcessHeap () returned 0x630000 [0057.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.691] GetProcessHeap () returned 0x630000 [0057.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.691] GetProcessHeap () returned 0x630000 [0057.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.691] GetProcessHeap () returned 0x630000 [0057.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.691] GetProcessHeap () returned 0x630000 [0057.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0057.691] GetProcessHeap () returned 0x630000 [0057.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0057.691] GetProcessHeap () returned 0x630000 [0057.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.691] GetProcessHeap () returned 0x630000 [0057.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.691] GetProcessHeap () returned 0x630000 [0057.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.692] GetProcessHeap () returned 0x630000 [0057.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.692] GetProcessHeap () returned 0x630000 [0057.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0057.692] GetProcessHeap () returned 0x630000 [0057.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0057.692] GetProcessHeap () returned 0x630000 [0057.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.692] GetProcessHeap () returned 0x630000 [0057.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.692] GetProcessHeap () returned 0x630000 [0057.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.692] GetProcessHeap () returned 0x630000 [0057.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.692] GetProcessHeap () returned 0x630000 [0057.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0057.692] GetProcessHeap () returned 0x630000 [0057.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0057.692] GetProcessHeap () returned 0x630000 [0057.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.692] GetProcessHeap () returned 0x630000 [0057.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.692] GetProcessHeap () returned 0x630000 [0057.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.692] GetProcessHeap () returned 0x630000 [0057.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.692] GetProcessHeap () returned 0x630000 [0057.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.692] GetProcessHeap () returned 0x630000 [0057.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.692] GetProcessHeap () returned 0x630000 [0057.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.692] GetProcessHeap () returned 0x630000 [0057.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.692] GetProcessHeap () returned 0x630000 [0057.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0057.693] GetProcessHeap () returned 0x630000 [0057.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0057.693] GetProcessHeap () returned 0x630000 [0057.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.693] GetProcessHeap () returned 0x630000 [0057.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.693] GetProcessHeap () returned 0x630000 [0057.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.693] GetProcessHeap () returned 0x630000 [0057.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.693] GetProcessHeap () returned 0x630000 [0057.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.693] GetProcessHeap () returned 0x630000 [0057.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.693] GetProcessHeap () returned 0x630000 [0057.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0057.693] GetProcessHeap () returned 0x630000 [0057.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0057.693] GetProcessHeap () returned 0x630000 [0057.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0057.693] GetProcessHeap () returned 0x630000 [0057.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0057.693] GetProcessHeap () returned 0x630000 [0057.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0057.693] GetProcessHeap () returned 0x630000 [0057.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0057.693] GetProcessHeap () returned 0x630000 [0057.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.693] GetProcessHeap () returned 0x630000 [0057.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.693] GetProcessHeap () returned 0x630000 [0057.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.693] GetProcessHeap () returned 0x630000 [0057.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.693] GetProcessHeap () returned 0x630000 [0057.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0057.693] GetProcessHeap () returned 0x630000 [0057.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0057.694] GetProcessHeap () returned 0x630000 [0057.694] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.694] GetProcessHeap () returned 0x630000 [0057.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.694] GetProcessHeap () returned 0x630000 [0057.694] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0057.694] GetProcessHeap () returned 0x630000 [0057.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0057.694] GetProcessHeap () returned 0x630000 [0057.694] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.694] GetProcessHeap () returned 0x630000 [0057.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.694] GetProcessHeap () returned 0x630000 [0057.694] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0057.694] GetProcessHeap () returned 0x630000 [0057.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0057.694] GetProcessHeap () returned 0x630000 [0057.694] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.694] GetProcessHeap () returned 0x630000 [0057.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.694] GetProcessHeap () returned 0x630000 [0057.694] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.694] GetProcessHeap () returned 0x630000 [0057.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.694] GetProcessHeap () returned 0x630000 [0057.694] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.694] GetProcessHeap () returned 0x630000 [0057.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.694] GetProcessHeap () returned 0x630000 [0057.694] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0057.694] GetProcessHeap () returned 0x630000 [0057.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0057.694] GetProcessHeap () returned 0x630000 [0057.694] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.694] GetProcessHeap () returned 0x630000 [0057.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.694] GetProcessHeap () returned 0x630000 [0057.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.695] GetProcessHeap () returned 0x630000 [0057.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.695] GetProcessHeap () returned 0x630000 [0057.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.695] GetProcessHeap () returned 0x630000 [0057.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.695] GetProcessHeap () returned 0x630000 [0057.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0057.695] GetProcessHeap () returned 0x630000 [0057.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0057.695] GetProcessHeap () returned 0x630000 [0057.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.695] GetProcessHeap () returned 0x630000 [0057.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.695] GetProcessHeap () returned 0x630000 [0057.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.695] GetProcessHeap () returned 0x630000 [0057.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.695] GetProcessHeap () returned 0x630000 [0057.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0057.695] GetProcessHeap () returned 0x630000 [0057.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0057.695] GetProcessHeap () returned 0x630000 [0057.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0057.695] GetProcessHeap () returned 0x630000 [0057.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0057.695] GetProcessHeap () returned 0x630000 [0057.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0057.695] GetProcessHeap () returned 0x630000 [0057.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0057.695] GetProcessHeap () returned 0x630000 [0057.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0057.695] GetProcessHeap () returned 0x630000 [0057.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e6a0 | out: hHeap=0x630000) returned 1 [0057.695] GetProcessHeap () returned 0x630000 [0057.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0057.696] GetProcessHeap () returned 0x630000 [0057.696] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0057.696] GetProcessHeap () returned 0x630000 [0057.696] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0057.696] WriteFile (in: hFile=0x230, lpBuffer=0x65f6a0*, nNumberOfBytesToWrite=0x384, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65f6a0*, lpNumberOfBytesWritten=0x243d864*=0x384, lpOverlapped=0x0) returned 1 [0057.700] GetProcessHeap () returned 0x630000 [0057.700] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65f6a0, Size=0x30) returned 0x65f6a0 [0057.700] GetProcessHeap () returned 0x630000 [0057.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0057.700] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0057.700] GetProcessHeap () returned 0x630000 [0057.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x180) returned 0x63f408 [0057.700] ReadFile (in: hFile=0x230, lpBuffer=0x63f408, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x63f408*, lpNumberOfBytesRead=0x243d7e8*=0x180, lpOverlapped=0x0) returned 1 [0057.700] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0057.700] WriteFile (in: hFile=0x230, lpBuffer=0x63f408*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x63f408*, lpNumberOfBytesWritten=0x243d7e4*=0x180, lpOverlapped=0x0) returned 1 [0057.701] GetProcessHeap () returned 0x630000 [0057.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63f408 | out: hHeap=0x630000) returned 1 [0057.701] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0057.701] WriteFile (in: hFile=0x230, lpBuffer=0x65f6a0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65f6a0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0057.702] CloseHandle (hObject=0x230) returned 1 [0057.704] GetProcessHeap () returned 0x630000 [0057.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x652000 | out: hHeap=0x630000) returned 1 [0057.704] GetProcessHeap () returned 0x630000 [0057.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655490 | out: hHeap=0x630000) returned 1 [0057.704] GetProcessHeap () returned 0x630000 [0057.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0057.704] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\Public\\Videos\\desktop.ini" | out: lpString1="C:\\Users\\Public\\Videos\\desktop.ini") returned="C:\\Users\\Public\\Videos\\desktop.ini" [0057.704] lstrcatW (in: lpString1="C:\\Users\\Public\\Videos\\desktop.ini", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\Public\\Videos\\desktop.ini.happythreechoose") returned="C:\\Users\\Public\\Videos\\desktop.ini.happythreechoose" [0057.704] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Videos\\desktop.ini" (normalized: "c:\\users\\public\\videos\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Videos\\desktop.ini.happythreechoose" (normalized: "c:\\users\\public\\videos\\desktop.ini.happythreechoose"), dwFlags=0x1) returned 1 [0057.708] PathRemoveFileSpecW (in: pszPath="C:\\Users\\Public\\Videos\\desktop.ini" | out: pszPath="C:\\Users\\Public\\Videos") returned 1 [0057.708] PathAddBackslashW (in: pszPath="C:\\Users\\Public\\Videos" | out: pszPath="C:\\Users\\Public\\Videos\\") returned="" [0057.708] lstrcatW (in: lpString1="C:\\Users\\Public\\Videos\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\Public\\Videos\\Decryption INFO.html") returned="C:\\Users\\Public\\Videos\\Decryption INFO.html" [0057.708] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Videos\\Decryption INFO.html" (normalized: "c:\\users\\public\\videos\\decryption info.html")) returned 0xffffffff [0057.708] CreateFileW (lpFileName="C:\\Users\\Public\\Videos\\Decryption INFO.html" (normalized: "c:\\users\\public\\videos\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0057.709] GetProcessHeap () returned 0x630000 [0057.709] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655580 [0057.709] GetProcessHeap () returned 0x630000 [0057.709] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0057.716] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.717] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.717] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.717] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.717] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.717] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.717] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.717] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.717] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.717] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.717] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.717] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.718] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.718] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.718] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.718] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.718] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.718] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.718] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.718] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.718] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.718] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.718] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.718] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.718] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.719] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.719] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.719] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.719] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.719] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.720] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.720] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.720] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.720] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.720] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.720] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.720] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.721] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.721] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.721] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.721] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.721] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.721] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.721] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.721] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.721] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.721] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.721] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.721] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.721] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.722] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.722] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.722] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.722] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.722] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.722] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.722] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.722] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.722] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.722] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.722] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.722] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.722] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.722] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.723] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.723] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.723] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.723] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.723] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.723] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.723] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.723] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.723] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.723] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.723] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.723] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.723] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.723] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.724] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.724] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.724] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.724] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.724] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.724] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.724] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.724] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.724] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.724] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.724] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.724] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.724] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.724] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.725] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.725] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.725] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.725] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.725] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.725] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.725] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.725] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.725] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.725] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.725] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.725] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.725] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.725] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.726] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.726] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.726] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.726] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.726] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.726] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.726] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.726] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.726] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.726] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.726] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.726] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.726] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.726] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.727] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.727] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.727] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.727] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.727] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.727] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.727] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.727] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.727] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.727] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.727] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.727] GetProcessHeap () returned 0x630000 [0057.727] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655580 | out: hHeap=0x630000) returned 1 [0057.727] GetProcessHeap () returned 0x630000 [0057.727] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0057.727] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0057.728] GetProcessHeap () returned 0x630000 [0057.728] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655670 [0057.728] GetProcessHeap () returned 0x630000 [0057.728] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0057.735] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.735] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.735] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.735] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.735] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.735] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.735] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.735] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.735] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.735] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.735] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.735] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.735] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.736] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.736] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.736] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.736] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.736] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.736] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.736] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.736] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.736] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.736] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.736] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.736] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.736] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.736] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.737] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.737] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.737] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.737] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.737] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.737] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.737] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.737] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.737] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.737] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.737] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.737] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.737] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.737] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.738] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.738] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.738] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.738] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.738] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.738] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.738] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.738] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.738] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.738] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.738] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.738] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.738] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.738] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.739] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.739] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.739] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.739] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.739] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.739] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.739] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.739] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.739] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.739] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.739] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.739] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.739] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.739] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.740] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.740] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.740] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.740] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.740] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.740] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.740] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.740] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.740] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.740] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.740] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.740] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.741] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.741] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.741] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.741] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.741] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.741] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.741] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.741] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.741] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.741] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.741] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.741] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.741] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.741] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.741] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.742] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.742] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.742] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.742] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.742] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.742] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.742] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.742] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.742] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.742] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.742] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.742] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.742] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.742] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.743] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.743] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.743] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.743] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.743] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.743] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.743] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.743] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.744] GetProcessHeap () returned 0x630000 [0057.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655670 | out: hHeap=0x630000) returned 1 [0057.744] GetProcessHeap () returned 0x630000 [0057.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0057.744] CloseHandle (hObject=0x230) returned 1 [0057.744] GetProcessHeap () returned 0x630000 [0057.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0057.744] FindNextFileW (in: hFindFile=0x648850, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0057.744] FindClose (in: hFindFile=0x648850 | out: hFindFile=0x648850) returned 1 [0057.744] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\Public\\Pictures\\" | out: lpString1="C:\\Users\\Public\\Pictures\\") returned="C:\\Users\\Public\\Pictures\\" [0057.744] GetProcessHeap () returned 0x630000 [0057.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x648a90 | out: hHeap=0x630000) returned 1 [0057.745] GetProcessHeap () returned 0x630000 [0057.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0057.745] lstrlenW (lpString="C:\\Users\\Public\\Pictures\\") returned 25 [0057.745] lstrcatW (in: lpString1="C:\\Users\\Public\\Pictures\\", lpString2="*" | out: lpString1="C:\\Users\\Public\\Pictures\\*") returned="C:\\Users\\Public\\Pictures\\*" [0057.745] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6487d0 [0057.745] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0057.745] FindNextFileW (in: hFindFile=0x6487d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.745] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0057.745] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0057.745] FindNextFileW (in: hFindFile=0x6487d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0057.745] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0057.745] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0057.745] lstrcatW (in: lpString1="C:\\Users\\Public\\Pictures\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\Public\\Pictures\\desktop.ini") returned="C:\\Users\\Public\\Pictures\\desktop.ini" [0057.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0057.745] GetProcessHeap () returned 0x630000 [0057.745] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0057.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0057.745] lstrlenA (lpString="desktop.ini") returned 11 [0057.745] lstrlenA (lpString=".happythreechoose") returned 17 [0057.745] lstrcmpiW (lpString1="desktop.ini", lpString2="Decryption INFO.html") returned 1 [0057.745] lstrcmpiW (lpString1="desktop.ini", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0057.746] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0057.746] lstrcmpiW (lpString1="desktop.ini", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0057.746] GetProcessHeap () returned 0x630000 [0057.746] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x652000 [0057.746] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\desktop.ini" (normalized: "c:\\users\\public\\pictures\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0057.746] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=380) returned 1 [0057.746] GetProcessHeap () returned 0x630000 [0057.746] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6558c8 [0057.746] GetProcessHeap () returned 0x630000 [0057.746] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0057.746] lstrlenW (lpString="C:\\Users\\Public\\Pictures\\desktop.ini") returned 36 [0057.746] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0057.746] GetProcessHeap () returned 0x630000 [0057.746] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0057.746] GetProcessHeap () returned 0x630000 [0057.746] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x384) returned 0x65f6d8 [0057.746] lstrlenA (lpString="rsa_encrypt") returned 11 [0057.746] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0057.747] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0057.747] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0057.747] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0057.747] GetProcessHeap () returned 0x630000 [0057.747] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0057.747] lstrlenA (lpString="010001") returned 6 [0057.747] GetProcessHeap () returned 0x630000 [0057.747] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0057.747] GetProcessHeap () returned 0x630000 [0057.747] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0057.747] GetProcessHeap () returned 0x630000 [0057.747] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e8e0 [0057.747] GetProcessHeap () returned 0x630000 [0057.747] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0057.747] GetProcessHeap () returned 0x630000 [0057.747] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e3d0 [0057.747] GetProcessHeap () returned 0x630000 [0057.747] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657558 [0057.747] GetProcessHeap () returned 0x630000 [0057.747] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2f8 [0057.747] GetProcessHeap () returned 0x630000 [0057.747] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0057.747] GetProcessHeap () returned 0x630000 [0057.747] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.747] GetProcessHeap () returned 0x630000 [0057.748] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0057.748] GetProcessHeap () returned 0x630000 [0057.748] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0057.748] GetProcessHeap () returned 0x630000 [0057.748] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657670 [0057.748] GetProcessHeap () returned 0x630000 [0057.748] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0057.748] GetProcessHeap () returned 0x630000 [0057.748] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0057.748] GetProcessHeap () returned 0x630000 [0057.748] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e970 [0057.748] GetProcessHeap () returned 0x630000 [0057.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0057.748] GetProcessHeap () returned 0x630000 [0057.748] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0057.748] GetProcessHeap () returned 0x630000 [0057.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0057.748] GetProcessHeap () returned 0x630000 [0057.748] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.748] GetProcessHeap () returned 0x630000 [0057.748] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65aa98 [0057.748] GetProcessHeap () returned 0x630000 [0057.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0057.748] GetProcessHeap () returned 0x630000 [0057.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.748] GetProcessHeap () returned 0x630000 [0057.748] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0057.748] GetProcessHeap () returned 0x630000 [0057.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0057.748] GetProcessHeap () returned 0x630000 [0057.748] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e2b0 [0057.748] GetProcessHeap () returned 0x630000 [0057.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65aa98 | out: hHeap=0x630000) returned 1 [0057.748] GetProcessHeap () returned 0x630000 [0057.748] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0057.748] GetProcessHeap () returned 0x630000 [0057.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e2b0 | out: hHeap=0x630000) returned 1 [0057.748] GetProcessHeap () returned 0x630000 [0057.749] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.749] GetProcessHeap () returned 0x630000 [0057.749] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.749] GetProcessHeap () returned 0x630000 [0057.749] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0057.749] GetProcessHeap () returned 0x630000 [0057.749] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0057.749] GetProcessHeap () returned 0x630000 [0057.749] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0057.749] GetProcessHeap () returned 0x630000 [0057.749] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0057.749] GetProcessHeap () returned 0x630000 [0057.749] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.749] GetProcessHeap () returned 0x630000 [0057.749] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.749] GetProcessHeap () returned 0x630000 [0057.749] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0057.749] GetProcessHeap () returned 0x630000 [0057.749] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0057.749] GetProcessHeap () returned 0x630000 [0057.749] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0057.749] GetProcessHeap () returned 0x630000 [0057.749] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0057.749] GetProcessHeap () returned 0x630000 [0057.749] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0057.749] GetProcessHeap () returned 0x630000 [0057.749] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0057.749] GetProcessHeap () returned 0x630000 [0057.749] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0057.749] GetProcessHeap () returned 0x630000 [0057.749] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0057.749] GetProcessHeap () returned 0x630000 [0057.749] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.749] GetProcessHeap () returned 0x630000 [0057.749] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.749] GetProcessHeap () returned 0x630000 [0057.750] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0057.750] GetProcessHeap () returned 0x630000 [0057.750] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0057.750] GetProcessHeap () returned 0x630000 [0057.750] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.750] GetProcessHeap () returned 0x630000 [0057.750] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.750] GetProcessHeap () returned 0x630000 [0057.750] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0057.750] GetProcessHeap () returned 0x630000 [0057.750] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0057.750] GetProcessHeap () returned 0x630000 [0057.750] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0057.750] GetProcessHeap () returned 0x630000 [0057.750] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0057.750] GetProcessHeap () returned 0x630000 [0057.752] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.752] GetProcessHeap () returned 0x630000 [0057.752] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.752] GetProcessHeap () returned 0x630000 [0057.752] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0057.752] GetProcessHeap () returned 0x630000 [0057.752] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0057.752] GetProcessHeap () returned 0x630000 [0057.752] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.752] GetProcessHeap () returned 0x630000 [0057.752] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.752] GetProcessHeap () returned 0x630000 [0057.752] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0057.752] GetProcessHeap () returned 0x630000 [0057.752] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0057.752] GetProcessHeap () returned 0x630000 [0057.752] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.752] GetProcessHeap () returned 0x630000 [0057.752] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.752] GetProcessHeap () returned 0x630000 [0057.752] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0057.752] GetProcessHeap () returned 0x630000 [0057.752] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0057.752] GetProcessHeap () returned 0x630000 [0057.752] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.752] GetProcessHeap () returned 0x630000 [0057.752] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.752] GetProcessHeap () returned 0x630000 [0057.752] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0057.752] GetProcessHeap () returned 0x630000 [0057.752] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0057.753] GetProcessHeap () returned 0x630000 [0057.753] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.753] GetProcessHeap () returned 0x630000 [0057.753] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.753] GetProcessHeap () returned 0x630000 [0057.753] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.753] GetProcessHeap () returned 0x630000 [0057.753] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.753] GetProcessHeap () returned 0x630000 [0057.753] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0057.753] GetProcessHeap () returned 0x630000 [0057.753] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0057.753] GetProcessHeap () returned 0x630000 [0057.753] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0057.753] GetProcessHeap () returned 0x630000 [0057.753] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0057.753] GetProcessHeap () returned 0x630000 [0057.753] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.753] GetProcessHeap () returned 0x630000 [0057.753] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.753] GetProcessHeap () returned 0x630000 [0057.753] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0057.753] GetProcessHeap () returned 0x630000 [0057.753] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0057.753] GetProcessHeap () returned 0x630000 [0057.753] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.753] GetProcessHeap () returned 0x630000 [0057.753] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.753] GetProcessHeap () returned 0x630000 [0057.753] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.753] GetProcessHeap () returned 0x630000 [0057.753] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.753] GetProcessHeap () returned 0x630000 [0057.753] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0057.753] GetProcessHeap () returned 0x630000 [0057.753] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0057.754] GetProcessHeap () returned 0x630000 [0057.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.754] GetProcessHeap () returned 0x630000 [0057.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.754] GetProcessHeap () returned 0x630000 [0057.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.754] GetProcessHeap () returned 0x630000 [0057.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.754] GetProcessHeap () returned 0x630000 [0057.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.754] GetProcessHeap () returned 0x630000 [0057.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.754] GetProcessHeap () returned 0x630000 [0057.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.754] GetProcessHeap () returned 0x630000 [0057.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.754] GetProcessHeap () returned 0x630000 [0057.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0057.754] GetProcessHeap () returned 0x630000 [0057.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0057.754] GetProcessHeap () returned 0x630000 [0057.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.754] GetProcessHeap () returned 0x630000 [0057.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.754] GetProcessHeap () returned 0x630000 [0057.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0057.754] GetProcessHeap () returned 0x630000 [0057.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0057.754] GetProcessHeap () returned 0x630000 [0057.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.754] GetProcessHeap () returned 0x630000 [0057.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.754] GetProcessHeap () returned 0x630000 [0057.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0057.754] GetProcessHeap () returned 0x630000 [0057.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0057.755] GetProcessHeap () returned 0x630000 [0057.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0057.755] GetProcessHeap () returned 0x630000 [0057.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0057.755] GetProcessHeap () returned 0x630000 [0057.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.755] GetProcessHeap () returned 0x630000 [0057.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.755] GetProcessHeap () returned 0x630000 [0057.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0057.755] GetProcessHeap () returned 0x630000 [0057.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0057.755] GetProcessHeap () returned 0x630000 [0057.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0057.755] GetProcessHeap () returned 0x630000 [0057.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0057.755] GetProcessHeap () returned 0x630000 [0057.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0057.755] GetProcessHeap () returned 0x630000 [0057.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0057.755] GetProcessHeap () returned 0x630000 [0057.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0057.755] GetProcessHeap () returned 0x630000 [0057.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0057.755] GetProcessHeap () returned 0x630000 [0057.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0057.755] GetProcessHeap () returned 0x630000 [0057.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0057.755] GetProcessHeap () returned 0x630000 [0057.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0057.755] WriteFile (in: hFile=0x230, lpBuffer=0x65f6d8*, nNumberOfBytesToWrite=0x384, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65f6d8*, lpNumberOfBytesWritten=0x243d864*=0x384, lpOverlapped=0x0) returned 1 [0057.760] GetProcessHeap () returned 0x630000 [0057.760] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65f6d8, Size=0x30) returned 0x65f6d8 [0057.761] GetProcessHeap () returned 0x630000 [0057.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0057.761] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0057.761] GetProcessHeap () returned 0x630000 [0057.761] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x180) returned 0x63f408 [0057.761] ReadFile (in: hFile=0x230, lpBuffer=0x63f408, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x63f408*, lpNumberOfBytesRead=0x243d7e8*=0x180, lpOverlapped=0x0) returned 1 [0057.761] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0057.761] WriteFile (in: hFile=0x230, lpBuffer=0x63f408*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x63f408*, lpNumberOfBytesWritten=0x243d7e4*=0x180, lpOverlapped=0x0) returned 1 [0057.762] GetProcessHeap () returned 0x630000 [0057.762] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63f408 | out: hHeap=0x630000) returned 1 [0057.762] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0057.762] WriteFile (in: hFile=0x230, lpBuffer=0x65f6d8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65f6d8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0057.763] CloseHandle (hObject=0x230) returned 1 [0057.764] GetProcessHeap () returned 0x630000 [0057.764] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x652000 | out: hHeap=0x630000) returned 1 [0057.764] GetProcessHeap () returned 0x630000 [0057.764] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6558c8 | out: hHeap=0x630000) returned 1 [0057.764] GetProcessHeap () returned 0x630000 [0057.764] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0057.765] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\Public\\Pictures\\desktop.ini" | out: lpString1="C:\\Users\\Public\\Pictures\\desktop.ini") returned="C:\\Users\\Public\\Pictures\\desktop.ini" [0057.765] lstrcatW (in: lpString1="C:\\Users\\Public\\Pictures\\desktop.ini", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\Public\\Pictures\\desktop.ini.happythreechoose") returned="C:\\Users\\Public\\Pictures\\desktop.ini.happythreechoose" [0057.765] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Pictures\\desktop.ini" (normalized: "c:\\users\\public\\pictures\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Pictures\\desktop.ini.happythreechoose" (normalized: "c:\\users\\public\\pictures\\desktop.ini.happythreechoose"), dwFlags=0x1) returned 1 [0057.765] PathRemoveFileSpecW (in: pszPath="C:\\Users\\Public\\Pictures\\desktop.ini" | out: pszPath="C:\\Users\\Public\\Pictures") returned 1 [0057.765] PathAddBackslashW (in: pszPath="C:\\Users\\Public\\Pictures" | out: pszPath="C:\\Users\\Public\\Pictures\\") returned="" [0057.765] lstrcatW (in: lpString1="C:\\Users\\Public\\Pictures\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\Public\\Pictures\\Decryption INFO.html") returned="C:\\Users\\Public\\Pictures\\Decryption INFO.html" [0057.765] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Decryption INFO.html" (normalized: "c:\\users\\public\\pictures\\decryption info.html")) returned 0xffffffff [0057.765] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Decryption INFO.html" (normalized: "c:\\users\\public\\pictures\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0057.766] GetProcessHeap () returned 0x630000 [0057.766] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6555f8 [0057.766] GetProcessHeap () returned 0x630000 [0057.766] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0057.773] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.774] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.774] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.774] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.774] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.774] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.774] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.774] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.774] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.774] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.774] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.774] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.774] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.774] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.775] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.775] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.775] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.775] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.775] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.775] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.775] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.775] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.775] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.775] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.775] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.775] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.775] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.776] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.776] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.776] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.776] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.776] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.776] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.776] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.776] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.776] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.776] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.777] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.777] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.777] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.777] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.777] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.777] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.777] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.777] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.777] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.777] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.778] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.778] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.778] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.778] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.778] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.778] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.778] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.778] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.778] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.778] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.778] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.778] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.778] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.778] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.778] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.779] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.779] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.779] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.779] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.779] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.779] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.779] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.779] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.779] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.779] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.779] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.779] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.779] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.779] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.780] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.780] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.780] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.780] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.780] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.780] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.780] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.780] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.780] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.780] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.780] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.780] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.780] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.780] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.781] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.781] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.781] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.781] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.781] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.781] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.781] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.781] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.781] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.781] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.781] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.781] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.783] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.783] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.783] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.783] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.783] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.783] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.783] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.783] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.783] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.783] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.783] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.783] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.783] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.783] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.784] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.784] GetProcessHeap () returned 0x630000 [0057.784] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6555f8 | out: hHeap=0x630000) returned 1 [0057.784] GetProcessHeap () returned 0x630000 [0057.784] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0057.784] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0057.784] GetProcessHeap () returned 0x630000 [0057.784] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655508 [0057.784] GetProcessHeap () returned 0x630000 [0057.784] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0057.791] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.791] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.791] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.791] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.791] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.791] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.791] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.791] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.791] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.793] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.793] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.793] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.793] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.793] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.793] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.793] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.793] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.793] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.793] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.793] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.793] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.793] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.793] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.794] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.794] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.794] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.794] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.794] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.794] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.794] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.794] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.794] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.794] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.794] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.794] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.794] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.794] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.795] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.795] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.795] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.795] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.795] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.795] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.795] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.795] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.795] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.795] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.795] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.795] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.795] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.795] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.796] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.796] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.796] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.796] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.796] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.796] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.796] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.796] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.796] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.796] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.796] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.796] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.796] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.797] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.797] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.797] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.798] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.798] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.798] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.799] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.799] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.799] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.799] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.799] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.799] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.799] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.799] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.799] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.799] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.799] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.799] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.799] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.799] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.800] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.800] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.800] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.800] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.800] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.800] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.800] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.800] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.800] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.800] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.800] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.800] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.800] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.800] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.801] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.801] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.801] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.801] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.801] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.801] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.802] GetProcessHeap () returned 0x630000 [0057.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655508 | out: hHeap=0x630000) returned 1 [0057.802] GetProcessHeap () returned 0x630000 [0057.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0057.802] CloseHandle (hObject=0x230) returned 1 [0057.802] GetProcessHeap () returned 0x630000 [0057.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0057.802] FindNextFileW (in: hFindFile=0x6487d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0057.802] FindClose (in: hFindFile=0x6487d0 | out: hFindFile=0x6487d0) returned 1 [0057.802] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\Public\\Music\\" | out: lpString1="C:\\Users\\Public\\Music\\") returned="C:\\Users\\Public\\Music\\" [0057.802] GetProcessHeap () returned 0x630000 [0057.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x652518 | out: hHeap=0x630000) returned 1 [0057.802] GetProcessHeap () returned 0x630000 [0057.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0057.802] lstrlenW (lpString="C:\\Users\\Public\\Music\\") returned 22 [0057.803] lstrcatW (in: lpString1="C:\\Users\\Public\\Music\\", lpString2="*" | out: lpString1="C:\\Users\\Public\\Music\\*") returned="C:\\Users\\Public\\Music\\*" [0057.803] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648ad0 [0057.803] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0057.803] FindNextFileW (in: hFindFile=0x648ad0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.803] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0057.803] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0057.803] FindNextFileW (in: hFindFile=0x648ad0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0057.803] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0057.803] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0057.803] lstrcatW (in: lpString1="C:\\Users\\Public\\Music\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\Public\\Music\\desktop.ini") returned="C:\\Users\\Public\\Music\\desktop.ini" [0057.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0057.803] GetProcessHeap () returned 0x630000 [0057.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0057.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0057.803] lstrlenA (lpString="desktop.ini") returned 11 [0057.803] lstrlenA (lpString=".happythreechoose") returned 17 [0057.803] lstrcmpiW (lpString1="desktop.ini", lpString2="Decryption INFO.html") returned 1 [0057.803] lstrcmpiW (lpString1="desktop.ini", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0057.803] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0057.803] lstrcmpiW (lpString1="desktop.ini", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0057.803] GetProcessHeap () returned 0x630000 [0057.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0057.803] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\desktop.ini" (normalized: "c:\\users\\public\\music\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0057.804] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=380) returned 1 [0057.804] GetProcessHeap () returned 0x630000 [0057.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655508 [0057.804] GetProcessHeap () returned 0x630000 [0057.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0057.804] lstrlenW (lpString="C:\\Users\\Public\\Music\\desktop.ini") returned 33 [0057.804] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0057.804] GetProcessHeap () returned 0x630000 [0057.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0057.804] GetProcessHeap () returned 0x630000 [0057.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x384) returned 0x65f710 [0057.804] lstrlenA (lpString="rsa_encrypt") returned 11 [0057.804] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0057.805] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0057.805] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0057.805] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0057.805] GetProcessHeap () returned 0x630000 [0057.805] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0057.805] lstrlenA (lpString="010001") returned 6 [0057.805] GetProcessHeap () returned 0x630000 [0057.805] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a348 [0057.805] GetProcessHeap () returned 0x630000 [0057.805] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0057.805] GetProcessHeap () returned 0x630000 [0057.805] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e100 [0057.805] GetProcessHeap () returned 0x630000 [0057.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0057.805] GetProcessHeap () returned 0x630000 [0057.805] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dfe0 [0057.805] GetProcessHeap () returned 0x630000 [0057.805] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656db0 [0057.805] GetProcessHeap () returned 0x630000 [0057.805] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2f8 [0057.805] GetProcessHeap () returned 0x630000 [0057.805] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0057.805] GetProcessHeap () returned 0x630000 [0057.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.806] GetProcessHeap () returned 0x630000 [0057.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0057.806] GetProcessHeap () returned 0x630000 [0057.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0057.806] GetProcessHeap () returned 0x630000 [0057.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657558 [0057.806] GetProcessHeap () returned 0x630000 [0057.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0057.806] GetProcessHeap () returned 0x630000 [0057.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0057.806] GetProcessHeap () returned 0x630000 [0057.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e7c0 [0057.806] GetProcessHeap () returned 0x630000 [0057.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0057.806] GetProcessHeap () returned 0x630000 [0057.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0057.806] GetProcessHeap () returned 0x630000 [0057.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e7c0 | out: hHeap=0x630000) returned 1 [0057.806] GetProcessHeap () returned 0x630000 [0057.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0057.806] GetProcessHeap () returned 0x630000 [0057.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65aab0 [0057.806] GetProcessHeap () returned 0x630000 [0057.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0057.806] GetProcessHeap () returned 0x630000 [0057.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0057.806] GetProcessHeap () returned 0x630000 [0057.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.806] GetProcessHeap () returned 0x630000 [0057.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.806] GetProcessHeap () returned 0x630000 [0057.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65eb20 [0057.806] GetProcessHeap () returned 0x630000 [0057.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65aab0 | out: hHeap=0x630000) returned 1 [0057.806] GetProcessHeap () returned 0x630000 [0057.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0057.806] GetProcessHeap () returned 0x630000 [0057.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0057.807] GetProcessHeap () returned 0x630000 [0057.807] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.807] GetProcessHeap () returned 0x630000 [0057.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.807] GetProcessHeap () returned 0x630000 [0057.807] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.807] GetProcessHeap () returned 0x630000 [0057.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.807] GetProcessHeap () returned 0x630000 [0057.807] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0057.807] GetProcessHeap () returned 0x630000 [0057.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0057.807] GetProcessHeap () returned 0x630000 [0057.807] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.807] GetProcessHeap () returned 0x630000 [0057.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.807] GetProcessHeap () returned 0x630000 [0057.807] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0057.807] GetProcessHeap () returned 0x630000 [0057.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0057.807] GetProcessHeap () returned 0x630000 [0057.807] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.807] GetProcessHeap () returned 0x630000 [0057.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.807] GetProcessHeap () returned 0x630000 [0057.807] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.807] GetProcessHeap () returned 0x630000 [0057.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.807] GetProcessHeap () returned 0x630000 [0057.807] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0057.807] GetProcessHeap () returned 0x630000 [0057.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0057.807] GetProcessHeap () returned 0x630000 [0057.807] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.807] GetProcessHeap () returned 0x630000 [0057.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.808] GetProcessHeap () returned 0x630000 [0057.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.808] GetProcessHeap () returned 0x630000 [0057.808] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.808] GetProcessHeap () returned 0x630000 [0057.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.808] GetProcessHeap () returned 0x630000 [0057.808] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.808] GetProcessHeap () returned 0x630000 [0057.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.808] GetProcessHeap () returned 0x630000 [0057.808] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.808] GetProcessHeap () returned 0x630000 [0057.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0057.808] GetProcessHeap () returned 0x630000 [0057.808] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0057.808] GetProcessHeap () returned 0x630000 [0057.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0057.808] GetProcessHeap () returned 0x630000 [0057.808] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0057.808] GetProcessHeap () returned 0x630000 [0057.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.808] GetProcessHeap () returned 0x630000 [0057.808] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.808] GetProcessHeap () returned 0x630000 [0057.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.808] GetProcessHeap () returned 0x630000 [0057.808] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.808] GetProcessHeap () returned 0x630000 [0057.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0057.808] GetProcessHeap () returned 0x630000 [0057.808] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0057.808] GetProcessHeap () returned 0x630000 [0057.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.808] GetProcessHeap () returned 0x630000 [0057.808] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.808] GetProcessHeap () returned 0x630000 [0057.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0057.809] GetProcessHeap () returned 0x630000 [0057.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0057.809] GetProcessHeap () returned 0x630000 [0057.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.809] GetProcessHeap () returned 0x630000 [0057.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.809] GetProcessHeap () returned 0x630000 [0057.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0057.809] GetProcessHeap () returned 0x630000 [0057.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0057.809] GetProcessHeap () returned 0x630000 [0057.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0057.809] GetProcessHeap () returned 0x630000 [0057.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0057.809] GetProcessHeap () returned 0x630000 [0057.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0057.809] GetProcessHeap () returned 0x630000 [0057.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0057.809] GetProcessHeap () returned 0x630000 [0057.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.809] GetProcessHeap () returned 0x630000 [0057.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.809] GetProcessHeap () returned 0x630000 [0057.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.809] GetProcessHeap () returned 0x630000 [0057.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.809] GetProcessHeap () returned 0x630000 [0057.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0057.809] GetProcessHeap () returned 0x630000 [0057.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0057.809] GetProcessHeap () returned 0x630000 [0057.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.809] GetProcessHeap () returned 0x630000 [0057.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.809] GetProcessHeap () returned 0x630000 [0057.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0057.810] GetProcessHeap () returned 0x630000 [0057.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0057.810] GetProcessHeap () returned 0x630000 [0057.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.810] GetProcessHeap () returned 0x630000 [0057.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.810] GetProcessHeap () returned 0x630000 [0057.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.810] GetProcessHeap () returned 0x630000 [0057.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.810] GetProcessHeap () returned 0x630000 [0057.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0057.810] GetProcessHeap () returned 0x630000 [0057.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0057.810] GetProcessHeap () returned 0x630000 [0057.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0057.810] GetProcessHeap () returned 0x630000 [0057.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0057.810] GetProcessHeap () returned 0x630000 [0057.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0057.810] GetProcessHeap () returned 0x630000 [0057.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0057.810] GetProcessHeap () returned 0x630000 [0057.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.810] GetProcessHeap () returned 0x630000 [0057.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.810] GetProcessHeap () returned 0x630000 [0057.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.810] GetProcessHeap () returned 0x630000 [0057.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.810] GetProcessHeap () returned 0x630000 [0057.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.810] GetProcessHeap () returned 0x630000 [0057.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.810] GetProcessHeap () returned 0x630000 [0057.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.810] GetProcessHeap () returned 0x630000 [0057.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.810] GetProcessHeap () returned 0x630000 [0057.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.811] GetProcessHeap () returned 0x630000 [0057.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.811] GetProcessHeap () returned 0x630000 [0057.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0057.811] GetProcessHeap () returned 0x630000 [0057.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0057.811] GetProcessHeap () returned 0x630000 [0057.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.811] GetProcessHeap () returned 0x630000 [0057.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.811] GetProcessHeap () returned 0x630000 [0057.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.811] GetProcessHeap () returned 0x630000 [0057.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.811] GetProcessHeap () returned 0x630000 [0057.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0057.811] GetProcessHeap () returned 0x630000 [0057.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0057.811] GetProcessHeap () returned 0x630000 [0057.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0057.811] GetProcessHeap () returned 0x630000 [0057.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0057.811] GetProcessHeap () returned 0x630000 [0057.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0057.811] GetProcessHeap () returned 0x630000 [0057.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0057.811] GetProcessHeap () returned 0x630000 [0057.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0057.811] GetProcessHeap () returned 0x630000 [0057.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0057.811] GetProcessHeap () returned 0x630000 [0057.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0057.811] GetProcessHeap () returned 0x630000 [0057.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0057.811] GetProcessHeap () returned 0x630000 [0057.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0057.812] WriteFile (in: hFile=0x230, lpBuffer=0x65f710*, nNumberOfBytesToWrite=0x384, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65f710*, lpNumberOfBytesWritten=0x243d864*=0x384, lpOverlapped=0x0) returned 1 [0057.817] GetProcessHeap () returned 0x630000 [0057.817] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65f710, Size=0x30) returned 0x65f710 [0057.817] GetProcessHeap () returned 0x630000 [0057.817] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0057.817] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0057.817] GetProcessHeap () returned 0x630000 [0057.818] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x180) returned 0x63f408 [0057.818] ReadFile (in: hFile=0x230, lpBuffer=0x63f408, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x63f408*, lpNumberOfBytesRead=0x243d7e8*=0x180, lpOverlapped=0x0) returned 1 [0057.818] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0057.818] WriteFile (in: hFile=0x230, lpBuffer=0x63f408*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x63f408*, lpNumberOfBytesWritten=0x243d7e4*=0x180, lpOverlapped=0x0) returned 1 [0057.819] GetProcessHeap () returned 0x630000 [0057.819] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63f408 | out: hHeap=0x630000) returned 1 [0057.819] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0057.819] WriteFile (in: hFile=0x230, lpBuffer=0x65f710*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65f710*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0057.820] CloseHandle (hObject=0x230) returned 1 [0057.822] GetProcessHeap () returned 0x630000 [0057.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0057.822] GetProcessHeap () returned 0x630000 [0057.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655508 | out: hHeap=0x630000) returned 1 [0057.822] GetProcessHeap () returned 0x630000 [0057.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0057.822] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\Public\\Music\\desktop.ini" | out: lpString1="C:\\Users\\Public\\Music\\desktop.ini") returned="C:\\Users\\Public\\Music\\desktop.ini" [0057.822] lstrcatW (in: lpString1="C:\\Users\\Public\\Music\\desktop.ini", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\Public\\Music\\desktop.ini.happythreechoose") returned="C:\\Users\\Public\\Music\\desktop.ini.happythreechoose" [0057.822] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Music\\desktop.ini" (normalized: "c:\\users\\public\\music\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Music\\desktop.ini.happythreechoose" (normalized: "c:\\users\\public\\music\\desktop.ini.happythreechoose"), dwFlags=0x1) returned 1 [0057.823] PathRemoveFileSpecW (in: pszPath="C:\\Users\\Public\\Music\\desktop.ini" | out: pszPath="C:\\Users\\Public\\Music") returned 1 [0057.823] PathAddBackslashW (in: pszPath="C:\\Users\\Public\\Music" | out: pszPath="C:\\Users\\Public\\Music\\") returned="" [0057.823] lstrcatW (in: lpString1="C:\\Users\\Public\\Music\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\Public\\Music\\Decryption INFO.html") returned="C:\\Users\\Public\\Music\\Decryption INFO.html" [0057.823] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Music\\Decryption INFO.html" (normalized: "c:\\users\\public\\music\\decryption info.html")) returned 0xffffffff [0057.823] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\Decryption INFO.html" (normalized: "c:\\users\\public\\music\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0057.823] GetProcessHeap () returned 0x630000 [0057.823] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655940 [0057.823] GetProcessHeap () returned 0x630000 [0057.823] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0057.873] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.874] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.874] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.875] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.875] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.875] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.875] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.875] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.875] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.875] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.875] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.875] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.875] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.876] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.876] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.876] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.876] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.876] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.876] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.876] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.876] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.876] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.876] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.876] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.876] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.876] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.881] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.881] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.881] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.881] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.881] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.881] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.881] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.881] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.881] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.881] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.881] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.881] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.881] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.881] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.882] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.882] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.882] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.882] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.882] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.882] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.882] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.882] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.882] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.882] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.882] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.882] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.882] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.882] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.883] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.883] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.883] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.883] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.883] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.883] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.883] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.883] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.883] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.883] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.883] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.883] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.883] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.883] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.884] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.884] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.884] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.884] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.884] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.884] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.884] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.884] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.884] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.884] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.884] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.884] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.884] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.884] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.884] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.885] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.885] GetProcessHeap () returned 0x630000 [0057.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655940 | out: hHeap=0x630000) returned 1 [0057.885] GetProcessHeap () returned 0x630000 [0057.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0057.885] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0057.885] GetProcessHeap () returned 0x630000 [0057.885] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655508 [0057.885] GetProcessHeap () returned 0x630000 [0057.885] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0057.892] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.892] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.892] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.892] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.892] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.893] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.893] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.893] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.893] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.893] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.893] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.893] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.893] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.893] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.893] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.893] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.893] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.893] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.893] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.893] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.894] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.894] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.894] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.894] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.894] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.894] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.894] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.894] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.894] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.894] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.894] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.894] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.894] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.894] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.895] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.895] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.895] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.895] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.895] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.895] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.895] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.895] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.895] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.895] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.895] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.895] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.895] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.895] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.895] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.896] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.896] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.896] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.896] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.896] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.896] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.896] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.896] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.896] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.896] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.896] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.896] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.896] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.897] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.897] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.897] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.897] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.897] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.897] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.897] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.897] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.897] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.897] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.897] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.897] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.897] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.897] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.897] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.898] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.898] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.898] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.898] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.898] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.898] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.898] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.898] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.898] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.898] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.898] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.898] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.898] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.899] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.899] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.899] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.899] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.899] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.899] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.899] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.899] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.899] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.899] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.899] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.899] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.899] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.899] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.900] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.900] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.900] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.900] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.900] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.900] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.900] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.900] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.900] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.900] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.900] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.900] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.900] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.900] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.901] GetProcessHeap () returned 0x630000 [0057.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655508 | out: hHeap=0x630000) returned 1 [0057.901] GetProcessHeap () returned 0x630000 [0057.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0057.901] CloseHandle (hObject=0x230) returned 1 [0057.901] GetProcessHeap () returned 0x630000 [0057.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0057.901] FindNextFileW (in: hFindFile=0x648ad0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0057.902] FindClose (in: hFindFile=0x648ad0 | out: hFindFile=0x648ad0) returned 1 [0057.902] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\Public\\Libraries\\" | out: lpString1="C:\\Users\\Public\\Libraries\\") returned="C:\\Users\\Public\\Libraries\\" [0057.902] GetProcessHeap () returned 0x630000 [0057.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x648810 | out: hHeap=0x630000) returned 1 [0057.902] GetProcessHeap () returned 0x630000 [0057.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0057.902] lstrlenW (lpString="C:\\Users\\Public\\Libraries\\") returned 26 [0057.902] lstrcatW (in: lpString1="C:\\Users\\Public\\Libraries\\", lpString2="*" | out: lpString1="C:\\Users\\Public\\Libraries\\*") returned="C:\\Users\\Public\\Libraries\\*" [0057.902] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Libraries\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb207547d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb207547d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648bd0 [0057.902] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0057.902] FindNextFileW (in: hFindFile=0x648bd0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb207547d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb207547d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.902] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0057.902] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0057.902] FindNextFileW (in: hFindFile=0x648bd0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0057.902] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0057.902] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0057.902] lstrcatW (in: lpString1="C:\\Users\\Public\\Libraries\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\Public\\Libraries\\desktop.ini") returned="C:\\Users\\Public\\Libraries\\desktop.ini" [0057.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0057.902] GetProcessHeap () returned 0x630000 [0057.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0057.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0057.903] lstrlenA (lpString="desktop.ini") returned 11 [0057.903] lstrlenA (lpString=".happythreechoose") returned 17 [0057.903] lstrcmpiW (lpString1="desktop.ini", lpString2="Decryption INFO.html") returned 1 [0057.903] lstrcmpiW (lpString1="desktop.ini", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0057.903] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0057.903] lstrcmpiW (lpString1="desktop.ini", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0057.903] GetProcessHeap () returned 0x630000 [0057.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0057.903] CreateFileW (lpFileName="C:\\Users\\Public\\Libraries\\desktop.ini" (normalized: "c:\\users\\public\\libraries\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0057.903] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=175) returned 1 [0057.903] GetProcessHeap () returned 0x630000 [0057.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655850 [0057.903] GetProcessHeap () returned 0x630000 [0057.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0057.903] lstrlenW (lpString="C:\\Users\\Public\\Libraries\\desktop.ini") returned 37 [0057.903] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0057.903] GetProcessHeap () returned 0x630000 [0057.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0057.903] GetProcessHeap () returned 0x630000 [0057.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x381) returned 0x65f748 [0057.903] lstrlenA (lpString="rsa_encrypt") returned 11 [0057.904] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0057.904] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0057.904] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0057.904] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0057.904] GetProcessHeap () returned 0x630000 [0057.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0057.904] lstrlenA (lpString="010001") returned 6 [0057.904] GetProcessHeap () returned 0x630000 [0057.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0057.904] GetProcessHeap () returned 0x630000 [0057.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0057.904] GetProcessHeap () returned 0x630000 [0057.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e8e0 [0057.904] GetProcessHeap () returned 0x630000 [0057.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0057.904] GetProcessHeap () returned 0x630000 [0057.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e610 [0057.905] GetProcessHeap () returned 0x630000 [0057.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656fe0 [0057.905] GetProcessHeap () returned 0x630000 [0057.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2a8 [0057.905] GetProcessHeap () returned 0x630000 [0057.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0057.905] GetProcessHeap () returned 0x630000 [0057.905] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0057.905] GetProcessHeap () returned 0x630000 [0057.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0057.905] GetProcessHeap () returned 0x630000 [0057.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0057.905] GetProcessHeap () returned 0x630000 [0057.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657670 [0057.905] GetProcessHeap () returned 0x630000 [0057.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.905] GetProcessHeap () returned 0x630000 [0057.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0057.905] GetProcessHeap () returned 0x630000 [0057.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e730 [0057.905] GetProcessHeap () returned 0x630000 [0057.905] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0057.905] GetProcessHeap () returned 0x630000 [0057.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0057.905] GetProcessHeap () returned 0x630000 [0057.905] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0057.905] GetProcessHeap () returned 0x630000 [0057.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.905] GetProcessHeap () returned 0x630000 [0057.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65a888 [0057.905] GetProcessHeap () returned 0x630000 [0057.905] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.905] GetProcessHeap () returned 0x630000 [0057.905] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.905] GetProcessHeap () returned 0x630000 [0057.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0057.905] GetProcessHeap () returned 0x630000 [0057.905] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0057.905] GetProcessHeap () returned 0x630000 [0057.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ea00 [0057.905] GetProcessHeap () returned 0x630000 [0057.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a888 | out: hHeap=0x630000) returned 1 [0057.906] GetProcessHeap () returned 0x630000 [0057.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0057.906] GetProcessHeap () returned 0x630000 [0057.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0057.906] GetProcessHeap () returned 0x630000 [0057.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.906] GetProcessHeap () returned 0x630000 [0057.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.906] GetProcessHeap () returned 0x630000 [0057.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0057.906] GetProcessHeap () returned 0x630000 [0057.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0057.906] GetProcessHeap () returned 0x630000 [0057.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.906] GetProcessHeap () returned 0x630000 [0057.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.906] GetProcessHeap () returned 0x630000 [0057.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0057.906] GetProcessHeap () returned 0x630000 [0057.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0057.906] GetProcessHeap () returned 0x630000 [0057.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.906] GetProcessHeap () returned 0x630000 [0057.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.906] GetProcessHeap () returned 0x630000 [0057.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0057.908] GetProcessHeap () returned 0x630000 [0057.908] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0057.908] GetProcessHeap () returned 0x630000 [0057.908] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0057.908] GetProcessHeap () returned 0x630000 [0057.908] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0057.908] GetProcessHeap () returned 0x630000 [0057.908] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0057.908] GetProcessHeap () returned 0x630000 [0057.908] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0057.908] GetProcessHeap () returned 0x630000 [0057.908] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0057.908] GetProcessHeap () returned 0x630000 [0057.908] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0057.908] GetProcessHeap () returned 0x630000 [0057.908] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0057.908] GetProcessHeap () returned 0x630000 [0057.908] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0057.908] GetProcessHeap () returned 0x630000 [0057.908] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0057.908] GetProcessHeap () returned 0x630000 [0057.908] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0057.909] GetProcessHeap () returned 0x630000 [0057.909] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0057.909] GetProcessHeap () returned 0x630000 [0057.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0057.909] GetProcessHeap () returned 0x630000 [0057.909] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0057.909] GetProcessHeap () returned 0x630000 [0057.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0057.909] GetProcessHeap () returned 0x630000 [0057.909] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.909] GetProcessHeap () returned 0x630000 [0057.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.909] GetProcessHeap () returned 0x630000 [0057.909] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0057.909] GetProcessHeap () returned 0x630000 [0057.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0057.909] GetProcessHeap () returned 0x630000 [0057.909] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.909] GetProcessHeap () returned 0x630000 [0057.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.909] GetProcessHeap () returned 0x630000 [0057.909] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0057.909] GetProcessHeap () returned 0x630000 [0057.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0057.909] GetProcessHeap () returned 0x630000 [0057.909] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.909] GetProcessHeap () returned 0x630000 [0057.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.909] GetProcessHeap () returned 0x630000 [0057.909] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.909] GetProcessHeap () returned 0x630000 [0057.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.909] GetProcessHeap () returned 0x630000 [0057.909] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.909] GetProcessHeap () returned 0x630000 [0057.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.909] GetProcessHeap () returned 0x630000 [0057.909] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0057.909] GetProcessHeap () returned 0x630000 [0057.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0057.910] GetProcessHeap () returned 0x630000 [0057.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0057.910] GetProcessHeap () returned 0x630000 [0057.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0057.910] GetProcessHeap () returned 0x630000 [0057.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0057.910] GetProcessHeap () returned 0x630000 [0057.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0057.910] GetProcessHeap () returned 0x630000 [0057.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0057.910] GetProcessHeap () returned 0x630000 [0057.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0057.910] GetProcessHeap () returned 0x630000 [0057.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.910] GetProcessHeap () returned 0x630000 [0057.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.910] GetProcessHeap () returned 0x630000 [0057.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.910] GetProcessHeap () returned 0x630000 [0057.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.910] GetProcessHeap () returned 0x630000 [0057.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.910] GetProcessHeap () returned 0x630000 [0057.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.910] GetProcessHeap () returned 0x630000 [0057.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0057.910] GetProcessHeap () returned 0x630000 [0057.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0057.910] GetProcessHeap () returned 0x630000 [0057.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.910] GetProcessHeap () returned 0x630000 [0057.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.910] GetProcessHeap () returned 0x630000 [0057.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0057.910] GetProcessHeap () returned 0x630000 [0057.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0057.910] GetProcessHeap () returned 0x630000 [0057.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.911] GetProcessHeap () returned 0x630000 [0057.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.911] GetProcessHeap () returned 0x630000 [0057.911] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0057.911] GetProcessHeap () returned 0x630000 [0057.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0057.911] GetProcessHeap () returned 0x630000 [0057.911] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0057.911] GetProcessHeap () returned 0x630000 [0057.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0057.911] GetProcessHeap () returned 0x630000 [0057.911] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0057.911] GetProcessHeap () returned 0x630000 [0057.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0057.911] GetProcessHeap () returned 0x630000 [0057.911] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.911] GetProcessHeap () returned 0x630000 [0057.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.911] GetProcessHeap () returned 0x630000 [0057.911] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0057.911] GetProcessHeap () returned 0x630000 [0057.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0057.911] GetProcessHeap () returned 0x630000 [0057.911] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.911] GetProcessHeap () returned 0x630000 [0057.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.911] GetProcessHeap () returned 0x630000 [0057.911] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.911] GetProcessHeap () returned 0x630000 [0057.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.911] GetProcessHeap () returned 0x630000 [0057.911] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0057.911] GetProcessHeap () returned 0x630000 [0057.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0057.911] GetProcessHeap () returned 0x630000 [0057.911] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.911] GetProcessHeap () returned 0x630000 [0057.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.912] GetProcessHeap () returned 0x630000 [0057.912] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0057.912] GetProcessHeap () returned 0x630000 [0057.912] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0057.912] GetProcessHeap () returned 0x630000 [0057.912] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0057.912] GetProcessHeap () returned 0x630000 [0057.912] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0057.912] GetProcessHeap () returned 0x630000 [0057.912] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0057.912] GetProcessHeap () returned 0x630000 [0057.912] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0057.912] GetProcessHeap () returned 0x630000 [0057.912] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0057.912] GetProcessHeap () returned 0x630000 [0057.912] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0057.912] GetProcessHeap () returned 0x630000 [0057.912] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0057.912] GetProcessHeap () returned 0x630000 [0057.912] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0057.912] GetProcessHeap () returned 0x630000 [0057.912] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0057.912] GetProcessHeap () returned 0x630000 [0057.912] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0057.912] GetProcessHeap () returned 0x630000 [0057.912] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0057.912] WriteFile (in: hFile=0x230, lpBuffer=0x65f748*, nNumberOfBytesToWrite=0x381, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65f748*, lpNumberOfBytesWritten=0x243d864*=0x381, lpOverlapped=0x0) returned 1 [0057.916] GetProcessHeap () returned 0x630000 [0057.916] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65f748, Size=0x30) returned 0x65f748 [0057.916] GetProcessHeap () returned 0x630000 [0057.916] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0057.916] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0057.916] GetProcessHeap () returned 0x630000 [0057.916] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb0) returned 0x640c90 [0057.917] ReadFile (in: hFile=0x230, lpBuffer=0x640c90, nNumberOfBytesToRead=0xb0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x640c90*, lpNumberOfBytesRead=0x243d7e8*=0xb0, lpOverlapped=0x0) returned 1 [0057.917] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0057.917] WriteFile (in: hFile=0x230, lpBuffer=0x640c90*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x640c90*, lpNumberOfBytesWritten=0x243d7e4*=0xb0, lpOverlapped=0x0) returned 1 [0057.917] GetProcessHeap () returned 0x630000 [0057.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0057.918] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0057.918] WriteFile (in: hFile=0x230, lpBuffer=0x65f748*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65f748*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0057.918] CloseHandle (hObject=0x230) returned 1 [0057.920] GetProcessHeap () returned 0x630000 [0057.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0057.920] GetProcessHeap () returned 0x630000 [0057.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655850 | out: hHeap=0x630000) returned 1 [0057.920] GetProcessHeap () returned 0x630000 [0057.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0057.920] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\Public\\Libraries\\desktop.ini" | out: lpString1="C:\\Users\\Public\\Libraries\\desktop.ini") returned="C:\\Users\\Public\\Libraries\\desktop.ini" [0057.920] lstrcatW (in: lpString1="C:\\Users\\Public\\Libraries\\desktop.ini", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\Public\\Libraries\\desktop.ini.happythreechoose") returned="C:\\Users\\Public\\Libraries\\desktop.ini.happythreechoose" [0057.920] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Libraries\\desktop.ini" (normalized: "c:\\users\\public\\libraries\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Libraries\\desktop.ini.happythreechoose" (normalized: "c:\\users\\public\\libraries\\desktop.ini.happythreechoose"), dwFlags=0x1) returned 1 [0057.921] PathRemoveFileSpecW (in: pszPath="C:\\Users\\Public\\Libraries\\desktop.ini" | out: pszPath="C:\\Users\\Public\\Libraries") returned 1 [0057.921] PathAddBackslashW (in: pszPath="C:\\Users\\Public\\Libraries" | out: pszPath="C:\\Users\\Public\\Libraries\\") returned="" [0057.921] lstrcatW (in: lpString1="C:\\Users\\Public\\Libraries\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\Public\\Libraries\\Decryption INFO.html") returned="C:\\Users\\Public\\Libraries\\Decryption INFO.html" [0057.921] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Libraries\\Decryption INFO.html" (normalized: "c:\\users\\public\\libraries\\decryption info.html")) returned 0xffffffff [0057.921] CreateFileW (lpFileName="C:\\Users\\Public\\Libraries\\Decryption INFO.html" (normalized: "c:\\users\\public\\libraries\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0057.923] GetProcessHeap () returned 0x630000 [0057.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655508 [0057.923] GetProcessHeap () returned 0x630000 [0057.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0057.930] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.930] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.930] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.931] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.931] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.931] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.931] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.931] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.931] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.931] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.931] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.931] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.931] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.931] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.931] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.932] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.932] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.932] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.932] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.932] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.932] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.932] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.932] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.932] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.932] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.932] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.932] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.932] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.933] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.933] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.933] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.933] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.933] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.933] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.933] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.933] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.933] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.934] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.934] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.934] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.934] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.934] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.937] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.937] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.937] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.937] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.937] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.937] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.937] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.937] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.937] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.937] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.937] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.937] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.937] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.938] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.938] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.938] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.938] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.938] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.938] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.938] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.938] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.938] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.938] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.938] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.938] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.939] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.939] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.939] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.939] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.939] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.939] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.939] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.939] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.939] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.939] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.939] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.939] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.939] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.939] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.939] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.940] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.940] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.940] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.940] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.940] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.940] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.940] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.940] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.940] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.940] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.940] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.940] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.940] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.941] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.941] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.941] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.941] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.941] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.941] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.941] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.941] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.941] GetProcessHeap () returned 0x630000 [0057.941] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655508 | out: hHeap=0x630000) returned 1 [0057.941] GetProcessHeap () returned 0x630000 [0057.941] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0057.941] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0057.941] GetProcessHeap () returned 0x630000 [0057.941] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6557d8 [0057.941] GetProcessHeap () returned 0x630000 [0057.941] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0057.948] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.948] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.948] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.948] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.949] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.949] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.949] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.949] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.949] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.949] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.949] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.949] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.949] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.949] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.949] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.949] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.949] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.949] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.949] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.950] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.950] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.950] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.950] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.950] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.950] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.950] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.950] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.950] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.950] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.950] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.950] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.951] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.951] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.951] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.951] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.951] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.951] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.951] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.951] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.951] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.952] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.952] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.952] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.952] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.952] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.952] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.952] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.952] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.952] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.952] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.952] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.952] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.952] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.952] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.952] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.953] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.953] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.953] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.953] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.953] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.953] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.953] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.953] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.954] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.954] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.954] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.954] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.954] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.954] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.954] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.954] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.954] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.955] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.955] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.955] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.955] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.955] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.955] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.955] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.955] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.955] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.956] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.956] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.956] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.956] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.956] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.956] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.956] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.956] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.956] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.956] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.956] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.956] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.956] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.956] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.957] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.957] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.957] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.957] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.957] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.957] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.957] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.957] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.957] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.957] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.957] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.957] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.957] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.957] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.957] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.958] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.958] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.958] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.958] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.958] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.958] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.958] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.958] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0057.959] GetProcessHeap () returned 0x630000 [0057.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6557d8 | out: hHeap=0x630000) returned 1 [0057.959] GetProcessHeap () returned 0x630000 [0057.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0057.959] CloseHandle (hObject=0x230) returned 1 [0057.959] GetProcessHeap () returned 0x630000 [0057.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0057.959] FindNextFileW (in: hFindFile=0x648bd0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecordedTV.library-ms", cAlternateFileName="RECORD~1.LIB")) returned 1 [0057.959] lstrcmpiW (lpString1="RecordedTV.library-ms", lpString2=".") returned 1 [0057.959] lstrcmpiW (lpString1="RecordedTV.library-ms", lpString2="..") returned 1 [0057.959] lstrcatW (in: lpString1="C:\\Users\\Public\\Libraries\\", lpString2="RecordedTV.library-ms" | out: lpString1="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms") returned="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" [0057.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RecordedTV.library-ms", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0057.959] GetProcessHeap () returned 0x630000 [0057.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x645fb8 [0057.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RecordedTV.library-ms", cchWideChar=-1, lpMultiByteStr=0x645fb8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RecordedTV.library-ms", lpUsedDefaultChar=0x0) returned 22 [0057.959] lstrlenA (lpString="RecordedTV.library-ms") returned 21 [0057.959] lstrlenA (lpString=".happythreechoose") returned 17 [0057.959] lstrlenA (lpString=".happythreechoose") returned 17 [0057.959] lstrlenA (lpString="RecordedTV.library-ms") returned 21 [0057.959] lstrcmpiA (lpString1="rdedTV.library-ms", lpString2=".happythreechoose") returned 1 [0057.960] lstrcmpiW (lpString1="RecordedTV.library-ms", lpString2="Decryption INFO.html") returned 1 [0057.960] lstrcmpiW (lpString1="RecordedTV.library-ms", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0057.960] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0057.960] lstrcmpiW (lpString1="RecordedTV.library-ms", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0057.960] GetProcessHeap () returned 0x630000 [0057.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0057.960] CreateFileW (lpFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0057.960] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=960) returned 1 [0057.960] GetProcessHeap () returned 0x630000 [0057.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655aa8 [0057.960] GetProcessHeap () returned 0x630000 [0057.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0057.960] lstrlenW (lpString="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms") returned 47 [0057.960] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0057.960] GetProcessHeap () returned 0x630000 [0057.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0057.960] GetProcessHeap () returned 0x630000 [0057.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x65f780 [0057.960] lstrlenA (lpString="rsa_encrypt") returned 11 [0057.960] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0057.961] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0057.961] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0057.961] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0057.961] GetProcessHeap () returned 0x630000 [0057.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0057.961] lstrlenA (lpString="010001") returned 6 [0057.961] GetProcessHeap () returned 0x630000 [0057.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3f8 [0057.961] GetProcessHeap () returned 0x630000 [0057.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0057.961] GetProcessHeap () returned 0x630000 [0057.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0057.961] GetProcessHeap () returned 0x630000 [0057.961] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0057.961] GetProcessHeap () returned 0x630000 [0057.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e3d0 [0057.961] GetProcessHeap () returned 0x630000 [0057.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657440 [0057.961] GetProcessHeap () returned 0x630000 [0057.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0057.961] GetProcessHeap () returned 0x630000 [0057.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0057.961] GetProcessHeap () returned 0x630000 [0057.962] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0057.962] GetProcessHeap () returned 0x630000 [0057.962] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0057.962] GetProcessHeap () returned 0x630000 [0057.962] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0057.962] GetProcessHeap () returned 0x630000 [0057.962] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656fe0 [0057.962] GetProcessHeap () returned 0x630000 [0057.962] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0057.962] GetProcessHeap () returned 0x630000 [0057.962] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0057.962] GetProcessHeap () returned 0x630000 [0057.962] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65df50 [0057.962] GetProcessHeap () returned 0x630000 [0057.962] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0057.962] GetProcessHeap () returned 0x630000 [0057.962] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0057.962] GetProcessHeap () returned 0x630000 [0057.962] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0057.962] GetProcessHeap () returned 0x630000 [0057.962] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0057.962] GetProcessHeap () returned 0x630000 [0057.962] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0057.962] GetProcessHeap () returned 0x630000 [0057.962] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0057.962] GetProcessHeap () returned 0x630000 [0057.962] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0057.962] GetProcessHeap () returned 0x630000 [0057.962] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0057.962] GetProcessHeap () returned 0x630000 [0057.962] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0057.962] GetProcessHeap () returned 0x630000 [0057.962] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e460 [0057.962] GetProcessHeap () returned 0x630000 [0057.962] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0057.962] GetProcessHeap () returned 0x630000 [0057.962] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0057.962] GetProcessHeap () returned 0x630000 [0057.962] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e460 | out: hHeap=0x630000) returned 1 [0057.962] GetProcessHeap () returned 0x630000 [0057.962] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.963] GetProcessHeap () returned 0x630000 [0057.963] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.963] GetProcessHeap () returned 0x630000 [0057.963] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0057.963] GetProcessHeap () returned 0x630000 [0057.963] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0057.963] GetProcessHeap () returned 0x630000 [0057.963] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.963] GetProcessHeap () returned 0x630000 [0057.963] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.963] GetProcessHeap () returned 0x630000 [0057.963] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0057.963] GetProcessHeap () returned 0x630000 [0057.963] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0057.963] GetProcessHeap () returned 0x630000 [0057.963] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0057.963] GetProcessHeap () returned 0x630000 [0057.963] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0057.963] GetProcessHeap () returned 0x630000 [0057.963] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0057.963] GetProcessHeap () returned 0x630000 [0057.963] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0057.963] GetProcessHeap () returned 0x630000 [0057.963] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0057.963] GetProcessHeap () returned 0x630000 [0057.963] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0057.963] GetProcessHeap () returned 0x630000 [0057.963] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0057.963] GetProcessHeap () returned 0x630000 [0057.963] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0057.963] GetProcessHeap () returned 0x630000 [0057.963] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0057.963] GetProcessHeap () returned 0x630000 [0057.963] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0057.963] GetProcessHeap () returned 0x630000 [0057.963] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0057.963] GetProcessHeap () returned 0x630000 [0057.963] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0057.964] GetProcessHeap () returned 0x630000 [0057.964] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0057.964] GetProcessHeap () returned 0x630000 [0057.964] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0057.964] GetProcessHeap () returned 0x630000 [0057.964] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.964] GetProcessHeap () returned 0x630000 [0057.964] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.964] GetProcessHeap () returned 0x630000 [0057.964] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0057.964] GetProcessHeap () returned 0x630000 [0057.964] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0057.964] GetProcessHeap () returned 0x630000 [0057.964] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0057.964] GetProcessHeap () returned 0x630000 [0057.964] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0057.964] GetProcessHeap () returned 0x630000 [0057.964] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0057.964] GetProcessHeap () returned 0x630000 [0057.964] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0057.964] GetProcessHeap () returned 0x630000 [0057.964] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0057.964] GetProcessHeap () returned 0x630000 [0057.964] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0057.964] GetProcessHeap () returned 0x630000 [0057.964] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0057.964] GetProcessHeap () returned 0x630000 [0057.964] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0057.964] GetProcessHeap () returned 0x630000 [0057.964] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0057.964] GetProcessHeap () returned 0x630000 [0057.964] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0057.964] GetProcessHeap () returned 0x630000 [0057.964] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.964] GetProcessHeap () returned 0x630000 [0057.964] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.964] GetProcessHeap () returned 0x630000 [0057.964] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0057.964] GetProcessHeap () returned 0x630000 [0057.965] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0057.965] GetProcessHeap () returned 0x630000 [0057.965] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0057.965] GetProcessHeap () returned 0x630000 [0057.965] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0057.965] GetProcessHeap () returned 0x630000 [0057.965] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0057.965] GetProcessHeap () returned 0x630000 [0057.965] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0057.965] GetProcessHeap () returned 0x630000 [0057.965] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0057.965] GetProcessHeap () returned 0x630000 [0057.965] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0057.965] GetProcessHeap () returned 0x630000 [0057.965] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0057.965] GetProcessHeap () returned 0x630000 [0057.965] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0057.965] GetProcessHeap () returned 0x630000 [0057.965] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0057.965] GetProcessHeap () returned 0x630000 [0057.965] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0057.965] GetProcessHeap () returned 0x630000 [0057.965] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0057.965] GetProcessHeap () returned 0x630000 [0057.965] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0057.965] GetProcessHeap () returned 0x630000 [0057.965] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0057.965] GetProcessHeap () returned 0x630000 [0057.965] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0057.965] GetProcessHeap () returned 0x630000 [0057.965] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0057.965] GetProcessHeap () returned 0x630000 [0057.965] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0057.965] GetProcessHeap () returned 0x630000 [0057.965] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0057.965] GetProcessHeap () returned 0x630000 [0057.965] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0057.965] GetProcessHeap () returned 0x630000 [0057.965] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0057.965] GetProcessHeap () returned 0x630000 [0057.966] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0057.966] GetProcessHeap () returned 0x630000 [0057.966] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0057.966] GetProcessHeap () returned 0x630000 [0057.966] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0057.966] GetProcessHeap () returned 0x630000 [0057.966] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0057.966] GetProcessHeap () returned 0x630000 [0057.966] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0057.966] GetProcessHeap () returned 0x630000 [0057.966] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0057.966] GetProcessHeap () returned 0x630000 [0057.966] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0057.966] GetProcessHeap () returned 0x630000 [0057.966] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0057.966] GetProcessHeap () returned 0x630000 [0057.966] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0057.966] GetProcessHeap () returned 0x630000 [0057.966] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0057.966] GetProcessHeap () returned 0x630000 [0057.966] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0057.966] GetProcessHeap () returned 0x630000 [0057.966] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0057.966] GetProcessHeap () returned 0x630000 [0057.966] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0057.966] GetProcessHeap () returned 0x630000 [0057.966] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.966] GetProcessHeap () returned 0x630000 [0057.966] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.966] GetProcessHeap () returned 0x630000 [0057.966] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.966] GetProcessHeap () returned 0x630000 [0057.966] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.966] GetProcessHeap () returned 0x630000 [0057.966] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0057.966] GetProcessHeap () returned 0x630000 [0057.966] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0057.966] GetProcessHeap () returned 0x630000 [0057.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0057.967] GetProcessHeap () returned 0x630000 [0057.967] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0057.967] GetProcessHeap () returned 0x630000 [0057.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0057.967] GetProcessHeap () returned 0x630000 [0057.967] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0057.967] GetProcessHeap () returned 0x630000 [0057.967] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0057.967] GetProcessHeap () returned 0x630000 [0057.967] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0057.967] GetProcessHeap () returned 0x630000 [0057.967] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0057.967] GetProcessHeap () returned 0x630000 [0057.967] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0057.967] GetProcessHeap () returned 0x630000 [0057.967] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0057.967] GetProcessHeap () returned 0x630000 [0057.967] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0057.967] GetProcessHeap () returned 0x630000 [0057.967] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0057.967] GetProcessHeap () returned 0x630000 [0057.967] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0057.967] GetProcessHeap () returned 0x630000 [0057.967] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0057.967] GetProcessHeap () returned 0x630000 [0057.967] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.967] GetProcessHeap () returned 0x630000 [0057.967] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0057.967] WriteFile (in: hFile=0x230, lpBuffer=0x65f780*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65f780*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0057.978] GetProcessHeap () returned 0x630000 [0057.978] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65f780, Size=0x30) returned 0x65f780 [0057.978] GetProcessHeap () returned 0x630000 [0057.978] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0057.978] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0057.978] GetProcessHeap () returned 0x630000 [0057.978] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3c0) returned 0x65f7b8 [0057.978] ReadFile (in: hFile=0x230, lpBuffer=0x65f7b8, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65f7b8*, lpNumberOfBytesRead=0x243d7e8*=0x3c0, lpOverlapped=0x0) returned 1 [0057.978] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0057.978] WriteFile (in: hFile=0x230, lpBuffer=0x65f7b8*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65f7b8*, lpNumberOfBytesWritten=0x243d7e4*=0x3c0, lpOverlapped=0x0) returned 1 [0057.979] GetProcessHeap () returned 0x630000 [0057.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65f7b8 | out: hHeap=0x630000) returned 1 [0057.979] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0057.979] WriteFile (in: hFile=0x230, lpBuffer=0x65f780*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65f780*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0057.980] CloseHandle (hObject=0x230) returned 1 [0057.982] GetProcessHeap () returned 0x630000 [0057.982] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0057.982] GetProcessHeap () returned 0x630000 [0057.982] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655aa8 | out: hHeap=0x630000) returned 1 [0057.982] GetProcessHeap () returned 0x630000 [0057.982] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0057.982] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" | out: lpString1="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms") returned="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" [0057.982] lstrcatW (in: lpString1="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms.happythreechoose") returned="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms.happythreechoose" [0057.982] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms"), lpNewFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms.happythreechoose" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms.happythreechoose"), dwFlags=0x1) returned 1 [0057.982] PathRemoveFileSpecW (in: pszPath="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" | out: pszPath="C:\\Users\\Public\\Libraries") returned 1 [0057.982] PathAddBackslashW (in: pszPath="C:\\Users\\Public\\Libraries" | out: pszPath="C:\\Users\\Public\\Libraries\\") returned="" [0057.982] lstrcatW (in: lpString1="C:\\Users\\Public\\Libraries\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\Public\\Libraries\\Decryption INFO.html") returned="C:\\Users\\Public\\Libraries\\Decryption INFO.html" [0057.982] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Libraries\\Decryption INFO.html" (normalized: "c:\\users\\public\\libraries\\decryption info.html")) returned 0x20 [0057.983] GetProcessHeap () returned 0x630000 [0057.983] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645fb8 | out: hHeap=0x630000) returned 1 [0057.983] FindNextFileW (in: hFindFile=0x648bd0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecordedTV.library-ms", cAlternateFileName="RECORD~1.LIB")) returned 0 [0057.983] FindClose (in: hFindFile=0x648bd0 | out: hFindFile=0x648bd0) returned 1 [0057.983] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\Public\\Downloads\\" | out: lpString1="C:\\Users\\Public\\Downloads\\") returned="C:\\Users\\Public\\Downloads\\" [0057.983] GetProcessHeap () returned 0x630000 [0057.983] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x648b50 | out: hHeap=0x630000) returned 1 [0057.983] GetProcessHeap () returned 0x630000 [0057.983] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0057.983] lstrlenW (lpString="C:\\Users\\Public\\Downloads\\") returned 26 [0057.983] lstrcatW (in: lpString1="C:\\Users\\Public\\Downloads\\", lpString2="*" | out: lpString1="C:\\Users\\Public\\Downloads\\*") returned="C:\\Users\\Public\\Downloads\\*" [0057.983] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Downloads\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6487d0 [0057.983] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0057.983] FindNextFileW (in: hFindFile=0x6487d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.983] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0057.983] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0057.983] FindNextFileW (in: hFindFile=0x6487d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0057.983] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0057.983] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0057.983] lstrcatW (in: lpString1="C:\\Users\\Public\\Downloads\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\Public\\Downloads\\desktop.ini") returned="C:\\Users\\Public\\Downloads\\desktop.ini" [0057.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0057.983] GetProcessHeap () returned 0x630000 [0057.983] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0057.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0057.984] lstrlenA (lpString="desktop.ini") returned 11 [0057.984] lstrlenA (lpString=".happythreechoose") returned 17 [0057.984] lstrcmpiW (lpString1="desktop.ini", lpString2="Decryption INFO.html") returned 1 [0057.984] lstrcmpiW (lpString1="desktop.ini", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0057.984] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0057.984] lstrcmpiW (lpString1="desktop.ini", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0057.984] GetProcessHeap () returned 0x630000 [0057.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0057.984] CreateFileW (lpFileName="C:\\Users\\Public\\Downloads\\desktop.ini" (normalized: "c:\\users\\public\\downloads\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0057.984] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=174) returned 1 [0057.984] GetProcessHeap () returned 0x630000 [0057.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655670 [0057.984] GetProcessHeap () returned 0x630000 [0057.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0057.984] lstrlenW (lpString="C:\\Users\\Public\\Downloads\\desktop.ini") returned 37 [0057.984] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0057.984] GetProcessHeap () returned 0x630000 [0057.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0057.984] GetProcessHeap () returned 0x630000 [0057.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x382) returned 0x65f7b8 [0057.984] lstrlenA (lpString="rsa_encrypt") returned 11 [0057.984] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0057.985] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0057.985] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0057.985] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0057.985] GetProcessHeap () returned 0x630000 [0057.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0057.985] lstrlenA (lpString="010001") returned 6 [0057.985] GetProcessHeap () returned 0x630000 [0057.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0057.985] GetProcessHeap () returned 0x630000 [0057.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0057.985] GetProcessHeap () returned 0x630000 [0057.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e100 [0057.985] GetProcessHeap () returned 0x630000 [0057.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0057.985] GetProcessHeap () returned 0x630000 [0057.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e8e0 [0057.985] GetProcessHeap () returned 0x630000 [0057.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656db0 [0057.985] GetProcessHeap () returned 0x630000 [0057.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3f8 [0057.986] GetProcessHeap () returned 0x630000 [0057.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0057.986] GetProcessHeap () returned 0x630000 [0057.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.986] GetProcessHeap () returned 0x630000 [0057.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0057.986] GetProcessHeap () returned 0x630000 [0057.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0057.986] GetProcessHeap () returned 0x630000 [0057.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656b80 [0057.986] GetProcessHeap () returned 0x630000 [0057.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.986] GetProcessHeap () returned 0x630000 [0057.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0057.986] GetProcessHeap () returned 0x630000 [0057.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e340 [0057.986] GetProcessHeap () returned 0x630000 [0057.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0057.986] GetProcessHeap () returned 0x630000 [0057.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0057.986] GetProcessHeap () returned 0x630000 [0057.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0057.986] GetProcessHeap () returned 0x630000 [0057.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.986] GetProcessHeap () returned 0x630000 [0057.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65a978 [0057.986] GetProcessHeap () returned 0x630000 [0057.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.986] GetProcessHeap () returned 0x630000 [0057.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.986] GetProcessHeap () returned 0x630000 [0057.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0057.986] GetProcessHeap () returned 0x630000 [0057.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0057.986] GetProcessHeap () returned 0x630000 [0057.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65eb20 [0057.986] GetProcessHeap () returned 0x630000 [0057.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a978 | out: hHeap=0x630000) returned 1 [0057.986] GetProcessHeap () returned 0x630000 [0057.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0057.987] GetProcessHeap () returned 0x630000 [0057.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0057.987] GetProcessHeap () returned 0x630000 [0057.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0057.987] GetProcessHeap () returned 0x630000 [0057.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0057.987] GetProcessHeap () returned 0x630000 [0057.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0057.987] GetProcessHeap () returned 0x630000 [0057.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0057.987] GetProcessHeap () returned 0x630000 [0057.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0057.987] GetProcessHeap () returned 0x630000 [0057.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0057.987] GetProcessHeap () returned 0x630000 [0057.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0057.987] GetProcessHeap () returned 0x630000 [0057.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0057.987] GetProcessHeap () returned 0x630000 [0057.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0057.987] GetProcessHeap () returned 0x630000 [0057.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0057.987] GetProcessHeap () returned 0x630000 [0057.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0057.987] GetProcessHeap () returned 0x630000 [0057.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0057.987] GetProcessHeap () returned 0x630000 [0057.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0057.987] GetProcessHeap () returned 0x630000 [0057.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0057.987] GetProcessHeap () returned 0x630000 [0057.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0057.987] GetProcessHeap () returned 0x630000 [0057.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0057.987] GetProcessHeap () returned 0x630000 [0057.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0057.987] GetProcessHeap () returned 0x630000 [0057.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0057.988] GetProcessHeap () returned 0x630000 [0057.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0057.988] GetProcessHeap () returned 0x630000 [0057.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0057.988] GetProcessHeap () returned 0x630000 [0057.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.988] GetProcessHeap () returned 0x630000 [0057.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.988] GetProcessHeap () returned 0x630000 [0057.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0057.988] GetProcessHeap () returned 0x630000 [0057.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0057.988] GetProcessHeap () returned 0x630000 [0057.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.988] GetProcessHeap () returned 0x630000 [0057.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.988] GetProcessHeap () returned 0x630000 [0057.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0057.988] GetProcessHeap () returned 0x630000 [0057.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0057.988] GetProcessHeap () returned 0x630000 [0057.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0057.988] GetProcessHeap () returned 0x630000 [0057.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0057.988] GetProcessHeap () returned 0x630000 [0057.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0057.988] GetProcessHeap () returned 0x630000 [0057.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0057.988] GetProcessHeap () returned 0x630000 [0057.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0057.988] GetProcessHeap () returned 0x630000 [0057.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0057.988] GetProcessHeap () returned 0x630000 [0057.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0057.988] GetProcessHeap () returned 0x630000 [0057.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0057.989] GetProcessHeap () returned 0x630000 [0057.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0057.989] GetProcessHeap () returned 0x630000 [0057.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0057.989] GetProcessHeap () returned 0x630000 [0057.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0057.989] GetProcessHeap () returned 0x630000 [0057.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0057.989] GetProcessHeap () returned 0x630000 [0057.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0057.989] GetProcessHeap () returned 0x630000 [0057.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0057.989] GetProcessHeap () returned 0x630000 [0057.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0057.989] GetProcessHeap () returned 0x630000 [0057.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0057.989] GetProcessHeap () returned 0x630000 [0057.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0057.989] GetProcessHeap () returned 0x630000 [0057.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0057.989] GetProcessHeap () returned 0x630000 [0057.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.989] GetProcessHeap () returned 0x630000 [0057.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.989] GetProcessHeap () returned 0x630000 [0057.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0057.989] GetProcessHeap () returned 0x630000 [0057.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0057.989] GetProcessHeap () returned 0x630000 [0057.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.989] GetProcessHeap () returned 0x630000 [0057.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.989] GetProcessHeap () returned 0x630000 [0057.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0057.989] GetProcessHeap () returned 0x630000 [0057.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0057.989] GetProcessHeap () returned 0x630000 [0057.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0057.989] GetProcessHeap () returned 0x630000 [0057.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0057.990] GetProcessHeap () returned 0x630000 [0057.990] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0057.990] GetProcessHeap () returned 0x630000 [0057.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0057.990] GetProcessHeap () returned 0x630000 [0057.990] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.990] GetProcessHeap () returned 0x630000 [0057.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.990] GetProcessHeap () returned 0x630000 [0057.990] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0057.990] GetProcessHeap () returned 0x630000 [0057.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0057.990] GetProcessHeap () returned 0x630000 [0057.990] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0057.990] GetProcessHeap () returned 0x630000 [0057.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0057.990] GetProcessHeap () returned 0x630000 [0057.990] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.990] GetProcessHeap () returned 0x630000 [0057.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.990] GetProcessHeap () returned 0x630000 [0057.990] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0057.990] GetProcessHeap () returned 0x630000 [0057.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0057.990] GetProcessHeap () returned 0x630000 [0057.990] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0057.990] GetProcessHeap () returned 0x630000 [0057.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0057.990] GetProcessHeap () returned 0x630000 [0057.990] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0057.990] GetProcessHeap () returned 0x630000 [0057.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0057.990] GetProcessHeap () returned 0x630000 [0057.990] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0057.990] GetProcessHeap () returned 0x630000 [0057.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0057.990] GetProcessHeap () returned 0x630000 [0057.991] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0057.991] GetProcessHeap () returned 0x630000 [0057.991] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0057.991] GetProcessHeap () returned 0x630000 [0057.991] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0057.991] GetProcessHeap () returned 0x630000 [0057.991] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0057.991] GetProcessHeap () returned 0x630000 [0057.991] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0057.991] GetProcessHeap () returned 0x630000 [0057.991] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0057.991] GetProcessHeap () returned 0x630000 [0057.991] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0057.991] GetProcessHeap () returned 0x630000 [0057.991] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0057.991] GetProcessHeap () returned 0x630000 [0057.991] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0057.991] GetProcessHeap () returned 0x630000 [0057.991] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0057.991] GetProcessHeap () returned 0x630000 [0057.991] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0057.991] GetProcessHeap () returned 0x630000 [0057.991] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0057.991] GetProcessHeap () returned 0x630000 [0057.991] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0057.991] GetProcessHeap () returned 0x630000 [0057.991] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0057.991] GetProcessHeap () returned 0x630000 [0057.991] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0057.991] GetProcessHeap () returned 0x630000 [0057.991] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0057.991] GetProcessHeap () returned 0x630000 [0057.991] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0057.991] GetProcessHeap () returned 0x630000 [0057.991] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0057.991] GetProcessHeap () returned 0x630000 [0057.991] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0057.992] WriteFile (in: hFile=0x230, lpBuffer=0x65f7b8*, nNumberOfBytesToWrite=0x382, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65f7b8*, lpNumberOfBytesWritten=0x243d864*=0x382, lpOverlapped=0x0) returned 1 [0057.995] GetProcessHeap () returned 0x630000 [0057.995] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65f7b8, Size=0x30) returned 0x65f7b8 [0057.995] GetProcessHeap () returned 0x630000 [0057.995] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0057.995] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0057.995] GetProcessHeap () returned 0x630000 [0057.996] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb0) returned 0x640c90 [0057.996] ReadFile (in: hFile=0x230, lpBuffer=0x640c90, nNumberOfBytesToRead=0xb0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x640c90*, lpNumberOfBytesRead=0x243d7e8*=0xb0, lpOverlapped=0x0) returned 1 [0057.996] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0057.996] WriteFile (in: hFile=0x230, lpBuffer=0x640c90*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x640c90*, lpNumberOfBytesWritten=0x243d7e4*=0xb0, lpOverlapped=0x0) returned 1 [0057.997] GetProcessHeap () returned 0x630000 [0057.997] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0057.997] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0057.997] WriteFile (in: hFile=0x230, lpBuffer=0x65f7b8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65f7b8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0057.998] CloseHandle (hObject=0x230) returned 1 [0057.999] GetProcessHeap () returned 0x630000 [0057.999] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0057.999] GetProcessHeap () returned 0x630000 [0057.999] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655670 | out: hHeap=0x630000) returned 1 [0057.999] GetProcessHeap () returned 0x630000 [0057.999] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0057.999] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\Public\\Downloads\\desktop.ini" | out: lpString1="C:\\Users\\Public\\Downloads\\desktop.ini") returned="C:\\Users\\Public\\Downloads\\desktop.ini" [0057.999] lstrcatW (in: lpString1="C:\\Users\\Public\\Downloads\\desktop.ini", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\Public\\Downloads\\desktop.ini.happythreechoose") returned="C:\\Users\\Public\\Downloads\\desktop.ini.happythreechoose" [0057.999] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Downloads\\desktop.ini" (normalized: "c:\\users\\public\\downloads\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Downloads\\desktop.ini.happythreechoose" (normalized: "c:\\users\\public\\downloads\\desktop.ini.happythreechoose"), dwFlags=0x1) returned 1 [0058.000] PathRemoveFileSpecW (in: pszPath="C:\\Users\\Public\\Downloads\\desktop.ini" | out: pszPath="C:\\Users\\Public\\Downloads") returned 1 [0058.000] PathAddBackslashW (in: pszPath="C:\\Users\\Public\\Downloads" | out: pszPath="C:\\Users\\Public\\Downloads\\") returned="" [0058.000] lstrcatW (in: lpString1="C:\\Users\\Public\\Downloads\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\Public\\Downloads\\Decryption INFO.html") returned="C:\\Users\\Public\\Downloads\\Decryption INFO.html" [0058.000] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Downloads\\Decryption INFO.html" (normalized: "c:\\users\\public\\downloads\\decryption info.html")) returned 0xffffffff [0058.000] CreateFileW (lpFileName="C:\\Users\\Public\\Downloads\\Decryption INFO.html" (normalized: "c:\\users\\public\\downloads\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0058.000] GetProcessHeap () returned 0x630000 [0058.000] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655490 [0058.000] GetProcessHeap () returned 0x630000 [0058.000] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0058.007] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.008] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.008] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.008] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.008] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.008] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.009] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.009] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.009] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.009] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.009] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.009] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.009] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.009] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.009] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.009] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.009] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.009] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.009] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.009] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.010] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.010] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.010] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.010] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.010] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.010] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.010] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.010] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.010] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.010] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.010] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.011] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.011] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.011] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.011] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.011] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.011] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.011] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.012] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.012] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.012] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.012] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.012] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.012] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.012] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.012] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.012] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.012] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.012] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.012] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.012] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.012] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.014] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.014] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.014] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.014] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.014] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.014] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.014] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.014] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.014] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.014] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.014] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.014] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.014] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.014] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.015] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.015] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.015] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.015] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.015] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.015] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.015] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.015] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.015] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.015] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.015] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.015] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.015] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.015] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.017] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.017] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.017] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.017] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.017] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.017] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.017] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.017] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.017] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.017] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.017] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.017] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.017] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.018] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.018] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.018] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.018] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.018] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.018] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.018] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.018] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.018] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.018] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.018] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.018] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.018] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.018] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.018] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.019] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.019] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.019] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.019] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.019] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.019] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.019] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.019] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.019] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.019] GetProcessHeap () returned 0x630000 [0058.019] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655490 | out: hHeap=0x630000) returned 1 [0058.019] GetProcessHeap () returned 0x630000 [0058.019] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0058.019] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0058.019] GetProcessHeap () returned 0x630000 [0058.019] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6558c8 [0058.019] GetProcessHeap () returned 0x630000 [0058.020] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0058.026] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.026] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.026] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.027] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.027] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.027] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.027] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.027] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.027] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.027] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.027] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.027] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.027] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.027] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.027] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.027] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.027] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.027] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.028] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.028] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.028] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.028] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.028] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.028] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.028] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.028] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.028] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.028] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.028] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.028] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.028] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.028] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.029] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.029] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.029] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.029] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.029] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.029] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.029] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.029] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.029] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.029] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.029] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.029] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.029] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.029] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.029] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.030] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.030] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.030] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.030] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.030] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.030] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.030] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.030] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.030] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.030] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.030] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.030] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.030] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.030] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.030] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.031] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.031] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.031] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.031] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.031] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.031] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.031] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.031] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.032] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.032] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.032] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.032] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.032] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.032] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.032] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.032] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.033] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.033] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.033] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.033] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.033] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.033] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.065] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.065] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.065] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.065] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.065] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.065] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.065] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.065] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.065] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.065] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.065] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.065] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.065] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.065] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.065] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.066] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.066] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.066] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.066] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.066] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.066] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.066] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.066] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.066] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.066] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.066] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.066] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.066] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.066] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.067] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.067] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.067] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.067] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.067] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.067] GetProcessHeap () returned 0x630000 [0058.067] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6558c8 | out: hHeap=0x630000) returned 1 [0058.068] GetProcessHeap () returned 0x630000 [0058.068] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0058.068] CloseHandle (hObject=0x230) returned 1 [0058.068] GetProcessHeap () returned 0x630000 [0058.068] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0058.068] FindNextFileW (in: hFindFile=0x6487d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0058.068] FindClose (in: hFindFile=0x6487d0 | out: hFindFile=0x6487d0) returned 1 [0058.068] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\Public\\Documents\\" | out: lpString1="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0058.068] GetProcessHeap () returned 0x630000 [0058.068] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x648710 | out: hHeap=0x630000) returned 1 [0058.068] GetProcessHeap () returned 0x630000 [0058.068] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0058.068] lstrlenW (lpString="C:\\Users\\Public\\Documents\\") returned 26 [0058.068] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="*" | out: lpString1="C:\\Users\\Public\\Documents\\*") returned="C:\\Users\\Public\\Documents\\*" [0058.068] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb1fb672c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648c10 [0058.070] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0058.070] FindNextFileW (in: hFindFile=0x648c10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb1fb672c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.070] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0058.070] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0058.070] FindNextFileW (in: hFindFile=0x648c10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0058.070] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0058.070] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0058.070] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\Public\\Documents\\desktop.ini") returned="C:\\Users\\Public\\Documents\\desktop.ini" [0058.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0058.070] GetProcessHeap () returned 0x630000 [0058.070] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0058.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0058.071] lstrlenA (lpString="desktop.ini") returned 11 [0058.071] lstrlenA (lpString=".happythreechoose") returned 17 [0058.071] lstrcmpiW (lpString1="desktop.ini", lpString2="Decryption INFO.html") returned 1 [0058.071] lstrcmpiW (lpString1="desktop.ini", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0058.071] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0058.071] lstrcmpiW (lpString1="desktop.ini", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0058.071] GetProcessHeap () returned 0x630000 [0058.071] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0058.071] CreateFileW (lpFileName="C:\\Users\\Public\\Documents\\desktop.ini" (normalized: "c:\\users\\public\\documents\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0058.072] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=278) returned 1 [0058.072] GetProcessHeap () returned 0x630000 [0058.072] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655580 [0058.072] GetProcessHeap () returned 0x630000 [0058.072] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0058.072] lstrlenW (lpString="C:\\Users\\Public\\Documents\\desktop.ini") returned 37 [0058.072] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.072] GetProcessHeap () returned 0x630000 [0058.072] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0058.072] GetProcessHeap () returned 0x630000 [0058.072] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38a) returned 0x65f7f0 [0058.072] lstrlenA (lpString="rsa_encrypt") returned 11 [0058.072] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0058.073] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0058.073] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0058.073] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0058.073] GetProcessHeap () returned 0x630000 [0058.073] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0058.073] lstrlenA (lpString="010001") returned 6 [0058.073] GetProcessHeap () returned 0x630000 [0058.073] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0058.073] GetProcessHeap () returned 0x630000 [0058.073] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.073] GetProcessHeap () returned 0x630000 [0058.073] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea00 [0058.073] GetProcessHeap () returned 0x630000 [0058.073] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.073] GetProcessHeap () returned 0x630000 [0058.073] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e4f0 [0058.073] GetProcessHeap () returned 0x630000 [0058.073] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657670 [0058.073] GetProcessHeap () returned 0x630000 [0058.073] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0058.073] GetProcessHeap () returned 0x630000 [0058.073] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0058.073] GetProcessHeap () returned 0x630000 [0058.073] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0058.073] GetProcessHeap () returned 0x630000 [0058.073] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0058.073] GetProcessHeap () returned 0x630000 [0058.073] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.073] GetProcessHeap () returned 0x630000 [0058.073] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656b80 [0058.073] GetProcessHeap () returned 0x630000 [0058.073] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0058.073] GetProcessHeap () returned 0x630000 [0058.073] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0058.073] GetProcessHeap () returned 0x630000 [0058.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0058.074] GetProcessHeap () returned 0x630000 [0058.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.074] GetProcessHeap () returned 0x630000 [0058.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0058.074] GetProcessHeap () returned 0x630000 [0058.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0058.074] GetProcessHeap () returned 0x630000 [0058.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0058.074] GetProcessHeap () returned 0x630000 [0058.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65a930 [0058.074] GetProcessHeap () returned 0x630000 [0058.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0058.074] GetProcessHeap () returned 0x630000 [0058.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0058.074] GetProcessHeap () returned 0x630000 [0058.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0058.074] GetProcessHeap () returned 0x630000 [0058.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0058.074] GetProcessHeap () returned 0x630000 [0058.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ebb0 [0058.074] GetProcessHeap () returned 0x630000 [0058.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a930 | out: hHeap=0x630000) returned 1 [0058.074] GetProcessHeap () returned 0x630000 [0058.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0058.074] GetProcessHeap () returned 0x630000 [0058.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0058.074] GetProcessHeap () returned 0x630000 [0058.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0058.074] GetProcessHeap () returned 0x630000 [0058.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0058.074] GetProcessHeap () returned 0x630000 [0058.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0058.074] GetProcessHeap () returned 0x630000 [0058.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0058.074] GetProcessHeap () returned 0x630000 [0058.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0058.074] GetProcessHeap () returned 0x630000 [0058.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0058.075] GetProcessHeap () returned 0x630000 [0058.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0058.075] GetProcessHeap () returned 0x630000 [0058.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0058.075] GetProcessHeap () returned 0x630000 [0058.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0058.075] GetProcessHeap () returned 0x630000 [0058.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0058.075] GetProcessHeap () returned 0x630000 [0058.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0058.075] GetProcessHeap () returned 0x630000 [0058.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0058.075] GetProcessHeap () returned 0x630000 [0058.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0058.075] GetProcessHeap () returned 0x630000 [0058.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0058.075] GetProcessHeap () returned 0x630000 [0058.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0058.075] GetProcessHeap () returned 0x630000 [0058.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0058.075] GetProcessHeap () returned 0x630000 [0058.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0058.075] GetProcessHeap () returned 0x630000 [0058.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0058.075] GetProcessHeap () returned 0x630000 [0058.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0058.075] GetProcessHeap () returned 0x630000 [0058.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0058.075] GetProcessHeap () returned 0x630000 [0058.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0058.075] GetProcessHeap () returned 0x630000 [0058.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0058.075] GetProcessHeap () returned 0x630000 [0058.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0058.075] GetProcessHeap () returned 0x630000 [0058.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0058.076] GetProcessHeap () returned 0x630000 [0058.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0058.076] GetProcessHeap () returned 0x630000 [0058.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0058.076] GetProcessHeap () returned 0x630000 [0058.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0058.076] GetProcessHeap () returned 0x630000 [0058.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0058.076] GetProcessHeap () returned 0x630000 [0058.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0058.076] GetProcessHeap () returned 0x630000 [0058.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0058.076] GetProcessHeap () returned 0x630000 [0058.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0058.076] GetProcessHeap () returned 0x630000 [0058.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0058.076] GetProcessHeap () returned 0x630000 [0058.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0058.076] GetProcessHeap () returned 0x630000 [0058.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0058.076] GetProcessHeap () returned 0x630000 [0058.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0058.076] GetProcessHeap () returned 0x630000 [0058.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0058.076] GetProcessHeap () returned 0x630000 [0058.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0058.076] GetProcessHeap () returned 0x630000 [0058.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0058.076] GetProcessHeap () returned 0x630000 [0058.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0058.076] GetProcessHeap () returned 0x630000 [0058.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0058.076] GetProcessHeap () returned 0x630000 [0058.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0058.076] GetProcessHeap () returned 0x630000 [0058.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0058.076] GetProcessHeap () returned 0x630000 [0058.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0058.076] GetProcessHeap () returned 0x630000 [0058.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0058.077] GetProcessHeap () returned 0x630000 [0058.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0058.077] GetProcessHeap () returned 0x630000 [0058.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0058.077] GetProcessHeap () returned 0x630000 [0058.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0058.077] GetProcessHeap () returned 0x630000 [0058.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0058.077] GetProcessHeap () returned 0x630000 [0058.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0058.077] GetProcessHeap () returned 0x630000 [0058.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0058.077] GetProcessHeap () returned 0x630000 [0058.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0058.077] GetProcessHeap () returned 0x630000 [0058.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0058.077] GetProcessHeap () returned 0x630000 [0058.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0058.077] GetProcessHeap () returned 0x630000 [0058.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0058.077] GetProcessHeap () returned 0x630000 [0058.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0058.077] GetProcessHeap () returned 0x630000 [0058.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0058.077] GetProcessHeap () returned 0x630000 [0058.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0058.077] GetProcessHeap () returned 0x630000 [0058.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0058.077] GetProcessHeap () returned 0x630000 [0058.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0058.077] GetProcessHeap () returned 0x630000 [0058.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0058.077] GetProcessHeap () returned 0x630000 [0058.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0058.077] GetProcessHeap () returned 0x630000 [0058.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0058.077] GetProcessHeap () returned 0x630000 [0058.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0058.077] GetProcessHeap () returned 0x630000 [0058.078] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0058.078] GetProcessHeap () returned 0x630000 [0058.078] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0058.078] GetProcessHeap () returned 0x630000 [0058.078] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0058.078] GetProcessHeap () returned 0x630000 [0058.078] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0058.078] GetProcessHeap () returned 0x630000 [0058.078] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0058.078] GetProcessHeap () returned 0x630000 [0058.078] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0058.078] GetProcessHeap () returned 0x630000 [0058.078] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0058.078] GetProcessHeap () returned 0x630000 [0058.078] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0058.078] GetProcessHeap () returned 0x630000 [0058.078] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0058.078] GetProcessHeap () returned 0x630000 [0058.078] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0058.078] GetProcessHeap () returned 0x630000 [0058.078] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0058.078] GetProcessHeap () returned 0x630000 [0058.078] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0058.078] GetProcessHeap () returned 0x630000 [0058.078] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0058.078] GetProcessHeap () returned 0x630000 [0058.078] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0058.078] GetProcessHeap () returned 0x630000 [0058.078] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0058.078] GetProcessHeap () returned 0x630000 [0058.078] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0058.078] GetProcessHeap () returned 0x630000 [0058.078] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0058.079] GetProcessHeap () returned 0x630000 [0058.079] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0058.079] GetProcessHeap () returned 0x630000 [0058.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0058.079] GetProcessHeap () returned 0x630000 [0058.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0058.079] GetProcessHeap () returned 0x630000 [0058.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0058.079] GetProcessHeap () returned 0x630000 [0058.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0058.079] GetProcessHeap () returned 0x630000 [0058.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0058.079] GetProcessHeap () returned 0x630000 [0058.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0058.079] GetProcessHeap () returned 0x630000 [0058.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0058.079] GetProcessHeap () returned 0x630000 [0058.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0058.079] GetProcessHeap () returned 0x630000 [0058.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0058.079] GetProcessHeap () returned 0x630000 [0058.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0058.079] GetProcessHeap () returned 0x630000 [0058.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.079] GetProcessHeap () returned 0x630000 [0058.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0058.079] WriteFile (in: hFile=0x230, lpBuffer=0x65f7f0*, nNumberOfBytesToWrite=0x38a, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65f7f0*, lpNumberOfBytesWritten=0x243d864*=0x38a, lpOverlapped=0x0) returned 1 [0058.083] GetProcessHeap () returned 0x630000 [0058.083] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65f7f0, Size=0x30) returned 0x65f7f0 [0058.083] GetProcessHeap () returned 0x630000 [0058.083] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0058.083] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.083] GetProcessHeap () returned 0x630000 [0058.083] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x120) returned 0x65aac8 [0058.083] ReadFile (in: hFile=0x230, lpBuffer=0x65aac8, nNumberOfBytesToRead=0x120, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65aac8*, lpNumberOfBytesRead=0x243d7e8*=0x120, lpOverlapped=0x0) returned 1 [0058.084] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.084] WriteFile (in: hFile=0x230, lpBuffer=0x65aac8*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65aac8*, lpNumberOfBytesWritten=0x243d7e4*=0x120, lpOverlapped=0x0) returned 1 [0058.084] GetProcessHeap () returned 0x630000 [0058.085] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65aac8 | out: hHeap=0x630000) returned 1 [0058.085] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.085] WriteFile (in: hFile=0x230, lpBuffer=0x65f7f0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65f7f0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0058.085] CloseHandle (hObject=0x230) returned 1 [0058.087] GetProcessHeap () returned 0x630000 [0058.087] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0058.087] GetProcessHeap () returned 0x630000 [0058.087] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655580 | out: hHeap=0x630000) returned 1 [0058.087] GetProcessHeap () returned 0x630000 [0058.087] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0058.087] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\Public\\Documents\\desktop.ini" | out: lpString1="C:\\Users\\Public\\Documents\\desktop.ini") returned="C:\\Users\\Public\\Documents\\desktop.ini" [0058.087] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\desktop.ini", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\Public\\Documents\\desktop.ini.happythreechoose") returned="C:\\Users\\Public\\Documents\\desktop.ini.happythreechoose" [0058.087] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Documents\\desktop.ini" (normalized: "c:\\users\\public\\documents\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Documents\\desktop.ini.happythreechoose" (normalized: "c:\\users\\public\\documents\\desktop.ini.happythreechoose"), dwFlags=0x1) returned 1 [0058.088] PathRemoveFileSpecW (in: pszPath="C:\\Users\\Public\\Documents\\desktop.ini" | out: pszPath="C:\\Users\\Public\\Documents") returned 1 [0058.088] PathAddBackslashW (in: pszPath="C:\\Users\\Public\\Documents" | out: pszPath="C:\\Users\\Public\\Documents\\") returned="" [0058.088] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\Public\\Documents\\Decryption INFO.html") returned="C:\\Users\\Public\\Documents\\Decryption INFO.html" [0058.088] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Documents\\Decryption INFO.html" (normalized: "c:\\users\\public\\documents\\decryption info.html")) returned 0xffffffff [0058.088] CreateFileW (lpFileName="C:\\Users\\Public\\Documents\\Decryption INFO.html" (normalized: "c:\\users\\public\\documents\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0058.088] GetProcessHeap () returned 0x630000 [0058.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655aa8 [0058.088] GetProcessHeap () returned 0x630000 [0058.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0058.095] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.096] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.096] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.096] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.096] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.096] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.096] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.097] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.097] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.097] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.097] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.097] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.097] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.097] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.097] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.097] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.097] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.097] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.097] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.098] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.098] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.098] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.098] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.098] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.098] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.098] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.098] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.098] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.098] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.098] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.098] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.098] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.099] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.099] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.099] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.099] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.099] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.099] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.100] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.100] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.100] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.100] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.100] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.100] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.100] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.100] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.100] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.100] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.100] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.100] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.100] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.100] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.101] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.101] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.101] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.101] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.101] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.101] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.101] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.101] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.101] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.101] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.101] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.101] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.101] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.101] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.102] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.102] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.102] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.102] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.102] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.102] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.102] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.102] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.102] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.102] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.102] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.102] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.102] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.102] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.103] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.103] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.103] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.103] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.103] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.103] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.103] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.103] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.103] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.103] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.103] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.103] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.103] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.103] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.104] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.104] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.104] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.104] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.104] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.104] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.104] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.104] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.104] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.104] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.104] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.104] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.104] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.104] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.105] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.105] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.105] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.105] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.105] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.105] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.105] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.105] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.105] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.105] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.105] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.105] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.105] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.105] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.106] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.106] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.106] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.106] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.106] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.106] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.106] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.106] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.106] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.106] GetProcessHeap () returned 0x630000 [0058.106] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655aa8 | out: hHeap=0x630000) returned 1 [0058.106] GetProcessHeap () returned 0x630000 [0058.106] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0058.106] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0058.106] GetProcessHeap () returned 0x630000 [0058.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655490 [0058.106] GetProcessHeap () returned 0x630000 [0058.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0058.113] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.113] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.113] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.113] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.114] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.114] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.114] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.114] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.114] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.114] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.114] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.114] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.114] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.114] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.114] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.114] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.114] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.114] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.114] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.115] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.115] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.115] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.115] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.115] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.115] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.115] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.115] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.115] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.115] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.115] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.115] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.115] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.115] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.116] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.116] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.116] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.116] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.116] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.116] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.116] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.116] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.116] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.116] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.116] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.116] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.116] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.116] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.117] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.117] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.117] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.117] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.117] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.117] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.117] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.117] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.117] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.117] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.117] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.117] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.117] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.117] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.118] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.118] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.118] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.118] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.118] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.118] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.118] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.118] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.118] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.118] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.118] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.118] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.118] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.119] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.119] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.119] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.119] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.119] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.119] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.119] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.119] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.119] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.119] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.119] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.119] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.120] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.120] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.120] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.120] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.120] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.120] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.120] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.120] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.120] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.120] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.120] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.120] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.120] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.120] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.120] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.121] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.121] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.121] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.121] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.121] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.121] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.121] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.121] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.121] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.121] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.121] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.121] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.121] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.121] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.122] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.122] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.122] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.122] GetProcessHeap () returned 0x630000 [0058.122] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655490 | out: hHeap=0x630000) returned 1 [0058.122] GetProcessHeap () returned 0x630000 [0058.122] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0058.122] CloseHandle (hObject=0x230) returned 1 [0058.123] GetProcessHeap () returned 0x630000 [0058.123] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0058.123] FindNextFileW (in: hFindFile=0x648c10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0058.123] lstrcmpiW (lpString1="My Music", lpString2=".") returned 1 [0058.123] lstrcmpiW (lpString1="My Music", lpString2="..") returned 1 [0058.123] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="My Music" | out: lpString1="C:\\Users\\Public\\Documents\\My Music") returned="C:\\Users\\Public\\Documents\\My Music" [0058.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="My Music", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0058.123] GetProcessHeap () returned 0x630000 [0058.123] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9) returned 0x64c9f0 [0058.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="My Music", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="My Music", lpUsedDefaultChar=0x0) returned 9 [0058.123] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0058.123] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0058.123] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0058.123] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0058.123] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0058.123] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0058.123] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0058.123] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0058.123] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0058.123] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0058.123] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0058.123] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0058.123] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0058.123] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0058.123] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0058.123] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0058.124] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0058.124] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0058.124] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0058.124] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0058.124] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0058.124] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0058.124] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0058.124] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0058.124] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0058.124] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0058.124] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0058.124] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0058.124] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0058.124] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0058.124] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0058.124] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0058.124] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0058.124] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0058.124] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0058.124] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0058.124] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0058.124] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0058.124] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0058.124] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0058.124] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0058.124] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0058.124] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0058.124] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Music", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Music\\") returned="C:\\Users\\Public\\Documents\\My Music\\" [0058.124] GetProcessHeap () returned 0x630000 [0058.124] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a298 [0058.124] lstrlenW (lpString="C:\\Users\\Public\\Documents\\My Music\\") returned 35 [0058.124] GetProcessHeap () returned 0x630000 [0058.124] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x48) returned 0x655d60 [0058.124] lstrcpyW (in: lpString1=0x655d60, lpString2="C:\\Users\\Public\\Documents\\My Music\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Music\\") returned="C:\\Users\\Public\\Documents\\My Music\\" [0058.124] GetProcessHeap () returned 0x630000 [0058.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0058.125] FindNextFileW (in: hFindFile=0x648c10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0058.125] lstrcmpiW (lpString1="My Pictures", lpString2=".") returned 1 [0058.125] lstrcmpiW (lpString1="My Pictures", lpString2="..") returned 1 [0058.125] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="My Pictures" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures") returned="C:\\Users\\Public\\Documents\\My Pictures" [0058.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="My Pictures", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0058.125] GetProcessHeap () returned 0x630000 [0058.125] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0058.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="My Pictures", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="My Pictures", lpUsedDefaultChar=0x0) returned 12 [0058.125] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0058.125] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0058.125] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0058.125] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0058.125] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0058.125] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0058.125] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0058.129] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0058.129] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0058.129] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0058.129] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0058.129] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0058.129] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0058.129] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0058.129] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0058.129] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0058.129] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0058.129] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0058.129] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0058.129] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0058.129] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0058.129] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0058.129] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0058.129] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0058.129] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0058.129] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0058.129] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0058.129] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0058.129] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0058.129] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0058.129] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0058.129] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0058.129] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0058.129] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0058.129] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0058.129] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0058.129] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0058.129] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0058.129] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0058.129] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0058.130] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0058.130] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0058.130] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0058.130] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Pictures", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\") returned="C:\\Users\\Public\\Documents\\My Pictures\\" [0058.130] GetProcessHeap () returned 0x630000 [0058.130] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a398 [0058.130] lstrlenW (lpString="C:\\Users\\Public\\Documents\\My Pictures\\") returned 38 [0058.130] GetProcessHeap () returned 0x630000 [0058.130] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4e) returned 0x65f430 [0058.130] lstrcpyW (in: lpString1=0x65f430, lpString2="C:\\Users\\Public\\Documents\\My Pictures\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\") returned="C:\\Users\\Public\\Documents\\My Pictures\\" [0058.130] GetProcessHeap () returned 0x630000 [0058.130] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0058.130] FindNextFileW (in: hFindFile=0x648c10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0058.130] lstrcmpiW (lpString1="My Videos", lpString2=".") returned 1 [0058.130] lstrcmpiW (lpString1="My Videos", lpString2="..") returned 1 [0058.130] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="My Videos" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos") returned="C:\\Users\\Public\\Documents\\My Videos" [0058.130] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="My Videos", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0058.130] GetProcessHeap () returned 0x630000 [0058.130] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x64c9f0 [0058.130] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="My Videos", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="My Videos", lpUsedDefaultChar=0x0) returned 10 [0058.130] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0058.130] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0058.130] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0058.130] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0058.130] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0058.130] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0058.130] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0058.130] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0058.130] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0058.130] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0058.130] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0058.130] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0058.130] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0058.130] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0058.131] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0058.131] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0058.131] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0058.131] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0058.131] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0058.131] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0058.131] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0058.131] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0058.131] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0058.131] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0058.131] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0058.131] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0058.131] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0058.131] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0058.131] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0058.131] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0058.131] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0058.131] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0058.131] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0058.131] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0058.131] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0058.131] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0058.131] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0058.131] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0058.131] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0058.131] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0058.131] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0058.131] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0058.131] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0058.131] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Videos", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos\\") returned="C:\\Users\\Public\\Documents\\My Videos\\" [0058.131] GetProcessHeap () returned 0x630000 [0058.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a2b8 [0058.131] lstrlenW (lpString="C:\\Users\\Public\\Documents\\My Videos\\") returned 36 [0058.131] GetProcessHeap () returned 0x630000 [0058.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4a) returned 0x65f328 [0058.132] lstrcpyW (in: lpString1=0x65f328, lpString2="C:\\Users\\Public\\Documents\\My Videos\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos\\") returned="C:\\Users\\Public\\Documents\\My Videos\\" [0058.132] GetProcessHeap () returned 0x630000 [0058.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0058.132] FindNextFileW (in: hFindFile=0x648c10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0058.132] FindClose (in: hFindFile=0x648c10 | out: hFindFile=0x648c10) returned 1 [0058.132] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\Public\\Documents\\My Videos\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos\\") returned="C:\\Users\\Public\\Documents\\My Videos\\" [0058.132] GetProcessHeap () returned 0x630000 [0058.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65f328 | out: hHeap=0x630000) returned 1 [0058.132] GetProcessHeap () returned 0x630000 [0058.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0058.132] lstrlenW (lpString="C:\\Users\\Public\\Documents\\My Videos\\") returned 36 [0058.132] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Videos\\", lpString2="*" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos\\*") returned="C:\\Users\\Public\\Documents\\My Videos\\*" [0058.132] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0xffffffff [0058.133] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\Public\\Documents\\My Pictures\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\") returned="C:\\Users\\Public\\Documents\\My Pictures\\" [0058.133] GetProcessHeap () returned 0x630000 [0058.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65f430 | out: hHeap=0x630000) returned 1 [0058.133] GetProcessHeap () returned 0x630000 [0058.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0058.133] lstrlenW (lpString="C:\\Users\\Public\\Documents\\My Pictures\\") returned 38 [0058.133] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\", lpString2="*" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\*") returned="C:\\Users\\Public\\Documents\\My Pictures\\*" [0058.133] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0xffffffff [0058.133] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\Public\\Documents\\My Music\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Music\\") returned="C:\\Users\\Public\\Documents\\My Music\\" [0058.133] GetProcessHeap () returned 0x630000 [0058.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655d60 | out: hHeap=0x630000) returned 1 [0058.133] GetProcessHeap () returned 0x630000 [0058.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0058.133] lstrlenW (lpString="C:\\Users\\Public\\Documents\\My Music\\") returned 35 [0058.133] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Music\\", lpString2="*" | out: lpString1="C:\\Users\\Public\\Documents\\My Music\\*") returned="C:\\Users\\Public\\Documents\\My Music\\*" [0058.134] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Music\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0xffffffff [0058.134] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\Public\\Desktop\\" | out: lpString1="C:\\Users\\Public\\Desktop\\") returned="C:\\Users\\Public\\Desktop\\" [0058.134] GetProcessHeap () returned 0x630000 [0058.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x648a10 | out: hHeap=0x630000) returned 1 [0058.134] GetProcessHeap () returned 0x630000 [0058.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0058.134] lstrlenW (lpString="C:\\Users\\Public\\Desktop\\") returned 24 [0058.134] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\", lpString2="*" | out: lpString1="C:\\Users\\Public\\Desktop\\*") returned="C:\\Users\\Public\\Desktop\\*" [0058.134] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Desktop\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c3ce2c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648a10 [0058.134] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0058.134] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c3ce2c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.134] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0058.134] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0058.134] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38bb5c78, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x38bb5c78, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x38bb5c78, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x852, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Acrobat Reader DC.lnk", cAlternateFileName="ACROBA~1.LNK")) returned 1 [0058.134] lstrcmpiW (lpString1="Acrobat Reader DC.lnk", lpString2=".") returned 1 [0058.134] lstrcmpiW (lpString1="Acrobat Reader DC.lnk", lpString2="..") returned 1 [0058.134] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\", lpString2="Acrobat Reader DC.lnk" | out: lpString1="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk") returned="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk" [0058.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Acrobat Reader DC.lnk", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0058.134] GetProcessHeap () returned 0x630000 [0058.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x645e98 [0058.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Acrobat Reader DC.lnk", cchWideChar=-1, lpMultiByteStr=0x645e98, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acrobat Reader DC.lnk", lpUsedDefaultChar=0x0) returned 22 [0058.134] lstrlenA (lpString="Acrobat Reader DC.lnk") returned 21 [0058.134] lstrlenA (lpString=".happythreechoose") returned 17 [0058.134] lstrlenA (lpString=".happythreechoose") returned 17 [0058.134] lstrlenA (lpString="Acrobat Reader DC.lnk") returned 21 [0058.134] lstrcmpiA (lpString1="bat Reader DC.lnk", lpString2=".happythreechoose") returned 1 [0058.134] lstrcmpiW (lpString1="Acrobat Reader DC.lnk", lpString2="Decryption INFO.html") returned -1 [0058.134] lstrcmpiW (lpString1="Acrobat Reader DC.lnk", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0058.134] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0058.135] lstrcmpiW (lpString1="Acrobat Reader DC.lnk", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0058.135] GetProcessHeap () returned 0x630000 [0058.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0058.135] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk" (normalized: "c:\\users\\public\\desktop\\acrobat reader dc.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0058.135] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=2130) returned 1 [0058.135] GetProcessHeap () returned 0x630000 [0058.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655508 [0058.135] GetProcessHeap () returned 0x630000 [0058.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0058.135] lstrlenW (lpString="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk") returned 45 [0058.135] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.135] GetProcessHeap () returned 0x630000 [0058.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0058.135] GetProcessHeap () returned 0x630000 [0058.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38e) returned 0x65f828 [0058.135] lstrlenA (lpString="rsa_encrypt") returned 11 [0058.135] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0058.136] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0058.136] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0058.136] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0058.136] GetProcessHeap () returned 0x630000 [0058.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0058.136] lstrlenA (lpString="010001") returned 6 [0058.136] GetProcessHeap () returned 0x630000 [0058.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2f8 [0058.136] GetProcessHeap () returned 0x630000 [0058.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.136] GetProcessHeap () returned 0x630000 [0058.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65eb20 [0058.136] GetProcessHeap () returned 0x630000 [0058.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.136] GetProcessHeap () returned 0x630000 [0058.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e850 [0058.136] GetProcessHeap () returned 0x630000 [0058.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657670 [0058.136] GetProcessHeap () returned 0x630000 [0058.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a378 [0058.136] GetProcessHeap () returned 0x630000 [0058.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0058.136] GetProcessHeap () returned 0x630000 [0058.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0058.136] GetProcessHeap () returned 0x630000 [0058.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0058.136] GetProcessHeap () returned 0x630000 [0058.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.136] GetProcessHeap () returned 0x630000 [0058.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656950 [0058.137] GetProcessHeap () returned 0x630000 [0058.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0058.137] GetProcessHeap () returned 0x630000 [0058.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0058.137] GetProcessHeap () returned 0x630000 [0058.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ec40 [0058.137] GetProcessHeap () returned 0x630000 [0058.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.137] GetProcessHeap () returned 0x630000 [0058.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0058.137] GetProcessHeap () returned 0x630000 [0058.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ec40 | out: hHeap=0x630000) returned 1 [0058.137] GetProcessHeap () returned 0x630000 [0058.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0058.137] GetProcessHeap () returned 0x630000 [0058.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0058.137] GetProcessHeap () returned 0x630000 [0058.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0058.137] GetProcessHeap () returned 0x630000 [0058.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0058.137] GetProcessHeap () returned 0x630000 [0058.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0058.137] GetProcessHeap () returned 0x630000 [0058.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0058.137] GetProcessHeap () returned 0x630000 [0058.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65dda0 [0058.137] GetProcessHeap () returned 0x630000 [0058.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0058.137] GetProcessHeap () returned 0x630000 [0058.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0058.137] GetProcessHeap () returned 0x630000 [0058.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0058.137] GetProcessHeap () returned 0x630000 [0058.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.137] GetProcessHeap () returned 0x630000 [0058.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.137] GetProcessHeap () returned 0x630000 [0058.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0058.138] GetProcessHeap () returned 0x630000 [0058.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0058.138] GetProcessHeap () returned 0x630000 [0058.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0058.138] GetProcessHeap () returned 0x630000 [0058.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0058.138] GetProcessHeap () returned 0x630000 [0058.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0058.138] GetProcessHeap () returned 0x630000 [0058.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0058.138] GetProcessHeap () returned 0x630000 [0058.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.138] GetProcessHeap () returned 0x630000 [0058.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.138] GetProcessHeap () returned 0x630000 [0058.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0058.138] GetProcessHeap () returned 0x630000 [0058.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0058.138] GetProcessHeap () returned 0x630000 [0058.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0058.138] GetProcessHeap () returned 0x630000 [0058.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0058.138] GetProcessHeap () returned 0x630000 [0058.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.138] GetProcessHeap () returned 0x630000 [0058.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.138] GetProcessHeap () returned 0x630000 [0058.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.138] GetProcessHeap () returned 0x630000 [0058.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.138] GetProcessHeap () returned 0x630000 [0058.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0058.138] GetProcessHeap () returned 0x630000 [0058.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0058.138] GetProcessHeap () returned 0x630000 [0058.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.138] GetProcessHeap () returned 0x630000 [0058.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.139] GetProcessHeap () returned 0x630000 [0058.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.139] GetProcessHeap () returned 0x630000 [0058.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.139] GetProcessHeap () returned 0x630000 [0058.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0058.139] GetProcessHeap () returned 0x630000 [0058.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0058.139] GetProcessHeap () returned 0x630000 [0058.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0058.139] GetProcessHeap () returned 0x630000 [0058.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0058.139] GetProcessHeap () returned 0x630000 [0058.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0058.139] GetProcessHeap () returned 0x630000 [0058.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0058.139] GetProcessHeap () returned 0x630000 [0058.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0058.139] GetProcessHeap () returned 0x630000 [0058.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0058.139] GetProcessHeap () returned 0x630000 [0058.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0058.139] GetProcessHeap () returned 0x630000 [0058.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0058.139] GetProcessHeap () returned 0x630000 [0058.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.139] GetProcessHeap () returned 0x630000 [0058.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.139] GetProcessHeap () returned 0x630000 [0058.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0058.139] GetProcessHeap () returned 0x630000 [0058.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0058.139] GetProcessHeap () returned 0x630000 [0058.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0058.139] GetProcessHeap () returned 0x630000 [0058.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0058.139] GetProcessHeap () returned 0x630000 [0058.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.140] GetProcessHeap () returned 0x630000 [0058.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.140] GetProcessHeap () returned 0x630000 [0058.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0058.140] GetProcessHeap () returned 0x630000 [0058.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0058.140] GetProcessHeap () returned 0x630000 [0058.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0058.140] GetProcessHeap () returned 0x630000 [0058.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0058.140] GetProcessHeap () returned 0x630000 [0058.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0058.140] GetProcessHeap () returned 0x630000 [0058.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0058.140] GetProcessHeap () returned 0x630000 [0058.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0058.140] GetProcessHeap () returned 0x630000 [0058.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0058.140] GetProcessHeap () returned 0x630000 [0058.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0058.140] GetProcessHeap () returned 0x630000 [0058.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0058.140] GetProcessHeap () returned 0x630000 [0058.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0058.140] GetProcessHeap () returned 0x630000 [0058.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0058.140] GetProcessHeap () returned 0x630000 [0058.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0058.140] GetProcessHeap () returned 0x630000 [0058.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0058.140] GetProcessHeap () returned 0x630000 [0058.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0058.140] GetProcessHeap () returned 0x630000 [0058.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0058.140] GetProcessHeap () returned 0x630000 [0058.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0058.141] GetProcessHeap () returned 0x630000 [0058.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0058.141] GetProcessHeap () returned 0x630000 [0058.141] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.141] GetProcessHeap () returned 0x630000 [0058.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.141] GetProcessHeap () returned 0x630000 [0058.141] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0058.141] GetProcessHeap () returned 0x630000 [0058.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0058.141] GetProcessHeap () returned 0x630000 [0058.141] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0058.141] GetProcessHeap () returned 0x630000 [0058.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0058.142] GetProcessHeap () returned 0x630000 [0058.142] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0058.142] GetProcessHeap () returned 0x630000 [0058.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0058.142] GetProcessHeap () returned 0x630000 [0058.142] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0058.142] GetProcessHeap () returned 0x630000 [0058.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0058.142] GetProcessHeap () returned 0x630000 [0058.142] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0058.142] GetProcessHeap () returned 0x630000 [0058.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0058.142] GetProcessHeap () returned 0x630000 [0058.142] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0058.142] GetProcessHeap () returned 0x630000 [0058.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0058.142] GetProcessHeap () returned 0x630000 [0058.142] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0058.142] GetProcessHeap () returned 0x630000 [0058.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0058.142] GetProcessHeap () returned 0x630000 [0058.142] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0058.142] GetProcessHeap () returned 0x630000 [0058.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0058.142] GetProcessHeap () returned 0x630000 [0058.142] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0058.142] GetProcessHeap () returned 0x630000 [0058.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0058.142] GetProcessHeap () returned 0x630000 [0058.142] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0058.142] GetProcessHeap () returned 0x630000 [0058.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0058.142] GetProcessHeap () returned 0x630000 [0058.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0058.142] GetProcessHeap () returned 0x630000 [0058.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0058.142] GetProcessHeap () returned 0x630000 [0058.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0058.143] GetProcessHeap () returned 0x630000 [0058.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0058.143] GetProcessHeap () returned 0x630000 [0058.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0058.143] GetProcessHeap () returned 0x630000 [0058.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0058.143] GetProcessHeap () returned 0x630000 [0058.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0058.143] GetProcessHeap () returned 0x630000 [0058.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0058.143] GetProcessHeap () returned 0x630000 [0058.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0058.143] GetProcessHeap () returned 0x630000 [0058.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0058.143] GetProcessHeap () returned 0x630000 [0058.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0058.143] WriteFile (in: hFile=0x230, lpBuffer=0x65f828*, nNumberOfBytesToWrite=0x38e, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65f828*, lpNumberOfBytesWritten=0x243d864*=0x38e, lpOverlapped=0x0) returned 1 [0058.148] GetProcessHeap () returned 0x630000 [0058.148] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65f828, Size=0x30) returned 0x65f828 [0058.148] GetProcessHeap () returned 0x630000 [0058.148] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0058.148] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.148] GetProcessHeap () returned 0x630000 [0058.148] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x860) returned 0x65f860 [0058.148] ReadFile (in: hFile=0x230, lpBuffer=0x65f860, nNumberOfBytesToRead=0x860, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65f860*, lpNumberOfBytesRead=0x243d7e8*=0x860, lpOverlapped=0x0) returned 1 [0058.148] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.148] WriteFile (in: hFile=0x230, lpBuffer=0x65f860*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65f860*, lpNumberOfBytesWritten=0x243d7e4*=0x860, lpOverlapped=0x0) returned 1 [0058.149] GetProcessHeap () returned 0x630000 [0058.149] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65f860 | out: hHeap=0x630000) returned 1 [0058.149] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.150] WriteFile (in: hFile=0x230, lpBuffer=0x65f828*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65f828*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0058.150] CloseHandle (hObject=0x230) returned 1 [0058.152] GetProcessHeap () returned 0x630000 [0058.152] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0058.152] GetProcessHeap () returned 0x630000 [0058.152] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655508 | out: hHeap=0x630000) returned 1 [0058.152] GetProcessHeap () returned 0x630000 [0058.152] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0058.152] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk" | out: lpString1="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk") returned="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk" [0058.152] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk.happythreechoose") returned="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk.happythreechoose" [0058.152] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk" (normalized: "c:\\users\\public\\desktop\\acrobat reader dc.lnk"), lpNewFileName="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk.happythreechoose" (normalized: "c:\\users\\public\\desktop\\acrobat reader dc.lnk.happythreechoose"), dwFlags=0x1) returned 1 [0058.153] PathRemoveFileSpecW (in: pszPath="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk" | out: pszPath="C:\\Users\\Public\\Desktop") returned 1 [0058.153] PathAddBackslashW (in: pszPath="C:\\Users\\Public\\Desktop" | out: pszPath="C:\\Users\\Public\\Desktop\\") returned="" [0058.153] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\Public\\Desktop\\Decryption INFO.html") returned="C:\\Users\\Public\\Desktop\\Decryption INFO.html" [0058.153] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Desktop\\Decryption INFO.html" (normalized: "c:\\users\\public\\desktop\\decryption info.html")) returned 0xffffffff [0058.153] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Decryption INFO.html" (normalized: "c:\\users\\public\\desktop\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0058.153] GetProcessHeap () returned 0x630000 [0058.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655508 [0058.153] GetProcessHeap () returned 0x630000 [0058.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0058.160] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.161] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.161] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.161] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.161] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.162] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.162] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.162] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.162] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.162] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.162] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.162] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.162] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.162] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.162] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.162] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.162] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.162] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.163] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.163] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.163] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.163] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.163] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.163] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.163] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.163] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.163] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.163] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.163] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.163] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.164] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.164] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.164] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.164] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.164] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.164] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.164] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.165] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.165] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.165] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.165] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.165] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.165] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.165] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.165] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.165] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.165] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.166] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.166] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.166] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.166] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.166] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.166] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.166] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.166] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.166] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.166] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.166] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.166] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.166] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.167] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.167] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.167] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.167] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.167] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.167] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.167] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.167] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.167] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.167] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.167] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.167] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.167] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.167] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.167] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.168] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.168] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.168] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.168] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.168] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.168] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.168] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.168] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.168] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.168] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.168] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.168] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.168] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.168] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.169] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.169] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.169] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.169] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.169] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.169] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.169] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.169] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.169] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.169] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.169] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.169] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.169] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.169] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.170] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.170] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.170] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.170] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.170] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.170] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.170] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.170] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.170] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.170] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.170] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.170] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.170] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.170] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.171] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.171] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.171] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.171] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.171] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.171] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.171] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.171] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.171] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.171] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.171] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.171] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.171] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.172] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.172] GetProcessHeap () returned 0x630000 [0058.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655508 | out: hHeap=0x630000) returned 1 [0058.172] GetProcessHeap () returned 0x630000 [0058.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0058.172] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0058.172] GetProcessHeap () returned 0x630000 [0058.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6559b8 [0058.172] GetProcessHeap () returned 0x630000 [0058.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0058.179] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.179] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.179] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.179] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.179] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.179] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.179] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.179] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.179] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.180] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.180] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.180] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.180] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.180] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.180] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.180] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.180] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.180] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.180] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.180] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.180] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.180] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.180] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.180] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.181] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.181] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.181] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.181] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.181] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.181] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.181] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.181] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.181] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.181] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.181] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.181] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.181] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.181] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.182] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.182] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.182] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.182] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.182] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.182] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.182] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.182] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.182] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.182] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.182] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.182] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.182] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.182] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.183] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.183] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.183] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.183] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.183] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.183] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.183] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.183] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.183] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.183] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.183] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.183] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.183] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.183] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.184] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.184] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.184] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.184] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.184] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.184] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.184] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.184] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.184] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.184] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.184] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.184] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.184] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.185] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.185] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.187] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.187] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.187] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.187] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.187] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.187] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.187] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.188] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.188] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.188] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.188] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.188] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.188] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.188] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.188] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.188] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.188] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.188] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.188] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.188] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.189] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.189] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.189] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.189] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.189] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.189] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.189] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.189] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.189] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.189] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.189] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.189] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.189] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.189] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.189] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.190] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.190] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.190] GetProcessHeap () returned 0x630000 [0058.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6559b8 | out: hHeap=0x630000) returned 1 [0058.190] GetProcessHeap () returned 0x630000 [0058.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0058.190] CloseHandle (hObject=0x230) returned 1 [0058.191] GetProcessHeap () returned 0x630000 [0058.191] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645e98 | out: hHeap=0x630000) returned 1 [0058.191] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0058.191] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0058.191] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0058.191] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\Public\\Desktop\\desktop.ini") returned="C:\\Users\\Public\\Desktop\\desktop.ini" [0058.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0058.191] GetProcessHeap () returned 0x630000 [0058.191] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0058.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0058.191] lstrlenA (lpString="desktop.ini") returned 11 [0058.191] lstrlenA (lpString=".happythreechoose") returned 17 [0058.191] lstrcmpiW (lpString1="desktop.ini", lpString2="Decryption INFO.html") returned 1 [0058.191] lstrcmpiW (lpString1="desktop.ini", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0058.191] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0058.191] lstrcmpiW (lpString1="desktop.ini", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0058.191] GetProcessHeap () returned 0x630000 [0058.191] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0058.191] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\desktop.ini" (normalized: "c:\\users\\public\\desktop\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0058.191] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=174) returned 1 [0058.192] GetProcessHeap () returned 0x630000 [0058.192] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655580 [0058.192] GetProcessHeap () returned 0x630000 [0058.192] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0058.192] lstrlenW (lpString="C:\\Users\\Public\\Desktop\\desktop.ini") returned 35 [0058.192] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.192] GetProcessHeap () returned 0x630000 [0058.192] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0058.192] GetProcessHeap () returned 0x630000 [0058.192] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x382) returned 0x65f860 [0058.192] lstrlenA (lpString="rsa_encrypt") returned 11 [0058.192] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0058.192] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0058.192] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0058.192] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0058.193] GetProcessHeap () returned 0x630000 [0058.193] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0058.193] lstrlenA (lpString="010001") returned 6 [0058.193] GetProcessHeap () returned 0x630000 [0058.193] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a398 [0058.193] GetProcessHeap () returned 0x630000 [0058.193] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.193] GetProcessHeap () returned 0x630000 [0058.193] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e610 [0058.193] GetProcessHeap () returned 0x630000 [0058.193] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.193] GetProcessHeap () returned 0x630000 [0058.193] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ecd0 [0058.193] GetProcessHeap () returned 0x630000 [0058.193] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657558 [0058.193] GetProcessHeap () returned 0x630000 [0058.193] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2f8 [0058.193] GetProcessHeap () returned 0x630000 [0058.193] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0058.193] GetProcessHeap () returned 0x630000 [0058.193] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0058.193] GetProcessHeap () returned 0x630000 [0058.193] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0058.193] GetProcessHeap () returned 0x630000 [0058.193] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.193] GetProcessHeap () returned 0x630000 [0058.193] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657788 [0058.193] GetProcessHeap () returned 0x630000 [0058.193] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0058.193] GetProcessHeap () returned 0x630000 [0058.193] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0058.193] GetProcessHeap () returned 0x630000 [0058.193] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e460 [0058.193] GetProcessHeap () returned 0x630000 [0058.193] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.193] GetProcessHeap () returned 0x630000 [0058.193] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0058.193] GetProcessHeap () returned 0x630000 [0058.193] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e460 | out: hHeap=0x630000) returned 1 [0058.194] GetProcessHeap () returned 0x630000 [0058.194] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0058.194] GetProcessHeap () returned 0x630000 [0058.194] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65aa98 [0058.194] GetProcessHeap () returned 0x630000 [0058.194] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0058.194] GetProcessHeap () returned 0x630000 [0058.194] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0058.194] GetProcessHeap () returned 0x630000 [0058.194] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0058.194] GetProcessHeap () returned 0x630000 [0058.194] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0058.194] GetProcessHeap () returned 0x630000 [0058.194] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ea00 [0058.194] GetProcessHeap () returned 0x630000 [0058.194] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65aa98 | out: hHeap=0x630000) returned 1 [0058.194] GetProcessHeap () returned 0x630000 [0058.194] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0058.194] GetProcessHeap () returned 0x630000 [0058.194] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0058.194] GetProcessHeap () returned 0x630000 [0058.194] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0058.194] GetProcessHeap () returned 0x630000 [0058.194] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0058.194] GetProcessHeap () returned 0x630000 [0058.194] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0058.194] GetProcessHeap () returned 0x630000 [0058.194] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0058.194] GetProcessHeap () returned 0x630000 [0058.194] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0058.194] GetProcessHeap () returned 0x630000 [0058.194] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0058.194] GetProcessHeap () returned 0x630000 [0058.194] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0058.194] GetProcessHeap () returned 0x630000 [0058.194] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0058.194] GetProcessHeap () returned 0x630000 [0058.194] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0058.194] GetProcessHeap () returned 0x630000 [0058.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0058.195] GetProcessHeap () returned 0x630000 [0058.195] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0058.195] GetProcessHeap () returned 0x630000 [0058.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0058.195] GetProcessHeap () returned 0x630000 [0058.195] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0058.195] GetProcessHeap () returned 0x630000 [0058.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0058.195] GetProcessHeap () returned 0x630000 [0058.195] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0058.195] GetProcessHeap () returned 0x630000 [0058.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0058.195] GetProcessHeap () returned 0x630000 [0058.195] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0058.195] GetProcessHeap () returned 0x630000 [0058.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0058.195] GetProcessHeap () returned 0x630000 [0058.195] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0058.195] GetProcessHeap () returned 0x630000 [0058.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0058.195] GetProcessHeap () returned 0x630000 [0058.195] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0058.195] GetProcessHeap () returned 0x630000 [0058.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0058.195] GetProcessHeap () returned 0x630000 [0058.195] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0058.195] GetProcessHeap () returned 0x630000 [0058.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0058.195] GetProcessHeap () returned 0x630000 [0058.195] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0058.195] GetProcessHeap () returned 0x630000 [0058.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0058.195] GetProcessHeap () returned 0x630000 [0058.195] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0058.196] GetProcessHeap () returned 0x630000 [0058.196] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0058.196] GetProcessHeap () returned 0x630000 [0058.196] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0058.196] GetProcessHeap () returned 0x630000 [0058.196] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0058.196] GetProcessHeap () returned 0x630000 [0058.196] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.196] GetProcessHeap () returned 0x630000 [0058.196] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.196] GetProcessHeap () returned 0x630000 [0058.196] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0058.196] GetProcessHeap () returned 0x630000 [0058.196] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0058.196] GetProcessHeap () returned 0x630000 [0058.196] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0058.196] GetProcessHeap () returned 0x630000 [0058.196] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0058.196] GetProcessHeap () returned 0x630000 [0058.196] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0058.196] GetProcessHeap () returned 0x630000 [0058.196] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0058.196] GetProcessHeap () returned 0x630000 [0058.196] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.196] GetProcessHeap () returned 0x630000 [0058.196] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.196] GetProcessHeap () returned 0x630000 [0058.196] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0058.196] GetProcessHeap () returned 0x630000 [0058.196] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0058.196] GetProcessHeap () returned 0x630000 [0058.196] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.196] GetProcessHeap () returned 0x630000 [0058.196] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.196] GetProcessHeap () returned 0x630000 [0058.196] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0058.196] GetProcessHeap () returned 0x630000 [0058.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0058.197] GetProcessHeap () returned 0x630000 [0058.197] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0058.197] GetProcessHeap () returned 0x630000 [0058.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0058.197] GetProcessHeap () returned 0x630000 [0058.197] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0058.197] GetProcessHeap () returned 0x630000 [0058.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0058.197] GetProcessHeap () returned 0x630000 [0058.197] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0058.197] GetProcessHeap () returned 0x630000 [0058.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0058.197] GetProcessHeap () returned 0x630000 [0058.197] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0058.197] GetProcessHeap () returned 0x630000 [0058.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0058.197] GetProcessHeap () returned 0x630000 [0058.197] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0058.197] GetProcessHeap () returned 0x630000 [0058.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0058.197] GetProcessHeap () returned 0x630000 [0058.197] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0058.197] GetProcessHeap () returned 0x630000 [0058.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0058.197] GetProcessHeap () returned 0x630000 [0058.197] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0058.197] GetProcessHeap () returned 0x630000 [0058.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0058.197] GetProcessHeap () returned 0x630000 [0058.197] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0058.197] GetProcessHeap () returned 0x630000 [0058.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0058.197] GetProcessHeap () returned 0x630000 [0058.197] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0058.197] GetProcessHeap () returned 0x630000 [0058.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0058.198] GetProcessHeap () returned 0x630000 [0058.198] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.198] GetProcessHeap () returned 0x630000 [0058.198] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.198] GetProcessHeap () returned 0x630000 [0058.198] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0058.198] GetProcessHeap () returned 0x630000 [0058.198] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0058.198] GetProcessHeap () returned 0x630000 [0058.198] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0058.198] GetProcessHeap () returned 0x630000 [0058.198] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0058.198] GetProcessHeap () returned 0x630000 [0058.198] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0058.198] GetProcessHeap () returned 0x630000 [0058.198] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0058.198] GetProcessHeap () returned 0x630000 [0058.198] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0058.198] GetProcessHeap () returned 0x630000 [0058.198] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0058.198] GetProcessHeap () returned 0x630000 [0058.198] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0058.198] GetProcessHeap () returned 0x630000 [0058.198] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0058.198] GetProcessHeap () returned 0x630000 [0058.198] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0058.198] GetProcessHeap () returned 0x630000 [0058.198] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0058.198] GetProcessHeap () returned 0x630000 [0058.198] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0058.198] GetProcessHeap () returned 0x630000 [0058.198] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0058.198] GetProcessHeap () returned 0x630000 [0058.198] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0058.198] GetProcessHeap () returned 0x630000 [0058.198] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0058.198] GetProcessHeap () returned 0x630000 [0058.198] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0058.199] GetProcessHeap () returned 0x630000 [0058.199] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0058.199] GetProcessHeap () returned 0x630000 [0058.199] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0058.199] GetProcessHeap () returned 0x630000 [0058.199] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0058.199] GetProcessHeap () returned 0x630000 [0058.199] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0058.199] GetProcessHeap () returned 0x630000 [0058.199] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ecd0 | out: hHeap=0x630000) returned 1 [0058.199] GetProcessHeap () returned 0x630000 [0058.199] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0058.199] GetProcessHeap () returned 0x630000 [0058.199] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0058.199] GetProcessHeap () returned 0x630000 [0058.199] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0058.199] GetProcessHeap () returned 0x630000 [0058.199] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0058.199] GetProcessHeap () returned 0x630000 [0058.199] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0058.199] WriteFile (in: hFile=0x230, lpBuffer=0x65f860*, nNumberOfBytesToWrite=0x382, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65f860*, lpNumberOfBytesWritten=0x243d864*=0x382, lpOverlapped=0x0) returned 1 [0058.202] GetProcessHeap () returned 0x630000 [0058.202] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65f860, Size=0x30) returned 0x65f860 [0058.202] GetProcessHeap () returned 0x630000 [0058.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0058.202] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.202] GetProcessHeap () returned 0x630000 [0058.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb0) returned 0x640c90 [0058.202] ReadFile (in: hFile=0x230, lpBuffer=0x640c90, nNumberOfBytesToRead=0xb0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x640c90*, lpNumberOfBytesRead=0x243d7e8*=0xb0, lpOverlapped=0x0) returned 1 [0058.202] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.202] WriteFile (in: hFile=0x230, lpBuffer=0x640c90*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x640c90*, lpNumberOfBytesWritten=0x243d7e4*=0xb0, lpOverlapped=0x0) returned 1 [0058.203] GetProcessHeap () returned 0x630000 [0058.204] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.204] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.204] WriteFile (in: hFile=0x230, lpBuffer=0x65f860*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65f860*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0058.204] CloseHandle (hObject=0x230) returned 1 [0058.206] GetProcessHeap () returned 0x630000 [0058.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0058.206] GetProcessHeap () returned 0x630000 [0058.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655580 | out: hHeap=0x630000) returned 1 [0058.206] GetProcessHeap () returned 0x630000 [0058.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0058.206] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\Public\\Desktop\\desktop.ini" | out: lpString1="C:\\Users\\Public\\Desktop\\desktop.ini") returned="C:\\Users\\Public\\Desktop\\desktop.ini" [0058.206] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\desktop.ini", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\Public\\Desktop\\desktop.ini.happythreechoose") returned="C:\\Users\\Public\\Desktop\\desktop.ini.happythreechoose" [0058.206] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Desktop\\desktop.ini" (normalized: "c:\\users\\public\\desktop\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\Desktop\\desktop.ini.happythreechoose" (normalized: "c:\\users\\public\\desktop\\desktop.ini.happythreechoose"), dwFlags=0x1) returned 1 [0058.206] PathRemoveFileSpecW (in: pszPath="C:\\Users\\Public\\Desktop\\desktop.ini" | out: pszPath="C:\\Users\\Public\\Desktop") returned 1 [0058.206] PathAddBackslashW (in: pszPath="C:\\Users\\Public\\Desktop" | out: pszPath="C:\\Users\\Public\\Desktop\\") returned="" [0058.207] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\Public\\Desktop\\Decryption INFO.html") returned="C:\\Users\\Public\\Desktop\\Decryption INFO.html" [0058.207] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Desktop\\Decryption INFO.html" (normalized: "c:\\users\\public\\desktop\\decryption info.html")) returned 0x20 [0058.207] GetProcessHeap () returned 0x630000 [0058.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0058.207] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4c3ce2c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c6308a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x91a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1 [0058.207] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2=".") returned 1 [0058.207] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2="..") returned 1 [0058.207] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\", lpString2="Google Chrome.lnk" | out: lpString1="C:\\Users\\Public\\Desktop\\Google Chrome.lnk") returned="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" [0058.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Google Chrome.lnk", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0058.207] GetProcessHeap () returned 0x630000 [0058.207] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x645e58 [0058.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Google Chrome.lnk", cchWideChar=-1, lpMultiByteStr=0x645e58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Google Chrome.lnk", lpUsedDefaultChar=0x0) returned 18 [0058.207] lstrlenA (lpString="Google Chrome.lnk") returned 17 [0058.207] lstrlenA (lpString=".happythreechoose") returned 17 [0058.207] lstrlenA (lpString=".happythreechoose") returned 17 [0058.207] lstrlenA (lpString="Google Chrome.lnk") returned 17 [0058.207] lstrcmpiA (lpString1="Google Chrome.lnk", lpString2=".happythreechoose") returned 1 [0058.207] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2="Decryption INFO.html") returned 1 [0058.207] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0058.207] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0058.207] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0058.207] GetProcessHeap () returned 0x630000 [0058.207] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f10 [0058.207] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0058.207] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=2330) returned 1 [0058.207] GetProcessHeap () returned 0x630000 [0058.207] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6557d8 [0058.207] GetProcessHeap () returned 0x630000 [0058.207] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0058.207] lstrlenW (lpString="C:\\Users\\Public\\Desktop\\Google Chrome.lnk") returned 41 [0058.208] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.208] GetProcessHeap () returned 0x630000 [0058.208] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0058.208] GetProcessHeap () returned 0x630000 [0058.208] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x386) returned 0x65f898 [0058.208] lstrlenA (lpString="rsa_encrypt") returned 11 [0058.208] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0058.208] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0058.208] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0058.208] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0058.208] GetProcessHeap () returned 0x630000 [0058.208] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0058.208] lstrlenA (lpString="010001") returned 6 [0058.208] GetProcessHeap () returned 0x630000 [0058.208] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2f8 [0058.209] GetProcessHeap () returned 0x630000 [0058.209] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.209] GetProcessHeap () returned 0x630000 [0058.209] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65df50 [0058.209] GetProcessHeap () returned 0x630000 [0058.209] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.209] GetProcessHeap () returned 0x630000 [0058.209] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0058.209] GetProcessHeap () returned 0x630000 [0058.209] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656ec8 [0058.209] GetProcessHeap () returned 0x630000 [0058.209] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3f8 [0058.209] GetProcessHeap () returned 0x630000 [0058.209] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0058.209] GetProcessHeap () returned 0x630000 [0058.209] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0058.209] GetProcessHeap () returned 0x630000 [0058.209] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0058.209] GetProcessHeap () returned 0x630000 [0058.209] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.209] GetProcessHeap () returned 0x630000 [0058.209] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656b80 [0058.209] GetProcessHeap () returned 0x630000 [0058.209] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.209] GetProcessHeap () returned 0x630000 [0058.209] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0058.209] GetProcessHeap () returned 0x630000 [0058.209] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e8e0 [0058.209] GetProcessHeap () returned 0x630000 [0058.209] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.209] GetProcessHeap () returned 0x630000 [0058.209] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0058.209] GetProcessHeap () returned 0x630000 [0058.209] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0058.209] GetProcessHeap () returned 0x630000 [0058.209] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0058.209] GetProcessHeap () returned 0x630000 [0058.209] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0058.209] GetProcessHeap () returned 0x630000 [0058.210] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.210] GetProcessHeap () returned 0x630000 [0058.210] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0058.210] GetProcessHeap () returned 0x630000 [0058.210] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0058.210] GetProcessHeap () returned 0x630000 [0058.210] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0058.210] GetProcessHeap () returned 0x630000 [0058.210] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e4f0 [0058.210] GetProcessHeap () returned 0x630000 [0058.210] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0058.210] GetProcessHeap () returned 0x630000 [0058.210] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0058.210] GetProcessHeap () returned 0x630000 [0058.210] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0058.210] GetProcessHeap () returned 0x630000 [0058.210] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0058.210] GetProcessHeap () returned 0x630000 [0058.210] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0058.210] GetProcessHeap () returned 0x630000 [0058.210] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0058.210] GetProcessHeap () returned 0x630000 [0058.210] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0058.210] GetProcessHeap () returned 0x630000 [0058.210] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.210] GetProcessHeap () returned 0x630000 [0058.210] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.210] GetProcessHeap () returned 0x630000 [0058.210] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0058.210] GetProcessHeap () returned 0x630000 [0058.210] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0058.210] GetProcessHeap () returned 0x630000 [0058.210] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0058.210] GetProcessHeap () returned 0x630000 [0058.210] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0058.210] GetProcessHeap () returned 0x630000 [0058.210] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0058.210] GetProcessHeap () returned 0x630000 [0058.211] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0058.211] GetProcessHeap () returned 0x630000 [0058.211] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0058.211] GetProcessHeap () returned 0x630000 [0058.211] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0058.211] GetProcessHeap () returned 0x630000 [0058.211] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0058.211] GetProcessHeap () returned 0x630000 [0058.211] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0058.211] GetProcessHeap () returned 0x630000 [0058.211] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0058.211] GetProcessHeap () returned 0x630000 [0058.211] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0058.211] GetProcessHeap () returned 0x630000 [0058.211] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.211] GetProcessHeap () returned 0x630000 [0058.211] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.211] GetProcessHeap () returned 0x630000 [0058.211] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0058.211] GetProcessHeap () returned 0x630000 [0058.211] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0058.211] GetProcessHeap () returned 0x630000 [0058.211] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0058.211] GetProcessHeap () returned 0x630000 [0058.211] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0058.211] GetProcessHeap () returned 0x630000 [0058.211] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0058.211] GetProcessHeap () returned 0x630000 [0058.211] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0058.211] GetProcessHeap () returned 0x630000 [0058.211] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0058.211] GetProcessHeap () returned 0x630000 [0058.211] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0058.211] GetProcessHeap () returned 0x630000 [0058.211] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0058.211] GetProcessHeap () returned 0x630000 [0058.211] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0058.212] GetProcessHeap () returned 0x630000 [0058.212] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0058.212] GetProcessHeap () returned 0x630000 [0058.212] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0058.212] GetProcessHeap () returned 0x630000 [0058.212] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0058.212] GetProcessHeap () returned 0x630000 [0058.212] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0058.212] GetProcessHeap () returned 0x630000 [0058.212] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0058.212] GetProcessHeap () returned 0x630000 [0058.212] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0058.212] GetProcessHeap () returned 0x630000 [0058.212] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.212] GetProcessHeap () returned 0x630000 [0058.212] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.212] GetProcessHeap () returned 0x630000 [0058.212] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0058.212] GetProcessHeap () returned 0x630000 [0058.212] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0058.212] GetProcessHeap () returned 0x630000 [0058.212] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0058.212] GetProcessHeap () returned 0x630000 [0058.212] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0058.212] GetProcessHeap () returned 0x630000 [0058.212] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0058.212] GetProcessHeap () returned 0x630000 [0058.212] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0058.212] GetProcessHeap () returned 0x630000 [0058.212] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0058.212] GetProcessHeap () returned 0x630000 [0058.212] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0058.212] GetProcessHeap () returned 0x630000 [0058.212] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0058.212] GetProcessHeap () returned 0x630000 [0058.212] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0058.212] GetProcessHeap () returned 0x630000 [0058.212] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0058.213] GetProcessHeap () returned 0x630000 [0058.213] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0058.213] GetProcessHeap () returned 0x630000 [0058.213] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0058.213] GetProcessHeap () returned 0x630000 [0058.213] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0058.213] GetProcessHeap () returned 0x630000 [0058.213] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0058.213] GetProcessHeap () returned 0x630000 [0058.213] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0058.213] GetProcessHeap () returned 0x630000 [0058.213] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.213] GetProcessHeap () returned 0x630000 [0058.213] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.213] GetProcessHeap () returned 0x630000 [0058.213] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.213] GetProcessHeap () returned 0x630000 [0058.213] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.213] GetProcessHeap () returned 0x630000 [0058.213] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.213] GetProcessHeap () returned 0x630000 [0058.213] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.213] GetProcessHeap () returned 0x630000 [0058.213] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0058.213] GetProcessHeap () returned 0x630000 [0058.213] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0058.213] GetProcessHeap () returned 0x630000 [0058.213] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0058.213] GetProcessHeap () returned 0x630000 [0058.213] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0058.213] GetProcessHeap () returned 0x630000 [0058.213] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0058.213] GetProcessHeap () returned 0x630000 [0058.213] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0058.213] GetProcessHeap () returned 0x630000 [0058.213] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0058.213] GetProcessHeap () returned 0x630000 [0058.213] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0058.214] GetProcessHeap () returned 0x630000 [0058.214] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0058.214] GetProcessHeap () returned 0x630000 [0058.214] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0058.214] GetProcessHeap () returned 0x630000 [0058.214] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.214] GetProcessHeap () returned 0x630000 [0058.214] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.214] GetProcessHeap () returned 0x630000 [0058.214] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0058.214] GetProcessHeap () returned 0x630000 [0058.214] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0058.214] GetProcessHeap () returned 0x630000 [0058.214] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0058.214] GetProcessHeap () returned 0x630000 [0058.214] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0058.214] GetProcessHeap () returned 0x630000 [0058.214] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0058.214] GetProcessHeap () returned 0x630000 [0058.214] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0058.214] GetProcessHeap () returned 0x630000 [0058.214] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0058.214] GetProcessHeap () returned 0x630000 [0058.214] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0058.214] GetProcessHeap () returned 0x630000 [0058.214] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.214] GetProcessHeap () returned 0x630000 [0058.214] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.214] GetProcessHeap () returned 0x630000 [0058.214] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0058.214] GetProcessHeap () returned 0x630000 [0058.214] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0058.214] GetProcessHeap () returned 0x630000 [0058.214] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0058.214] GetProcessHeap () returned 0x630000 [0058.214] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0058.214] GetProcessHeap () returned 0x630000 [0058.214] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0058.215] GetProcessHeap () returned 0x630000 [0058.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0058.215] GetProcessHeap () returned 0x630000 [0058.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0058.215] GetProcessHeap () returned 0x630000 [0058.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0058.215] GetProcessHeap () returned 0x630000 [0058.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0058.215] GetProcessHeap () returned 0x630000 [0058.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0058.215] GetProcessHeap () returned 0x630000 [0058.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0058.215] WriteFile (in: hFile=0x230, lpBuffer=0x65f898*, nNumberOfBytesToWrite=0x386, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65f898*, lpNumberOfBytesWritten=0x243d864*=0x386, lpOverlapped=0x0) returned 1 [0058.224] GetProcessHeap () returned 0x630000 [0058.224] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65f898, Size=0x30) returned 0x65f898 [0058.224] GetProcessHeap () returned 0x630000 [0058.224] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0058.224] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.224] GetProcessHeap () returned 0x630000 [0058.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x920) returned 0x65f8d0 [0058.224] ReadFile (in: hFile=0x230, lpBuffer=0x65f8d0, nNumberOfBytesToRead=0x920, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65f8d0*, lpNumberOfBytesRead=0x243d7e8*=0x920, lpOverlapped=0x0) returned 1 [0058.225] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.225] WriteFile (in: hFile=0x230, lpBuffer=0x65f8d0*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65f8d0*, lpNumberOfBytesWritten=0x243d7e4*=0x920, lpOverlapped=0x0) returned 1 [0058.225] GetProcessHeap () returned 0x630000 [0058.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65f8d0 | out: hHeap=0x630000) returned 1 [0058.226] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.226] WriteFile (in: hFile=0x230, lpBuffer=0x65f898*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65f898*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0058.226] CloseHandle (hObject=0x230) returned 1 [0058.228] GetProcessHeap () returned 0x630000 [0058.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f10 | out: hHeap=0x630000) returned 1 [0058.228] GetProcessHeap () returned 0x630000 [0058.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6557d8 | out: hHeap=0x630000) returned 1 [0058.228] GetProcessHeap () returned 0x630000 [0058.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0058.228] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" | out: lpString1="C:\\Users\\Public\\Desktop\\Google Chrome.lnk") returned="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" [0058.228] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\Google Chrome.lnk", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\Public\\Desktop\\Google Chrome.lnk.happythreechoose") returned="C:\\Users\\Public\\Desktop\\Google Chrome.lnk.happythreechoose" [0058.228] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk"), lpNewFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk.happythreechoose" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk.happythreechoose"), dwFlags=0x1) returned 1 [0058.229] PathRemoveFileSpecW (in: pszPath="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" | out: pszPath="C:\\Users\\Public\\Desktop") returned 1 [0058.229] PathAddBackslashW (in: pszPath="C:\\Users\\Public\\Desktop" | out: pszPath="C:\\Users\\Public\\Desktop\\") returned="" [0058.229] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\Public\\Desktop\\Decryption INFO.html") returned="C:\\Users\\Public\\Desktop\\Decryption INFO.html" [0058.229] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Desktop\\Decryption INFO.html" (normalized: "c:\\users\\public\\desktop\\decryption info.html")) returned 0x20 [0058.229] GetProcessHeap () returned 0x630000 [0058.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645e58 | out: hHeap=0x630000) returned 1 [0058.229] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef84fc3f, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef84fc3f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef84fc3f, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x3e7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 1 [0058.229] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2=".") returned 1 [0058.229] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2="..") returned 1 [0058.229] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\", lpString2="Mozilla Firefox.lnk" | out: lpString1="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk") returned="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" [0058.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Mozilla Firefox.lnk", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0058.229] GetProcessHeap () returned 0x630000 [0058.229] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x645f98 [0058.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Mozilla Firefox.lnk", cchWideChar=-1, lpMultiByteStr=0x645f98, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mozilla Firefox.lnk", lpUsedDefaultChar=0x0) returned 20 [0058.229] lstrlenA (lpString="Mozilla Firefox.lnk") returned 19 [0058.229] lstrlenA (lpString=".happythreechoose") returned 17 [0058.229] lstrlenA (lpString=".happythreechoose") returned 17 [0058.229] lstrlenA (lpString="Mozilla Firefox.lnk") returned 19 [0058.229] lstrcmpiA (lpString1="zilla Firefox.lnk", lpString2=".happythreechoose") returned 1 [0058.229] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2="Decryption INFO.html") returned 1 [0058.230] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0058.230] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0058.230] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0058.230] GetProcessHeap () returned 0x630000 [0058.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0058.230] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0058.230] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=999) returned 1 [0058.230] GetProcessHeap () returned 0x630000 [0058.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655b20 [0058.230] GetProcessHeap () returned 0x630000 [0058.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0058.230] lstrlenW (lpString="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk") returned 43 [0058.230] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.230] GetProcessHeap () returned 0x630000 [0058.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0058.230] GetProcessHeap () returned 0x630000 [0058.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x389) returned 0x65f8d0 [0058.230] lstrlenA (lpString="rsa_encrypt") returned 11 [0058.230] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0058.231] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0058.231] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0058.231] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0058.231] GetProcessHeap () returned 0x630000 [0058.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0058.231] lstrlenA (lpString="010001") returned 6 [0058.231] GetProcessHeap () returned 0x630000 [0058.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a298 [0058.231] GetProcessHeap () returned 0x630000 [0058.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.231] GetProcessHeap () returned 0x630000 [0058.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e850 [0058.231] GetProcessHeap () returned 0x630000 [0058.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.231] GetProcessHeap () returned 0x630000 [0058.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e730 [0058.231] GetProcessHeap () returned 0x630000 [0058.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657788 [0058.231] GetProcessHeap () returned 0x630000 [0058.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3f8 [0058.231] GetProcessHeap () returned 0x630000 [0058.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0058.231] GetProcessHeap () returned 0x630000 [0058.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0058.231] GetProcessHeap () returned 0x630000 [0058.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0058.231] GetProcessHeap () returned 0x630000 [0058.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.232] GetProcessHeap () returned 0x630000 [0058.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656a68 [0058.232] GetProcessHeap () returned 0x630000 [0058.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0058.232] GetProcessHeap () returned 0x630000 [0058.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0058.232] GetProcessHeap () returned 0x630000 [0058.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65eb20 [0058.232] GetProcessHeap () returned 0x630000 [0058.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.232] GetProcessHeap () returned 0x630000 [0058.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0058.232] GetProcessHeap () returned 0x630000 [0058.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0058.232] GetProcessHeap () returned 0x630000 [0058.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0058.232] GetProcessHeap () returned 0x630000 [0058.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0058.232] GetProcessHeap () returned 0x630000 [0058.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0058.232] GetProcessHeap () returned 0x630000 [0058.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0058.232] GetProcessHeap () returned 0x630000 [0058.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0058.232] GetProcessHeap () returned 0x630000 [0058.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0058.232] GetProcessHeap () returned 0x630000 [0058.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65dfe0 [0058.232] GetProcessHeap () returned 0x630000 [0058.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0058.232] GetProcessHeap () returned 0x630000 [0058.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0058.232] GetProcessHeap () returned 0x630000 [0058.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0058.232] GetProcessHeap () returned 0x630000 [0058.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.232] GetProcessHeap () returned 0x630000 [0058.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.233] GetProcessHeap () returned 0x630000 [0058.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0058.233] GetProcessHeap () returned 0x630000 [0058.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0058.233] GetProcessHeap () returned 0x630000 [0058.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0058.233] GetProcessHeap () returned 0x630000 [0058.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0058.233] GetProcessHeap () returned 0x630000 [0058.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0058.233] GetProcessHeap () returned 0x630000 [0058.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0058.233] GetProcessHeap () returned 0x630000 [0058.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0058.233] GetProcessHeap () returned 0x630000 [0058.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0058.233] GetProcessHeap () returned 0x630000 [0058.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0058.233] GetProcessHeap () returned 0x630000 [0058.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0058.233] GetProcessHeap () returned 0x630000 [0058.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0058.233] GetProcessHeap () returned 0x630000 [0058.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0058.233] GetProcessHeap () returned 0x630000 [0058.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0058.233] GetProcessHeap () returned 0x630000 [0058.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0058.233] GetProcessHeap () returned 0x630000 [0058.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0058.233] GetProcessHeap () returned 0x630000 [0058.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0058.233] GetProcessHeap () returned 0x630000 [0058.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0058.233] GetProcessHeap () returned 0x630000 [0058.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0058.234] GetProcessHeap () returned 0x630000 [0058.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0058.234] GetProcessHeap () returned 0x630000 [0058.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0058.234] GetProcessHeap () returned 0x630000 [0058.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0058.234] GetProcessHeap () returned 0x630000 [0058.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0058.234] GetProcessHeap () returned 0x630000 [0058.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.234] GetProcessHeap () returned 0x630000 [0058.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.234] GetProcessHeap () returned 0x630000 [0058.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.234] GetProcessHeap () returned 0x630000 [0058.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.234] GetProcessHeap () returned 0x630000 [0058.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0058.234] GetProcessHeap () returned 0x630000 [0058.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0058.234] GetProcessHeap () returned 0x630000 [0058.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0058.234] GetProcessHeap () returned 0x630000 [0058.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0058.234] GetProcessHeap () returned 0x630000 [0058.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0058.234] GetProcessHeap () returned 0x630000 [0058.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0058.234] GetProcessHeap () returned 0x630000 [0058.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0058.234] GetProcessHeap () returned 0x630000 [0058.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0058.234] GetProcessHeap () returned 0x630000 [0058.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0058.235] GetProcessHeap () returned 0x630000 [0058.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0058.235] GetProcessHeap () returned 0x630000 [0058.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.235] GetProcessHeap () returned 0x630000 [0058.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.235] GetProcessHeap () returned 0x630000 [0058.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0058.235] GetProcessHeap () returned 0x630000 [0058.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0058.235] GetProcessHeap () returned 0x630000 [0058.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0058.235] GetProcessHeap () returned 0x630000 [0058.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0058.235] GetProcessHeap () returned 0x630000 [0058.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0058.235] GetProcessHeap () returned 0x630000 [0058.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0058.235] GetProcessHeap () returned 0x630000 [0058.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0058.235] GetProcessHeap () returned 0x630000 [0058.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0058.235] GetProcessHeap () returned 0x630000 [0058.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0058.235] GetProcessHeap () returned 0x630000 [0058.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0058.235] GetProcessHeap () returned 0x630000 [0058.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0058.235] GetProcessHeap () returned 0x630000 [0058.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0058.235] GetProcessHeap () returned 0x630000 [0058.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0058.235] GetProcessHeap () returned 0x630000 [0058.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0058.235] GetProcessHeap () returned 0x630000 [0058.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0058.235] GetProcessHeap () returned 0x630000 [0058.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0058.236] GetProcessHeap () returned 0x630000 [0058.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0058.236] GetProcessHeap () returned 0x630000 [0058.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0058.236] GetProcessHeap () returned 0x630000 [0058.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0058.236] GetProcessHeap () returned 0x630000 [0058.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0058.236] GetProcessHeap () returned 0x630000 [0058.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0058.236] GetProcessHeap () returned 0x630000 [0058.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0058.236] GetProcessHeap () returned 0x630000 [0058.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0058.236] GetProcessHeap () returned 0x630000 [0058.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0058.236] GetProcessHeap () returned 0x630000 [0058.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.236] GetProcessHeap () returned 0x630000 [0058.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.236] GetProcessHeap () returned 0x630000 [0058.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0058.236] GetProcessHeap () returned 0x630000 [0058.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0058.236] GetProcessHeap () returned 0x630000 [0058.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0058.236] GetProcessHeap () returned 0x630000 [0058.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0058.236] GetProcessHeap () returned 0x630000 [0058.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0058.236] GetProcessHeap () returned 0x630000 [0058.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0058.236] GetProcessHeap () returned 0x630000 [0058.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0058.236] GetProcessHeap () returned 0x630000 [0058.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0058.236] GetProcessHeap () returned 0x630000 [0058.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0058.237] GetProcessHeap () returned 0x630000 [0058.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0058.237] GetProcessHeap () returned 0x630000 [0058.237] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0058.237] GetProcessHeap () returned 0x630000 [0058.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0058.237] GetProcessHeap () returned 0x630000 [0058.237] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0058.237] GetProcessHeap () returned 0x630000 [0058.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0058.237] GetProcessHeap () returned 0x630000 [0058.237] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0058.237] GetProcessHeap () returned 0x630000 [0058.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0058.237] GetProcessHeap () returned 0x630000 [0058.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0058.237] GetProcessHeap () returned 0x630000 [0058.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0058.237] GetProcessHeap () returned 0x630000 [0058.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0058.237] GetProcessHeap () returned 0x630000 [0058.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0058.237] GetProcessHeap () returned 0x630000 [0058.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0058.237] GetProcessHeap () returned 0x630000 [0058.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0058.237] GetProcessHeap () returned 0x630000 [0058.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0058.237] GetProcessHeap () returned 0x630000 [0058.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0058.237] GetProcessHeap () returned 0x630000 [0058.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0058.237] GetProcessHeap () returned 0x630000 [0058.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0058.237] GetProcessHeap () returned 0x630000 [0058.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0058.238] WriteFile (in: hFile=0x230, lpBuffer=0x65f8d0*, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65f8d0*, lpNumberOfBytesWritten=0x243d864*=0x389, lpOverlapped=0x0) returned 1 [0058.243] GetProcessHeap () returned 0x630000 [0058.243] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65f8d0, Size=0x30) returned 0x65f8d0 [0058.243] GetProcessHeap () returned 0x630000 [0058.243] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0058.243] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.243] GetProcessHeap () returned 0x630000 [0058.243] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3f0) returned 0x65f908 [0058.243] ReadFile (in: hFile=0x230, lpBuffer=0x65f908, nNumberOfBytesToRead=0x3f0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65f908*, lpNumberOfBytesRead=0x243d7e8*=0x3f0, lpOverlapped=0x0) returned 1 [0058.243] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.243] WriteFile (in: hFile=0x230, lpBuffer=0x65f908*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65f908*, lpNumberOfBytesWritten=0x243d7e4*=0x3f0, lpOverlapped=0x0) returned 1 [0058.244] GetProcessHeap () returned 0x630000 [0058.244] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65f908 | out: hHeap=0x630000) returned 1 [0058.244] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.244] WriteFile (in: hFile=0x230, lpBuffer=0x65f8d0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65f8d0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0058.245] CloseHandle (hObject=0x230) returned 1 [0058.246] GetProcessHeap () returned 0x630000 [0058.246] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0058.247] GetProcessHeap () returned 0x630000 [0058.247] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655b20 | out: hHeap=0x630000) returned 1 [0058.247] GetProcessHeap () returned 0x630000 [0058.247] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0058.247] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" | out: lpString1="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk") returned="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" [0058.247] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk.happythreechoose") returned="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk.happythreechoose" [0058.247] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), lpNewFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk.happythreechoose" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk.happythreechoose"), dwFlags=0x1) returned 1 [0058.247] PathRemoveFileSpecW (in: pszPath="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" | out: pszPath="C:\\Users\\Public\\Desktop") returned 1 [0058.247] PathAddBackslashW (in: pszPath="C:\\Users\\Public\\Desktop" | out: pszPath="C:\\Users\\Public\\Desktop\\") returned="" [0058.247] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\Public\\Desktop\\Decryption INFO.html") returned="C:\\Users\\Public\\Desktop\\Decryption INFO.html" [0058.247] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Desktop\\Decryption INFO.html" (normalized: "c:\\users\\public\\desktop\\decryption info.html")) returned 0x20 [0058.247] GetProcessHeap () returned 0x630000 [0058.247] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645f98 | out: hHeap=0x630000) returned 1 [0058.247] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef84fc3f, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef84fc3f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef84fc3f, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x3e7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 0 [0058.248] FindClose (in: hFindFile=0x648a10 | out: hFindFile=0x648a10) returned 1 [0058.248] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\Public\\AccountPictures\\" | out: lpString1="C:\\Users\\Public\\AccountPictures\\") returned="C:\\Users\\Public\\AccountPictures\\" [0058.248] GetProcessHeap () returned 0x630000 [0058.248] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655ef0 | out: hHeap=0x630000) returned 1 [0058.248] GetProcessHeap () returned 0x630000 [0058.248] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0058.248] lstrlenW (lpString="C:\\Users\\Public\\AccountPictures\\") returned 32 [0058.248] lstrcatW (in: lpString1="C:\\Users\\Public\\AccountPictures\\", lpString2="*" | out: lpString1="C:\\Users\\Public\\AccountPictures\\*") returned="C:\\Users\\Public\\AccountPictures\\*" [0058.248] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\AccountPictures\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3079b77, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648710 [0058.250] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0058.250] FindNextFileW (in: hFindFile=0x648710, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3079b77, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.250] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0058.250] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0058.250] FindNextFileW (in: hFindFile=0x648710, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xce317778, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0058.250] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0058.250] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0058.250] lstrcatW (in: lpString1="C:\\Users\\Public\\AccountPictures\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\Public\\AccountPictures\\desktop.ini") returned="C:\\Users\\Public\\AccountPictures\\desktop.ini" [0058.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0058.250] GetProcessHeap () returned 0x630000 [0058.250] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0058.250] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0058.250] lstrlenA (lpString="desktop.ini") returned 11 [0058.250] lstrlenA (lpString=".happythreechoose") returned 17 [0058.250] lstrcmpiW (lpString1="desktop.ini", lpString2="Decryption INFO.html") returned 1 [0058.250] lstrcmpiW (lpString1="desktop.ini", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0058.250] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0058.250] lstrcmpiW (lpString1="desktop.ini", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0058.250] GetProcessHeap () returned 0x630000 [0058.250] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f10 [0058.251] CreateFileW (lpFileName="C:\\Users\\Public\\AccountPictures\\desktop.ini" (normalized: "c:\\users\\public\\accountpictures\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0058.252] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=196) returned 1 [0058.252] GetProcessHeap () returned 0x630000 [0058.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655a30 [0058.252] GetProcessHeap () returned 0x630000 [0058.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0058.252] lstrlenW (lpString="C:\\Users\\Public\\AccountPictures\\desktop.ini") returned 43 [0058.252] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.252] GetProcessHeap () returned 0x630000 [0058.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0058.252] GetProcessHeap () returned 0x630000 [0058.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38c) returned 0x655bf8 [0058.252] lstrlenA (lpString="rsa_encrypt") returned 11 [0058.252] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0058.253] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0058.253] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0058.253] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0058.253] GetProcessHeap () returned 0x630000 [0058.253] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0058.253] lstrlenA (lpString="010001") returned 6 [0058.253] GetProcessHeap () returned 0x630000 [0058.253] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3f8 [0058.253] GetProcessHeap () returned 0x630000 [0058.253] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.253] GetProcessHeap () returned 0x630000 [0058.253] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e8e0 [0058.253] GetProcessHeap () returned 0x630000 [0058.253] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.253] GetProcessHeap () returned 0x630000 [0058.253] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65df50 [0058.253] GetProcessHeap () returned 0x630000 [0058.253] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657440 [0058.253] GetProcessHeap () returned 0x630000 [0058.253] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2a8 [0058.253] GetProcessHeap () returned 0x630000 [0058.253] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0058.253] GetProcessHeap () returned 0x630000 [0058.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0058.254] GetProcessHeap () returned 0x630000 [0058.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0058.254] GetProcessHeap () returned 0x630000 [0058.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.254] GetProcessHeap () returned 0x630000 [0058.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656db0 [0058.254] GetProcessHeap () returned 0x630000 [0058.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0058.254] GetProcessHeap () returned 0x630000 [0058.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0058.254] GetProcessHeap () returned 0x630000 [0058.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e340 [0058.254] GetProcessHeap () returned 0x630000 [0058.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.254] GetProcessHeap () returned 0x630000 [0058.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0058.254] GetProcessHeap () returned 0x630000 [0058.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0058.254] GetProcessHeap () returned 0x630000 [0058.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0058.254] GetProcessHeap () returned 0x630000 [0058.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65aab0 [0058.254] GetProcessHeap () returned 0x630000 [0058.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0058.254] GetProcessHeap () returned 0x630000 [0058.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0058.254] GetProcessHeap () returned 0x630000 [0058.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0058.254] GetProcessHeap () returned 0x630000 [0058.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0058.254] GetProcessHeap () returned 0x630000 [0058.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e730 [0058.254] GetProcessHeap () returned 0x630000 [0058.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65aab0 | out: hHeap=0x630000) returned 1 [0058.254] GetProcessHeap () returned 0x630000 [0058.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0058.254] GetProcessHeap () returned 0x630000 [0058.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0058.255] GetProcessHeap () returned 0x630000 [0058.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0058.255] GetProcessHeap () returned 0x630000 [0058.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0058.255] GetProcessHeap () returned 0x630000 [0058.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.255] GetProcessHeap () returned 0x630000 [0058.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.255] GetProcessHeap () returned 0x630000 [0058.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0058.255] GetProcessHeap () returned 0x630000 [0058.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0058.255] GetProcessHeap () returned 0x630000 [0058.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0058.255] GetProcessHeap () returned 0x630000 [0058.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0058.255] GetProcessHeap () returned 0x630000 [0058.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.255] GetProcessHeap () returned 0x630000 [0058.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.255] GetProcessHeap () returned 0x630000 [0058.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0058.255] GetProcessHeap () returned 0x630000 [0058.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0058.255] GetProcessHeap () returned 0x630000 [0058.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0058.255] GetProcessHeap () returned 0x630000 [0058.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0058.255] GetProcessHeap () returned 0x630000 [0058.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0058.255] GetProcessHeap () returned 0x630000 [0058.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0058.255] GetProcessHeap () returned 0x630000 [0058.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0058.255] GetProcessHeap () returned 0x630000 [0058.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0058.255] GetProcessHeap () returned 0x630000 [0058.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0058.256] GetProcessHeap () returned 0x630000 [0058.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0058.256] GetProcessHeap () returned 0x630000 [0058.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.256] GetProcessHeap () returned 0x630000 [0058.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.256] GetProcessHeap () returned 0x630000 [0058.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0058.256] GetProcessHeap () returned 0x630000 [0058.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0058.256] GetProcessHeap () returned 0x630000 [0058.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0058.256] GetProcessHeap () returned 0x630000 [0058.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0058.256] GetProcessHeap () returned 0x630000 [0058.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0058.256] GetProcessHeap () returned 0x630000 [0058.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0058.256] GetProcessHeap () returned 0x630000 [0058.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0058.256] GetProcessHeap () returned 0x630000 [0058.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0058.256] GetProcessHeap () returned 0x630000 [0058.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0058.256] GetProcessHeap () returned 0x630000 [0058.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0058.256] GetProcessHeap () returned 0x630000 [0058.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0058.256] GetProcessHeap () returned 0x630000 [0058.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0058.256] GetProcessHeap () returned 0x630000 [0058.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0058.256] GetProcessHeap () returned 0x630000 [0058.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0058.256] GetProcessHeap () returned 0x630000 [0058.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0058.257] GetProcessHeap () returned 0x630000 [0058.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0058.257] GetProcessHeap () returned 0x630000 [0058.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0058.257] GetProcessHeap () returned 0x630000 [0058.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0058.257] GetProcessHeap () returned 0x630000 [0058.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0058.257] GetProcessHeap () returned 0x630000 [0058.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0058.257] GetProcessHeap () returned 0x630000 [0058.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.257] GetProcessHeap () returned 0x630000 [0058.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.257] GetProcessHeap () returned 0x630000 [0058.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0058.257] GetProcessHeap () returned 0x630000 [0058.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0058.257] GetProcessHeap () returned 0x630000 [0058.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0058.257] GetProcessHeap () returned 0x630000 [0058.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0058.257] GetProcessHeap () returned 0x630000 [0058.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0058.257] GetProcessHeap () returned 0x630000 [0058.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0058.257] GetProcessHeap () returned 0x630000 [0058.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0058.257] GetProcessHeap () returned 0x630000 [0058.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0058.257] GetProcessHeap () returned 0x630000 [0058.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0058.257] GetProcessHeap () returned 0x630000 [0058.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0058.257] GetProcessHeap () returned 0x630000 [0058.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0058.257] GetProcessHeap () returned 0x630000 [0058.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0058.258] GetProcessHeap () returned 0x630000 [0058.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0058.258] GetProcessHeap () returned 0x630000 [0058.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0058.258] GetProcessHeap () returned 0x630000 [0058.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0058.258] GetProcessHeap () returned 0x630000 [0058.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0058.258] GetProcessHeap () returned 0x630000 [0058.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0058.258] GetProcessHeap () returned 0x630000 [0058.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0058.258] GetProcessHeap () returned 0x630000 [0058.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0058.258] GetProcessHeap () returned 0x630000 [0058.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0058.258] GetProcessHeap () returned 0x630000 [0058.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0058.258] GetProcessHeap () returned 0x630000 [0058.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0058.258] GetProcessHeap () returned 0x630000 [0058.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0058.258] GetProcessHeap () returned 0x630000 [0058.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0058.258] GetProcessHeap () returned 0x630000 [0058.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0058.258] GetProcessHeap () returned 0x630000 [0058.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0058.258] GetProcessHeap () returned 0x630000 [0058.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0058.258] GetProcessHeap () returned 0x630000 [0058.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0058.258] GetProcessHeap () returned 0x630000 [0058.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0058.258] GetProcessHeap () returned 0x630000 [0058.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0058.258] GetProcessHeap () returned 0x630000 [0058.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0058.259] GetProcessHeap () returned 0x630000 [0058.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0058.259] GetProcessHeap () returned 0x630000 [0058.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0058.259] GetProcessHeap () returned 0x630000 [0058.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0058.259] GetProcessHeap () returned 0x630000 [0058.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0058.259] GetProcessHeap () returned 0x630000 [0058.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0058.259] GetProcessHeap () returned 0x630000 [0058.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0058.259] GetProcessHeap () returned 0x630000 [0058.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0058.259] GetProcessHeap () returned 0x630000 [0058.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0058.259] GetProcessHeap () returned 0x630000 [0058.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0058.259] GetProcessHeap () returned 0x630000 [0058.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0058.259] GetProcessHeap () returned 0x630000 [0058.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0058.259] GetProcessHeap () returned 0x630000 [0058.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0058.259] GetProcessHeap () returned 0x630000 [0058.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0058.259] GetProcessHeap () returned 0x630000 [0058.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0058.259] GetProcessHeap () returned 0x630000 [0058.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0058.259] GetProcessHeap () returned 0x630000 [0058.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0058.259] GetProcessHeap () returned 0x630000 [0058.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0058.259] GetProcessHeap () returned 0x630000 [0058.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0058.260] WriteFile (in: hFile=0x230, lpBuffer=0x655bf8*, nNumberOfBytesToWrite=0x38c, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x655bf8*, lpNumberOfBytesWritten=0x243d864*=0x38c, lpOverlapped=0x0) returned 1 [0058.263] GetProcessHeap () returned 0x630000 [0058.263] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x655bf8, Size=0x30) returned 0x655bf8 [0058.263] GetProcessHeap () returned 0x630000 [0058.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0058.263] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.263] GetProcessHeap () returned 0x630000 [0058.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd0) returned 0x6491c0 [0058.263] ReadFile (in: hFile=0x230, lpBuffer=0x6491c0, nNumberOfBytesToRead=0xd0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x6491c0*, lpNumberOfBytesRead=0x243d7e8*=0xd0, lpOverlapped=0x0) returned 1 [0058.263] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.264] WriteFile (in: hFile=0x230, lpBuffer=0x6491c0*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x6491c0*, lpNumberOfBytesWritten=0x243d7e4*=0xd0, lpOverlapped=0x0) returned 1 [0058.264] GetProcessHeap () returned 0x630000 [0058.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6491c0 | out: hHeap=0x630000) returned 1 [0058.264] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.265] WriteFile (in: hFile=0x230, lpBuffer=0x655bf8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x655bf8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0058.265] CloseHandle (hObject=0x230) returned 1 [0058.268] GetProcessHeap () returned 0x630000 [0058.269] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f10 | out: hHeap=0x630000) returned 1 [0058.269] GetProcessHeap () returned 0x630000 [0058.269] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655a30 | out: hHeap=0x630000) returned 1 [0058.269] GetProcessHeap () returned 0x630000 [0058.269] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0058.269] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\Public\\AccountPictures\\desktop.ini" | out: lpString1="C:\\Users\\Public\\AccountPictures\\desktop.ini") returned="C:\\Users\\Public\\AccountPictures\\desktop.ini" [0058.269] lstrcatW (in: lpString1="C:\\Users\\Public\\AccountPictures\\desktop.ini", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\Public\\AccountPictures\\desktop.ini.happythreechoose") returned="C:\\Users\\Public\\AccountPictures\\desktop.ini.happythreechoose" [0058.269] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\AccountPictures\\desktop.ini" (normalized: "c:\\users\\public\\accountpictures\\desktop.ini"), lpNewFileName="C:\\Users\\Public\\AccountPictures\\desktop.ini.happythreechoose" (normalized: "c:\\users\\public\\accountpictures\\desktop.ini.happythreechoose"), dwFlags=0x1) returned 1 [0058.269] PathRemoveFileSpecW (in: pszPath="C:\\Users\\Public\\AccountPictures\\desktop.ini" | out: pszPath="C:\\Users\\Public\\AccountPictures") returned 1 [0058.269] PathAddBackslashW (in: pszPath="C:\\Users\\Public\\AccountPictures" | out: pszPath="C:\\Users\\Public\\AccountPictures\\") returned="" [0058.269] lstrcatW (in: lpString1="C:\\Users\\Public\\AccountPictures\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\Public\\AccountPictures\\Decryption INFO.html") returned="C:\\Users\\Public\\AccountPictures\\Decryption INFO.html" [0058.269] GetFileAttributesW (lpFileName="C:\\Users\\Public\\AccountPictures\\Decryption INFO.html" (normalized: "c:\\users\\public\\accountpictures\\decryption info.html")) returned 0xffffffff [0058.269] CreateFileW (lpFileName="C:\\Users\\Public\\AccountPictures\\Decryption INFO.html" (normalized: "c:\\users\\public\\accountpictures\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0058.270] GetProcessHeap () returned 0x630000 [0058.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6556e8 [0058.270] GetProcessHeap () returned 0x630000 [0058.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0058.277] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.278] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.278] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.278] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.278] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.278] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.278] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.278] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.278] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.278] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.278] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.278] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.278] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.279] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.279] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.279] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.279] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.279] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.279] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.279] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.279] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.279] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.279] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.279] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.279] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.279] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.280] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.280] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.280] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.280] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.280] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.280] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.280] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.280] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.280] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.280] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.280] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.281] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.281] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.281] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.282] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.282] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.282] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.282] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.282] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.282] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.282] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.282] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.282] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.282] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.282] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.282] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.282] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.282] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.283] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.283] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.283] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.283] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.283] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.283] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.283] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.283] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.283] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.283] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.283] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.283] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.283] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.283] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.284] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.284] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.284] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.284] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.284] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.284] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.284] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.284] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.284] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.284] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.284] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.284] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.284] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.284] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.285] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.285] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.285] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.285] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.285] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.285] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.285] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.285] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.285] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.285] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.285] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.285] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.285] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.285] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.286] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.286] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.286] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.286] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.286] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.286] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.286] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.286] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.286] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.286] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.286] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.286] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.286] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.286] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.287] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.287] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.287] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.287] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.287] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.287] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.287] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.287] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.287] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.287] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.287] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.287] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.287] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.288] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.288] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.288] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.288] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.288] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.288] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.288] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.288] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.288] GetProcessHeap () returned 0x630000 [0058.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6556e8 | out: hHeap=0x630000) returned 1 [0058.288] GetProcessHeap () returned 0x630000 [0058.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0058.288] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0058.288] GetProcessHeap () returned 0x630000 [0058.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655508 [0058.288] GetProcessHeap () returned 0x630000 [0058.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0058.295] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.295] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.295] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.295] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.296] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.296] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.296] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.296] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.296] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.296] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.296] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.296] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.296] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.296] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.296] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.296] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.296] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.296] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.297] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.297] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.297] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.297] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.297] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.297] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.297] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.297] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.297] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.297] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.297] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.297] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.297] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.297] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.298] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.298] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.298] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.298] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.298] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.298] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.298] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.298] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.298] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.298] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.298] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.298] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.298] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.298] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.299] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.299] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.299] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.299] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.299] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.299] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.299] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.299] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.299] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.299] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.299] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.299] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.299] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.299] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.300] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.300] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.300] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.300] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.300] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.300] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.300] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.300] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.300] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.300] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.300] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.300] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.300] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.300] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.301] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.301] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.301] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.301] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.301] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.301] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.301] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.301] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.301] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.301] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.320] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.320] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.320] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.320] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.320] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.320] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.320] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.321] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.321] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.321] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.321] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.321] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.321] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.321] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.321] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.321] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.321] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.321] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.321] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.321] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.321] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.322] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.322] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.322] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.322] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.322] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.322] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.322] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.322] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.322] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.322] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.322] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.322] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.322] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.323] GetProcessHeap () returned 0x630000 [0058.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655508 | out: hHeap=0x630000) returned 1 [0058.323] GetProcessHeap () returned 0x630000 [0058.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0058.323] CloseHandle (hObject=0x230) returned 1 [0058.324] GetProcessHeap () returned 0x630000 [0058.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0058.324] FindNextFileW (in: hFindFile=0x648710, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xce317778, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0058.324] FindClose (in: hFindFile=0x648710 | out: hFindFile=0x648710) returned 1 [0058.324] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\" | out: lpString1="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0058.324] GetProcessHeap () returned 0x630000 [0058.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x644ab0 | out: hHeap=0x630000) returned 1 [0058.324] GetProcessHeap () returned 0x630000 [0058.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0058.324] lstrlenW (lpString="C:\\Users\\FD1HVy\\") returned 16 [0058.324] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\*") returned="C:\\Users\\FD1HVy\\*" [0058.324] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648b50 [0058.324] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0058.324] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.324] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0058.324] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0058.324] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3b5a0677, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3b5a0677, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0058.324] lstrcmpiW (lpString1="AppData", lpString2=".") returned 1 [0058.324] lstrcmpiW (lpString1="AppData", lpString2="..") returned 1 [0058.325] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="AppData" | out: lpString1="C:\\Users\\FD1HVy\\AppData") returned="C:\\Users\\FD1HVy\\AppData" [0058.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AppData", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0058.325] GetProcessHeap () returned 0x630000 [0058.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a398 [0058.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AppData", cchWideChar=-1, lpMultiByteStr=0x65a398, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AppData", lpUsedDefaultChar=0x0) returned 8 [0058.325] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0058.325] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0058.325] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0058.325] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0058.325] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0058.325] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0058.325] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0058.325] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0058.325] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0058.325] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0058.325] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0058.325] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0058.325] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0058.325] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0058.325] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0058.325] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0058.325] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0058.325] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0058.325] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0058.325] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0058.325] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0058.325] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0058.325] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0058.325] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 1 [0058.325] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0058.325] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0058.325] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 1 [0058.325] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0058.325] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0058.326] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0058.326] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0058.326] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 1 [0058.326] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0058.326] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0058.326] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0058.326] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0058.326] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0058.326] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0058.326] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0058.326] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0058.326] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0058.326] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0058.326] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0058.326] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\") returned="C:\\Users\\FD1HVy\\AppData\\" [0058.326] GetProcessHeap () returned 0x630000 [0058.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a3f8 [0058.326] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\") returned 24 [0058.326] GetProcessHeap () returned 0x630000 [0058.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x32) returned 0x648710 [0058.326] lstrcpyW (in: lpString1=0x648710, lpString2="C:\\Users\\FD1HVy\\AppData\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\") returned="C:\\Users\\FD1HVy\\AppData\\" [0058.326] GetProcessHeap () returned 0x630000 [0058.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0058.326] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0058.326] lstrcmpiW (lpString1="Application Data", lpString2=".") returned 1 [0058.326] lstrcmpiW (lpString1="Application Data", lpString2="..") returned 1 [0058.326] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Application Data" | out: lpString1="C:\\Users\\FD1HVy\\Application Data") returned="C:\\Users\\FD1HVy\\Application Data" [0058.326] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Application Data", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0058.326] GetProcessHeap () returned 0x630000 [0058.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11) returned 0x645d18 [0058.326] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Application Data", cchWideChar=-1, lpMultiByteStr=0x645d18, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Application Data", lpUsedDefaultChar=0x0) returned 17 [0058.326] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0058.326] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0058.326] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0058.326] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0058.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0058.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0058.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0058.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0058.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0058.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0058.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0058.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0058.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0058.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0058.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0058.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0058.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0058.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0058.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0058.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0058.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0058.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0058.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0058.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 1 [0058.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0058.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0058.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 1 [0058.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0058.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0058.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0058.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0058.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 1 [0058.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0058.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0058.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0058.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0058.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0058.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0058.328] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0058.328] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0058.328] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0058.328] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0058.328] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0058.328] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Application Data", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Application Data\\") returned="C:\\Users\\FD1HVy\\Application Data\\" [0058.328] GetProcessHeap () returned 0x630000 [0058.328] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a3a8 [0058.328] lstrlenW (lpString="C:\\Users\\FD1HVy\\Application Data\\") returned 33 [0058.328] GetProcessHeap () returned 0x630000 [0058.328] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x44) returned 0x65fca0 [0058.328] lstrcpyW (in: lpString1=0x65fca0, lpString2="C:\\Users\\FD1HVy\\Application Data\\" | out: lpString1="C:\\Users\\FD1HVy\\Application Data\\") returned="C:\\Users\\FD1HVy\\Application Data\\" [0058.328] GetProcessHeap () returned 0x630000 [0058.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645d18 | out: hHeap=0x630000) returned 1 [0058.328] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1 [0058.328] lstrcmpiW (lpString1="Contacts", lpString2=".") returned 1 [0058.328] lstrcmpiW (lpString1="Contacts", lpString2="..") returned 1 [0058.328] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Contacts" | out: lpString1="C:\\Users\\FD1HVy\\Contacts") returned="C:\\Users\\FD1HVy\\Contacts" [0058.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Contacts", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0058.328] GetProcessHeap () returned 0x630000 [0058.328] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9) returned 0x64ca20 [0058.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Contacts", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Contacts", lpUsedDefaultChar=0x0) returned 9 [0058.328] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0058.328] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0058.328] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0058.328] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0058.328] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0058.328] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0058.328] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0058.328] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0058.328] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0058.328] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0058.328] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0058.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0058.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0058.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0058.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0058.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0058.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0058.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0058.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0058.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0058.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0058.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0058.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0058.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0058.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0058.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0058.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0058.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0058.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0058.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0058.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0058.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0058.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0058.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0058.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0058.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0058.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0058.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0058.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0058.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0058.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0058.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0058.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0058.329] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Contacts", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Contacts\\") returned="C:\\Users\\FD1HVy\\Contacts\\" [0058.330] GetProcessHeap () returned 0x630000 [0058.330] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a378 [0058.330] lstrlenW (lpString="C:\\Users\\FD1HVy\\Contacts\\") returned 25 [0058.330] GetProcessHeap () returned 0x630000 [0058.330] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x34) returned 0x648a10 [0058.330] lstrcpyW (in: lpString1=0x648a10, lpString2="C:\\Users\\FD1HVy\\Contacts\\" | out: lpString1="C:\\Users\\FD1HVy\\Contacts\\") returned="C:\\Users\\FD1HVy\\Contacts\\" [0058.330] GetProcessHeap () returned 0x630000 [0058.330] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0058.330] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0058.330] lstrcmpiW (lpString1="Cookies", lpString2=".") returned 1 [0058.330] lstrcmpiW (lpString1="Cookies", lpString2="..") returned 1 [0058.330] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Cookies" | out: lpString1="C:\\Users\\FD1HVy\\Cookies") returned="C:\\Users\\FD1HVy\\Cookies" [0058.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Cookies", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0058.330] GetProcessHeap () returned 0x630000 [0058.330] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a2f8 [0058.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Cookies", cchWideChar=-1, lpMultiByteStr=0x65a2f8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Cookies", lpUsedDefaultChar=0x0) returned 8 [0058.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0058.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0058.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0058.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0058.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0058.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0058.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0058.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0058.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0058.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0058.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0058.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0058.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0058.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0058.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0058.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0058.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0058.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0058.330] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0058.331] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0058.331] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0058.331] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0058.331] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0058.331] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0058.331] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0058.331] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0058.331] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0058.331] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0058.331] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0058.331] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0058.331] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0058.331] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0058.331] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0058.331] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0058.331] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0058.331] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0058.331] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0058.331] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0058.331] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0058.331] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0058.331] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0058.331] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0058.331] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0058.331] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Cookies", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Cookies\\") returned="C:\\Users\\FD1HVy\\Cookies\\" [0058.331] GetProcessHeap () returned 0x630000 [0058.331] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a398 [0058.331] lstrlenW (lpString="C:\\Users\\FD1HVy\\Cookies\\") returned 24 [0058.331] GetProcessHeap () returned 0x630000 [0058.331] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x32) returned 0x6487d0 [0058.331] lstrcpyW (in: lpString1=0x6487d0, lpString2="C:\\Users\\FD1HVy\\Cookies\\" | out: lpString1="C:\\Users\\FD1HVy\\Cookies\\") returned="C:\\Users\\FD1HVy\\Cookies\\" [0058.331] GetProcessHeap () returned 0x630000 [0058.331] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0058.331] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3a7a7482, ftLastAccessTime.dwHighDateTime=0x1d5dbe3, ftLastWriteTime.dwLowDateTime=0x3a7a7482, ftLastWriteTime.dwHighDateTime=0x1d5dbe3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0058.331] lstrcmpiW (lpString1="Desktop", lpString2=".") returned 1 [0058.332] lstrcmpiW (lpString1="Desktop", lpString2="..") returned 1 [0058.332] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Desktop" | out: lpString1="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0058.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Desktop", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0058.332] GetProcessHeap () returned 0x630000 [0058.332] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a298 [0058.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Desktop", cchWideChar=-1, lpMultiByteStr=0x65a298, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Desktop", lpUsedDefaultChar=0x0) returned 8 [0058.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0058.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0058.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0058.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0058.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0058.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0058.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0058.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0058.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0058.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0058.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0058.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0058.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0058.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0058.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0058.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0058.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0058.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0058.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0058.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0058.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0058.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0058.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0058.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0058.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0058.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0058.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0058.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0058.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0058.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0058.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0058.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0058.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0058.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0058.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0058.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0058.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0058.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0058.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0058.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0058.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0058.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0058.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0058.333] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0058.333] GetProcessHeap () returned 0x630000 [0058.333] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a2a8 [0058.333] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\") returned 24 [0058.333] GetProcessHeap () returned 0x630000 [0058.333] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x32) returned 0x648a90 [0058.333] lstrcpyW (in: lpString1=0x648a90, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0058.333] GetProcessHeap () returned 0x630000 [0058.333] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0058.333] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3a712416, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3a712416, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0058.333] lstrcmpiW (lpString1="Documents", lpString2=".") returned 1 [0058.333] lstrcmpiW (lpString1="Documents", lpString2="..") returned 1 [0058.333] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Documents" | out: lpString1="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0058.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Documents", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0058.333] GetProcessHeap () returned 0x630000 [0058.333] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x64c9f0 [0058.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Documents", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Documents", lpUsedDefaultChar=0x0) returned 10 [0058.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0058.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0058.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0058.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0058.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0058.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0058.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0058.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0058.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0058.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0058.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0058.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0058.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0058.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0058.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0058.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0058.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0058.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0058.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0058.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0058.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0058.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0058.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0058.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0058.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0058.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0058.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0058.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0058.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0058.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0058.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0058.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0058.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0058.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0058.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0058.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0058.335] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0058.335] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0058.335] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0058.335] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0058.335] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0058.335] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0058.335] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0058.335] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0058.335] GetProcessHeap () returned 0x630000 [0058.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a2f8 [0058.335] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\") returned 26 [0058.335] GetProcessHeap () returned 0x630000 [0058.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x36) returned 0x648810 [0058.335] lstrcpyW (in: lpString1=0x648810, lpString2="C:\\Users\\FD1HVy\\Documents\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0058.335] GetProcessHeap () returned 0x630000 [0058.335] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0058.335] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa2dc870b, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xa2dc870b, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0058.335] lstrcmpiW (lpString1="Downloads", lpString2=".") returned 1 [0058.335] lstrcmpiW (lpString1="Downloads", lpString2="..") returned 1 [0058.335] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Downloads" | out: lpString1="C:\\Users\\FD1HVy\\Downloads") returned="C:\\Users\\FD1HVy\\Downloads" [0058.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Downloads", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0058.335] GetProcessHeap () returned 0x630000 [0058.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x64ca20 [0058.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Downloads", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Downloads", lpUsedDefaultChar=0x0) returned 10 [0058.335] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0058.335] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0058.335] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0058.335] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0058.335] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0058.335] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0058.335] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0058.335] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0058.335] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0058.335] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0058.335] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0058.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0058.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0058.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0058.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0058.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0058.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0058.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0058.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0058.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0058.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0058.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0058.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0058.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0058.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0058.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0058.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0058.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0058.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0058.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0058.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0058.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0058.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0058.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0058.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0058.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0058.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0058.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0058.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0058.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0058.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0058.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0058.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0058.336] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Downloads", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Downloads\\") returned="C:\\Users\\FD1HVy\\Downloads\\" [0058.336] GetProcessHeap () returned 0x630000 [0058.337] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a298 [0058.337] lstrlenW (lpString="C:\\Users\\FD1HVy\\Downloads\\") returned 26 [0058.337] GetProcessHeap () returned 0x630000 [0058.337] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x36) returned 0x648c90 [0058.337] lstrcpyW (in: lpString1=0x648c90, lpString2="C:\\Users\\FD1HVy\\Downloads\\" | out: lpString1="C:\\Users\\FD1HVy\\Downloads\\") returned="C:\\Users\\FD1HVy\\Downloads\\" [0058.337] GetProcessHeap () returned 0x630000 [0058.337] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0058.337] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0058.337] lstrcmpiW (lpString1="Favorites", lpString2=".") returned 1 [0058.337] lstrcmpiW (lpString1="Favorites", lpString2="..") returned 1 [0058.337] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Favorites" | out: lpString1="C:\\Users\\FD1HVy\\Favorites") returned="C:\\Users\\FD1HVy\\Favorites" [0058.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Favorites", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0058.337] GetProcessHeap () returned 0x630000 [0058.337] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x64c9f0 [0058.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Favorites", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Favorites", lpUsedDefaultChar=0x0) returned 10 [0058.337] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0058.337] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0058.337] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0058.337] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0058.337] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0058.337] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0058.337] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0058.337] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0058.337] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0058.337] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0058.337] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0058.337] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0058.337] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0058.337] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0058.337] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0058.337] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0058.337] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0058.337] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0058.337] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0058.337] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0058.338] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0058.338] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0058.338] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0058.338] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0058.338] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0058.338] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0058.338] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0058.338] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0058.338] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0058.338] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0058.338] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0058.338] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0058.338] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0058.338] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0058.338] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0058.338] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0058.338] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0058.338] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0058.338] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0058.338] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0058.338] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0058.338] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0058.338] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0058.338] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Favorites", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\") returned="C:\\Users\\FD1HVy\\Favorites\\" [0058.338] GetProcessHeap () returned 0x630000 [0058.338] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a408 [0058.338] lstrlenW (lpString="C:\\Users\\FD1HVy\\Favorites\\") returned 26 [0058.338] GetProcessHeap () returned 0x630000 [0058.338] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x36) returned 0x648850 [0058.338] lstrcpyW (in: lpString1=0x648850, lpString2="C:\\Users\\FD1HVy\\Favorites\\" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\") returned="C:\\Users\\FD1HVy\\Favorites\\" [0058.338] GetProcessHeap () returned 0x630000 [0058.338] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0058.338] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0058.338] lstrcmpiW (lpString1="Links", lpString2=".") returned 1 [0058.338] lstrcmpiW (lpString1="Links", lpString2="..") returned 1 [0058.339] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Links" | out: lpString1="C:\\Users\\FD1HVy\\Links") returned="C:\\Users\\FD1HVy\\Links" [0058.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Links", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0058.339] GetProcessHeap () returned 0x630000 [0058.339] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6) returned 0x65a2b8 [0058.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Links", cchWideChar=-1, lpMultiByteStr=0x65a2b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Links", lpUsedDefaultChar=0x0) returned 6 [0058.339] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0058.339] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0058.339] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0058.339] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0058.339] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0058.339] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0058.339] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0058.339] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0058.339] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0058.339] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0058.339] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0058.339] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0058.339] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0058.339] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0058.339] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0058.339] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0058.339] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0058.339] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0058.339] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0058.339] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0058.339] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0058.339] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0058.339] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0058.339] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0058.339] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0058.339] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0058.339] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0058.339] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0058.339] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0058.340] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0058.340] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0058.340] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0058.340] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0058.340] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0058.340] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0058.340] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0058.340] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0058.340] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0058.340] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0058.340] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0058.340] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0058.340] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0058.340] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0058.340] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Links", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Links\\") returned="C:\\Users\\FD1HVy\\Links\\" [0058.340] GetProcessHeap () returned 0x630000 [0058.340] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a328 [0058.340] lstrlenW (lpString="C:\\Users\\FD1HVy\\Links\\") returned 22 [0058.340] GetProcessHeap () returned 0x630000 [0058.340] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2e) returned 0x652748 [0058.340] lstrcpyW (in: lpString1=0x652748, lpString2="C:\\Users\\FD1HVy\\Links\\" | out: lpString1="C:\\Users\\FD1HVy\\Links\\") returned="C:\\Users\\FD1HVy\\Links\\" [0058.340] GetProcessHeap () returned 0x630000 [0058.340] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0058.340] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0058.340] lstrcmpiW (lpString1="Local Settings", lpString2=".") returned 1 [0058.340] lstrcmpiW (lpString1="Local Settings", lpString2="..") returned 1 [0058.340] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Local Settings" | out: lpString1="C:\\Users\\FD1HVy\\Local Settings") returned="C:\\Users\\FD1HVy\\Local Settings" [0058.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Local Settings", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0058.340] GetProcessHeap () returned 0x630000 [0058.340] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0058.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Local Settings", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Local Settings", lpUsedDefaultChar=0x0) returned 15 [0058.340] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0058.340] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0058.340] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0058.340] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0058.340] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0058.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0058.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0058.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0058.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0058.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0058.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0058.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0058.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0058.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0058.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0058.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0058.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0058.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0058.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0058.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0058.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0058.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0058.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0058.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0058.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0058.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0058.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0058.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0058.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0058.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0058.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0058.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0058.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0058.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0058.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0058.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0058.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0058.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0058.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0058.342] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0058.342] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0058.342] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0058.342] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0058.342] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Local Settings", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Local Settings\\") returned="C:\\Users\\FD1HVy\\Local Settings\\" [0058.342] GetProcessHeap () returned 0x630000 [0058.342] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a268 [0058.342] lstrlenW (lpString="C:\\Users\\FD1HVy\\Local Settings\\") returned 31 [0058.342] GetProcessHeap () returned 0x630000 [0058.342] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x40) returned 0x641f20 [0058.342] lstrcpyW (in: lpString1=0x641f20, lpString2="C:\\Users\\FD1HVy\\Local Settings\\" | out: lpString1="C:\\Users\\FD1HVy\\Local Settings\\") returned="C:\\Users\\FD1HVy\\Local Settings\\" [0058.342] GetProcessHeap () returned 0x630000 [0058.342] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0058.342] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3a784dd5, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3a784dd5, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0058.342] lstrcmpiW (lpString1="Music", lpString2=".") returned 1 [0058.342] lstrcmpiW (lpString1="Music", lpString2="..") returned 1 [0058.342] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Music" | out: lpString1="C:\\Users\\FD1HVy\\Music") returned="C:\\Users\\FD1HVy\\Music" [0058.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Music", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0058.342] GetProcessHeap () returned 0x630000 [0058.342] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6) returned 0x65a278 [0058.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Music", cchWideChar=-1, lpMultiByteStr=0x65a278, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Music", lpUsedDefaultChar=0x0) returned 6 [0058.342] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0058.342] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0058.342] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0058.342] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0058.342] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0058.342] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0058.342] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0058.342] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0058.342] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0058.342] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0058.342] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0058.342] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0058.342] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0058.342] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0058.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0058.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0058.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0058.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0058.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0058.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0058.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0058.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0058.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0058.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0058.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0058.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0058.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0058.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0058.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0058.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0058.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0058.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0058.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0058.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0058.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0058.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0058.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0058.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0058.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0058.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0058.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0058.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0058.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0058.343] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0058.343] GetProcessHeap () returned 0x630000 [0058.343] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a348 [0058.343] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\") returned 22 [0058.343] GetProcessHeap () returned 0x630000 [0058.343] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2e) returned 0x6522b0 [0058.344] lstrcpyW (in: lpString1=0x6522b0, lpString2="C:\\Users\\FD1HVy\\Music\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0058.344] GetProcessHeap () returned 0x630000 [0058.344] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0058.344] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0058.344] lstrcmpiW (lpString1="My Documents", lpString2=".") returned 1 [0058.344] lstrcmpiW (lpString1="My Documents", lpString2="..") returned 1 [0058.344] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="My Documents" | out: lpString1="C:\\Users\\FD1HVy\\My Documents") returned="C:\\Users\\FD1HVy\\My Documents" [0058.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="My Documents", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0058.344] GetProcessHeap () returned 0x630000 [0058.344] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd) returned 0x64ca20 [0058.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="My Documents", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="My Documents", lpUsedDefaultChar=0x0) returned 13 [0058.345] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0058.345] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0058.345] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0058.345] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0058.345] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0058.345] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0058.345] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0058.345] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0058.345] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0058.345] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0058.345] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0058.345] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0058.345] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0058.345] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0058.345] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0058.345] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0058.345] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0058.345] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0058.345] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0058.345] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0058.345] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0058.345] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0058.345] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0058.345] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0058.345] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0058.345] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0058.345] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0058.345] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0058.345] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0058.345] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0058.345] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0058.345] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0058.345] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0058.346] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0058.346] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0058.346] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0058.346] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0058.346] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0058.346] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0058.346] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0058.346] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0058.346] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0058.346] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0058.346] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\My Documents", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\My Documents\\") returned="C:\\Users\\FD1HVy\\My Documents\\" [0058.346] GetProcessHeap () returned 0x630000 [0058.346] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a318 [0058.346] lstrlenW (lpString="C:\\Users\\FD1HVy\\My Documents\\") returned 29 [0058.346] GetProcessHeap () returned 0x630000 [0058.346] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3c) returned 0x642238 [0058.346] lstrcpyW (in: lpString1=0x642238, lpString2="C:\\Users\\FD1HVy\\My Documents\\" | out: lpString1="C:\\Users\\FD1HVy\\My Documents\\") returned="C:\\Users\\FD1HVy\\My Documents\\" [0058.346] GetProcessHeap () returned 0x630000 [0058.346] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0058.346] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0058.346] lstrcmpiW (lpString1="NetHood", lpString2=".") returned 1 [0058.346] lstrcmpiW (lpString1="NetHood", lpString2="..") returned 1 [0058.346] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="NetHood" | out: lpString1="C:\\Users\\FD1HVy\\NetHood") returned="C:\\Users\\FD1HVy\\NetHood" [0058.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetHood", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0058.346] GetProcessHeap () returned 0x630000 [0058.346] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a338 [0058.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetHood", cchWideChar=-1, lpMultiByteStr=0x65a338, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetHood", lpUsedDefaultChar=0x0) returned 8 [0058.346] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0058.346] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0058.346] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0058.346] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0058.346] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0058.346] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0058.346] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0058.346] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0058.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0058.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0058.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0058.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0058.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0058.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0058.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0058.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0058.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0058.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0058.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0058.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0058.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0058.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0058.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0058.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0058.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0058.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0058.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0058.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0058.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0058.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0058.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0058.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0058.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0058.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0058.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0058.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0058.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0058.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0058.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0058.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0058.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0058.348] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0058.348] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0058.348] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\NetHood", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\NetHood\\") returned="C:\\Users\\FD1HVy\\NetHood\\" [0058.349] GetProcessHeap () returned 0x630000 [0058.349] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a2b8 [0058.349] lstrlenW (lpString="C:\\Users\\FD1HVy\\NetHood\\") returned 24 [0058.349] GetProcessHeap () returned 0x630000 [0058.349] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x32) returned 0x648890 [0058.349] lstrcpyW (in: lpString1=0x648890, lpString2="C:\\Users\\FD1HVy\\NetHood\\" | out: lpString1="C:\\Users\\FD1HVy\\NetHood\\") returned="C:\\Users\\FD1HVy\\NetHood\\" [0058.349] GetProcessHeap () returned 0x630000 [0058.349] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.349] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd21a84e3, ftLastAccessTime.dwHighDateTime=0x1d5d815, ftLastWriteTime.dwLowDateTime=0xd21a84e3, ftLastWriteTime.dwHighDateTime=0x1d5d815, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0058.349] lstrcmpiW (lpString1="NTUSER.DAT", lpString2=".") returned 1 [0058.349] lstrcmpiW (lpString1="NTUSER.DAT", lpString2="..") returned 1 [0058.349] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="NTUSER.DAT" | out: lpString1="C:\\Users\\FD1HVy\\NTUSER.DAT") returned="C:\\Users\\FD1HVy\\NTUSER.DAT" [0058.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NTUSER.DAT", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0058.349] GetProcessHeap () returned 0x630000 [0058.349] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb) returned 0x64c9f0 [0058.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NTUSER.DAT", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NTUSER.DAT", lpUsedDefaultChar=0x0) returned 11 [0058.349] lstrlenA (lpString="NTUSER.DAT") returned 10 [0058.349] lstrlenA (lpString=".happythreechoose") returned 17 [0058.349] lstrcmpiW (lpString1="NTUSER.DAT", lpString2="Decryption INFO.html") returned 1 [0058.349] lstrcmpiW (lpString1="NTUSER.DAT", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0058.349] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0058.349] lstrcmpiW (lpString1="NTUSER.DAT", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0058.349] GetProcessHeap () returned 0x630000 [0058.349] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f10 [0058.349] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT" (normalized: "c:\\users\\fd1hvy\\ntuser.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0058.350] CloseHandle (hObject=0xffffffff) returned 1 [0058.350] GetProcessHeap () returned 0x630000 [0058.350] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f10 | out: hHeap=0x630000) returned 1 [0058.350] GetProcessHeap () returned 0x630000 [0058.350] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0058.350] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x21204700, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0xbd400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0058.350] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2=".") returned 1 [0058.350] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2="..") returned 1 [0058.350] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="ntuser.dat.LOG1" | out: lpString1="C:\\Users\\FD1HVy\\ntuser.dat.LOG1") returned="C:\\Users\\FD1HVy\\ntuser.dat.LOG1" [0058.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ntuser.dat.LOG1", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0058.350] GetProcessHeap () returned 0x630000 [0058.350] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x64ca20 [0058.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ntuser.dat.LOG1", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ntuser.dat.LOG1", lpUsedDefaultChar=0x0) returned 16 [0058.350] lstrlenA (lpString="ntuser.dat.LOG1") returned 15 [0058.350] lstrlenA (lpString=".happythreechoose") returned 17 [0058.350] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2="Decryption INFO.html") returned 1 [0058.350] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0058.350] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0058.350] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0058.350] GetProcessHeap () returned 0x630000 [0058.350] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0058.350] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\ntuser.dat.LOG1" (normalized: "c:\\users\\fd1hvy\\ntuser.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0058.350] CloseHandle (hObject=0xffffffff) returned 1 [0058.350] GetProcessHeap () returned 0x630000 [0058.350] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0058.350] GetProcessHeap () returned 0x630000 [0058.350] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0058.351] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x21204700, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0058.351] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2=".") returned 1 [0058.351] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2="..") returned 1 [0058.351] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="ntuser.dat.LOG2" | out: lpString1="C:\\Users\\FD1HVy\\ntuser.dat.LOG2") returned="C:\\Users\\FD1HVy\\ntuser.dat.LOG2" [0058.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ntuser.dat.LOG2", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0058.351] GetProcessHeap () returned 0x630000 [0058.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x64ca20 [0058.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ntuser.dat.LOG2", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ntuser.dat.LOG2", lpUsedDefaultChar=0x0) returned 16 [0058.351] lstrlenA (lpString="ntuser.dat.LOG2") returned 15 [0058.351] lstrlenA (lpString=".happythreechoose") returned 17 [0058.351] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2="Decryption INFO.html") returned 1 [0058.351] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0058.351] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0058.351] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0058.351] GetProcessHeap () returned 0x630000 [0058.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0058.351] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\ntuser.dat.LOG2" (normalized: "c:\\users\\fd1hvy\\ntuser.dat.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0058.351] CloseHandle (hObject=0xffffffff) returned 1 [0058.351] GetProcessHeap () returned 0x630000 [0058.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0058.351] GetProcessHeap () returned 0x630000 [0058.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0058.351] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0058.351] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", lpString2=".") returned 1 [0058.351] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", lpString2="..") returned 1 [0058.351] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf" | out: lpString1="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf") returned="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf" [0058.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 56 [0058.351] GetProcessHeap () returned 0x630000 [0058.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38) returned 0x648ad0 [0058.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", cchWideChar=-1, lpMultiByteStr=0x648ad0, cbMultiByte=56, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", lpUsedDefaultChar=0x0) returned 56 [0058.351] lstrlenA (lpString="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf") returned 55 [0058.352] lstrlenA (lpString=".happythreechoose") returned 17 [0058.352] lstrlenA (lpString=".happythreechoose") returned 17 [0058.352] lstrlenA (lpString="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf") returned 55 [0058.352] lstrcmpiA (lpString1="8901d6c9b}.TM.blf", lpString2=".happythreechoose") returned 1 [0058.352] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", lpString2="Decryption INFO.html") returned 1 [0058.352] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0058.352] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0058.352] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0058.352] GetProcessHeap () returned 0x630000 [0058.352] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0058.352] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tm.blf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0058.352] CloseHandle (hObject=0xffffffff) returned 1 [0058.352] GetProcessHeap () returned 0x630000 [0058.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0058.352] GetProcessHeap () returned 0x630000 [0058.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x648ad0 | out: hHeap=0x630000) returned 1 [0058.352] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2122a949, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2122a949, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0058.352] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", lpString2=".") returned 1 [0058.352] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", lpString2="..") returned 1 [0058.352] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms" | out: lpString1="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms") returned="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms" [0058.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 93 [0058.352] GetProcessHeap () returned 0x630000 [0058.352] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5d) returned 0x63e830 [0058.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", cchWideChar=-1, lpMultiByteStr=0x63e830, cbMultiByte=93, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", lpUsedDefaultChar=0x0) returned 93 [0058.352] lstrlenA (lpString="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms") returned 92 [0058.352] lstrlenA (lpString=".happythreechoose") returned 17 [0058.352] lstrlenA (lpString=".happythreechoose") returned 17 [0058.352] lstrlenA (lpString="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms") returned 92 [0058.352] lstrcmpiA (lpString1="00001.regtrans-ms", lpString2=".happythreechoose") returned 1 [0058.352] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", lpString2="Decryption INFO.html") returned 1 [0058.353] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0058.353] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0058.353] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0058.353] GetProcessHeap () returned 0x630000 [0058.353] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0058.353] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000001.regtrans-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0058.353] CloseHandle (hObject=0xffffffff) returned 1 [0058.353] GetProcessHeap () returned 0x630000 [0058.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0058.353] GetProcessHeap () returned 0x630000 [0058.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0058.353] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2122a949, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2122a949, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0058.353] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", lpString2=".") returned 1 [0058.353] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", lpString2="..") returned 1 [0058.353] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms" | out: lpString1="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms") returned="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms" [0058.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 93 [0058.353] GetProcessHeap () returned 0x630000 [0058.353] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5d) returned 0x63e830 [0058.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", cchWideChar=-1, lpMultiByteStr=0x63e830, cbMultiByte=93, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", lpUsedDefaultChar=0x0) returned 93 [0058.353] lstrlenA (lpString="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms") returned 92 [0058.353] lstrlenA (lpString=".happythreechoose") returned 17 [0058.353] lstrlenA (lpString=".happythreechoose") returned 17 [0058.353] lstrlenA (lpString="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms") returned 92 [0058.353] lstrcmpiA (lpString1="00002.regtrans-ms", lpString2=".happythreechoose") returned 1 [0058.353] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", lpString2="Decryption INFO.html") returned 1 [0058.353] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0058.353] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0058.353] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0058.354] GetProcessHeap () returned 0x630000 [0058.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0058.354] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000002.regtrans-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0058.354] CloseHandle (hObject=0xffffffff) returned 1 [0058.354] GetProcessHeap () returned 0x630000 [0058.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0058.354] GetProcessHeap () returned 0x630000 [0058.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0058.354] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xc1adea7d, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc1adea7d, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc1adea7d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0058.354] lstrcmpiW (lpString1="ntuser.ini", lpString2=".") returned 1 [0058.354] lstrcmpiW (lpString1="ntuser.ini", lpString2="..") returned 1 [0058.354] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="ntuser.ini" | out: lpString1="C:\\Users\\FD1HVy\\ntuser.ini") returned="C:\\Users\\FD1HVy\\ntuser.ini" [0058.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ntuser.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0058.354] GetProcessHeap () returned 0x630000 [0058.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb) returned 0x64c9f0 [0058.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ntuser.ini", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ntuser.ini", lpUsedDefaultChar=0x0) returned 11 [0058.354] lstrlenA (lpString="ntuser.ini") returned 10 [0058.354] lstrlenA (lpString=".happythreechoose") returned 17 [0058.354] lstrcmpiW (lpString1="ntuser.ini", lpString2="Decryption INFO.html") returned 1 [0058.354] lstrcmpiW (lpString1="ntuser.ini", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0058.354] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0058.354] lstrcmpiW (lpString1="ntuser.ini", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0058.354] GetProcessHeap () returned 0x630000 [0058.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0058.354] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\ntuser.ini" (normalized: "c:\\users\\fd1hvy\\ntuser.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0058.355] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=20) returned 1 [0058.355] GetProcessHeap () returned 0x630000 [0058.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655850 [0058.355] GetProcessHeap () returned 0x630000 [0058.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0058.355] lstrlenW (lpString="C:\\Users\\FD1HVy\\ntuser.ini") returned 26 [0058.355] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.355] GetProcessHeap () returned 0x630000 [0058.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0058.355] GetProcessHeap () returned 0x630000 [0058.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38c) returned 0x655c30 [0058.355] lstrlenA (lpString="rsa_encrypt") returned 11 [0058.355] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0058.356] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0058.356] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0058.356] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0058.356] GetProcessHeap () returned 0x630000 [0058.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0058.356] lstrlenA (lpString="010001") returned 6 [0058.356] GetProcessHeap () returned 0x630000 [0058.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0058.356] GetProcessHeap () returned 0x630000 [0058.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.356] GetProcessHeap () returned 0x630000 [0058.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e730 [0058.356] GetProcessHeap () returned 0x630000 [0058.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.356] GetProcessHeap () returned 0x630000 [0058.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ecd0 [0058.356] GetProcessHeap () returned 0x630000 [0058.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657670 [0058.356] GetProcessHeap () returned 0x630000 [0058.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0058.356] GetProcessHeap () returned 0x630000 [0058.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0058.356] GetProcessHeap () returned 0x630000 [0058.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0058.356] GetProcessHeap () returned 0x630000 [0058.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0058.356] GetProcessHeap () returned 0x630000 [0058.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.356] GetProcessHeap () returned 0x630000 [0058.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657788 [0058.356] GetProcessHeap () returned 0x630000 [0058.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0058.357] GetProcessHeap () returned 0x630000 [0058.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0058.357] GetProcessHeap () returned 0x630000 [0058.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0058.357] GetProcessHeap () returned 0x630000 [0058.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.357] GetProcessHeap () returned 0x630000 [0058.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0058.357] GetProcessHeap () returned 0x630000 [0058.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0058.357] GetProcessHeap () returned 0x630000 [0058.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0058.357] GetProcessHeap () returned 0x630000 [0058.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65a930 [0058.357] GetProcessHeap () returned 0x630000 [0058.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0058.357] GetProcessHeap () returned 0x630000 [0058.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0058.357] GetProcessHeap () returned 0x630000 [0058.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.357] GetProcessHeap () returned 0x630000 [0058.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.357] GetProcessHeap () returned 0x630000 [0058.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e070 [0058.357] GetProcessHeap () returned 0x630000 [0058.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a930 | out: hHeap=0x630000) returned 1 [0058.357] GetProcessHeap () returned 0x630000 [0058.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0058.357] GetProcessHeap () returned 0x630000 [0058.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0058.357] GetProcessHeap () returned 0x630000 [0058.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0058.357] GetProcessHeap () returned 0x630000 [0058.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0058.357] GetProcessHeap () returned 0x630000 [0058.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.357] GetProcessHeap () returned 0x630000 [0058.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.358] GetProcessHeap () returned 0x630000 [0058.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0058.358] GetProcessHeap () returned 0x630000 [0058.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0058.358] GetProcessHeap () returned 0x630000 [0058.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0058.358] GetProcessHeap () returned 0x630000 [0058.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0058.358] GetProcessHeap () returned 0x630000 [0058.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0058.358] GetProcessHeap () returned 0x630000 [0058.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0058.358] GetProcessHeap () returned 0x630000 [0058.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0058.358] GetProcessHeap () returned 0x630000 [0058.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0058.358] GetProcessHeap () returned 0x630000 [0058.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.358] GetProcessHeap () returned 0x630000 [0058.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.358] GetProcessHeap () returned 0x630000 [0058.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.358] GetProcessHeap () returned 0x630000 [0058.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.358] GetProcessHeap () returned 0x630000 [0058.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.358] GetProcessHeap () returned 0x630000 [0058.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.358] GetProcessHeap () returned 0x630000 [0058.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.358] GetProcessHeap () returned 0x630000 [0058.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.358] GetProcessHeap () returned 0x630000 [0058.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.358] GetProcessHeap () returned 0x630000 [0058.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.358] GetProcessHeap () returned 0x630000 [0058.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0058.359] GetProcessHeap () returned 0x630000 [0058.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0058.359] GetProcessHeap () returned 0x630000 [0058.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0058.359] GetProcessHeap () returned 0x630000 [0058.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0058.359] GetProcessHeap () returned 0x630000 [0058.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.359] GetProcessHeap () returned 0x630000 [0058.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.359] GetProcessHeap () returned 0x630000 [0058.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0058.359] GetProcessHeap () returned 0x630000 [0058.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0058.359] GetProcessHeap () returned 0x630000 [0058.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.359] GetProcessHeap () returned 0x630000 [0058.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.359] GetProcessHeap () returned 0x630000 [0058.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.359] GetProcessHeap () returned 0x630000 [0058.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.359] GetProcessHeap () returned 0x630000 [0058.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.359] GetProcessHeap () returned 0x630000 [0058.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.362] GetProcessHeap () returned 0x630000 [0058.362] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0058.362] GetProcessHeap () returned 0x630000 [0058.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0058.362] GetProcessHeap () returned 0x630000 [0058.362] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.362] GetProcessHeap () returned 0x630000 [0058.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.362] GetProcessHeap () returned 0x630000 [0058.362] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0058.362] GetProcessHeap () returned 0x630000 [0058.363] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0058.363] GetProcessHeap () returned 0x630000 [0058.363] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.363] GetProcessHeap () returned 0x630000 [0058.363] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.363] GetProcessHeap () returned 0x630000 [0058.363] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0058.363] GetProcessHeap () returned 0x630000 [0058.363] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0058.363] GetProcessHeap () returned 0x630000 [0058.363] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0058.363] GetProcessHeap () returned 0x630000 [0058.363] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0058.363] GetProcessHeap () returned 0x630000 [0058.363] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.363] GetProcessHeap () returned 0x630000 [0058.363] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.363] GetProcessHeap () returned 0x630000 [0058.363] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0058.363] GetProcessHeap () returned 0x630000 [0058.363] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0058.363] GetProcessHeap () returned 0x630000 [0058.363] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0058.363] GetProcessHeap () returned 0x630000 [0058.363] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0058.363] GetProcessHeap () returned 0x630000 [0058.363] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0058.363] GetProcessHeap () returned 0x630000 [0058.363] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0058.363] GetProcessHeap () returned 0x630000 [0058.363] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0058.363] GetProcessHeap () returned 0x630000 [0058.363] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0058.363] GetProcessHeap () returned 0x630000 [0058.363] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.363] GetProcessHeap () returned 0x630000 [0058.363] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.363] GetProcessHeap () returned 0x630000 [0058.364] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.364] GetProcessHeap () returned 0x630000 [0058.364] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.364] GetProcessHeap () returned 0x630000 [0058.364] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.364] GetProcessHeap () returned 0x630000 [0058.364] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.364] GetProcessHeap () returned 0x630000 [0058.364] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0058.364] GetProcessHeap () returned 0x630000 [0058.364] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0058.364] GetProcessHeap () returned 0x630000 [0058.364] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0058.364] GetProcessHeap () returned 0x630000 [0058.364] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0058.364] GetProcessHeap () returned 0x630000 [0058.364] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0058.364] GetProcessHeap () returned 0x630000 [0058.364] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0058.364] GetProcessHeap () returned 0x630000 [0058.364] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0058.364] GetProcessHeap () returned 0x630000 [0058.364] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0058.364] GetProcessHeap () returned 0x630000 [0058.364] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0058.364] GetProcessHeap () returned 0x630000 [0058.364] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0058.364] GetProcessHeap () returned 0x630000 [0058.364] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0058.364] GetProcessHeap () returned 0x630000 [0058.364] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0058.364] GetProcessHeap () returned 0x630000 [0058.364] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0058.364] GetProcessHeap () returned 0x630000 [0058.364] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0058.364] GetProcessHeap () returned 0x630000 [0058.364] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0058.365] GetProcessHeap () returned 0x630000 [0058.365] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0058.365] GetProcessHeap () returned 0x630000 [0058.365] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0058.365] GetProcessHeap () returned 0x630000 [0058.365] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0058.365] GetProcessHeap () returned 0x630000 [0058.365] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0058.365] GetProcessHeap () returned 0x630000 [0058.365] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0058.365] GetProcessHeap () returned 0x630000 [0058.365] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0058.365] GetProcessHeap () returned 0x630000 [0058.365] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0058.365] GetProcessHeap () returned 0x630000 [0058.365] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0058.365] GetProcessHeap () returned 0x630000 [0058.365] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ecd0 | out: hHeap=0x630000) returned 1 [0058.365] GetProcessHeap () returned 0x630000 [0058.365] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0058.365] GetProcessHeap () returned 0x630000 [0058.365] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0058.365] GetProcessHeap () returned 0x630000 [0058.365] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0058.365] GetProcessHeap () returned 0x630000 [0058.365] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0058.365] GetProcessHeap () returned 0x630000 [0058.365] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0058.365] WriteFile (in: hFile=0x230, lpBuffer=0x655c30*, nNumberOfBytesToWrite=0x38c, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x655c30*, lpNumberOfBytesWritten=0x243d864*=0x38c, lpOverlapped=0x0) returned 1 [0058.376] GetProcessHeap () returned 0x630000 [0058.376] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x655c30, Size=0x30) returned 0x655c30 [0058.376] GetProcessHeap () returned 0x630000 [0058.376] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0058.376] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.376] GetProcessHeap () returned 0x630000 [0058.376] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x20) returned 0x652000 [0058.376] ReadFile (in: hFile=0x230, lpBuffer=0x652000, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x652000*, lpNumberOfBytesRead=0x243d7e8*=0x20, lpOverlapped=0x0) returned 1 [0058.376] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.376] WriteFile (in: hFile=0x230, lpBuffer=0x652000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x652000*, lpNumberOfBytesWritten=0x243d7e4*=0x20, lpOverlapped=0x0) returned 1 [0058.377] GetProcessHeap () returned 0x630000 [0058.377] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x652000 | out: hHeap=0x630000) returned 1 [0058.377] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.377] WriteFile (in: hFile=0x230, lpBuffer=0x655c30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x655c30*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0058.378] CloseHandle (hObject=0x230) returned 1 [0058.380] GetProcessHeap () returned 0x630000 [0058.380] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0058.380] GetProcessHeap () returned 0x630000 [0058.380] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655850 | out: hHeap=0x630000) returned 1 [0058.380] GetProcessHeap () returned 0x630000 [0058.380] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0058.380] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\ntuser.ini" | out: lpString1="C:\\Users\\FD1HVy\\ntuser.ini") returned="C:\\Users\\FD1HVy\\ntuser.ini" [0058.380] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\ntuser.ini", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\ntuser.ini.happythreechoose") returned="C:\\Users\\FD1HVy\\ntuser.ini.happythreechoose" [0058.380] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\ntuser.ini" (normalized: "c:\\users\\fd1hvy\\ntuser.ini"), lpNewFileName="C:\\Users\\FD1HVy\\ntuser.ini.happythreechoose" (normalized: "c:\\users\\fd1hvy\\ntuser.ini.happythreechoose"), dwFlags=0x1) returned 1 [0058.380] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\ntuser.ini" | out: pszPath="C:\\Users\\FD1HVy") returned 1 [0058.380] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy" | out: pszPath="C:\\Users\\FD1HVy\\") returned="" [0058.380] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Decryption INFO.html" [0058.380] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\decryption info.html")) returned 0xffffffff [0058.381] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0058.381] GetProcessHeap () returned 0x630000 [0058.381] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655670 [0058.381] GetProcessHeap () returned 0x630000 [0058.381] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0058.388] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.389] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.389] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.389] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.389] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.389] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.389] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.390] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.390] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.390] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.390] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.390] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.390] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.390] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.390] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.390] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.390] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.390] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.390] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.390] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.391] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.391] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.391] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.391] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.391] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.391] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.391] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.391] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.391] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.391] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.391] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.391] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.391] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.392] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.392] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.392] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.392] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.393] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.393] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.393] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.393] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.393] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.393] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.393] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.393] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.393] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.394] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.394] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.394] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.394] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.394] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.394] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.394] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.394] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.394] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.394] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.394] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.394] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.394] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.395] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.395] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.395] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.395] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.395] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.395] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.395] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.395] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.395] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.395] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.395] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.395] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.395] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.395] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.395] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.396] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.396] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.396] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.396] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.396] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.396] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.396] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.396] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.396] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.396] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.396] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.396] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.396] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.396] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.397] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.397] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.397] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.397] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.397] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.397] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.397] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.397] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.397] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.397] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.397] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.397] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.397] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.397] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.398] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.398] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.398] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.398] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.398] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.398] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.398] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.398] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.398] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.398] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.398] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.398] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.398] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.398] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.398] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.399] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.399] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.399] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.399] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.399] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.399] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.399] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.399] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.399] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.399] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.399] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.399] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.399] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.399] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.399] GetProcessHeap () returned 0x630000 [0058.400] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655670 | out: hHeap=0x630000) returned 1 [0058.400] GetProcessHeap () returned 0x630000 [0058.400] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0058.400] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0058.400] GetProcessHeap () returned 0x630000 [0058.400] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655b20 [0058.400] GetProcessHeap () returned 0x630000 [0058.400] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0058.437] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.437] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.438] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.438] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.438] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.438] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.438] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.438] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.438] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.438] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.438] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.439] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.439] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.439] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.439] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.439] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.439] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.439] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.439] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.439] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.439] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.439] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.439] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.439] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.439] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.440] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.440] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.440] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.440] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.440] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.440] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.440] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.440] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.440] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.440] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.440] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.440] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.440] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.440] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.440] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.441] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.441] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.441] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.441] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.441] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.441] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.441] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.441] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.441] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.441] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.441] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.441] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.441] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.441] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.442] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.442] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.442] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.442] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.442] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.442] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.442] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.442] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.442] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.442] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.442] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.442] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.442] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.442] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.442] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.443] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.443] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.443] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.443] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.443] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.443] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.443] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.443] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.443] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.443] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.443] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.443] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.443] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.444] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.444] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.444] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.444] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.444] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.444] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.444] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.444] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.444] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.444] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.444] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.444] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.444] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.444] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.444] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.445] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.445] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.446] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.447] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.447] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.447] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.447] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.447] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.447] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.447] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.447] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.447] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.447] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.447] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.447] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.447] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.447] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.448] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.448] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.448] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.448] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.448] GetProcessHeap () returned 0x630000 [0058.448] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655b20 | out: hHeap=0x630000) returned 1 [0058.448] GetProcessHeap () returned 0x630000 [0058.448] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0058.449] CloseHandle (hObject=0x230) returned 1 [0058.449] GetProcessHeap () returned 0x630000 [0058.449] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0058.449] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OneDrive", cAlternateFileName="")) returned 1 [0058.449] lstrcmpiW (lpString1="OneDrive", lpString2=".") returned 1 [0058.449] lstrcmpiW (lpString1="OneDrive", lpString2="..") returned 1 [0058.449] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="OneDrive" | out: lpString1="C:\\Users\\FD1HVy\\OneDrive") returned="C:\\Users\\FD1HVy\\OneDrive" [0058.449] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="OneDrive", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0058.449] GetProcessHeap () returned 0x630000 [0058.449] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9) returned 0x64c9f0 [0058.449] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="OneDrive", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OneDrive", lpUsedDefaultChar=0x0) returned 9 [0058.449] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0058.449] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0058.449] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0058.449] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0058.449] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0058.449] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0058.449] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0058.449] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0058.449] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0058.449] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0058.449] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0058.449] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0058.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0058.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0058.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0058.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0058.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0058.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0058.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0058.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0058.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0058.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0058.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0058.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0058.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0058.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0058.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0058.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0058.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0058.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0058.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0058.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0058.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0058.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0058.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0058.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0058.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0058.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0058.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0058.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0058.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0058.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0058.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0058.450] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\OneDrive", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\OneDrive\\") returned="C:\\Users\\FD1HVy\\OneDrive\\" [0058.450] GetProcessHeap () returned 0x630000 [0058.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a338 [0058.451] lstrlenW (lpString="C:\\Users\\FD1HVy\\OneDrive\\") returned 25 [0058.451] GetProcessHeap () returned 0x630000 [0058.451] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x34) returned 0x648ad0 [0058.451] lstrcpyW (in: lpString1=0x648ad0, lpString2="C:\\Users\\FD1HVy\\OneDrive\\" | out: lpString1="C:\\Users\\FD1HVy\\OneDrive\\") returned="C:\\Users\\FD1HVy\\OneDrive\\" [0058.451] GetProcessHeap () returned 0x630000 [0058.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0058.451] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3a99ac44, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3a99ac44, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0058.451] lstrcmpiW (lpString1="Pictures", lpString2=".") returned 1 [0058.451] lstrcmpiW (lpString1="Pictures", lpString2="..") returned 1 [0058.451] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Pictures" | out: lpString1="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0058.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Pictures", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0058.451] GetProcessHeap () returned 0x630000 [0058.451] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9) returned 0x64ca20 [0058.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Pictures", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pictures", lpUsedDefaultChar=0x0) returned 9 [0058.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0058.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0058.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0058.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0058.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0058.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0058.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0058.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0058.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0058.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0058.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0058.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0058.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0058.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0058.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0058.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0058.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0058.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0058.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0058.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0058.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0058.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0058.452] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0058.452] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0058.452] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0058.452] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0058.452] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0058.452] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0058.452] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0058.452] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0058.452] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0058.452] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0058.452] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0058.452] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0058.452] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0058.452] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0058.452] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0058.452] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0058.452] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0058.452] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0058.452] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0058.452] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0058.452] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0058.452] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0058.452] GetProcessHeap () returned 0x630000 [0058.452] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a258 [0058.452] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\") returned 25 [0058.452] GetProcessHeap () returned 0x630000 [0058.452] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x34) returned 0x648b10 [0058.452] lstrcpyW (in: lpString1=0x648b10, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0058.452] GetProcessHeap () returned 0x630000 [0058.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0058.452] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0058.452] lstrcmpiW (lpString1="PrintHood", lpString2=".") returned 1 [0058.452] lstrcmpiW (lpString1="PrintHood", lpString2="..") returned 1 [0058.452] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="PrintHood" | out: lpString1="C:\\Users\\FD1HVy\\PrintHood") returned="C:\\Users\\FD1HVy\\PrintHood" [0058.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PrintHood", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0058.452] GetProcessHeap () returned 0x630000 [0058.453] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x64c9f0 [0058.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PrintHood", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PrintHood", lpUsedDefaultChar=0x0) returned 10 [0058.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0058.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0058.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0058.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0058.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0058.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0058.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0058.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0058.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0058.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0058.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0058.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0058.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0058.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0058.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0058.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0058.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0058.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0058.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0058.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0058.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0058.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0058.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0058.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0058.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0058.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0058.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0058.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0058.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0058.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0058.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0058.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0058.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0058.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0058.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0058.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0058.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0058.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0058.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0058.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0058.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0058.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0058.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0058.454] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\PrintHood", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\PrintHood\\") returned="C:\\Users\\FD1HVy\\PrintHood\\" [0058.454] GetProcessHeap () returned 0x630000 [0058.454] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a278 [0058.454] lstrlenW (lpString="C:\\Users\\FD1HVy\\PrintHood\\") returned 26 [0058.454] GetProcessHeap () returned 0x630000 [0058.454] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x36) returned 0x648bd0 [0058.454] lstrcpyW (in: lpString1=0x648bd0, lpString2="C:\\Users\\FD1HVy\\PrintHood\\" | out: lpString1="C:\\Users\\FD1HVy\\PrintHood\\") returned="C:\\Users\\FD1HVy\\PrintHood\\" [0058.454] GetProcessHeap () returned 0x630000 [0058.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0058.454] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0058.454] lstrcmpiW (lpString1="Recent", lpString2=".") returned 1 [0058.454] lstrcmpiW (lpString1="Recent", lpString2="..") returned 1 [0058.454] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Recent" | out: lpString1="C:\\Users\\FD1HVy\\Recent") returned="C:\\Users\\FD1HVy\\Recent" [0058.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Recent", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0058.454] GetProcessHeap () returned 0x630000 [0058.455] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7) returned 0x65a3b8 [0058.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Recent", cchWideChar=-1, lpMultiByteStr=0x65a3b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Recent", lpUsedDefaultChar=0x0) returned 7 [0058.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0058.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0058.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0058.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0058.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0058.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0058.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0058.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0058.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0058.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0058.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0058.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0058.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0058.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0058.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0058.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0058.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0058.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0058.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0058.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0058.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0058.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0058.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0058.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0058.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0058.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0058.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0058.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0058.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0058.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0058.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0058.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0058.456] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0058.456] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0058.456] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0058.456] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0058.456] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0058.456] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0058.456] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0058.456] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0058.456] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0058.456] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0058.456] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0058.456] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Recent\\") returned="C:\\Users\\FD1HVy\\Recent\\" [0058.456] GetProcessHeap () returned 0x630000 [0058.456] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a188 [0058.456] lstrlenW (lpString="C:\\Users\\FD1HVy\\Recent\\") returned 23 [0058.456] GetProcessHeap () returned 0x630000 [0058.456] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x30) returned 0x652240 [0058.456] lstrcpyW (in: lpString1=0x652240, lpString2="C:\\Users\\FD1HVy\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\Recent\\") returned="C:\\Users\\FD1HVy\\Recent\\" [0058.456] GetProcessHeap () returned 0x630000 [0058.456] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0058.456] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0058.456] lstrcmpiW (lpString1="Saved Games", lpString2=".") returned 1 [0058.456] lstrcmpiW (lpString1="Saved Games", lpString2="..") returned 1 [0058.456] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Saved Games" | out: lpString1="C:\\Users\\FD1HVy\\Saved Games") returned="C:\\Users\\FD1HVy\\Saved Games" [0058.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Saved Games", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0058.456] GetProcessHeap () returned 0x630000 [0058.456] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64ca20 [0058.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Saved Games", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Saved Games", lpUsedDefaultChar=0x0) returned 12 [0058.456] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0058.456] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0058.456] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0058.456] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0058.456] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0058.456] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0058.456] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0058.456] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0058.457] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0058.457] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0058.457] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0058.457] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0058.457] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0058.457] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0058.457] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0058.457] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0058.457] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0058.457] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0058.457] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0058.457] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0058.457] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0058.457] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0058.457] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0058.457] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0058.457] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0058.457] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0058.457] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0058.457] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0058.457] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0058.457] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0058.457] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0058.457] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0058.457] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0058.457] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0058.457] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0058.457] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0058.457] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0058.457] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0058.457] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0058.457] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0058.457] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0058.457] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0058.457] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0058.458] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Saved Games", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Saved Games\\") returned="C:\\Users\\FD1HVy\\Saved Games\\" [0058.458] GetProcessHeap () returned 0x630000 [0058.458] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a3b8 [0058.458] lstrlenW (lpString="C:\\Users\\FD1HVy\\Saved Games\\") returned 28 [0058.458] GetProcessHeap () returned 0x630000 [0058.458] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3a) returned 0x6424c0 [0058.458] lstrcpyW (in: lpString1=0x6424c0, lpString2="C:\\Users\\FD1HVy\\Saved Games\\" | out: lpString1="C:\\Users\\FD1HVy\\Saved Games\\") returned="C:\\Users\\FD1HVy\\Saved Games\\" [0058.458] GetProcessHeap () returned 0x630000 [0058.458] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0058.458] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1 [0058.458] lstrcmpiW (lpString1="Searches", lpString2=".") returned 1 [0058.458] lstrcmpiW (lpString1="Searches", lpString2="..") returned 1 [0058.458] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Searches" | out: lpString1="C:\\Users\\FD1HVy\\Searches") returned="C:\\Users\\FD1HVy\\Searches" [0058.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Searches", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0058.458] GetProcessHeap () returned 0x630000 [0058.458] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9) returned 0x64ca20 [0058.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Searches", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Searches", lpUsedDefaultChar=0x0) returned 9 [0058.458] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0058.458] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0058.458] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0058.458] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0058.458] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0058.458] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0058.458] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0058.458] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0058.458] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0058.458] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0058.458] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0058.458] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0058.458] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0058.458] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0058.458] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0058.458] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0058.458] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0058.458] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0058.458] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0058.459] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0058.459] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0058.459] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0058.459] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0058.459] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0058.459] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0058.459] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0058.459] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0058.459] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0058.459] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0058.459] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0058.459] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0058.459] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0058.459] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0058.459] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0058.459] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0058.459] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0058.459] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0058.459] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0058.459] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0058.459] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0058.459] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0058.459] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0058.459] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0058.459] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Searches", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\") returned="C:\\Users\\FD1HVy\\Searches\\" [0058.459] GetProcessHeap () returned 0x630000 [0058.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a078 [0058.459] lstrlenW (lpString="C:\\Users\\FD1HVy\\Searches\\") returned 25 [0058.459] GetProcessHeap () returned 0x630000 [0058.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x34) returned 0x648c10 [0058.459] lstrcpyW (in: lpString1=0x648c10, lpString2="C:\\Users\\FD1HVy\\Searches\\" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\") returned="C:\\Users\\FD1HVy\\Searches\\" [0058.459] GetProcessHeap () returned 0x630000 [0058.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0058.459] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0058.459] lstrcmpiW (lpString1="SendTo", lpString2=".") returned 1 [0058.460] lstrcmpiW (lpString1="SendTo", lpString2="..") returned 1 [0058.460] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="SendTo" | out: lpString1="C:\\Users\\FD1HVy\\SendTo") returned="C:\\Users\\FD1HVy\\SendTo" [0058.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SendTo", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0058.460] GetProcessHeap () returned 0x630000 [0058.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7) returned 0x65a168 [0058.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SendTo", cchWideChar=-1, lpMultiByteStr=0x65a168, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendTo", lpUsedDefaultChar=0x0) returned 7 [0058.460] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0058.460] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0058.460] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0058.460] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0058.460] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0058.460] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0058.460] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0058.460] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0058.460] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0058.460] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0058.460] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0058.460] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0058.460] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0058.460] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0058.460] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0058.460] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0058.460] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0058.460] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0058.460] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0058.460] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0058.460] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0058.460] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0058.460] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0058.460] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0058.460] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0058.460] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0058.460] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0058.460] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0058.460] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0058.461] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0058.461] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0058.461] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0058.461] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0058.461] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0058.461] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0058.461] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0058.461] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0058.461] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0058.461] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0058.461] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0058.461] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0058.461] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0058.461] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0058.461] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\SendTo", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\SendTo\\") returned="C:\\Users\\FD1HVy\\SendTo\\" [0058.461] GetProcessHeap () returned 0x630000 [0058.461] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a208 [0058.461] lstrlenW (lpString="C:\\Users\\FD1HVy\\SendTo\\") returned 23 [0058.461] GetProcessHeap () returned 0x630000 [0058.461] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x30) returned 0x652710 [0058.461] lstrcpyW (in: lpString1=0x652710, lpString2="C:\\Users\\FD1HVy\\SendTo\\" | out: lpString1="C:\\Users\\FD1HVy\\SendTo\\") returned="C:\\Users\\FD1HVy\\SendTo\\" [0058.461] GetProcessHeap () returned 0x630000 [0058.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0058.461] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0058.461] lstrcmpiW (lpString1="Start Menu", lpString2=".") returned 1 [0058.461] lstrcmpiW (lpString1="Start Menu", lpString2="..") returned 1 [0058.461] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Start Menu" | out: lpString1="C:\\Users\\FD1HVy\\Start Menu") returned="C:\\Users\\FD1HVy\\Start Menu" [0058.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Start Menu", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0058.461] GetProcessHeap () returned 0x630000 [0058.461] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb) returned 0x64ca20 [0058.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Start Menu", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Start Menu", lpUsedDefaultChar=0x0) returned 11 [0058.461] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0058.461] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0058.461] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0058.461] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0058.461] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0058.461] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0058.462] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0058.462] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0058.462] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0058.462] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0058.462] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0058.462] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0058.462] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0058.462] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0058.462] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0058.462] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0058.462] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0058.462] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0058.462] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0058.462] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0058.462] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0058.462] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0058.462] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0058.462] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0058.462] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 3 [0058.462] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0058.462] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0058.462] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0058.462] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0058.462] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0058.462] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0058.462] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0058.462] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0058.462] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0058.462] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0058.462] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0058.462] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0058.462] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0058.462] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0058.462] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0058.463] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0058.463] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0058.463] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0058.463] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Start Menu", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Start Menu\\") returned="C:\\Users\\FD1HVy\\Start Menu\\" [0058.463] GetProcessHeap () returned 0x630000 [0058.463] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a048 [0058.463] lstrlenW (lpString="C:\\Users\\FD1HVy\\Start Menu\\") returned 27 [0058.463] GetProcessHeap () returned 0x630000 [0058.463] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38) returned 0x65bbd0 [0058.463] lstrcpyW (in: lpString1=0x65bbd0, lpString2="C:\\Users\\FD1HVy\\Start Menu\\" | out: lpString1="C:\\Users\\FD1HVy\\Start Menu\\") returned="C:\\Users\\FD1HVy\\Start Menu\\" [0058.463] GetProcessHeap () returned 0x630000 [0058.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0058.463] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0058.463] lstrcmpiW (lpString1="Templates", lpString2=".") returned 1 [0058.463] lstrcmpiW (lpString1="Templates", lpString2="..") returned 1 [0058.463] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Templates" | out: lpString1="C:\\Users\\FD1HVy\\Templates") returned="C:\\Users\\FD1HVy\\Templates" [0058.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Templates", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0058.463] GetProcessHeap () returned 0x630000 [0058.463] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x64c9f0 [0058.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Templates", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Templates", lpUsedDefaultChar=0x0) returned 10 [0058.463] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0058.463] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0058.463] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0058.463] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0058.463] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0058.463] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0058.463] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0058.463] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0058.463] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0058.463] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0058.463] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0058.463] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0058.463] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0058.463] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0058.463] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0058.464] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0058.464] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0058.464] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0058.464] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0058.464] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0058.464] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0058.464] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0058.464] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0058.464] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0058.464] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 3 [0058.464] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 3 [0058.464] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0058.464] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0058.464] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 3 [0058.464] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 3 [0058.464] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 3 [0058.464] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0058.464] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0058.464] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0058.464] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0058.464] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0058.464] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0058.464] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0058.464] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0058.464] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0058.464] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0058.464] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0058.464] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0058.464] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Templates", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Templates\\") returned="C:\\Users\\FD1HVy\\Templates\\" [0058.464] GetProcessHeap () returned 0x630000 [0058.464] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a1a8 [0058.464] lstrlenW (lpString="C:\\Users\\FD1HVy\\Templates\\") returned 26 [0058.464] GetProcessHeap () returned 0x630000 [0058.464] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x36) returned 0x65bd10 [0058.464] lstrcpyW (in: lpString1=0x65bd10, lpString2="C:\\Users\\FD1HVy\\Templates\\" | out: lpString1="C:\\Users\\FD1HVy\\Templates\\") returned="C:\\Users\\FD1HVy\\Templates\\" [0058.464] GetProcessHeap () returned 0x630000 [0058.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0058.465] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3a94e7d8, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3a94e7d8, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0058.465] lstrcmpiW (lpString1="Videos", lpString2=".") returned 1 [0058.465] lstrcmpiW (lpString1="Videos", lpString2="..") returned 1 [0058.465] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Videos" | out: lpString1="C:\\Users\\FD1HVy\\Videos") returned="C:\\Users\\FD1HVy\\Videos" [0058.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Videos", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0058.465] GetProcessHeap () returned 0x630000 [0058.465] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7) returned 0x65a1d8 [0058.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Videos", cchWideChar=-1, lpMultiByteStr=0x65a1d8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Videos", lpUsedDefaultChar=0x0) returned 7 [0058.465] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0058.465] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0058.465] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0058.465] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0058.465] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0058.465] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0058.465] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0058.465] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0058.465] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0058.465] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0058.465] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0058.465] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0058.465] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0058.465] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0058.465] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0058.465] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0058.465] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0058.465] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0058.465] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0058.465] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0058.465] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0058.465] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0058.465] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0058.465] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0058.465] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 3 [0058.465] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 3 [0058.465] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0058.465] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0058.466] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 3 [0058.466] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 3 [0058.466] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 3 [0058.466] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0058.466] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0058.466] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0058.466] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0058.466] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0058.466] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0058.466] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0058.466] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0058.466] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0058.466] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0058.466] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0058.466] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0058.466] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\") returned="C:\\Users\\FD1HVy\\Videos\\" [0058.466] GetProcessHeap () returned 0x630000 [0058.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a138 [0058.466] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\") returned 23 [0058.466] GetProcessHeap () returned 0x630000 [0058.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x30) returned 0x652780 [0058.466] lstrcpyW (in: lpString1=0x652780, lpString2="C:\\Users\\FD1HVy\\Videos\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\") returned="C:\\Users\\FD1HVy\\Videos\\" [0058.466] GetProcessHeap () returned 0x630000 [0058.466] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0058.466] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3a94e7d8, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3a94e7d8, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0058.466] FindClose (in: hFindFile=0x648b50 | out: hFindFile=0x648b50) returned 1 [0058.466] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\Videos\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\") returned="C:\\Users\\FD1HVy\\Videos\\" [0058.466] GetProcessHeap () returned 0x630000 [0058.466] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x652780 | out: hHeap=0x630000) returned 1 [0058.466] GetProcessHeap () returned 0x630000 [0058.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0058.467] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\") returned 23 [0058.467] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\*") returned="C:\\Users\\FD1HVy\\Videos\\*" [0058.467] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3a94e7d8, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3a94e7d8, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65b710 [0058.467] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0058.467] FindNextFileW (in: hFindFile=0x65b710, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3a94e7d8, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3a94e7d8, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.467] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0058.467] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0058.467] FindNextFileW (in: hFindFile=0x65b710, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13255380, ftCreationTime.dwHighDateTime=0x1d5d416, ftLastAccessTime.dwLowDateTime=0xc87c3150, ftLastAccessTime.dwHighDateTime=0x1d5d442, ftLastWriteTime.dwLowDateTime=0xc87c3150, ftLastWriteTime.dwHighDateTime=0x1d5d442, nFileSizeHigh=0x0, nFileSizeLow=0x78c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="2J80DrUI0ukoi.mkv", cAlternateFileName="2J80DR~1.MKV")) returned 1 [0058.467] lstrcmpiW (lpString1="2J80DrUI0ukoi.mkv", lpString2=".") returned 1 [0058.467] lstrcmpiW (lpString1="2J80DrUI0ukoi.mkv", lpString2="..") returned 1 [0058.467] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="2J80DrUI0ukoi.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\2J80DrUI0ukoi.mkv") returned="C:\\Users\\FD1HVy\\Videos\\2J80DrUI0ukoi.mkv" [0058.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="2J80DrUI0ukoi.mkv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0058.467] GetProcessHeap () returned 0x630000 [0058.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x645f58 [0058.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="2J80DrUI0ukoi.mkv", cchWideChar=-1, lpMultiByteStr=0x645f58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2J80DrUI0ukoi.mkv", lpUsedDefaultChar=0x0) returned 18 [0058.467] lstrlenA (lpString="2J80DrUI0ukoi.mkv") returned 17 [0058.467] lstrlenA (lpString=".happythreechoose") returned 17 [0058.467] lstrlenA (lpString=".happythreechoose") returned 17 [0058.467] lstrlenA (lpString="2J80DrUI0ukoi.mkv") returned 17 [0058.467] lstrcmpiA (lpString1="2J80DrUI0ukoi.mkv", lpString2=".happythreechoose") returned 1 [0058.467] lstrcmpiW (lpString1="2J80DrUI0ukoi.mkv", lpString2="Decryption INFO.html") returned -1 [0058.467] lstrcmpiW (lpString1="2J80DrUI0ukoi.mkv", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned -1 [0058.467] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0058.467] lstrcmpiW (lpString1="2J80DrUI0ukoi.mkv", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0058.467] GetProcessHeap () returned 0x630000 [0058.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651ec0 [0058.467] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\2J80DrUI0ukoi.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\2j80drui0ukoi.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0058.468] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=1932) returned 1 [0058.468] GetProcessHeap () returned 0x630000 [0058.468] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655aa8 [0058.468] GetProcessHeap () returned 0x630000 [0058.468] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0058.468] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\2J80DrUI0ukoi.mkv") returned 40 [0058.468] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.468] GetProcessHeap () returned 0x630000 [0058.468] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0058.468] GetProcessHeap () returned 0x630000 [0058.468] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x384) returned 0x655c68 [0058.468] lstrlenA (lpString="rsa_encrypt") returned 11 [0058.468] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0058.469] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0058.469] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0058.469] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0058.469] GetProcessHeap () returned 0x630000 [0058.469] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0058.469] lstrlenA (lpString="010001") returned 6 [0058.469] GetProcessHeap () returned 0x630000 [0058.469] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a128 [0058.469] GetProcessHeap () returned 0x630000 [0058.469] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.469] GetProcessHeap () returned 0x630000 [0058.469] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e580 [0058.469] GetProcessHeap () returned 0x630000 [0058.469] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.469] GetProcessHeap () returned 0x630000 [0058.469] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e7c0 [0058.469] GetProcessHeap () returned 0x630000 [0058.469] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x6570f8 [0058.469] GetProcessHeap () returned 0x630000 [0058.469] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a0a8 [0058.469] GetProcessHeap () returned 0x630000 [0058.469] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0058.469] GetProcessHeap () returned 0x630000 [0058.469] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0058.469] GetProcessHeap () returned 0x630000 [0058.470] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0058.470] GetProcessHeap () returned 0x630000 [0058.470] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.470] GetProcessHeap () returned 0x630000 [0058.470] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656b80 [0058.470] GetProcessHeap () returned 0x630000 [0058.470] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.470] GetProcessHeap () returned 0x630000 [0058.470] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0058.470] GetProcessHeap () returned 0x630000 [0058.470] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0058.470] GetProcessHeap () returned 0x630000 [0058.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.470] GetProcessHeap () returned 0x630000 [0058.470] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0058.470] GetProcessHeap () returned 0x630000 [0058.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0058.470] GetProcessHeap () returned 0x630000 [0058.470] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0058.470] GetProcessHeap () returned 0x630000 [0058.470] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0058.470] GetProcessHeap () returned 0x630000 [0058.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.470] GetProcessHeap () returned 0x630000 [0058.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0058.470] GetProcessHeap () returned 0x630000 [0058.470] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.470] GetProcessHeap () returned 0x630000 [0058.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.470] GetProcessHeap () returned 0x630000 [0058.470] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e850 [0058.470] GetProcessHeap () returned 0x630000 [0058.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0058.470] GetProcessHeap () returned 0x630000 [0058.470] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0058.470] GetProcessHeap () returned 0x630000 [0058.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0058.470] GetProcessHeap () returned 0x630000 [0058.470] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0058.471] GetProcessHeap () returned 0x630000 [0058.471] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0058.471] GetProcessHeap () returned 0x630000 [0058.471] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0058.471] GetProcessHeap () returned 0x630000 [0058.471] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0058.471] GetProcessHeap () returned 0x630000 [0058.471] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0058.471] GetProcessHeap () returned 0x630000 [0058.471] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0058.471] GetProcessHeap () returned 0x630000 [0058.471] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.471] GetProcessHeap () returned 0x630000 [0058.471] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.471] GetProcessHeap () returned 0x630000 [0058.471] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0058.471] GetProcessHeap () returned 0x630000 [0058.471] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0058.471] GetProcessHeap () returned 0x630000 [0058.471] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.471] GetProcessHeap () returned 0x630000 [0058.471] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.471] GetProcessHeap () returned 0x630000 [0058.471] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0058.471] GetProcessHeap () returned 0x630000 [0058.471] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0058.471] GetProcessHeap () returned 0x630000 [0058.471] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0058.471] GetProcessHeap () returned 0x630000 [0058.471] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0058.471] GetProcessHeap () returned 0x630000 [0058.471] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0058.471] GetProcessHeap () returned 0x630000 [0058.471] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0058.471] GetProcessHeap () returned 0x630000 [0058.471] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0058.471] GetProcessHeap () returned 0x630000 [0058.471] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0058.472] GetProcessHeap () returned 0x630000 [0058.472] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0058.472] GetProcessHeap () returned 0x630000 [0058.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0058.472] GetProcessHeap () returned 0x630000 [0058.472] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.472] GetProcessHeap () returned 0x630000 [0058.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.472] GetProcessHeap () returned 0x630000 [0058.472] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0058.472] GetProcessHeap () returned 0x630000 [0058.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0058.472] GetProcessHeap () returned 0x630000 [0058.472] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0058.472] GetProcessHeap () returned 0x630000 [0058.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0058.472] GetProcessHeap () returned 0x630000 [0058.472] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0058.472] GetProcessHeap () returned 0x630000 [0058.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0058.472] GetProcessHeap () returned 0x630000 [0058.472] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.472] GetProcessHeap () returned 0x630000 [0058.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.472] GetProcessHeap () returned 0x630000 [0058.472] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0058.472] GetProcessHeap () returned 0x630000 [0058.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0058.472] GetProcessHeap () returned 0x630000 [0058.472] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0058.472] GetProcessHeap () returned 0x630000 [0058.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0058.472] GetProcessHeap () returned 0x630000 [0058.472] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0058.472] GetProcessHeap () returned 0x630000 [0058.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0058.472] GetProcessHeap () returned 0x630000 [0058.473] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0058.473] GetProcessHeap () returned 0x630000 [0058.473] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0058.473] GetProcessHeap () returned 0x630000 [0058.473] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0e8 [0058.473] GetProcessHeap () returned 0x630000 [0058.473] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0e8 | out: hHeap=0x630000) returned 1 [0058.473] GetProcessHeap () returned 0x630000 [0058.473] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0058.473] GetProcessHeap () returned 0x630000 [0058.473] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0058.473] GetProcessHeap () returned 0x630000 [0058.473] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0058.473] GetProcessHeap () returned 0x630000 [0058.473] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0058.473] GetProcessHeap () returned 0x630000 [0058.473] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0058.473] GetProcessHeap () returned 0x630000 [0058.473] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0058.473] GetProcessHeap () returned 0x630000 [0058.473] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0058.473] GetProcessHeap () returned 0x630000 [0058.473] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0058.473] GetProcessHeap () returned 0x630000 [0058.473] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0058.473] GetProcessHeap () returned 0x630000 [0058.473] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0058.473] GetProcessHeap () returned 0x630000 [0058.473] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0058.473] GetProcessHeap () returned 0x630000 [0058.473] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0058.473] GetProcessHeap () returned 0x630000 [0058.473] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0058.473] GetProcessHeap () returned 0x630000 [0058.473] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0058.473] GetProcessHeap () returned 0x630000 [0058.473] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.473] GetProcessHeap () returned 0x630000 [0058.474] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.474] GetProcessHeap () returned 0x630000 [0058.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0058.474] GetProcessHeap () returned 0x630000 [0058.474] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0058.474] GetProcessHeap () returned 0x630000 [0058.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0058.474] GetProcessHeap () returned 0x630000 [0058.474] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0058.474] GetProcessHeap () returned 0x630000 [0058.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0058.474] GetProcessHeap () returned 0x630000 [0058.474] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0058.474] GetProcessHeap () returned 0x630000 [0058.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.474] GetProcessHeap () returned 0x630000 [0058.474] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.474] GetProcessHeap () returned 0x630000 [0058.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0058.474] GetProcessHeap () returned 0x630000 [0058.474] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0058.474] GetProcessHeap () returned 0x630000 [0058.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0058.474] GetProcessHeap () returned 0x630000 [0058.474] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0058.474] GetProcessHeap () returned 0x630000 [0058.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0058.474] GetProcessHeap () returned 0x630000 [0058.474] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0058.474] GetProcessHeap () returned 0x630000 [0058.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0058.474] GetProcessHeap () returned 0x630000 [0058.474] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0058.474] GetProcessHeap () returned 0x630000 [0058.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.474] GetProcessHeap () returned 0x630000 [0058.474] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.474] GetProcessHeap () returned 0x630000 [0058.475] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0058.475] GetProcessHeap () returned 0x630000 [0058.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0058.475] GetProcessHeap () returned 0x630000 [0058.475] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0058.475] GetProcessHeap () returned 0x630000 [0058.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0058.475] GetProcessHeap () returned 0x630000 [0058.475] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0058.475] GetProcessHeap () returned 0x630000 [0058.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0058.475] GetProcessHeap () returned 0x630000 [0058.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0058.475] GetProcessHeap () returned 0x630000 [0058.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0058.475] GetProcessHeap () returned 0x630000 [0058.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0058.475] GetProcessHeap () returned 0x630000 [0058.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0058.475] GetProcessHeap () returned 0x630000 [0058.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0058.475] GetProcessHeap () returned 0x630000 [0058.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e7c0 | out: hHeap=0x630000) returned 1 [0058.475] GetProcessHeap () returned 0x630000 [0058.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0058.475] GetProcessHeap () returned 0x630000 [0058.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0058.475] GetProcessHeap () returned 0x630000 [0058.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0058.475] GetProcessHeap () returned 0x630000 [0058.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0058.475] GetProcessHeap () returned 0x630000 [0058.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0058.475] WriteFile (in: hFile=0x230, lpBuffer=0x655c68*, nNumberOfBytesToWrite=0x384, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x655c68*, lpNumberOfBytesWritten=0x243d864*=0x384, lpOverlapped=0x0) returned 1 [0058.478] GetProcessHeap () returned 0x630000 [0058.478] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x655c68, Size=0x30) returned 0x655c68 [0058.478] GetProcessHeap () returned 0x630000 [0058.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0058.478] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.478] GetProcessHeap () returned 0x630000 [0058.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x790) returned 0x660110 [0058.478] ReadFile (in: hFile=0x230, lpBuffer=0x660110, nNumberOfBytesToRead=0x790, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x660110*, lpNumberOfBytesRead=0x243d7e8*=0x790, lpOverlapped=0x0) returned 1 [0058.478] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.478] WriteFile (in: hFile=0x230, lpBuffer=0x660110*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x660110*, lpNumberOfBytesWritten=0x243d7e4*=0x790, lpOverlapped=0x0) returned 1 [0058.479] GetProcessHeap () returned 0x630000 [0058.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x660110 | out: hHeap=0x630000) returned 1 [0058.479] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.479] WriteFile (in: hFile=0x230, lpBuffer=0x655c68*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x655c68*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0058.480] CloseHandle (hObject=0x230) returned 1 [0058.481] GetProcessHeap () returned 0x630000 [0058.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651ec0 | out: hHeap=0x630000) returned 1 [0058.481] GetProcessHeap () returned 0x630000 [0058.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655aa8 | out: hHeap=0x630000) returned 1 [0058.482] GetProcessHeap () returned 0x630000 [0058.482] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0058.482] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\2J80DrUI0ukoi.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\2J80DrUI0ukoi.mkv") returned="C:\\Users\\FD1HVy\\Videos\\2J80DrUI0ukoi.mkv" [0058.482] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\2J80DrUI0ukoi.mkv", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\2J80DrUI0ukoi.mkv.happythreechoose") returned="C:\\Users\\FD1HVy\\Videos\\2J80DrUI0ukoi.mkv.happythreechoose" [0058.482] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\2J80DrUI0ukoi.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\2j80drui0ukoi.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\2J80DrUI0ukoi.mkv.happythreechoose" (normalized: "c:\\users\\fd1hvy\\videos\\2j80drui0ukoi.mkv.happythreechoose"), dwFlags=0x1) returned 1 [0058.482] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\2J80DrUI0ukoi.mkv" | out: pszPath="C:\\Users\\FD1HVy\\Videos") returned 1 [0058.482] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\") returned="" [0058.482] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Videos\\Decryption INFO.html" [0058.482] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\videos\\decryption info.html")) returned 0xffffffff [0058.482] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\videos\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0058.483] GetProcessHeap () returned 0x630000 [0058.483] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6557d8 [0058.483] GetProcessHeap () returned 0x630000 [0058.483] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0058.490] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.491] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.491] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.491] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.491] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.491] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.491] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.491] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.491] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.491] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.491] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.491] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.491] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.492] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.492] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.492] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.492] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.492] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.492] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.492] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.492] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.492] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.492] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.492] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.492] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.492] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.493] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.493] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.493] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.493] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.493] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.493] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.493] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.493] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.493] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.493] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.493] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.494] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.494] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.494] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.494] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.494] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.494] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.495] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.495] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.495] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.495] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.495] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.495] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.495] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.495] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.495] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.495] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.495] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.495] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.495] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.495] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.496] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.496] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.496] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.496] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.496] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.496] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.496] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.496] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.496] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.496] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.496] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.496] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.496] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.497] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.497] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.497] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.497] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.497] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.497] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.497] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.497] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.497] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.497] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.497] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.497] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.497] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.497] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.498] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.498] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.498] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.498] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.498] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.498] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.498] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.498] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.498] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.498] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.498] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.498] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.498] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.498] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.498] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.499] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.499] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.499] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.499] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.499] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.499] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.499] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.499] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.499] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.499] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.499] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.499] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.499] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.499] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.500] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.500] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.500] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.500] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.500] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.500] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.500] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.500] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.500] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.500] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.501] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.501] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.501] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.501] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.501] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.501] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.501] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.501] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.501] GetProcessHeap () returned 0x630000 [0058.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6557d8 | out: hHeap=0x630000) returned 1 [0058.501] GetProcessHeap () returned 0x630000 [0058.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0058.501] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0058.501] GetProcessHeap () returned 0x630000 [0058.501] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6558c8 [0058.501] GetProcessHeap () returned 0x630000 [0058.501] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0058.508] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.508] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.508] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.508] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.508] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.509] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.509] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.509] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.509] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.509] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.509] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.509] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.509] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.509] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.509] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.509] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.509] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.509] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.509] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.509] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.510] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.510] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.510] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.510] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.510] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.510] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.510] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.510] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.510] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.510] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.510] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.510] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.510] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.511] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.511] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.511] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.511] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.511] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.511] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.511] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.511] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.511] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.511] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.511] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.511] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.511] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.511] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.514] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.514] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.514] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.514] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.514] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.514] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.514] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.514] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.514] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.514] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.514] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.514] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.515] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.515] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.515] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.515] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.515] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.515] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.515] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.515] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.515] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.515] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.515] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.515] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.515] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.515] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.516] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.516] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.521] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.521] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.521] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.521] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.521] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.523] GetProcessHeap () returned 0x630000 [0058.523] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6558c8 | out: hHeap=0x630000) returned 1 [0058.523] GetProcessHeap () returned 0x630000 [0058.523] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0058.523] CloseHandle (hObject=0x230) returned 1 [0058.523] GetProcessHeap () returned 0x630000 [0058.523] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645f58 | out: hHeap=0x630000) returned 1 [0058.523] FindNextFileW (in: hFindFile=0x65b710, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51503d80, ftCreationTime.dwHighDateTime=0x1d5cea0, ftLastAccessTime.dwLowDateTime=0x4838a3c0, ftLastAccessTime.dwHighDateTime=0x1d5d109, ftLastWriteTime.dwLowDateTime=0x4838a3c0, ftLastWriteTime.dwHighDateTime=0x1d5d109, nFileSizeHigh=0x0, nFileSizeLow=0x182b1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bPEL72QuxX3Myy.swf", cAlternateFileName="BPEL72~1.SWF")) returned 1 [0058.523] lstrcmpiW (lpString1="bPEL72QuxX3Myy.swf", lpString2=".") returned 1 [0058.523] lstrcmpiW (lpString1="bPEL72QuxX3Myy.swf", lpString2="..") returned 1 [0058.524] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="bPEL72QuxX3Myy.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\bPEL72QuxX3Myy.swf") returned="C:\\Users\\FD1HVy\\Videos\\bPEL72QuxX3Myy.swf" [0058.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bPEL72QuxX3Myy.swf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0058.524] GetProcessHeap () returned 0x630000 [0058.524] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x13) returned 0x645d58 [0058.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bPEL72QuxX3Myy.swf", cchWideChar=-1, lpMultiByteStr=0x645d58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bPEL72QuxX3Myy.swf", lpUsedDefaultChar=0x0) returned 19 [0058.524] lstrlenA (lpString="bPEL72QuxX3Myy.swf") returned 18 [0058.524] lstrlenA (lpString=".happythreechoose") returned 17 [0058.524] lstrlenA (lpString=".happythreechoose") returned 17 [0058.524] lstrlenA (lpString="bPEL72QuxX3Myy.swf") returned 18 [0058.524] lstrcmpiA (lpString1="PEL72QuxX3Myy.swf", lpString2=".happythreechoose") returned 1 [0058.524] lstrcmpiW (lpString1="bPEL72QuxX3Myy.swf", lpString2="Decryption INFO.html") returned -1 [0058.524] lstrcmpiW (lpString1="bPEL72QuxX3Myy.swf", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0058.524] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0058.524] lstrcmpiW (lpString1="bPEL72QuxX3Myy.swf", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0058.524] GetProcessHeap () returned 0x630000 [0058.524] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0058.524] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\bPEL72QuxX3Myy.swf" (normalized: "c:\\users\\fd1hvy\\videos\\bpel72quxx3myy.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0058.524] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=98993) returned 1 [0058.524] GetProcessHeap () returned 0x630000 [0058.524] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655580 [0058.524] GetProcessHeap () returned 0x630000 [0058.524] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0058.524] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\bPEL72QuxX3Myy.swf") returned 41 [0058.524] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.524] GetProcessHeap () returned 0x630000 [0058.524] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0058.525] GetProcessHeap () returned 0x630000 [0058.525] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38f) returned 0x661118 [0058.525] lstrlenA (lpString="rsa_encrypt") returned 11 [0058.525] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0058.525] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0058.525] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0058.525] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0058.525] GetProcessHeap () returned 0x630000 [0058.525] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0058.525] lstrlenA (lpString="010001") returned 6 [0058.525] GetProcessHeap () returned 0x630000 [0058.525] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a138 [0058.525] GetProcessHeap () returned 0x630000 [0058.525] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.525] GetProcessHeap () returned 0x630000 [0058.525] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e4f0 [0058.526] GetProcessHeap () returned 0x630000 [0058.526] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.526] GetProcessHeap () returned 0x630000 [0058.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e850 [0058.526] GetProcessHeap () returned 0x630000 [0058.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656db0 [0058.526] GetProcessHeap () returned 0x630000 [0058.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a0d8 [0058.526] GetProcessHeap () returned 0x630000 [0058.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0058.526] GetProcessHeap () returned 0x630000 [0058.526] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0058.526] GetProcessHeap () returned 0x630000 [0058.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0058.526] GetProcessHeap () returned 0x630000 [0058.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.526] GetProcessHeap () returned 0x630000 [0058.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656ec8 [0058.526] GetProcessHeap () returned 0x630000 [0058.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.526] GetProcessHeap () returned 0x630000 [0058.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0058.526] GetProcessHeap () returned 0x630000 [0058.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0058.526] GetProcessHeap () returned 0x630000 [0058.526] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.526] GetProcessHeap () returned 0x630000 [0058.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0058.526] GetProcessHeap () returned 0x630000 [0058.526] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0058.526] GetProcessHeap () returned 0x630000 [0058.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.526] GetProcessHeap () returned 0x630000 [0058.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0058.526] GetProcessHeap () returned 0x630000 [0058.526] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.526] GetProcessHeap () returned 0x630000 [0058.526] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.526] GetProcessHeap () returned 0x630000 [0058.527] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.527] GetProcessHeap () returned 0x630000 [0058.527] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.527] GetProcessHeap () returned 0x630000 [0058.527] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ea00 [0058.527] GetProcessHeap () returned 0x630000 [0058.527] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0058.527] GetProcessHeap () returned 0x630000 [0058.527] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0058.527] GetProcessHeap () returned 0x630000 [0058.527] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0058.527] GetProcessHeap () returned 0x630000 [0058.527] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.527] GetProcessHeap () returned 0x630000 [0058.527] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.527] GetProcessHeap () returned 0x630000 [0058.527] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.527] GetProcessHeap () returned 0x630000 [0058.527] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.527] GetProcessHeap () returned 0x630000 [0058.527] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0058.527] GetProcessHeap () returned 0x630000 [0058.527] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0058.527] GetProcessHeap () returned 0x630000 [0058.527] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0058.527] GetProcessHeap () returned 0x630000 [0058.527] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0058.527] GetProcessHeap () returned 0x630000 [0058.527] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.527] GetProcessHeap () returned 0x630000 [0058.527] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.527] GetProcessHeap () returned 0x630000 [0058.527] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0058.527] GetProcessHeap () returned 0x630000 [0058.527] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0058.527] GetProcessHeap () returned 0x630000 [0058.527] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0058.527] GetProcessHeap () returned 0x630000 [0058.528] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0058.528] GetProcessHeap () returned 0x630000 [0058.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0058.528] GetProcessHeap () returned 0x630000 [0058.528] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0058.528] GetProcessHeap () returned 0x630000 [0058.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0058.528] GetProcessHeap () returned 0x630000 [0058.528] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0058.528] GetProcessHeap () returned 0x630000 [0058.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0058.528] GetProcessHeap () returned 0x630000 [0058.528] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0058.528] GetProcessHeap () returned 0x630000 [0058.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.528] GetProcessHeap () returned 0x630000 [0058.528] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.528] GetProcessHeap () returned 0x630000 [0058.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.528] GetProcessHeap () returned 0x630000 [0058.528] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.528] GetProcessHeap () returned 0x630000 [0058.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0058.528] GetProcessHeap () returned 0x630000 [0058.528] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0058.528] GetProcessHeap () returned 0x630000 [0058.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0058.528] GetProcessHeap () returned 0x630000 [0058.528] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0058.528] GetProcessHeap () returned 0x630000 [0058.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.528] GetProcessHeap () returned 0x630000 [0058.528] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.528] GetProcessHeap () returned 0x630000 [0058.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0058.528] GetProcessHeap () returned 0x630000 [0058.528] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0058.528] GetProcessHeap () returned 0x630000 [0058.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0058.529] GetProcessHeap () returned 0x630000 [0058.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0058.529] GetProcessHeap () returned 0x630000 [0058.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0058.529] GetProcessHeap () returned 0x630000 [0058.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0058.529] GetProcessHeap () returned 0x630000 [0058.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0058.529] GetProcessHeap () returned 0x630000 [0058.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0058.529] GetProcessHeap () returned 0x630000 [0058.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0058.529] GetProcessHeap () returned 0x630000 [0058.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0058.529] GetProcessHeap () returned 0x630000 [0058.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0058.529] GetProcessHeap () returned 0x630000 [0058.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0058.529] GetProcessHeap () returned 0x630000 [0058.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.529] GetProcessHeap () returned 0x630000 [0058.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.529] GetProcessHeap () returned 0x630000 [0058.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0058.529] GetProcessHeap () returned 0x630000 [0058.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0058.529] GetProcessHeap () returned 0x630000 [0058.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0058.529] GetProcessHeap () returned 0x630000 [0058.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0058.529] GetProcessHeap () returned 0x630000 [0058.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.529] GetProcessHeap () returned 0x630000 [0058.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.529] GetProcessHeap () returned 0x630000 [0058.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0058.530] GetProcessHeap () returned 0x630000 [0058.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0058.530] GetProcessHeap () returned 0x630000 [0058.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0058.530] GetProcessHeap () returned 0x630000 [0058.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0058.530] GetProcessHeap () returned 0x630000 [0058.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0058.530] GetProcessHeap () returned 0x630000 [0058.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0058.530] GetProcessHeap () returned 0x630000 [0058.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0058.530] GetProcessHeap () returned 0x630000 [0058.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0058.530] GetProcessHeap () returned 0x630000 [0058.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0058.530] GetProcessHeap () returned 0x630000 [0058.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0058.530] GetProcessHeap () returned 0x630000 [0058.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0058.530] GetProcessHeap () returned 0x630000 [0058.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0058.530] GetProcessHeap () returned 0x630000 [0058.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.530] GetProcessHeap () returned 0x630000 [0058.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.530] GetProcessHeap () returned 0x630000 [0058.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0058.530] GetProcessHeap () returned 0x630000 [0058.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0058.530] GetProcessHeap () returned 0x630000 [0058.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0058.530] GetProcessHeap () returned 0x630000 [0058.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0058.530] GetProcessHeap () returned 0x630000 [0058.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0058.530] GetProcessHeap () returned 0x630000 [0058.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0058.531] GetProcessHeap () returned 0x630000 [0058.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0058.531] GetProcessHeap () returned 0x630000 [0058.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0058.531] GetProcessHeap () returned 0x630000 [0058.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0058.531] GetProcessHeap () returned 0x630000 [0058.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0058.531] GetProcessHeap () returned 0x630000 [0058.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0058.531] GetProcessHeap () returned 0x630000 [0058.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0058.531] GetProcessHeap () returned 0x630000 [0058.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.531] GetProcessHeap () returned 0x630000 [0058.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.531] GetProcessHeap () returned 0x630000 [0058.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0058.531] GetProcessHeap () returned 0x630000 [0058.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0058.531] GetProcessHeap () returned 0x630000 [0058.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0058.531] GetProcessHeap () returned 0x630000 [0058.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0058.532] GetProcessHeap () returned 0x630000 [0058.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0058.532] GetProcessHeap () returned 0x630000 [0058.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0058.532] GetProcessHeap () returned 0x630000 [0058.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0058.532] GetProcessHeap () returned 0x630000 [0058.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0058.532] GetProcessHeap () returned 0x630000 [0058.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0058.532] GetProcessHeap () returned 0x630000 [0058.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0058.532] GetProcessHeap () returned 0x630000 [0058.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0058.532] GetProcessHeap () returned 0x630000 [0058.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0058.532] GetProcessHeap () returned 0x630000 [0058.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0058.532] GetProcessHeap () returned 0x630000 [0058.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0058.532] GetProcessHeap () returned 0x630000 [0058.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0058.532] WriteFile (in: hFile=0x230, lpBuffer=0x661118*, nNumberOfBytesToWrite=0x38f, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661118*, lpNumberOfBytesWritten=0x243d864*=0x38f, lpOverlapped=0x0) returned 1 [0058.534] GetProcessHeap () returned 0x630000 [0058.534] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x661118, Size=0x30) returned 0x661118 [0058.534] GetProcessHeap () returned 0x630000 [0058.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0058.535] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.535] GetProcessHeap () returned 0x630000 [0058.535] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x182c0) returned 0x661150 [0058.535] ReadFile (in: hFile=0x230, lpBuffer=0x661150, nNumberOfBytesToRead=0x182c0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661150*, lpNumberOfBytesRead=0x243d7e8*=0x182c0, lpOverlapped=0x0) returned 1 [0058.536] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.536] WriteFile (in: hFile=0x230, lpBuffer=0x661150*, nNumberOfBytesToWrite=0x182c0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661150*, lpNumberOfBytesWritten=0x243d7e4*=0x182c0, lpOverlapped=0x0) returned 1 [0058.537] GetProcessHeap () returned 0x630000 [0058.537] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661150 | out: hHeap=0x630000) returned 1 [0058.537] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.537] WriteFile (in: hFile=0x230, lpBuffer=0x661118*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661118*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0058.538] CloseHandle (hObject=0x230) returned 1 [0058.541] GetProcessHeap () returned 0x630000 [0058.541] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0058.541] GetProcessHeap () returned 0x630000 [0058.541] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655580 | out: hHeap=0x630000) returned 1 [0058.541] GetProcessHeap () returned 0x630000 [0058.541] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0058.541] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\bPEL72QuxX3Myy.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\bPEL72QuxX3Myy.swf") returned="C:\\Users\\FD1HVy\\Videos\\bPEL72QuxX3Myy.swf" [0058.541] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\bPEL72QuxX3Myy.swf", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\bPEL72QuxX3Myy.swf.happythreechoose") returned="C:\\Users\\FD1HVy\\Videos\\bPEL72QuxX3Myy.swf.happythreechoose" [0058.542] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\bPEL72QuxX3Myy.swf" (normalized: "c:\\users\\fd1hvy\\videos\\bpel72quxx3myy.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\bPEL72QuxX3Myy.swf.happythreechoose" (normalized: "c:\\users\\fd1hvy\\videos\\bpel72quxx3myy.swf.happythreechoose"), dwFlags=0x1) returned 1 [0058.546] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\bPEL72QuxX3Myy.swf" | out: pszPath="C:\\Users\\FD1HVy\\Videos") returned 1 [0058.546] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\") returned="" [0058.546] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Videos\\Decryption INFO.html" [0058.546] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\videos\\decryption info.html")) returned 0x20 [0058.546] GetProcessHeap () returned 0x630000 [0058.546] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645d58 | out: hHeap=0x630000) returned 1 [0058.546] FindNextFileW (in: hFindFile=0x65b710, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cf83100, ftCreationTime.dwHighDateTime=0x1d5d313, ftLastAccessTime.dwLowDateTime=0x32ebffa0, ftLastAccessTime.dwHighDateTime=0x1d5d125, ftLastWriteTime.dwLowDateTime=0x32ebffa0, ftLastWriteTime.dwHighDateTime=0x1d5d125, nFileSizeHigh=0x0, nFileSizeLow=0x152e4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CSga.swf", cAlternateFileName="")) returned 1 [0058.546] lstrcmpiW (lpString1="CSga.swf", lpString2=".") returned 1 [0058.546] lstrcmpiW (lpString1="CSga.swf", lpString2="..") returned 1 [0058.546] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="CSga.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\CSga.swf") returned="C:\\Users\\FD1HVy\\Videos\\CSga.swf" [0058.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSga.swf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0058.546] GetProcessHeap () returned 0x630000 [0058.546] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9) returned 0x64c9f0 [0058.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CSga.swf", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CSga.swf", lpUsedDefaultChar=0x0) returned 9 [0058.546] lstrlenA (lpString="CSga.swf") returned 8 [0058.546] lstrlenA (lpString=".happythreechoose") returned 17 [0058.546] lstrcmpiW (lpString1="CSga.swf", lpString2="Decryption INFO.html") returned -1 [0058.546] lstrcmpiW (lpString1="CSga.swf", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0058.546] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0058.546] lstrcmpiW (lpString1="CSga.swf", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0058.546] GetProcessHeap () returned 0x630000 [0058.546] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0058.546] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\CSga.swf" (normalized: "c:\\users\\fd1hvy\\videos\\csga.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0058.546] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=86756) returned 1 [0058.547] GetProcessHeap () returned 0x630000 [0058.547] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655850 [0058.547] GetProcessHeap () returned 0x630000 [0058.547] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0058.547] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\CSga.swf") returned 31 [0058.547] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.547] GetProcessHeap () returned 0x630000 [0058.547] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0058.556] GetProcessHeap () returned 0x630000 [0058.556] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38c) returned 0x661150 [0058.557] lstrlenA (lpString="rsa_encrypt") returned 11 [0058.557] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0058.557] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0058.557] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0058.557] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0058.557] GetProcessHeap () returned 0x630000 [0058.557] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0058.557] lstrlenA (lpString="010001") returned 6 [0058.557] GetProcessHeap () returned 0x630000 [0058.557] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a068 [0058.557] GetProcessHeap () returned 0x630000 [0058.557] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.558] GetProcessHeap () returned 0x630000 [0058.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e730 [0058.558] GetProcessHeap () returned 0x630000 [0058.558] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.558] GetProcessHeap () returned 0x630000 [0058.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dfe0 [0058.558] GetProcessHeap () returned 0x630000 [0058.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656b80 [0058.558] GetProcessHeap () returned 0x630000 [0058.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a0f8 [0058.558] GetProcessHeap () returned 0x630000 [0058.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0058.558] GetProcessHeap () returned 0x630000 [0058.558] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0058.558] GetProcessHeap () returned 0x630000 [0058.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0058.558] GetProcessHeap () returned 0x630000 [0058.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.558] GetProcessHeap () returned 0x630000 [0058.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656a68 [0058.558] GetProcessHeap () returned 0x630000 [0058.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0058.558] GetProcessHeap () returned 0x630000 [0058.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0058.558] GetProcessHeap () returned 0x630000 [0058.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ebb0 [0058.558] GetProcessHeap () returned 0x630000 [0058.558] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.558] GetProcessHeap () returned 0x630000 [0058.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0058.558] GetProcessHeap () returned 0x630000 [0058.558] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0058.558] GetProcessHeap () returned 0x630000 [0058.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0058.558] GetProcessHeap () returned 0x630000 [0058.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65aa80 [0058.558] GetProcessHeap () returned 0x630000 [0058.558] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0058.559] GetProcessHeap () returned 0x630000 [0058.559] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0058.559] GetProcessHeap () returned 0x630000 [0058.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0058.559] GetProcessHeap () returned 0x630000 [0058.559] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0058.559] GetProcessHeap () returned 0x630000 [0058.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e850 [0058.559] GetProcessHeap () returned 0x630000 [0058.559] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65aa80 | out: hHeap=0x630000) returned 1 [0058.559] GetProcessHeap () returned 0x630000 [0058.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0058.559] GetProcessHeap () returned 0x630000 [0058.559] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0058.559] GetProcessHeap () returned 0x630000 [0058.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0058.559] GetProcessHeap () returned 0x630000 [0058.559] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0058.559] GetProcessHeap () returned 0x630000 [0058.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0058.559] GetProcessHeap () returned 0x630000 [0058.559] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0058.559] GetProcessHeap () returned 0x630000 [0058.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0058.559] GetProcessHeap () returned 0x630000 [0058.559] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0058.559] GetProcessHeap () returned 0x630000 [0058.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.559] GetProcessHeap () returned 0x630000 [0058.559] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.559] GetProcessHeap () returned 0x630000 [0058.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.559] GetProcessHeap () returned 0x630000 [0058.559] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.559] GetProcessHeap () returned 0x630000 [0058.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0058.559] GetProcessHeap () returned 0x630000 [0058.559] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0058.560] GetProcessHeap () returned 0x630000 [0058.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0058.560] GetProcessHeap () returned 0x630000 [0058.560] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0058.560] GetProcessHeap () returned 0x630000 [0058.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0058.560] GetProcessHeap () returned 0x630000 [0058.560] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0058.560] GetProcessHeap () returned 0x630000 [0058.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.560] GetProcessHeap () returned 0x630000 [0058.560] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.560] GetProcessHeap () returned 0x630000 [0058.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.560] GetProcessHeap () returned 0x630000 [0058.560] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.560] GetProcessHeap () returned 0x630000 [0058.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0e8 [0058.560] GetProcessHeap () returned 0x630000 [0058.560] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0e8 | out: hHeap=0x630000) returned 1 [0058.560] GetProcessHeap () returned 0x630000 [0058.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.560] GetProcessHeap () returned 0x630000 [0058.560] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.560] GetProcessHeap () returned 0x630000 [0058.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0058.560] GetProcessHeap () returned 0x630000 [0058.560] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0058.560] GetProcessHeap () returned 0x630000 [0058.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0058.560] GetProcessHeap () returned 0x630000 [0058.560] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0058.560] GetProcessHeap () returned 0x630000 [0058.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0058.560] GetProcessHeap () returned 0x630000 [0058.560] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0058.561] GetProcessHeap () returned 0x630000 [0058.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0058.561] GetProcessHeap () returned 0x630000 [0058.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0058.561] GetProcessHeap () returned 0x630000 [0058.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0058.561] GetProcessHeap () returned 0x630000 [0058.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0058.561] GetProcessHeap () returned 0x630000 [0058.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0058.561] GetProcessHeap () returned 0x630000 [0058.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0058.561] GetProcessHeap () returned 0x630000 [0058.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.561] GetProcessHeap () returned 0x630000 [0058.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.561] GetProcessHeap () returned 0x630000 [0058.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.561] GetProcessHeap () returned 0x630000 [0058.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.561] GetProcessHeap () returned 0x630000 [0058.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0058.561] GetProcessHeap () returned 0x630000 [0058.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0058.561] GetProcessHeap () returned 0x630000 [0058.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0058.561] GetProcessHeap () returned 0x630000 [0058.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0058.561] GetProcessHeap () returned 0x630000 [0058.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0058.561] GetProcessHeap () returned 0x630000 [0058.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0058.561] GetProcessHeap () returned 0x630000 [0058.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0058.561] GetProcessHeap () returned 0x630000 [0058.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0058.561] GetProcessHeap () returned 0x630000 [0058.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0058.561] GetProcessHeap () returned 0x630000 [0058.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0058.562] GetProcessHeap () returned 0x630000 [0058.562] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0e8 [0058.562] GetProcessHeap () returned 0x630000 [0058.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0e8 | out: hHeap=0x630000) returned 1 [0058.562] GetProcessHeap () returned 0x630000 [0058.562] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0058.562] GetProcessHeap () returned 0x630000 [0058.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0058.562] GetProcessHeap () returned 0x630000 [0058.562] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0058.562] GetProcessHeap () returned 0x630000 [0058.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0058.562] GetProcessHeap () returned 0x630000 [0058.562] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0058.562] GetProcessHeap () returned 0x630000 [0058.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0058.562] GetProcessHeap () returned 0x630000 [0058.562] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0058.562] GetProcessHeap () returned 0x630000 [0058.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0058.562] GetProcessHeap () returned 0x630000 [0058.562] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0058.562] GetProcessHeap () returned 0x630000 [0058.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0058.562] GetProcessHeap () returned 0x630000 [0058.562] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.562] GetProcessHeap () returned 0x630000 [0058.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.562] GetProcessHeap () returned 0x630000 [0058.562] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0058.562] GetProcessHeap () returned 0x630000 [0058.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0058.562] GetProcessHeap () returned 0x630000 [0058.562] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0058.563] GetProcessHeap () returned 0x630000 [0058.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0058.563] GetProcessHeap () returned 0x630000 [0058.563] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.563] GetProcessHeap () returned 0x630000 [0058.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.563] GetProcessHeap () returned 0x630000 [0058.563] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0058.563] GetProcessHeap () returned 0x630000 [0058.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0058.563] GetProcessHeap () returned 0x630000 [0058.563] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0058.563] GetProcessHeap () returned 0x630000 [0058.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0058.563] GetProcessHeap () returned 0x630000 [0058.563] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0058.563] GetProcessHeap () returned 0x630000 [0058.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0058.563] GetProcessHeap () returned 0x630000 [0058.563] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.563] GetProcessHeap () returned 0x630000 [0058.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.563] GetProcessHeap () returned 0x630000 [0058.563] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.563] GetProcessHeap () returned 0x630000 [0058.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.563] GetProcessHeap () returned 0x630000 [0058.563] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0058.564] GetProcessHeap () returned 0x630000 [0058.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0058.564] GetProcessHeap () returned 0x630000 [0058.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0058.564] GetProcessHeap () returned 0x630000 [0058.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0058.564] GetProcessHeap () returned 0x630000 [0058.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0058.564] GetProcessHeap () returned 0x630000 [0058.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0058.564] GetProcessHeap () returned 0x630000 [0058.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0058.564] GetProcessHeap () returned 0x630000 [0058.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0058.564] GetProcessHeap () returned 0x630000 [0058.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0058.564] GetProcessHeap () returned 0x630000 [0058.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0058.564] GetProcessHeap () returned 0x630000 [0058.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0058.564] GetProcessHeap () returned 0x630000 [0058.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0058.564] GetProcessHeap () returned 0x630000 [0058.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0058.564] WriteFile (in: hFile=0x230, lpBuffer=0x661150*, nNumberOfBytesToWrite=0x38c, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661150*, lpNumberOfBytesWritten=0x243d864*=0x38c, lpOverlapped=0x0) returned 1 [0058.567] GetProcessHeap () returned 0x630000 [0058.567] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x661150, Size=0x30) returned 0x661150 [0058.567] GetProcessHeap () returned 0x630000 [0058.567] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0058.567] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.567] GetProcessHeap () returned 0x630000 [0058.567] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x152f0) returned 0x661188 [0058.567] ReadFile (in: hFile=0x230, lpBuffer=0x661188, nNumberOfBytesToRead=0x152f0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661188*, lpNumberOfBytesRead=0x243d7e8*=0x152f0, lpOverlapped=0x0) returned 1 [0058.568] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.568] WriteFile (in: hFile=0x230, lpBuffer=0x661188*, nNumberOfBytesToWrite=0x152f0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661188*, lpNumberOfBytesWritten=0x243d7e4*=0x152f0, lpOverlapped=0x0) returned 1 [0058.570] GetProcessHeap () returned 0x630000 [0058.570] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661188 | out: hHeap=0x630000) returned 1 [0058.571] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.571] WriteFile (in: hFile=0x230, lpBuffer=0x661150*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661150*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0058.572] CloseHandle (hObject=0x230) returned 1 [0058.575] GetProcessHeap () returned 0x630000 [0058.575] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0058.575] GetProcessHeap () returned 0x630000 [0058.575] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655850 | out: hHeap=0x630000) returned 1 [0058.575] GetProcessHeap () returned 0x630000 [0058.575] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0058.575] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\CSga.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\CSga.swf") returned="C:\\Users\\FD1HVy\\Videos\\CSga.swf" [0058.575] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\CSga.swf", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\CSga.swf.happythreechoose") returned="C:\\Users\\FD1HVy\\Videos\\CSga.swf.happythreechoose" [0058.575] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\CSga.swf" (normalized: "c:\\users\\fd1hvy\\videos\\csga.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\CSga.swf.happythreechoose" (normalized: "c:\\users\\fd1hvy\\videos\\csga.swf.happythreechoose"), dwFlags=0x1) returned 1 [0058.576] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\CSga.swf" | out: pszPath="C:\\Users\\FD1HVy\\Videos") returned 1 [0058.576] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\") returned="" [0058.576] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Videos\\Decryption INFO.html" [0058.576] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\videos\\decryption info.html")) returned 0x20 [0058.576] GetProcessHeap () returned 0x630000 [0058.576] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0058.576] FindNextFileW (in: hFindFile=0x65b710, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43f94523, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43f94523, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0058.576] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0058.576] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0058.576] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\desktop.ini") returned="C:\\Users\\FD1HVy\\Videos\\desktop.ini" [0058.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0058.576] GetProcessHeap () returned 0x630000 [0058.576] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0058.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0058.576] lstrlenA (lpString="desktop.ini") returned 11 [0058.576] lstrlenA (lpString=".happythreechoose") returned 17 [0058.576] lstrcmpiW (lpString1="desktop.ini", lpString2="Decryption INFO.html") returned 1 [0058.576] lstrcmpiW (lpString1="desktop.ini", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0058.576] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0058.576] lstrcmpiW (lpString1="desktop.ini", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0058.576] GetProcessHeap () returned 0x630000 [0058.576] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x652000 [0058.576] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\videos\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0058.576] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=504) returned 1 [0058.576] GetProcessHeap () returned 0x630000 [0058.576] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655580 [0058.576] GetProcessHeap () returned 0x630000 [0058.576] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0058.577] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\desktop.ini") returned 34 [0058.577] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.577] GetProcessHeap () returned 0x630000 [0058.577] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0058.577] GetProcessHeap () returned 0x630000 [0058.577] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x388) returned 0x661188 [0058.578] lstrlenA (lpString="rsa_encrypt") returned 11 [0058.578] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0058.578] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0058.579] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0058.579] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0058.579] GetProcessHeap () returned 0x630000 [0058.579] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0058.579] lstrlenA (lpString="010001") returned 6 [0058.579] GetProcessHeap () returned 0x630000 [0058.579] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a178 [0058.579] GetProcessHeap () returned 0x630000 [0058.579] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.579] GetProcessHeap () returned 0x630000 [0058.579] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea90 [0058.579] GetProcessHeap () returned 0x630000 [0058.579] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.579] GetProcessHeap () returned 0x630000 [0058.579] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dfe0 [0058.579] GetProcessHeap () returned 0x630000 [0058.579] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656a68 [0058.579] GetProcessHeap () returned 0x630000 [0058.579] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a088 [0058.579] GetProcessHeap () returned 0x630000 [0058.579] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0058.579] GetProcessHeap () returned 0x630000 [0058.579] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0058.579] GetProcessHeap () returned 0x630000 [0058.579] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0058.579] GetProcessHeap () returned 0x630000 [0058.579] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.579] GetProcessHeap () returned 0x630000 [0058.579] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656950 [0058.579] GetProcessHeap () returned 0x630000 [0058.579] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0058.579] GetProcessHeap () returned 0x630000 [0058.579] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0058.579] GetProcessHeap () returned 0x630000 [0058.579] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e610 [0058.579] GetProcessHeap () returned 0x630000 [0058.580] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.580] GetProcessHeap () returned 0x630000 [0058.580] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0058.580] GetProcessHeap () returned 0x630000 [0058.580] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0058.580] GetProcessHeap () returned 0x630000 [0058.580] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0058.580] GetProcessHeap () returned 0x630000 [0058.580] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65a780 [0058.580] GetProcessHeap () returned 0x630000 [0058.580] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0058.580] GetProcessHeap () returned 0x630000 [0058.580] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0058.580] GetProcessHeap () returned 0x630000 [0058.580] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.580] GetProcessHeap () returned 0x630000 [0058.580] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.580] GetProcessHeap () returned 0x630000 [0058.580] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e070 [0058.580] GetProcessHeap () returned 0x630000 [0058.580] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a780 | out: hHeap=0x630000) returned 1 [0058.580] GetProcessHeap () returned 0x630000 [0058.580] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0058.580] GetProcessHeap () returned 0x630000 [0058.580] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0058.580] GetProcessHeap () returned 0x630000 [0058.580] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0058.580] GetProcessHeap () returned 0x630000 [0058.580] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0058.580] GetProcessHeap () returned 0x630000 [0058.580] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.580] GetProcessHeap () returned 0x630000 [0058.580] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.580] GetProcessHeap () returned 0x630000 [0058.580] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0058.580] GetProcessHeap () returned 0x630000 [0058.580] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0058.580] GetProcessHeap () returned 0x630000 [0058.581] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0058.581] GetProcessHeap () returned 0x630000 [0058.581] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0058.581] GetProcessHeap () returned 0x630000 [0058.581] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0058.581] GetProcessHeap () returned 0x630000 [0058.581] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0058.581] GetProcessHeap () returned 0x630000 [0058.581] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.581] GetProcessHeap () returned 0x630000 [0058.581] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.581] GetProcessHeap () returned 0x630000 [0058.581] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0058.581] GetProcessHeap () returned 0x630000 [0058.581] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0058.581] GetProcessHeap () returned 0x630000 [0058.581] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0058.581] GetProcessHeap () returned 0x630000 [0058.581] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0058.581] GetProcessHeap () returned 0x630000 [0058.581] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0058.581] GetProcessHeap () returned 0x630000 [0058.581] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0058.581] GetProcessHeap () returned 0x630000 [0058.581] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0058.581] GetProcessHeap () returned 0x630000 [0058.581] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0058.581] GetProcessHeap () returned 0x630000 [0058.581] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.581] GetProcessHeap () returned 0x630000 [0058.581] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.581] GetProcessHeap () returned 0x630000 [0058.581] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0058.581] GetProcessHeap () returned 0x630000 [0058.581] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0058.581] GetProcessHeap () returned 0x630000 [0058.581] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.581] GetProcessHeap () returned 0x630000 [0058.582] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.582] GetProcessHeap () returned 0x630000 [0058.582] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0058.582] GetProcessHeap () returned 0x630000 [0058.582] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0058.582] GetProcessHeap () returned 0x630000 [0058.582] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0058.582] GetProcessHeap () returned 0x630000 [0058.582] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0058.582] GetProcessHeap () returned 0x630000 [0058.582] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.582] GetProcessHeap () returned 0x630000 [0058.582] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.582] GetProcessHeap () returned 0x630000 [0058.582] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0058.582] GetProcessHeap () returned 0x630000 [0058.582] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0058.582] GetProcessHeap () returned 0x630000 [0058.582] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0058.582] GetProcessHeap () returned 0x630000 [0058.582] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0058.582] GetProcessHeap () returned 0x630000 [0058.582] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0058.582] GetProcessHeap () returned 0x630000 [0058.582] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0058.582] GetProcessHeap () returned 0x630000 [0058.582] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.582] GetProcessHeap () returned 0x630000 [0058.582] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.582] GetProcessHeap () returned 0x630000 [0058.582] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.582] GetProcessHeap () returned 0x630000 [0058.582] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.582] GetProcessHeap () returned 0x630000 [0058.582] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0058.582] GetProcessHeap () returned 0x630000 [0058.582] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0058.583] GetProcessHeap () returned 0x630000 [0058.583] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.583] GetProcessHeap () returned 0x630000 [0058.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.583] GetProcessHeap () returned 0x630000 [0058.583] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0058.583] GetProcessHeap () returned 0x630000 [0058.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0058.583] GetProcessHeap () returned 0x630000 [0058.583] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0058.583] GetProcessHeap () returned 0x630000 [0058.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0058.583] GetProcessHeap () returned 0x630000 [0058.583] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.583] GetProcessHeap () returned 0x630000 [0058.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.583] GetProcessHeap () returned 0x630000 [0058.583] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.583] GetProcessHeap () returned 0x630000 [0058.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.583] GetProcessHeap () returned 0x630000 [0058.583] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0058.583] GetProcessHeap () returned 0x630000 [0058.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0058.583] GetProcessHeap () returned 0x630000 [0058.583] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0058.583] GetProcessHeap () returned 0x630000 [0058.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0058.583] GetProcessHeap () returned 0x630000 [0058.583] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0058.583] GetProcessHeap () returned 0x630000 [0058.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0058.583] GetProcessHeap () returned 0x630000 [0058.583] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0058.583] GetProcessHeap () returned 0x630000 [0058.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0058.583] GetProcessHeap () returned 0x630000 [0058.584] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.584] GetProcessHeap () returned 0x630000 [0058.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.584] GetProcessHeap () returned 0x630000 [0058.584] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.584] GetProcessHeap () returned 0x630000 [0058.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.584] GetProcessHeap () returned 0x630000 [0058.584] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.584] GetProcessHeap () returned 0x630000 [0058.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.584] GetProcessHeap () returned 0x630000 [0058.584] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.584] GetProcessHeap () returned 0x630000 [0058.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.584] GetProcessHeap () returned 0x630000 [0058.584] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0058.584] GetProcessHeap () returned 0x630000 [0058.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0058.584] GetProcessHeap () returned 0x630000 [0058.584] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0058.584] GetProcessHeap () returned 0x630000 [0058.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0058.584] GetProcessHeap () returned 0x630000 [0058.584] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.584] GetProcessHeap () returned 0x630000 [0058.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.584] GetProcessHeap () returned 0x630000 [0058.584] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.584] GetProcessHeap () returned 0x630000 [0058.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.584] GetProcessHeap () returned 0x630000 [0058.584] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0058.584] GetProcessHeap () returned 0x630000 [0058.584] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0058.584] GetProcessHeap () returned 0x630000 [0058.584] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0058.584] GetProcessHeap () returned 0x630000 [0058.585] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0058.585] GetProcessHeap () returned 0x630000 [0058.585] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0058.585] GetProcessHeap () returned 0x630000 [0058.585] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0058.585] GetProcessHeap () returned 0x630000 [0058.585] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0058.585] GetProcessHeap () returned 0x630000 [0058.585] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0058.585] GetProcessHeap () returned 0x630000 [0058.585] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0058.585] GetProcessHeap () returned 0x630000 [0058.585] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0058.585] GetProcessHeap () returned 0x630000 [0058.585] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0058.585] GetProcessHeap () returned 0x630000 [0058.585] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea90 | out: hHeap=0x630000) returned 1 [0058.585] GetProcessHeap () returned 0x630000 [0058.585] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0058.585] GetProcessHeap () returned 0x630000 [0058.585] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0058.585] GetProcessHeap () returned 0x630000 [0058.585] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0058.585] WriteFile (in: hFile=0x230, lpBuffer=0x661188*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661188*, lpNumberOfBytesWritten=0x243d864*=0x388, lpOverlapped=0x0) returned 1 [0058.588] GetProcessHeap () returned 0x630000 [0058.588] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x661188, Size=0x30) returned 0x661188 [0058.588] GetProcessHeap () returned 0x630000 [0058.588] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0058.588] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.588] GetProcessHeap () returned 0x630000 [0058.588] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0058.588] ReadFile (in: hFile=0x230, lpBuffer=0x64cc78, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x64cc78*, lpNumberOfBytesRead=0x243d7e8*=0x200, lpOverlapped=0x0) returned 1 [0058.588] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.588] WriteFile (in: hFile=0x230, lpBuffer=0x64cc78*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x64cc78*, lpNumberOfBytesWritten=0x243d7e4*=0x200, lpOverlapped=0x0) returned 1 [0058.589] GetProcessHeap () returned 0x630000 [0058.589] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0058.589] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.589] WriteFile (in: hFile=0x230, lpBuffer=0x661188*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661188*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0058.590] CloseHandle (hObject=0x230) returned 1 [0058.591] GetProcessHeap () returned 0x630000 [0058.591] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x652000 | out: hHeap=0x630000) returned 1 [0058.591] GetProcessHeap () returned 0x630000 [0058.591] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655580 | out: hHeap=0x630000) returned 1 [0058.591] GetProcessHeap () returned 0x630000 [0058.591] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0058.591] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\desktop.ini") returned="C:\\Users\\FD1HVy\\Videos\\desktop.ini" [0058.591] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\desktop.ini", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\desktop.ini.happythreechoose") returned="C:\\Users\\FD1HVy\\Videos\\desktop.ini.happythreechoose" [0058.592] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\videos\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\desktop.ini.happythreechoose" (normalized: "c:\\users\\fd1hvy\\videos\\desktop.ini.happythreechoose"), dwFlags=0x1) returned 1 [0058.592] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\Videos") returned 1 [0058.592] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\") returned="" [0058.592] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Videos\\Decryption INFO.html" [0058.592] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\videos\\decryption info.html")) returned 0x20 [0058.592] GetProcessHeap () returned 0x630000 [0058.592] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0058.592] FindNextFileW (in: hFindFile=0x65b710, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc87a4a0, ftCreationTime.dwHighDateTime=0x1d5d217, ftLastAccessTime.dwLowDateTime=0x17508010, ftLastAccessTime.dwHighDateTime=0x1d5c7b4, ftLastWriteTime.dwLowDateTime=0x17508010, ftLastWriteTime.dwHighDateTime=0x1d5c7b4, nFileSizeHigh=0x0, nFileSizeLow=0xde1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="h68GbEjUBDmeazE.mp4", cAlternateFileName="H68GBE~1.MP4")) returned 1 [0058.592] lstrcmpiW (lpString1="h68GbEjUBDmeazE.mp4", lpString2=".") returned 1 [0058.592] lstrcmpiW (lpString1="h68GbEjUBDmeazE.mp4", lpString2="..") returned 1 [0058.592] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="h68GbEjUBDmeazE.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\h68GbEjUBDmeazE.mp4") returned="C:\\Users\\FD1HVy\\Videos\\h68GbEjUBDmeazE.mp4" [0058.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h68GbEjUBDmeazE.mp4", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0058.592] GetProcessHeap () returned 0x630000 [0058.592] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x645e58 [0058.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h68GbEjUBDmeazE.mp4", cchWideChar=-1, lpMultiByteStr=0x645e58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h68GbEjUBDmeazE.mp4", lpUsedDefaultChar=0x0) returned 20 [0058.593] lstrlenA (lpString="h68GbEjUBDmeazE.mp4") returned 19 [0058.593] lstrlenA (lpString=".happythreechoose") returned 17 [0058.593] lstrlenA (lpString=".happythreechoose") returned 17 [0058.593] lstrlenA (lpString="h68GbEjUBDmeazE.mp4") returned 19 [0058.593] lstrcmpiA (lpString1="8GbEjUBDmeazE.mp4", lpString2=".happythreechoose") returned 1 [0058.593] lstrcmpiW (lpString1="h68GbEjUBDmeazE.mp4", lpString2="Decryption INFO.html") returned 1 [0058.593] lstrcmpiW (lpString1="h68GbEjUBDmeazE.mp4", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0058.593] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0058.593] lstrcmpiW (lpString1="h68GbEjUBDmeazE.mp4", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0058.593] GetProcessHeap () returned 0x630000 [0058.593] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0058.593] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\h68GbEjUBDmeazE.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\h68gbejubdmeaze.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0058.593] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=3553) returned 1 [0058.593] GetProcessHeap () returned 0x630000 [0058.593] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655670 [0058.593] GetProcessHeap () returned 0x630000 [0058.593] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0058.593] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\h68GbEjUBDmeazE.mp4") returned 42 [0058.593] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.593] GetProcessHeap () returned 0x630000 [0058.593] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0058.593] GetProcessHeap () returned 0x630000 [0058.593] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38f) returned 0x6611c0 [0058.593] lstrlenA (lpString="rsa_encrypt") returned 11 [0058.593] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0058.594] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0058.594] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0058.594] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0058.594] GetProcessHeap () returned 0x630000 [0058.594] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0058.594] lstrlenA (lpString="010001") returned 6 [0058.594] GetProcessHeap () returned 0x630000 [0058.594] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a1c8 [0058.594] GetProcessHeap () returned 0x630000 [0058.594] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.595] GetProcessHeap () returned 0x630000 [0058.595] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e6a0 [0058.595] GetProcessHeap () returned 0x630000 [0058.595] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.595] GetProcessHeap () returned 0x630000 [0058.595] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ebb0 [0058.595] GetProcessHeap () returned 0x630000 [0058.595] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657788 [0058.595] GetProcessHeap () returned 0x630000 [0058.595] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a0b8 [0058.595] GetProcessHeap () returned 0x630000 [0058.595] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0058.595] GetProcessHeap () returned 0x630000 [0058.595] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0058.595] GetProcessHeap () returned 0x630000 [0058.595] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0058.595] GetProcessHeap () returned 0x630000 [0058.595] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.595] GetProcessHeap () returned 0x630000 [0058.595] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656ec8 [0058.595] GetProcessHeap () returned 0x630000 [0058.595] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0058.595] GetProcessHeap () returned 0x630000 [0058.595] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0058.595] GetProcessHeap () returned 0x630000 [0058.595] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea00 [0058.595] GetProcessHeap () returned 0x630000 [0058.595] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.595] GetProcessHeap () returned 0x630000 [0058.595] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0058.595] GetProcessHeap () returned 0x630000 [0058.595] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0058.595] GetProcessHeap () returned 0x630000 [0058.595] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0058.595] GetProcessHeap () returned 0x630000 [0058.595] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0058.595] GetProcessHeap () returned 0x630000 [0058.595] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0058.595] GetProcessHeap () returned 0x630000 [0058.595] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0058.596] GetProcessHeap () returned 0x630000 [0058.596] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0058.596] GetProcessHeap () returned 0x630000 [0058.596] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0058.596] GetProcessHeap () returned 0x630000 [0058.596] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e220 [0058.596] GetProcessHeap () returned 0x630000 [0058.596] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0058.596] GetProcessHeap () returned 0x630000 [0058.596] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0058.596] GetProcessHeap () returned 0x630000 [0058.596] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0058.596] GetProcessHeap () returned 0x630000 [0058.596] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0058.596] GetProcessHeap () returned 0x630000 [0058.596] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0058.596] GetProcessHeap () returned 0x630000 [0058.596] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0058.596] GetProcessHeap () returned 0x630000 [0058.596] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0058.596] GetProcessHeap () returned 0x630000 [0058.596] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0058.596] GetProcessHeap () returned 0x630000 [0058.596] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0058.596] GetProcessHeap () returned 0x630000 [0058.596] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.596] GetProcessHeap () returned 0x630000 [0058.596] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.596] GetProcessHeap () returned 0x630000 [0058.596] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0058.596] GetProcessHeap () returned 0x630000 [0058.596] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0058.596] GetProcessHeap () returned 0x630000 [0058.596] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0058.596] GetProcessHeap () returned 0x630000 [0058.596] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0058.596] GetProcessHeap () returned 0x630000 [0058.597] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0058.597] GetProcessHeap () returned 0x630000 [0058.597] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0058.597] GetProcessHeap () returned 0x630000 [0058.597] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0058.597] GetProcessHeap () returned 0x630000 [0058.597] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0058.597] GetProcessHeap () returned 0x630000 [0058.597] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.597] GetProcessHeap () returned 0x630000 [0058.597] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.597] GetProcessHeap () returned 0x630000 [0058.597] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0058.597] GetProcessHeap () returned 0x630000 [0058.597] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0058.597] GetProcessHeap () returned 0x630000 [0058.597] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0058.597] GetProcessHeap () returned 0x630000 [0058.597] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0058.597] GetProcessHeap () returned 0x630000 [0058.597] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0058.597] GetProcessHeap () returned 0x630000 [0058.597] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0058.597] GetProcessHeap () returned 0x630000 [0058.597] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0058.597] GetProcessHeap () returned 0x630000 [0058.597] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0058.597] GetProcessHeap () returned 0x630000 [0058.597] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0058.597] GetProcessHeap () returned 0x630000 [0058.597] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0058.597] GetProcessHeap () returned 0x630000 [0058.597] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.597] GetProcessHeap () returned 0x630000 [0058.597] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.597] GetProcessHeap () returned 0x630000 [0058.597] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.598] GetProcessHeap () returned 0x630000 [0058.598] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.598] GetProcessHeap () returned 0x630000 [0058.598] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0058.598] GetProcessHeap () returned 0x630000 [0058.598] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0058.598] GetProcessHeap () returned 0x630000 [0058.598] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.598] GetProcessHeap () returned 0x630000 [0058.598] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.598] GetProcessHeap () returned 0x630000 [0058.598] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0058.598] GetProcessHeap () returned 0x630000 [0058.598] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0058.598] GetProcessHeap () returned 0x630000 [0058.598] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.598] GetProcessHeap () returned 0x630000 [0058.598] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.598] GetProcessHeap () returned 0x630000 [0058.598] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0058.598] GetProcessHeap () returned 0x630000 [0058.598] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0058.598] GetProcessHeap () returned 0x630000 [0058.598] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.598] GetProcessHeap () returned 0x630000 [0058.598] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.598] GetProcessHeap () returned 0x630000 [0058.598] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0058.598] GetProcessHeap () returned 0x630000 [0058.598] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0058.598] GetProcessHeap () returned 0x630000 [0058.598] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0058.598] GetProcessHeap () returned 0x630000 [0058.598] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0058.598] GetProcessHeap () returned 0x630000 [0058.598] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0058.598] GetProcessHeap () returned 0x630000 [0058.599] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0058.599] GetProcessHeap () returned 0x630000 [0058.599] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.599] GetProcessHeap () returned 0x630000 [0058.599] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.599] GetProcessHeap () returned 0x630000 [0058.599] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.599] GetProcessHeap () returned 0x630000 [0058.599] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.599] GetProcessHeap () returned 0x630000 [0058.599] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.599] GetProcessHeap () returned 0x630000 [0058.599] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.599] GetProcessHeap () returned 0x630000 [0058.599] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0058.599] GetProcessHeap () returned 0x630000 [0058.599] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0058.599] GetProcessHeap () returned 0x630000 [0058.599] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0058.599] GetProcessHeap () returned 0x630000 [0058.599] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0058.599] GetProcessHeap () returned 0x630000 [0058.599] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0058.599] GetProcessHeap () returned 0x630000 [0058.599] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0058.599] GetProcessHeap () returned 0x630000 [0058.599] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.599] GetProcessHeap () returned 0x630000 [0058.599] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.599] GetProcessHeap () returned 0x630000 [0058.599] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0058.599] GetProcessHeap () returned 0x630000 [0058.599] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0058.599] GetProcessHeap () returned 0x630000 [0058.599] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.599] GetProcessHeap () returned 0x630000 [0058.599] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.600] GetProcessHeap () returned 0x630000 [0058.600] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.600] GetProcessHeap () returned 0x630000 [0058.600] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.600] GetProcessHeap () returned 0x630000 [0058.600] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0058.600] GetProcessHeap () returned 0x630000 [0058.600] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0058.600] GetProcessHeap () returned 0x630000 [0058.600] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0058.600] GetProcessHeap () returned 0x630000 [0058.600] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0058.600] GetProcessHeap () returned 0x630000 [0058.600] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.600] GetProcessHeap () returned 0x630000 [0058.600] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.600] GetProcessHeap () returned 0x630000 [0058.600] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0058.600] GetProcessHeap () returned 0x630000 [0058.600] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0058.600] GetProcessHeap () returned 0x630000 [0058.600] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.600] GetProcessHeap () returned 0x630000 [0058.600] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.600] GetProcessHeap () returned 0x630000 [0058.600] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0058.600] GetProcessHeap () returned 0x630000 [0058.600] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0058.600] GetProcessHeap () returned 0x630000 [0058.600] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0058.600] GetProcessHeap () returned 0x630000 [0058.600] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0058.600] GetProcessHeap () returned 0x630000 [0058.600] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0058.600] GetProcessHeap () returned 0x630000 [0058.600] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0058.600] GetProcessHeap () returned 0x630000 [0058.600] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0058.601] GetProcessHeap () returned 0x630000 [0058.601] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0058.601] GetProcessHeap () returned 0x630000 [0058.601] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0058.601] GetProcessHeap () returned 0x630000 [0058.601] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e6a0 | out: hHeap=0x630000) returned 1 [0058.601] GetProcessHeap () returned 0x630000 [0058.601] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0058.601] GetProcessHeap () returned 0x630000 [0058.601] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0058.601] GetProcessHeap () returned 0x630000 [0058.601] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0058.601] WriteFile (in: hFile=0x230, lpBuffer=0x6611c0*, nNumberOfBytesToWrite=0x38f, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6611c0*, lpNumberOfBytesWritten=0x243d864*=0x38f, lpOverlapped=0x0) returned 1 [0058.603] GetProcessHeap () returned 0x630000 [0058.603] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6611c0, Size=0x30) returned 0x6611c0 [0058.603] GetProcessHeap () returned 0x630000 [0058.603] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0058.603] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.604] GetProcessHeap () returned 0x630000 [0058.604] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xdf0) returned 0x6611f8 [0058.604] ReadFile (in: hFile=0x230, lpBuffer=0x6611f8, nNumberOfBytesToRead=0xdf0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x6611f8*, lpNumberOfBytesRead=0x243d7e8*=0xdf0, lpOverlapped=0x0) returned 1 [0058.604] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.604] WriteFile (in: hFile=0x230, lpBuffer=0x6611f8*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x6611f8*, lpNumberOfBytesWritten=0x243d7e4*=0xdf0, lpOverlapped=0x0) returned 1 [0058.605] GetProcessHeap () returned 0x630000 [0058.605] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6611f8 | out: hHeap=0x630000) returned 1 [0058.605] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.605] WriteFile (in: hFile=0x230, lpBuffer=0x6611c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6611c0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0058.606] CloseHandle (hObject=0x230) returned 1 [0058.607] GetProcessHeap () returned 0x630000 [0058.607] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0058.607] GetProcessHeap () returned 0x630000 [0058.607] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655670 | out: hHeap=0x630000) returned 1 [0058.607] GetProcessHeap () returned 0x630000 [0058.607] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0058.607] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\h68GbEjUBDmeazE.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\h68GbEjUBDmeazE.mp4") returned="C:\\Users\\FD1HVy\\Videos\\h68GbEjUBDmeazE.mp4" [0058.607] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\h68GbEjUBDmeazE.mp4", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\h68GbEjUBDmeazE.mp4.happythreechoose") returned="C:\\Users\\FD1HVy\\Videos\\h68GbEjUBDmeazE.mp4.happythreechoose" [0058.607] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\h68GbEjUBDmeazE.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\h68gbejubdmeaze.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\h68GbEjUBDmeazE.mp4.happythreechoose" (normalized: "c:\\users\\fd1hvy\\videos\\h68gbejubdmeaze.mp4.happythreechoose"), dwFlags=0x1) returned 1 [0058.608] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\h68GbEjUBDmeazE.mp4" | out: pszPath="C:\\Users\\FD1HVy\\Videos") returned 1 [0058.608] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\") returned="" [0058.608] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Videos\\Decryption INFO.html" [0058.608] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\videos\\decryption info.html")) returned 0x20 [0058.608] GetProcessHeap () returned 0x630000 [0058.608] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645e58 | out: hHeap=0x630000) returned 1 [0058.608] FindNextFileW (in: hFindFile=0x65b710, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe539030, ftCreationTime.dwHighDateTime=0x1d5d6c0, ftLastAccessTime.dwLowDateTime=0x70cf8dc0, ftLastAccessTime.dwHighDateTime=0x1d5cddb, ftLastWriteTime.dwLowDateTime=0x70cf8dc0, ftLastWriteTime.dwHighDateTime=0x1d5cddb, nFileSizeHigh=0x0, nFileSizeLow=0x659, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="h9q20S8eRxd.swf", cAlternateFileName="H9Q20S~1.SWF")) returned 1 [0058.608] lstrcmpiW (lpString1="h9q20S8eRxd.swf", lpString2=".") returned 1 [0058.608] lstrcmpiW (lpString1="h9q20S8eRxd.swf", lpString2="..") returned 1 [0058.608] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="h9q20S8eRxd.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\h9q20S8eRxd.swf") returned="C:\\Users\\FD1HVy\\Videos\\h9q20S8eRxd.swf" [0058.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h9q20S8eRxd.swf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0058.608] GetProcessHeap () returned 0x630000 [0058.608] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x64ca20 [0058.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h9q20S8eRxd.swf", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="h9q20S8eRxd.swf", lpUsedDefaultChar=0x0) returned 16 [0058.608] lstrlenA (lpString="h9q20S8eRxd.swf") returned 15 [0058.608] lstrlenA (lpString=".happythreechoose") returned 17 [0058.608] lstrcmpiW (lpString1="h9q20S8eRxd.swf", lpString2="Decryption INFO.html") returned 1 [0058.608] lstrcmpiW (lpString1="h9q20S8eRxd.swf", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0058.608] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0058.608] lstrcmpiW (lpString1="h9q20S8eRxd.swf", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0058.608] GetProcessHeap () returned 0x630000 [0058.608] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651ec0 [0058.608] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\h9q20S8eRxd.swf" (normalized: "c:\\users\\fd1hvy\\videos\\h9q20s8erxd.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0058.609] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=1625) returned 1 [0058.609] GetProcessHeap () returned 0x630000 [0058.609] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6559b8 [0058.609] GetProcessHeap () returned 0x630000 [0058.609] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0058.609] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\h9q20S8eRxd.swf") returned 38 [0058.609] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.609] GetProcessHeap () returned 0x630000 [0058.609] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0058.609] GetProcessHeap () returned 0x630000 [0058.609] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x387) returned 0x6611f8 [0058.609] lstrlenA (lpString="rsa_encrypt") returned 11 [0058.609] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0058.610] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0058.610] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0058.610] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0058.610] GetProcessHeap () returned 0x630000 [0058.610] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0058.610] lstrlenA (lpString="010001") returned 6 [0058.610] GetProcessHeap () returned 0x630000 [0058.610] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a178 [0058.610] GetProcessHeap () returned 0x630000 [0058.610] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.610] GetProcessHeap () returned 0x630000 [0058.610] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e580 [0058.610] GetProcessHeap () returned 0x630000 [0058.610] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.610] GetProcessHeap () returned 0x630000 [0058.610] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0058.610] GetProcessHeap () returned 0x630000 [0058.610] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x6570f8 [0058.610] GetProcessHeap () returned 0x630000 [0058.610] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a118 [0058.610] GetProcessHeap () returned 0x630000 [0058.610] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0058.610] GetProcessHeap () returned 0x630000 [0058.611] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0058.611] GetProcessHeap () returned 0x630000 [0058.611] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0058.611] GetProcessHeap () returned 0x630000 [0058.611] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.611] GetProcessHeap () returned 0x630000 [0058.611] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656a68 [0058.611] GetProcessHeap () returned 0x630000 [0058.611] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0058.611] GetProcessHeap () returned 0x630000 [0058.611] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0058.611] GetProcessHeap () returned 0x630000 [0058.611] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e100 [0058.611] GetProcessHeap () returned 0x630000 [0058.611] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.611] GetProcessHeap () returned 0x630000 [0058.611] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0058.611] GetProcessHeap () returned 0x630000 [0058.611] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0058.611] GetProcessHeap () returned 0x630000 [0058.611] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0058.611] GetProcessHeap () returned 0x630000 [0058.611] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65a960 [0058.611] GetProcessHeap () returned 0x630000 [0058.611] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0058.611] GetProcessHeap () returned 0x630000 [0058.611] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0058.611] GetProcessHeap () returned 0x630000 [0058.611] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0058.611] GetProcessHeap () returned 0x630000 [0058.611] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0058.611] GetProcessHeap () returned 0x630000 [0058.611] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ebb0 [0058.611] GetProcessHeap () returned 0x630000 [0058.611] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a960 | out: hHeap=0x630000) returned 1 [0058.611] GetProcessHeap () returned 0x630000 [0058.611] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0058.611] GetProcessHeap () returned 0x630000 [0058.611] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0058.612] GetProcessHeap () returned 0x630000 [0058.612] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0058.612] GetProcessHeap () returned 0x630000 [0058.612] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0058.612] GetProcessHeap () returned 0x630000 [0058.612] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0058.612] GetProcessHeap () returned 0x630000 [0058.612] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0058.612] GetProcessHeap () returned 0x630000 [0058.612] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.612] GetProcessHeap () returned 0x630000 [0058.612] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.612] GetProcessHeap () returned 0x630000 [0058.612] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0058.612] GetProcessHeap () returned 0x630000 [0058.612] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0058.612] GetProcessHeap () returned 0x630000 [0058.612] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0058.612] GetProcessHeap () returned 0x630000 [0058.612] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0058.612] GetProcessHeap () returned 0x630000 [0058.612] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.612] GetProcessHeap () returned 0x630000 [0058.612] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.612] GetProcessHeap () returned 0x630000 [0058.612] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0058.612] GetProcessHeap () returned 0x630000 [0058.612] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0058.612] GetProcessHeap () returned 0x630000 [0058.612] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0058.612] GetProcessHeap () returned 0x630000 [0058.612] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0058.612] GetProcessHeap () returned 0x630000 [0058.612] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0058.612] GetProcessHeap () returned 0x630000 [0058.612] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0058.612] GetProcessHeap () returned 0x630000 [0058.613] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0058.613] GetProcessHeap () returned 0x630000 [0058.613] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0058.613] GetProcessHeap () returned 0x630000 [0058.613] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0058.613] GetProcessHeap () returned 0x630000 [0058.613] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0058.613] GetProcessHeap () returned 0x630000 [0058.613] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.613] GetProcessHeap () returned 0x630000 [0058.613] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.613] GetProcessHeap () returned 0x630000 [0058.613] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0058.613] GetProcessHeap () returned 0x630000 [0058.613] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0058.613] GetProcessHeap () returned 0x630000 [0058.613] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0058.613] GetProcessHeap () returned 0x630000 [0058.613] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0058.613] GetProcessHeap () returned 0x630000 [0058.613] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0058.613] GetProcessHeap () returned 0x630000 [0058.613] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0058.613] GetProcessHeap () returned 0x630000 [0058.613] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.613] GetProcessHeap () returned 0x630000 [0058.613] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.613] GetProcessHeap () returned 0x630000 [0058.613] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.613] GetProcessHeap () returned 0x630000 [0058.613] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.613] GetProcessHeap () returned 0x630000 [0058.613] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.613] GetProcessHeap () returned 0x630000 [0058.613] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.613] GetProcessHeap () returned 0x630000 [0058.613] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.614] GetProcessHeap () returned 0x630000 [0058.614] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.614] GetProcessHeap () returned 0x630000 [0058.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0058.614] GetProcessHeap () returned 0x630000 [0058.614] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0058.614] GetProcessHeap () returned 0x630000 [0058.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.614] GetProcessHeap () returned 0x630000 [0058.614] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.614] GetProcessHeap () returned 0x630000 [0058.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0058.614] GetProcessHeap () returned 0x630000 [0058.614] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0058.614] GetProcessHeap () returned 0x630000 [0058.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0058.614] GetProcessHeap () returned 0x630000 [0058.614] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0058.614] GetProcessHeap () returned 0x630000 [0058.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.614] GetProcessHeap () returned 0x630000 [0058.614] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.614] GetProcessHeap () returned 0x630000 [0058.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0058.614] GetProcessHeap () returned 0x630000 [0058.614] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0058.614] GetProcessHeap () returned 0x630000 [0058.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.614] GetProcessHeap () returned 0x630000 [0058.614] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.614] GetProcessHeap () returned 0x630000 [0058.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0058.614] GetProcessHeap () returned 0x630000 [0058.614] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0058.614] GetProcessHeap () returned 0x630000 [0058.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0058.614] GetProcessHeap () returned 0x630000 [0058.615] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0058.615] GetProcessHeap () returned 0x630000 [0058.615] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0058.615] GetProcessHeap () returned 0x630000 [0058.615] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0058.615] GetProcessHeap () returned 0x630000 [0058.615] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0058.615] GetProcessHeap () returned 0x630000 [0058.615] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0058.615] GetProcessHeap () returned 0x630000 [0058.615] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0058.615] GetProcessHeap () returned 0x630000 [0058.615] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0058.615] GetProcessHeap () returned 0x630000 [0058.615] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.615] GetProcessHeap () returned 0x630000 [0058.615] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.615] GetProcessHeap () returned 0x630000 [0058.615] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0058.615] GetProcessHeap () returned 0x630000 [0058.615] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0058.615] GetProcessHeap () returned 0x630000 [0058.615] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0058.615] GetProcessHeap () returned 0x630000 [0058.615] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0058.615] GetProcessHeap () returned 0x630000 [0058.615] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0058.615] GetProcessHeap () returned 0x630000 [0058.615] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0058.615] GetProcessHeap () returned 0x630000 [0058.615] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.615] GetProcessHeap () returned 0x630000 [0058.615] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.615] GetProcessHeap () returned 0x630000 [0058.615] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0058.615] GetProcessHeap () returned 0x630000 [0058.615] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0058.615] GetProcessHeap () returned 0x630000 [0058.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0058.616] GetProcessHeap () returned 0x630000 [0058.616] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0058.616] GetProcessHeap () returned 0x630000 [0058.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.616] GetProcessHeap () returned 0x630000 [0058.616] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.616] GetProcessHeap () returned 0x630000 [0058.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0058.616] GetProcessHeap () returned 0x630000 [0058.616] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0058.616] GetProcessHeap () returned 0x630000 [0058.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0e8 [0058.616] GetProcessHeap () returned 0x630000 [0058.616] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0e8 | out: hHeap=0x630000) returned 1 [0058.616] GetProcessHeap () returned 0x630000 [0058.616] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0058.616] GetProcessHeap () returned 0x630000 [0058.616] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0058.616] GetProcessHeap () returned 0x630000 [0058.616] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0058.616] GetProcessHeap () returned 0x630000 [0058.616] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0058.616] GetProcessHeap () returned 0x630000 [0058.616] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0058.616] GetProcessHeap () returned 0x630000 [0058.616] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0058.616] GetProcessHeap () returned 0x630000 [0058.616] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0058.616] GetProcessHeap () returned 0x630000 [0058.616] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0058.616] GetProcessHeap () returned 0x630000 [0058.616] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0058.616] GetProcessHeap () returned 0x630000 [0058.616] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0058.616] GetProcessHeap () returned 0x630000 [0058.617] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0058.617] WriteFile (in: hFile=0x230, lpBuffer=0x6611f8*, nNumberOfBytesToWrite=0x387, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6611f8*, lpNumberOfBytesWritten=0x243d864*=0x387, lpOverlapped=0x0) returned 1 [0058.619] GetProcessHeap () returned 0x630000 [0058.619] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6611f8, Size=0x30) returned 0x6611f8 [0058.619] GetProcessHeap () returned 0x630000 [0058.619] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0058.619] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.619] GetProcessHeap () returned 0x630000 [0058.619] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x660) returned 0x661230 [0058.619] ReadFile (in: hFile=0x230, lpBuffer=0x661230, nNumberOfBytesToRead=0x660, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661230*, lpNumberOfBytesRead=0x243d7e8*=0x660, lpOverlapped=0x0) returned 1 [0058.619] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.619] WriteFile (in: hFile=0x230, lpBuffer=0x661230*, nNumberOfBytesToWrite=0x660, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661230*, lpNumberOfBytesWritten=0x243d7e4*=0x660, lpOverlapped=0x0) returned 1 [0058.620] GetProcessHeap () returned 0x630000 [0058.620] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661230 | out: hHeap=0x630000) returned 1 [0058.620] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.620] WriteFile (in: hFile=0x230, lpBuffer=0x6611f8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6611f8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0058.621] CloseHandle (hObject=0x230) returned 1 [0058.622] GetProcessHeap () returned 0x630000 [0058.622] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651ec0 | out: hHeap=0x630000) returned 1 [0058.622] GetProcessHeap () returned 0x630000 [0058.622] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6559b8 | out: hHeap=0x630000) returned 1 [0058.622] GetProcessHeap () returned 0x630000 [0058.622] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0058.622] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\h9q20S8eRxd.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\h9q20S8eRxd.swf") returned="C:\\Users\\FD1HVy\\Videos\\h9q20S8eRxd.swf" [0058.622] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\h9q20S8eRxd.swf", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\h9q20S8eRxd.swf.happythreechoose") returned="C:\\Users\\FD1HVy\\Videos\\h9q20S8eRxd.swf.happythreechoose" [0058.622] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\h9q20S8eRxd.swf" (normalized: "c:\\users\\fd1hvy\\videos\\h9q20s8erxd.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\h9q20S8eRxd.swf.happythreechoose" (normalized: "c:\\users\\fd1hvy\\videos\\h9q20s8erxd.swf.happythreechoose"), dwFlags=0x1) returned 1 [0058.623] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\h9q20S8eRxd.swf" | out: pszPath="C:\\Users\\FD1HVy\\Videos") returned 1 [0058.623] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\") returned="" [0058.623] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Videos\\Decryption INFO.html" [0058.623] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\videos\\decryption info.html")) returned 0x20 [0058.623] GetProcessHeap () returned 0x630000 [0058.623] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0058.623] FindNextFileW (in: hFindFile=0x65b710, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a2d66d0, ftCreationTime.dwHighDateTime=0x1d5ca84, ftLastAccessTime.dwLowDateTime=0xa8fd4a30, ftLastAccessTime.dwHighDateTime=0x1d5cefc, ftLastWriteTime.dwLowDateTime=0xa8fd4a30, ftLastWriteTime.dwHighDateTime=0x1d5cefc, nFileSizeHigh=0x0, nFileSizeLow=0x506, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="lypfdAfjalW 5Vh.avi", cAlternateFileName="LYPFDA~1.AVI")) returned 1 [0058.623] lstrcmpiW (lpString1="lypfdAfjalW 5Vh.avi", lpString2=".") returned 1 [0058.623] lstrcmpiW (lpString1="lypfdAfjalW 5Vh.avi", lpString2="..") returned 1 [0058.623] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="lypfdAfjalW 5Vh.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\lypfdAfjalW 5Vh.avi") returned="C:\\Users\\FD1HVy\\Videos\\lypfdAfjalW 5Vh.avi" [0058.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lypfdAfjalW 5Vh.avi", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0058.623] GetProcessHeap () returned 0x630000 [0058.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x645cd8 [0058.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lypfdAfjalW 5Vh.avi", cchWideChar=-1, lpMultiByteStr=0x645cd8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lypfdAfjalW 5Vh.avi", lpUsedDefaultChar=0x0) returned 20 [0058.623] lstrlenA (lpString="lypfdAfjalW 5Vh.avi") returned 19 [0058.623] lstrlenA (lpString=".happythreechoose") returned 17 [0058.623] lstrlenA (lpString=".happythreechoose") returned 17 [0058.624] lstrlenA (lpString="lypfdAfjalW 5Vh.avi") returned 19 [0058.624] lstrcmpiA (lpString1="pfdAfjalW 5Vh.avi", lpString2=".happythreechoose") returned 1 [0058.624] lstrcmpiW (lpString1="lypfdAfjalW 5Vh.avi", lpString2="Decryption INFO.html") returned 1 [0058.624] lstrcmpiW (lpString1="lypfdAfjalW 5Vh.avi", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0058.624] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0058.624] lstrcmpiW (lpString1="lypfdAfjalW 5Vh.avi", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0058.624] GetProcessHeap () returned 0x630000 [0058.624] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0058.624] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\lypfdAfjalW 5Vh.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lypfdafjalw 5vh.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0058.624] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=1286) returned 1 [0058.624] GetProcessHeap () returned 0x630000 [0058.624] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655490 [0058.624] GetProcessHeap () returned 0x630000 [0058.624] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0058.624] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\lypfdAfjalW 5Vh.avi") returned 42 [0058.624] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.624] GetProcessHeap () returned 0x630000 [0058.624] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0058.624] GetProcessHeap () returned 0x630000 [0058.624] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38a) returned 0x661230 [0058.624] lstrlenA (lpString="rsa_encrypt") returned 11 [0058.624] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0058.625] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0058.625] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0058.625] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0058.625] GetProcessHeap () returned 0x630000 [0058.625] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0058.625] lstrlenA (lpString="010001") returned 6 [0058.625] GetProcessHeap () returned 0x630000 [0058.625] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a218 [0058.625] GetProcessHeap () returned 0x630000 [0058.625] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.625] GetProcessHeap () returned 0x630000 [0058.625] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e850 [0058.625] GetProcessHeap () returned 0x630000 [0058.625] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.625] GetProcessHeap () returned 0x630000 [0058.625] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65eb20 [0058.626] GetProcessHeap () returned 0x630000 [0058.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657210 [0058.626] GetProcessHeap () returned 0x630000 [0058.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a238 [0058.626] GetProcessHeap () returned 0x630000 [0058.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0058.626] GetProcessHeap () returned 0x630000 [0058.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0058.626] GetProcessHeap () returned 0x630000 [0058.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0058.626] GetProcessHeap () returned 0x630000 [0058.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.626] GetProcessHeap () returned 0x630000 [0058.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657328 [0058.626] GetProcessHeap () returned 0x630000 [0058.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0058.626] GetProcessHeap () returned 0x630000 [0058.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0058.626] GetProcessHeap () returned 0x630000 [0058.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea00 [0058.626] GetProcessHeap () returned 0x630000 [0058.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.626] GetProcessHeap () returned 0x630000 [0058.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0058.626] GetProcessHeap () returned 0x630000 [0058.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0058.626] GetProcessHeap () returned 0x630000 [0058.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0058.626] GetProcessHeap () returned 0x630000 [0058.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0058.626] GetProcessHeap () returned 0x630000 [0058.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0058.626] GetProcessHeap () returned 0x630000 [0058.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0058.626] GetProcessHeap () returned 0x630000 [0058.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.626] GetProcessHeap () returned 0x630000 [0058.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.627] GetProcessHeap () returned 0x630000 [0058.627] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e070 [0058.627] GetProcessHeap () returned 0x630000 [0058.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0058.627] GetProcessHeap () returned 0x630000 [0058.627] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0058.627] GetProcessHeap () returned 0x630000 [0058.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0058.627] GetProcessHeap () returned 0x630000 [0058.627] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0058.627] GetProcessHeap () returned 0x630000 [0058.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0058.627] GetProcessHeap () returned 0x630000 [0058.627] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.627] GetProcessHeap () returned 0x630000 [0058.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.627] GetProcessHeap () returned 0x630000 [0058.627] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.627] GetProcessHeap () returned 0x630000 [0058.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.627] GetProcessHeap () returned 0x630000 [0058.627] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0058.627] GetProcessHeap () returned 0x630000 [0058.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0058.627] GetProcessHeap () returned 0x630000 [0058.627] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0058.627] GetProcessHeap () returned 0x630000 [0058.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0058.627] GetProcessHeap () returned 0x630000 [0058.627] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0058.627] GetProcessHeap () returned 0x630000 [0058.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0058.627] GetProcessHeap () returned 0x630000 [0058.627] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0058.627] GetProcessHeap () returned 0x630000 [0058.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0058.627] GetProcessHeap () returned 0x630000 [0058.628] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0058.628] GetProcessHeap () returned 0x630000 [0058.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0058.628] GetProcessHeap () returned 0x630000 [0058.628] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.628] GetProcessHeap () returned 0x630000 [0058.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.628] GetProcessHeap () returned 0x630000 [0058.628] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0e8 [0058.628] GetProcessHeap () returned 0x630000 [0058.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0e8 | out: hHeap=0x630000) returned 1 [0058.628] GetProcessHeap () returned 0x630000 [0058.628] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0058.628] GetProcessHeap () returned 0x630000 [0058.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0058.628] GetProcessHeap () returned 0x630000 [0058.628] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0058.628] GetProcessHeap () returned 0x630000 [0058.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0058.628] GetProcessHeap () returned 0x630000 [0058.628] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0058.628] GetProcessHeap () returned 0x630000 [0058.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0058.628] GetProcessHeap () returned 0x630000 [0058.628] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.628] GetProcessHeap () returned 0x630000 [0058.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.628] GetProcessHeap () returned 0x630000 [0058.628] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0058.628] GetProcessHeap () returned 0x630000 [0058.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0058.628] GetProcessHeap () returned 0x630000 [0058.628] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.628] GetProcessHeap () returned 0x630000 [0058.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.628] GetProcessHeap () returned 0x630000 [0058.628] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.629] GetProcessHeap () returned 0x630000 [0058.629] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.629] GetProcessHeap () returned 0x630000 [0058.629] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0058.629] GetProcessHeap () returned 0x630000 [0058.629] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0058.629] GetProcessHeap () returned 0x630000 [0058.629] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.629] GetProcessHeap () returned 0x630000 [0058.629] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.629] GetProcessHeap () returned 0x630000 [0058.629] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0058.629] GetProcessHeap () returned 0x630000 [0058.629] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0058.629] GetProcessHeap () returned 0x630000 [0058.629] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.629] GetProcessHeap () returned 0x630000 [0058.629] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.629] GetProcessHeap () returned 0x630000 [0058.629] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0058.629] GetProcessHeap () returned 0x630000 [0058.629] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0058.629] GetProcessHeap () returned 0x630000 [0058.629] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.629] GetProcessHeap () returned 0x630000 [0058.629] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.629] GetProcessHeap () returned 0x630000 [0058.629] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.629] GetProcessHeap () returned 0x630000 [0058.629] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.629] GetProcessHeap () returned 0x630000 [0058.629] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.629] GetProcessHeap () returned 0x630000 [0058.629] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.629] GetProcessHeap () returned 0x630000 [0058.629] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0058.629] GetProcessHeap () returned 0x630000 [0058.630] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0058.630] GetProcessHeap () returned 0x630000 [0058.630] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0058.630] GetProcessHeap () returned 0x630000 [0058.630] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0058.630] GetProcessHeap () returned 0x630000 [0058.630] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0058.630] GetProcessHeap () returned 0x630000 [0058.630] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0058.630] GetProcessHeap () returned 0x630000 [0058.630] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0058.630] GetProcessHeap () returned 0x630000 [0058.630] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0058.630] GetProcessHeap () returned 0x630000 [0058.630] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0058.630] GetProcessHeap () returned 0x630000 [0058.630] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0058.630] GetProcessHeap () returned 0x630000 [0058.630] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0058.630] GetProcessHeap () returned 0x630000 [0058.630] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0058.630] GetProcessHeap () returned 0x630000 [0058.630] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0058.630] GetProcessHeap () returned 0x630000 [0058.630] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0058.630] GetProcessHeap () returned 0x630000 [0058.630] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0058.630] GetProcessHeap () returned 0x630000 [0058.630] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0058.630] GetProcessHeap () returned 0x630000 [0058.630] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0058.630] GetProcessHeap () returned 0x630000 [0058.630] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0058.630] GetProcessHeap () returned 0x630000 [0058.630] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0058.630] GetProcessHeap () returned 0x630000 [0058.630] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0058.631] GetProcessHeap () returned 0x630000 [0058.631] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0058.631] GetProcessHeap () returned 0x630000 [0058.631] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0058.631] GetProcessHeap () returned 0x630000 [0058.631] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0058.631] GetProcessHeap () returned 0x630000 [0058.631] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0058.631] GetProcessHeap () returned 0x630000 [0058.631] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0058.631] GetProcessHeap () returned 0x630000 [0058.631] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0058.631] GetProcessHeap () returned 0x630000 [0058.631] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0058.631] GetProcessHeap () returned 0x630000 [0058.631] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0058.631] GetProcessHeap () returned 0x630000 [0058.631] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0058.631] GetProcessHeap () returned 0x630000 [0058.631] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0058.631] GetProcessHeap () returned 0x630000 [0058.631] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0058.631] GetProcessHeap () returned 0x630000 [0058.631] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0058.631] GetProcessHeap () returned 0x630000 [0058.631] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0058.631] GetProcessHeap () returned 0x630000 [0058.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0058.632] GetProcessHeap () returned 0x630000 [0058.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0058.632] GetProcessHeap () returned 0x630000 [0058.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0058.632] GetProcessHeap () returned 0x630000 [0058.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0058.632] GetProcessHeap () returned 0x630000 [0058.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0058.632] GetProcessHeap () returned 0x630000 [0058.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0058.632] GetProcessHeap () returned 0x630000 [0058.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0058.632] GetProcessHeap () returned 0x630000 [0058.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0058.632] GetProcessHeap () returned 0x630000 [0058.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.632] GetProcessHeap () returned 0x630000 [0058.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0058.632] WriteFile (in: hFile=0x230, lpBuffer=0x661230*, nNumberOfBytesToWrite=0x38a, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661230*, lpNumberOfBytesWritten=0x243d864*=0x38a, lpOverlapped=0x0) returned 1 [0058.634] GetProcessHeap () returned 0x630000 [0058.634] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x661230, Size=0x30) returned 0x661230 [0058.634] GetProcessHeap () returned 0x630000 [0058.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0058.634] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.634] GetProcessHeap () returned 0x630000 [0058.634] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x510) returned 0x661268 [0058.634] ReadFile (in: hFile=0x230, lpBuffer=0x661268, nNumberOfBytesToRead=0x510, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661268*, lpNumberOfBytesRead=0x243d7e8*=0x510, lpOverlapped=0x0) returned 1 [0058.634] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.634] WriteFile (in: hFile=0x230, lpBuffer=0x661268*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661268*, lpNumberOfBytesWritten=0x243d7e4*=0x510, lpOverlapped=0x0) returned 1 [0058.635] GetProcessHeap () returned 0x630000 [0058.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661268 | out: hHeap=0x630000) returned 1 [0058.635] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.635] WriteFile (in: hFile=0x230, lpBuffer=0x661230*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661230*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0058.636] CloseHandle (hObject=0x230) returned 1 [0058.637] GetProcessHeap () returned 0x630000 [0058.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0058.637] GetProcessHeap () returned 0x630000 [0058.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655490 | out: hHeap=0x630000) returned 1 [0058.637] GetProcessHeap () returned 0x630000 [0058.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0058.637] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\lypfdAfjalW 5Vh.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\lypfdAfjalW 5Vh.avi") returned="C:\\Users\\FD1HVy\\Videos\\lypfdAfjalW 5Vh.avi" [0058.637] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\lypfdAfjalW 5Vh.avi", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\lypfdAfjalW 5Vh.avi.happythreechoose") returned="C:\\Users\\FD1HVy\\Videos\\lypfdAfjalW 5Vh.avi.happythreechoose" [0058.638] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\lypfdAfjalW 5Vh.avi" (normalized: "c:\\users\\fd1hvy\\videos\\lypfdafjalw 5vh.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\lypfdAfjalW 5Vh.avi.happythreechoose" (normalized: "c:\\users\\fd1hvy\\videos\\lypfdafjalw 5vh.avi.happythreechoose"), dwFlags=0x1) returned 1 [0058.638] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\lypfdAfjalW 5Vh.avi" | out: pszPath="C:\\Users\\FD1HVy\\Videos") returned 1 [0058.638] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\") returned="" [0058.638] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Videos\\Decryption INFO.html" [0058.638] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\videos\\decryption info.html")) returned 0x20 [0058.638] GetProcessHeap () returned 0x630000 [0058.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645cd8 | out: hHeap=0x630000) returned 1 [0058.638] FindNextFileW (in: hFindFile=0x65b710, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x473fa2c0, ftCreationTime.dwHighDateTime=0x1d5c97f, ftLastAccessTime.dwLowDateTime=0x6637c990, ftLastAccessTime.dwHighDateTime=0x1d5d2ea, ftLastWriteTime.dwLowDateTime=0x6637c990, ftLastWriteTime.dwHighDateTime=0x1d5d2ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PQRbVh-tDHt-M", cAlternateFileName="PQRBVH~1")) returned 1 [0058.639] lstrcmpiW (lpString1="PQRbVh-tDHt-M", lpString2=".") returned 1 [0058.639] lstrcmpiW (lpString1="PQRbVh-tDHt-M", lpString2="..") returned 1 [0058.639] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="PQRbVh-tDHt-M" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M" [0058.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PQRbVh-tDHt-M", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0058.639] GetProcessHeap () returned 0x630000 [0058.639] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x64c9f0 [0058.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PQRbVh-tDHt-M", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PQRbVh-tDHt-M", lpUsedDefaultChar=0x0) returned 14 [0058.639] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PQRbVh-tDHt-M", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0058.639] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PQRbVh-tDHt-M", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0058.639] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PQRbVh-tDHt-M", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0058.639] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PQRbVh-tDHt-M", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0058.639] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PQRbVh-tDHt-M", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0058.639] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PQRbVh-tDHt-M", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0058.639] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PQRbVh-tDHt-M", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0058.639] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PQRbVh-tDHt-M", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0058.639] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PQRbVh-tDHt-M", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0058.639] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PQRbVh-tDHt-M", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0058.639] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PQRbVh-tDHt-M", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0058.639] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PQRbVh-tDHt-M", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0058.639] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PQRbVh-tDHt-M", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0058.639] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PQRbVh-tDHt-M", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0058.639] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PQRbVh-tDHt-M", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0058.639] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PQRbVh-tDHt-M", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0058.639] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PQRbVh-tDHt-M", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0058.639] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PQRbVh-tDHt-M", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0058.639] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PQRbVh-tDHt-M", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0058.639] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PQRbVh-tDHt-M", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0058.639] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PQRbVh-tDHt-M", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0058.639] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PQRbVh-tDHt-M", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0058.639] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PQRbVh-tDHt-M", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0058.639] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PQRbVh-tDHt-M", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0058.640] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PQRbVh-tDHt-M", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0058.640] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PQRbVh-tDHt-M", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0058.640] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PQRbVh-tDHt-M", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0058.640] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PQRbVh-tDHt-M", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0058.640] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PQRbVh-tDHt-M", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0058.640] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PQRbVh-tDHt-M", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0058.640] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PQRbVh-tDHt-M", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0058.640] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PQRbVh-tDHt-M", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0058.640] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PQRbVh-tDHt-M", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0058.640] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PQRbVh-tDHt-M", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0058.640] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PQRbVh-tDHt-M", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0058.640] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PQRbVh-tDHt-M", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0058.640] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PQRbVh-tDHt-M", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0058.640] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PQRbVh-tDHt-M", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0058.640] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PQRbVh-tDHt-M", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0058.640] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PQRbVh-tDHt-M", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0058.640] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PQRbVh-tDHt-M", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0058.640] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PQRbVh-tDHt-M", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0058.640] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PQRbVh-tDHt-M", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0058.640] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\" [0058.640] GetProcessHeap () returned 0x630000 [0058.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a088 [0058.640] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\") returned 37 [0058.640] GetProcessHeap () returned 0x630000 [0058.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4c) returned 0x65eeb0 [0058.640] lstrcpyW (in: lpString1=0x65eeb0, lpString2="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\" [0058.640] GetProcessHeap () returned 0x630000 [0058.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0058.640] FindNextFileW (in: hFindFile=0x65b710, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75175030, ftCreationTime.dwHighDateTime=0x1d5d226, ftLastAccessTime.dwLowDateTime=0xabbf78a0, ftLastAccessTime.dwHighDateTime=0x1d5d187, ftLastWriteTime.dwLowDateTime=0xabbf78a0, ftLastWriteTime.dwHighDateTime=0x1d5d187, nFileSizeHigh=0x0, nFileSizeLow=0x55ed, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ryVN.swf", cAlternateFileName="")) returned 1 [0058.640] lstrcmpiW (lpString1="ryVN.swf", lpString2=".") returned 1 [0058.640] lstrcmpiW (lpString1="ryVN.swf", lpString2="..") returned 1 [0058.640] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="ryVN.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ryVN.swf") returned="C:\\Users\\FD1HVy\\Videos\\ryVN.swf" [0058.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ryVN.swf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0058.641] GetProcessHeap () returned 0x630000 [0058.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9) returned 0x64c9f0 [0058.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ryVN.swf", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ryVN.swf", lpUsedDefaultChar=0x0) returned 9 [0058.641] lstrlenA (lpString="ryVN.swf") returned 8 [0058.641] lstrlenA (lpString=".happythreechoose") returned 17 [0058.641] lstrcmpiW (lpString1="ryVN.swf", lpString2="Decryption INFO.html") returned 1 [0058.641] lstrcmpiW (lpString1="ryVN.swf", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0058.641] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0058.641] lstrcmpiW (lpString1="ryVN.swf", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0058.641] GetProcessHeap () returned 0x630000 [0058.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0058.641] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\ryVN.swf" (normalized: "c:\\users\\fd1hvy\\videos\\ryvn.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0058.641] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=21997) returned 1 [0058.641] GetProcessHeap () returned 0x630000 [0058.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655b20 [0058.641] GetProcessHeap () returned 0x630000 [0058.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0058.641] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\ryVN.swf") returned 31 [0058.641] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.641] GetProcessHeap () returned 0x630000 [0058.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0058.641] GetProcessHeap () returned 0x630000 [0058.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x383) returned 0x661268 [0058.641] lstrlenA (lpString="rsa_encrypt") returned 11 [0058.642] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0058.642] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0058.642] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0058.642] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0058.642] GetProcessHeap () returned 0x630000 [0058.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0058.642] lstrlenA (lpString="010001") returned 6 [0058.642] GetProcessHeap () returned 0x630000 [0058.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a1e8 [0058.642] GetProcessHeap () returned 0x630000 [0058.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.642] GetProcessHeap () returned 0x630000 [0058.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0058.642] GetProcessHeap () returned 0x630000 [0058.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.642] GetProcessHeap () returned 0x630000 [0058.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0058.643] GetProcessHeap () returned 0x630000 [0058.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x6570f8 [0058.643] GetProcessHeap () returned 0x630000 [0058.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a228 [0058.643] GetProcessHeap () returned 0x630000 [0058.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0058.643] GetProcessHeap () returned 0x630000 [0058.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0058.643] GetProcessHeap () returned 0x630000 [0058.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0058.643] GetProcessHeap () returned 0x630000 [0058.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.643] GetProcessHeap () returned 0x630000 [0058.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657788 [0058.643] GetProcessHeap () returned 0x630000 [0058.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0058.643] GetProcessHeap () returned 0x630000 [0058.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0058.643] GetProcessHeap () returned 0x630000 [0058.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0058.643] GetProcessHeap () returned 0x630000 [0058.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.643] GetProcessHeap () returned 0x630000 [0058.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0058.643] GetProcessHeap () returned 0x630000 [0058.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0058.643] GetProcessHeap () returned 0x630000 [0058.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0058.643] GetProcessHeap () returned 0x630000 [0058.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65aab0 [0058.643] GetProcessHeap () returned 0x630000 [0058.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0058.643] GetProcessHeap () returned 0x630000 [0058.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0058.643] GetProcessHeap () returned 0x630000 [0058.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0058.643] GetProcessHeap () returned 0x630000 [0058.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0058.644] GetProcessHeap () returned 0x630000 [0058.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65dec0 [0058.644] GetProcessHeap () returned 0x630000 [0058.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65aab0 | out: hHeap=0x630000) returned 1 [0058.644] GetProcessHeap () returned 0x630000 [0058.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0058.644] GetProcessHeap () returned 0x630000 [0058.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0058.644] GetProcessHeap () returned 0x630000 [0058.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.644] GetProcessHeap () returned 0x630000 [0058.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.644] GetProcessHeap () returned 0x630000 [0058.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0058.644] GetProcessHeap () returned 0x630000 [0058.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0058.644] GetProcessHeap () returned 0x630000 [0058.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.644] GetProcessHeap () returned 0x630000 [0058.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.644] GetProcessHeap () returned 0x630000 [0058.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.644] GetProcessHeap () returned 0x630000 [0058.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.644] GetProcessHeap () returned 0x630000 [0058.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0058.644] GetProcessHeap () returned 0x630000 [0058.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0058.644] GetProcessHeap () returned 0x630000 [0058.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0058.644] GetProcessHeap () returned 0x630000 [0058.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0058.644] GetProcessHeap () returned 0x630000 [0058.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0058.644] GetProcessHeap () returned 0x630000 [0058.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0058.644] GetProcessHeap () returned 0x630000 [0058.645] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0058.645] GetProcessHeap () returned 0x630000 [0058.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0058.645] GetProcessHeap () returned 0x630000 [0058.645] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.645] GetProcessHeap () returned 0x630000 [0058.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.645] GetProcessHeap () returned 0x630000 [0058.645] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.645] GetProcessHeap () returned 0x630000 [0058.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.645] GetProcessHeap () returned 0x630000 [0058.645] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0058.645] GetProcessHeap () returned 0x630000 [0058.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0058.645] GetProcessHeap () returned 0x630000 [0058.645] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.645] GetProcessHeap () returned 0x630000 [0058.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.645] GetProcessHeap () returned 0x630000 [0058.645] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0058.645] GetProcessHeap () returned 0x630000 [0058.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0058.645] GetProcessHeap () returned 0x630000 [0058.645] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.645] GetProcessHeap () returned 0x630000 [0058.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.645] GetProcessHeap () returned 0x630000 [0058.645] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0058.645] GetProcessHeap () returned 0x630000 [0058.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0058.645] GetProcessHeap () returned 0x630000 [0058.645] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.645] GetProcessHeap () returned 0x630000 [0058.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.645] GetProcessHeap () returned 0x630000 [0058.645] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.646] GetProcessHeap () returned 0x630000 [0058.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.646] GetProcessHeap () returned 0x630000 [0058.646] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.646] GetProcessHeap () returned 0x630000 [0058.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.646] GetProcessHeap () returned 0x630000 [0058.646] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.646] GetProcessHeap () returned 0x630000 [0058.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.646] GetProcessHeap () returned 0x630000 [0058.646] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0058.646] GetProcessHeap () returned 0x630000 [0058.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0058.646] GetProcessHeap () returned 0x630000 [0058.646] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0058.646] GetProcessHeap () returned 0x630000 [0058.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0058.646] GetProcessHeap () returned 0x630000 [0058.646] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0058.646] GetProcessHeap () returned 0x630000 [0058.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0058.646] GetProcessHeap () returned 0x630000 [0058.646] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0058.646] GetProcessHeap () returned 0x630000 [0058.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0058.646] GetProcessHeap () returned 0x630000 [0058.646] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.646] GetProcessHeap () returned 0x630000 [0058.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.646] GetProcessHeap () returned 0x630000 [0058.646] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.646] GetProcessHeap () returned 0x630000 [0058.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.646] GetProcessHeap () returned 0x630000 [0058.647] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.647] GetProcessHeap () returned 0x630000 [0058.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.647] GetProcessHeap () returned 0x630000 [0058.647] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0058.647] GetProcessHeap () returned 0x630000 [0058.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0058.647] GetProcessHeap () returned 0x630000 [0058.647] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0058.647] GetProcessHeap () returned 0x630000 [0058.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0058.647] GetProcessHeap () returned 0x630000 [0058.647] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.647] GetProcessHeap () returned 0x630000 [0058.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.647] GetProcessHeap () returned 0x630000 [0058.647] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.647] GetProcessHeap () returned 0x630000 [0058.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.647] GetProcessHeap () returned 0x630000 [0058.647] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0e8 [0058.647] GetProcessHeap () returned 0x630000 [0058.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0e8 | out: hHeap=0x630000) returned 1 [0058.647] GetProcessHeap () returned 0x630000 [0058.647] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.647] GetProcessHeap () returned 0x630000 [0058.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.647] GetProcessHeap () returned 0x630000 [0058.647] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0058.647] GetProcessHeap () returned 0x630000 [0058.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0058.647] GetProcessHeap () returned 0x630000 [0058.647] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0058.647] GetProcessHeap () returned 0x630000 [0058.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0058.647] GetProcessHeap () returned 0x630000 [0058.647] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0058.648] GetProcessHeap () returned 0x630000 [0058.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0058.648] GetProcessHeap () returned 0x630000 [0058.648] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0058.648] GetProcessHeap () returned 0x630000 [0058.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0058.648] GetProcessHeap () returned 0x630000 [0058.648] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0058.648] GetProcessHeap () returned 0x630000 [0058.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0058.648] GetProcessHeap () returned 0x630000 [0058.648] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0058.648] GetProcessHeap () returned 0x630000 [0058.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0058.648] GetProcessHeap () returned 0x630000 [0058.648] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.648] GetProcessHeap () returned 0x630000 [0058.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.648] GetProcessHeap () returned 0x630000 [0058.648] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.648] GetProcessHeap () returned 0x630000 [0058.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.648] GetProcessHeap () returned 0x630000 [0058.648] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0058.648] GetProcessHeap () returned 0x630000 [0058.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0058.648] GetProcessHeap () returned 0x630000 [0058.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0058.648] GetProcessHeap () returned 0x630000 [0058.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0058.648] GetProcessHeap () returned 0x630000 [0058.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0058.648] GetProcessHeap () returned 0x630000 [0058.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0058.648] GetProcessHeap () returned 0x630000 [0058.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0058.649] GetProcessHeap () returned 0x630000 [0058.649] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0058.649] GetProcessHeap () returned 0x630000 [0058.649] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0058.649] GetProcessHeap () returned 0x630000 [0058.649] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0058.649] GetProcessHeap () returned 0x630000 [0058.649] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0058.649] GetProcessHeap () returned 0x630000 [0058.649] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0058.649] GetProcessHeap () returned 0x630000 [0058.649] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0058.649] WriteFile (in: hFile=0x230, lpBuffer=0x661268*, nNumberOfBytesToWrite=0x383, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661268*, lpNumberOfBytesWritten=0x243d864*=0x383, lpOverlapped=0x0) returned 1 [0058.650] GetProcessHeap () returned 0x630000 [0058.650] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x661268, Size=0x30) returned 0x661268 [0058.650] GetProcessHeap () returned 0x630000 [0058.650] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0058.650] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.650] GetProcessHeap () returned 0x630000 [0058.651] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x55f0) returned 0x6612a0 [0058.651] ReadFile (in: hFile=0x230, lpBuffer=0x6612a0, nNumberOfBytesToRead=0x55f0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x6612a0*, lpNumberOfBytesRead=0x243d7e8*=0x55f0, lpOverlapped=0x0) returned 1 [0058.651] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.651] WriteFile (in: hFile=0x230, lpBuffer=0x6612a0*, nNumberOfBytesToWrite=0x55f0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x6612a0*, lpNumberOfBytesWritten=0x243d7e4*=0x55f0, lpOverlapped=0x0) returned 1 [0058.652] GetProcessHeap () returned 0x630000 [0058.652] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6612a0 | out: hHeap=0x630000) returned 1 [0058.654] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.654] WriteFile (in: hFile=0x230, lpBuffer=0x661268*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661268*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0058.655] CloseHandle (hObject=0x230) returned 1 [0058.657] GetProcessHeap () returned 0x630000 [0058.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0058.657] GetProcessHeap () returned 0x630000 [0058.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655b20 | out: hHeap=0x630000) returned 1 [0058.657] GetProcessHeap () returned 0x630000 [0058.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0058.657] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\ryVN.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ryVN.swf") returned="C:\\Users\\FD1HVy\\Videos\\ryVN.swf" [0058.657] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\ryVN.swf", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ryVN.swf.happythreechoose") returned="C:\\Users\\FD1HVy\\Videos\\ryVN.swf.happythreechoose" [0058.657] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\ryVN.swf" (normalized: "c:\\users\\fd1hvy\\videos\\ryvn.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\ryVN.swf.happythreechoose" (normalized: "c:\\users\\fd1hvy\\videos\\ryvn.swf.happythreechoose"), dwFlags=0x1) returned 1 [0058.658] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\ryVN.swf" | out: pszPath="C:\\Users\\FD1HVy\\Videos") returned 1 [0058.658] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\") returned="" [0058.658] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Videos\\Decryption INFO.html" [0058.658] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\videos\\decryption info.html")) returned 0x20 [0058.658] GetProcessHeap () returned 0x630000 [0058.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0058.658] FindNextFileW (in: hFindFile=0x65b710, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x769c9850, ftCreationTime.dwHighDateTime=0x1d5d331, ftLastAccessTime.dwLowDateTime=0xd059e400, ftLastAccessTime.dwHighDateTime=0x1d5c9a0, ftLastWriteTime.dwLowDateTime=0xd059e400, ftLastWriteTime.dwHighDateTime=0x1d5c9a0, nFileSizeHigh=0x0, nFileSizeLow=0x10064, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tSRa.mp4", cAlternateFileName="")) returned 1 [0058.658] lstrcmpiW (lpString1="tSRa.mp4", lpString2=".") returned 1 [0058.658] lstrcmpiW (lpString1="tSRa.mp4", lpString2="..") returned 1 [0058.658] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="tSRa.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\tSRa.mp4") returned="C:\\Users\\FD1HVy\\Videos\\tSRa.mp4" [0058.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tSRa.mp4", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0058.658] GetProcessHeap () returned 0x630000 [0058.658] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9) returned 0x64c9f0 [0058.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tSRa.mp4", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tSRa.mp4", lpUsedDefaultChar=0x0) returned 9 [0058.658] lstrlenA (lpString="tSRa.mp4") returned 8 [0058.658] lstrlenA (lpString=".happythreechoose") returned 17 [0058.658] lstrcmpiW (lpString1="tSRa.mp4", lpString2="Decryption INFO.html") returned 1 [0058.658] lstrcmpiW (lpString1="tSRa.mp4", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0058.658] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0058.658] lstrcmpiW (lpString1="tSRa.mp4", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0058.658] GetProcessHeap () returned 0x630000 [0058.658] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0058.658] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\tSRa.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\tsra.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0058.659] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=65636) returned 1 [0058.659] GetProcessHeap () returned 0x630000 [0058.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6557d8 [0058.659] GetProcessHeap () returned 0x630000 [0058.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0058.659] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\tSRa.mp4") returned 31 [0058.659] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.659] GetProcessHeap () returned 0x630000 [0058.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0058.659] GetProcessHeap () returned 0x630000 [0058.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38c) returned 0x6612a0 [0058.660] lstrlenA (lpString="rsa_encrypt") returned 11 [0058.660] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0058.661] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0058.661] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0058.661] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0058.661] GetProcessHeap () returned 0x630000 [0058.661] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0058.661] lstrlenA (lpString="010001") returned 6 [0058.661] GetProcessHeap () returned 0x630000 [0058.661] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a0d8 [0058.661] GetProcessHeap () returned 0x630000 [0058.661] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.661] GetProcessHeap () returned 0x630000 [0058.661] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65df50 [0058.661] GetProcessHeap () returned 0x630000 [0058.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.661] GetProcessHeap () returned 0x630000 [0058.661] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0058.661] GetProcessHeap () returned 0x630000 [0058.661] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656ec8 [0058.661] GetProcessHeap () returned 0x630000 [0058.661] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a218 [0058.661] GetProcessHeap () returned 0x630000 [0058.661] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0058.661] GetProcessHeap () returned 0x630000 [0058.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.661] GetProcessHeap () returned 0x630000 [0058.661] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0058.661] GetProcessHeap () returned 0x630000 [0058.661] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.661] GetProcessHeap () returned 0x630000 [0058.661] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656b80 [0058.661] GetProcessHeap () returned 0x630000 [0058.661] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0058.661] GetProcessHeap () returned 0x630000 [0058.661] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0058.662] GetProcessHeap () returned 0x630000 [0058.662] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e8e0 [0058.662] GetProcessHeap () returned 0x630000 [0058.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.662] GetProcessHeap () returned 0x630000 [0058.662] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0058.662] GetProcessHeap () returned 0x630000 [0058.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0058.662] GetProcessHeap () returned 0x630000 [0058.662] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0058.662] GetProcessHeap () returned 0x630000 [0058.662] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65a768 [0058.662] GetProcessHeap () returned 0x630000 [0058.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0058.662] GetProcessHeap () returned 0x630000 [0058.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0058.662] GetProcessHeap () returned 0x630000 [0058.662] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.662] GetProcessHeap () returned 0x630000 [0058.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.662] GetProcessHeap () returned 0x630000 [0058.662] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ea90 [0058.662] GetProcessHeap () returned 0x630000 [0058.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a768 | out: hHeap=0x630000) returned 1 [0058.662] GetProcessHeap () returned 0x630000 [0058.662] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0058.662] GetProcessHeap () returned 0x630000 [0058.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea90 | out: hHeap=0x630000) returned 1 [0058.662] GetProcessHeap () returned 0x630000 [0058.662] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0058.662] GetProcessHeap () returned 0x630000 [0058.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0058.662] GetProcessHeap () returned 0x630000 [0058.662] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0058.662] GetProcessHeap () returned 0x630000 [0058.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0058.662] GetProcessHeap () returned 0x630000 [0058.663] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0058.663] GetProcessHeap () returned 0x630000 [0058.663] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0058.663] GetProcessHeap () returned 0x630000 [0058.663] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.663] GetProcessHeap () returned 0x630000 [0058.663] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.663] GetProcessHeap () returned 0x630000 [0058.663] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.663] GetProcessHeap () returned 0x630000 [0058.663] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.663] GetProcessHeap () returned 0x630000 [0058.663] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.663] GetProcessHeap () returned 0x630000 [0058.663] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.663] GetProcessHeap () returned 0x630000 [0058.663] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0058.663] GetProcessHeap () returned 0x630000 [0058.663] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0058.663] GetProcessHeap () returned 0x630000 [0058.663] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0058.663] GetProcessHeap () returned 0x630000 [0058.663] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0058.663] GetProcessHeap () returned 0x630000 [0058.663] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.663] GetProcessHeap () returned 0x630000 [0058.663] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.663] GetProcessHeap () returned 0x630000 [0058.663] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0058.663] GetProcessHeap () returned 0x630000 [0058.663] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0058.663] GetProcessHeap () returned 0x630000 [0058.663] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0058.663] GetProcessHeap () returned 0x630000 [0058.663] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0058.663] GetProcessHeap () returned 0x630000 [0058.664] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0058.664] GetProcessHeap () returned 0x630000 [0058.664] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0058.664] GetProcessHeap () returned 0x630000 [0058.664] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0058.664] GetProcessHeap () returned 0x630000 [0058.664] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0058.664] GetProcessHeap () returned 0x630000 [0058.664] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0058.664] GetProcessHeap () returned 0x630000 [0058.664] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0058.664] GetProcessHeap () returned 0x630000 [0058.664] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.664] GetProcessHeap () returned 0x630000 [0058.664] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.664] GetProcessHeap () returned 0x630000 [0058.664] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0058.664] GetProcessHeap () returned 0x630000 [0058.664] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0058.664] GetProcessHeap () returned 0x630000 [0058.664] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0058.664] GetProcessHeap () returned 0x630000 [0058.664] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0058.664] GetProcessHeap () returned 0x630000 [0058.664] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.664] GetProcessHeap () returned 0x630000 [0058.664] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.664] GetProcessHeap () returned 0x630000 [0058.664] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.664] GetProcessHeap () returned 0x630000 [0058.664] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.664] GetProcessHeap () returned 0x630000 [0058.664] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.664] GetProcessHeap () returned 0x630000 [0058.664] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.664] GetProcessHeap () returned 0x630000 [0058.664] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.664] GetProcessHeap () returned 0x630000 [0058.665] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.665] GetProcessHeap () returned 0x630000 [0058.665] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.665] GetProcessHeap () returned 0x630000 [0058.665] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.665] GetProcessHeap () returned 0x630000 [0058.665] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0058.665] GetProcessHeap () returned 0x630000 [0058.665] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0058.665] GetProcessHeap () returned 0x630000 [0058.665] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0058.665] GetProcessHeap () returned 0x630000 [0058.665] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0058.665] GetProcessHeap () returned 0x630000 [0058.665] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0058.665] GetProcessHeap () returned 0x630000 [0058.665] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0058.665] GetProcessHeap () returned 0x630000 [0058.665] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.665] GetProcessHeap () returned 0x630000 [0058.665] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.665] GetProcessHeap () returned 0x630000 [0058.665] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0e8 [0058.665] GetProcessHeap () returned 0x630000 [0058.665] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0e8 | out: hHeap=0x630000) returned 1 [0058.665] GetProcessHeap () returned 0x630000 [0058.665] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0058.665] GetProcessHeap () returned 0x630000 [0058.665] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0058.665] GetProcessHeap () returned 0x630000 [0058.665] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0058.665] GetProcessHeap () returned 0x630000 [0058.665] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0058.665] GetProcessHeap () returned 0x630000 [0058.665] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0058.665] GetProcessHeap () returned 0x630000 [0058.665] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0058.665] GetProcessHeap () returned 0x630000 [0058.666] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.666] GetProcessHeap () returned 0x630000 [0058.666] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.666] GetProcessHeap () returned 0x630000 [0058.666] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0058.666] GetProcessHeap () returned 0x630000 [0058.666] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0058.666] GetProcessHeap () returned 0x630000 [0058.666] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.666] GetProcessHeap () returned 0x630000 [0058.666] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.666] GetProcessHeap () returned 0x630000 [0058.666] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0e8 [0058.666] GetProcessHeap () returned 0x630000 [0058.666] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0e8 | out: hHeap=0x630000) returned 1 [0058.666] GetProcessHeap () returned 0x630000 [0058.666] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0058.666] GetProcessHeap () returned 0x630000 [0058.666] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0058.666] GetProcessHeap () returned 0x630000 [0058.666] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.666] GetProcessHeap () returned 0x630000 [0058.666] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.666] GetProcessHeap () returned 0x630000 [0058.666] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.666] GetProcessHeap () returned 0x630000 [0058.666] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.666] GetProcessHeap () returned 0x630000 [0058.666] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0058.666] GetProcessHeap () returned 0x630000 [0058.666] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0058.666] GetProcessHeap () returned 0x630000 [0058.666] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0058.666] GetProcessHeap () returned 0x630000 [0058.666] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0058.666] GetProcessHeap () returned 0x630000 [0058.666] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.667] GetProcessHeap () returned 0x630000 [0058.667] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.667] GetProcessHeap () returned 0x630000 [0058.667] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.667] GetProcessHeap () returned 0x630000 [0058.667] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.667] GetProcessHeap () returned 0x630000 [0058.667] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0058.667] GetProcessHeap () returned 0x630000 [0058.667] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0058.667] GetProcessHeap () returned 0x630000 [0058.667] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0058.667] GetProcessHeap () returned 0x630000 [0058.667] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0058.667] GetProcessHeap () returned 0x630000 [0058.667] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0058.667] GetProcessHeap () returned 0x630000 [0058.667] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0058.667] GetProcessHeap () returned 0x630000 [0058.667] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0058.667] GetProcessHeap () returned 0x630000 [0058.667] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0058.667] GetProcessHeap () returned 0x630000 [0058.667] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0058.667] GetProcessHeap () returned 0x630000 [0058.667] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0058.667] GetProcessHeap () returned 0x630000 [0058.667] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0058.667] WriteFile (in: hFile=0x230, lpBuffer=0x6612a0*, nNumberOfBytesToWrite=0x38c, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6612a0*, lpNumberOfBytesWritten=0x243d864*=0x38c, lpOverlapped=0x0) returned 1 [0058.669] GetProcessHeap () returned 0x630000 [0058.669] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6612a0, Size=0x30) returned 0x6612a0 [0058.669] GetProcessHeap () returned 0x630000 [0058.669] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0058.669] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.669] GetProcessHeap () returned 0x630000 [0058.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10070) returned 0x6612d8 [0058.671] ReadFile (in: hFile=0x230, lpBuffer=0x6612d8, nNumberOfBytesToRead=0x10070, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x6612d8*, lpNumberOfBytesRead=0x243d7e8*=0x10070, lpOverlapped=0x0) returned 1 [0058.671] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.671] WriteFile (in: hFile=0x230, lpBuffer=0x6612d8*, nNumberOfBytesToWrite=0x10070, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x6612d8*, lpNumberOfBytesWritten=0x243d7e4*=0x10070, lpOverlapped=0x0) returned 1 [0058.673] GetProcessHeap () returned 0x630000 [0058.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6612d8 | out: hHeap=0x630000) returned 1 [0058.673] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.673] WriteFile (in: hFile=0x230, lpBuffer=0x6612a0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6612a0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0058.674] CloseHandle (hObject=0x230) returned 1 [0058.676] GetProcessHeap () returned 0x630000 [0058.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0058.676] GetProcessHeap () returned 0x630000 [0058.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6557d8 | out: hHeap=0x630000) returned 1 [0058.676] GetProcessHeap () returned 0x630000 [0058.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0058.676] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\tSRa.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\tSRa.mp4") returned="C:\\Users\\FD1HVy\\Videos\\tSRa.mp4" [0058.676] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\tSRa.mp4", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\tSRa.mp4.happythreechoose") returned="C:\\Users\\FD1HVy\\Videos\\tSRa.mp4.happythreechoose" [0058.676] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\tSRa.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\tsra.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\tSRa.mp4.happythreechoose" (normalized: "c:\\users\\fd1hvy\\videos\\tsra.mp4.happythreechoose"), dwFlags=0x1) returned 1 [0058.677] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\tSRa.mp4" | out: pszPath="C:\\Users\\FD1HVy\\Videos") returned 1 [0058.677] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\") returned="" [0058.677] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Videos\\Decryption INFO.html" [0058.677] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\videos\\decryption info.html")) returned 0x20 [0058.677] GetProcessHeap () returned 0x630000 [0058.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0058.677] FindNextFileW (in: hFindFile=0x65b710, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e9a4d40, ftCreationTime.dwHighDateTime=0x1d5ce48, ftLastAccessTime.dwLowDateTime=0xf819e620, ftLastAccessTime.dwHighDateTime=0x1d5cf5e, ftLastWriteTime.dwLowDateTime=0xf819e620, ftLastWriteTime.dwHighDateTime=0x1d5cf5e, nFileSizeHigh=0x0, nFileSizeLow=0x119d4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WEStXX.mkv", cAlternateFileName="")) returned 1 [0058.677] lstrcmpiW (lpString1="WEStXX.mkv", lpString2=".") returned 1 [0058.677] lstrcmpiW (lpString1="WEStXX.mkv", lpString2="..") returned 1 [0058.677] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="WEStXX.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\WEStXX.mkv") returned="C:\\Users\\FD1HVy\\Videos\\WEStXX.mkv" [0058.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WEStXX.mkv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0058.677] GetProcessHeap () returned 0x630000 [0058.677] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb) returned 0x64c9f0 [0058.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WEStXX.mkv", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WEStXX.mkv", lpUsedDefaultChar=0x0) returned 11 [0058.677] lstrlenA (lpString="WEStXX.mkv") returned 10 [0058.677] lstrlenA (lpString=".happythreechoose") returned 17 [0058.677] lstrcmpiW (lpString1="WEStXX.mkv", lpString2="Decryption INFO.html") returned 1 [0058.677] lstrcmpiW (lpString1="WEStXX.mkv", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0058.677] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0058.677] lstrcmpiW (lpString1="WEStXX.mkv", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0058.678] GetProcessHeap () returned 0x630000 [0058.678] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0058.678] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\WEStXX.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\westxx.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0058.678] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=72148) returned 1 [0058.678] GetProcessHeap () returned 0x630000 [0058.678] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655850 [0058.678] GetProcessHeap () returned 0x630000 [0058.678] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0058.678] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\WEStXX.mkv") returned 33 [0058.678] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.678] GetProcessHeap () returned 0x630000 [0058.678] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0058.678] GetProcessHeap () returned 0x630000 [0058.678] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38c) returned 0x6612d8 [0058.678] lstrlenA (lpString="rsa_encrypt") returned 11 [0058.678] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0058.679] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0058.679] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0058.679] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0058.679] GetProcessHeap () returned 0x630000 [0058.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0058.679] lstrlenA (lpString="010001") returned 6 [0058.679] GetProcessHeap () returned 0x630000 [0058.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a238 [0058.679] GetProcessHeap () returned 0x630000 [0058.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.679] GetProcessHeap () returned 0x630000 [0058.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65eb20 [0058.679] GetProcessHeap () returned 0x630000 [0058.679] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.679] GetProcessHeap () returned 0x630000 [0058.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ec40 [0058.679] GetProcessHeap () returned 0x630000 [0058.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656db0 [0058.679] GetProcessHeap () returned 0x630000 [0058.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a068 [0058.679] GetProcessHeap () returned 0x630000 [0058.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0058.679] GetProcessHeap () returned 0x630000 [0058.679] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0058.679] GetProcessHeap () returned 0x630000 [0058.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0058.679] GetProcessHeap () returned 0x630000 [0058.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.679] GetProcessHeap () returned 0x630000 [0058.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657788 [0058.679] GetProcessHeap () returned 0x630000 [0058.680] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.680] GetProcessHeap () returned 0x630000 [0058.680] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0058.680] GetProcessHeap () returned 0x630000 [0058.680] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea00 [0058.680] GetProcessHeap () returned 0x630000 [0058.680] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.680] GetProcessHeap () returned 0x630000 [0058.680] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0058.680] GetProcessHeap () returned 0x630000 [0058.680] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0058.680] GetProcessHeap () returned 0x630000 [0058.680] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0058.680] GetProcessHeap () returned 0x630000 [0058.680] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65a8a0 [0058.680] GetProcessHeap () returned 0x630000 [0058.680] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.680] GetProcessHeap () returned 0x630000 [0058.680] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0058.680] GetProcessHeap () returned 0x630000 [0058.680] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0058.680] GetProcessHeap () returned 0x630000 [0058.680] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0058.680] GetProcessHeap () returned 0x630000 [0058.680] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65dec0 [0058.680] GetProcessHeap () returned 0x630000 [0058.680] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a8a0 | out: hHeap=0x630000) returned 1 [0058.680] GetProcessHeap () returned 0x630000 [0058.680] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0058.680] GetProcessHeap () returned 0x630000 [0058.680] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0058.680] GetProcessHeap () returned 0x630000 [0058.680] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0058.680] GetProcessHeap () returned 0x630000 [0058.680] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0058.680] GetProcessHeap () returned 0x630000 [0058.680] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0058.680] GetProcessHeap () returned 0x630000 [0058.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0058.681] GetProcessHeap () returned 0x630000 [0058.681] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.681] GetProcessHeap () returned 0x630000 [0058.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.681] GetProcessHeap () returned 0x630000 [0058.681] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0058.681] GetProcessHeap () returned 0x630000 [0058.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0058.681] GetProcessHeap () returned 0x630000 [0058.681] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0058.681] GetProcessHeap () returned 0x630000 [0058.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0058.681] GetProcessHeap () returned 0x630000 [0058.681] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.681] GetProcessHeap () returned 0x630000 [0058.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.681] GetProcessHeap () returned 0x630000 [0058.681] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.681] GetProcessHeap () returned 0x630000 [0058.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.681] GetProcessHeap () returned 0x630000 [0058.681] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0058.681] GetProcessHeap () returned 0x630000 [0058.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0058.681] GetProcessHeap () returned 0x630000 [0058.681] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0058.681] GetProcessHeap () returned 0x630000 [0058.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0058.681] GetProcessHeap () returned 0x630000 [0058.681] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.681] GetProcessHeap () returned 0x630000 [0058.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.681] GetProcessHeap () returned 0x630000 [0058.681] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0058.681] GetProcessHeap () returned 0x630000 [0058.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0058.681] GetProcessHeap () returned 0x630000 [0058.681] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0058.682] GetProcessHeap () returned 0x630000 [0058.682] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0058.682] GetProcessHeap () returned 0x630000 [0058.682] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.682] GetProcessHeap () returned 0x630000 [0058.682] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.682] GetProcessHeap () returned 0x630000 [0058.682] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0058.682] GetProcessHeap () returned 0x630000 [0058.682] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0058.682] GetProcessHeap () returned 0x630000 [0058.682] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0058.682] GetProcessHeap () returned 0x630000 [0058.682] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0058.682] GetProcessHeap () returned 0x630000 [0058.682] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0058.682] GetProcessHeap () returned 0x630000 [0058.682] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0058.682] GetProcessHeap () returned 0x630000 [0058.682] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.682] GetProcessHeap () returned 0x630000 [0058.682] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.682] GetProcessHeap () returned 0x630000 [0058.682] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.682] GetProcessHeap () returned 0x630000 [0058.682] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.682] GetProcessHeap () returned 0x630000 [0058.682] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0058.682] GetProcessHeap () returned 0x630000 [0058.682] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0058.682] GetProcessHeap () returned 0x630000 [0058.682] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0058.682] GetProcessHeap () returned 0x630000 [0058.682] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0058.682] GetProcessHeap () returned 0x630000 [0058.683] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.683] GetProcessHeap () returned 0x630000 [0058.683] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.683] GetProcessHeap () returned 0x630000 [0058.683] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0058.683] GetProcessHeap () returned 0x630000 [0058.683] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0058.683] GetProcessHeap () returned 0x630000 [0058.683] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0058.683] GetProcessHeap () returned 0x630000 [0058.683] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0058.683] GetProcessHeap () returned 0x630000 [0058.683] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0058.683] GetProcessHeap () returned 0x630000 [0058.683] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0058.683] GetProcessHeap () returned 0x630000 [0058.683] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0058.683] GetProcessHeap () returned 0x630000 [0058.683] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0058.683] GetProcessHeap () returned 0x630000 [0058.683] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.683] GetProcessHeap () returned 0x630000 [0058.683] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.683] GetProcessHeap () returned 0x630000 [0058.683] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0058.683] GetProcessHeap () returned 0x630000 [0058.683] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0058.683] GetProcessHeap () returned 0x630000 [0058.683] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0058.683] GetProcessHeap () returned 0x630000 [0058.683] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0058.683] GetProcessHeap () returned 0x630000 [0058.683] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.683] GetProcessHeap () returned 0x630000 [0058.683] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.683] GetProcessHeap () returned 0x630000 [0058.683] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0058.684] GetProcessHeap () returned 0x630000 [0058.684] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0058.684] GetProcessHeap () returned 0x630000 [0058.684] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0058.684] GetProcessHeap () returned 0x630000 [0058.684] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0058.684] GetProcessHeap () returned 0x630000 [0058.684] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.684] GetProcessHeap () returned 0x630000 [0058.684] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.684] GetProcessHeap () returned 0x630000 [0058.684] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.684] GetProcessHeap () returned 0x630000 [0058.684] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.684] GetProcessHeap () returned 0x630000 [0058.684] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0058.684] GetProcessHeap () returned 0x630000 [0058.684] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0058.684] GetProcessHeap () returned 0x630000 [0058.684] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.684] GetProcessHeap () returned 0x630000 [0058.684] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.684] GetProcessHeap () returned 0x630000 [0058.684] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0058.684] GetProcessHeap () returned 0x630000 [0058.684] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0058.684] GetProcessHeap () returned 0x630000 [0058.684] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.684] GetProcessHeap () returned 0x630000 [0058.684] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.684] GetProcessHeap () returned 0x630000 [0058.684] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0058.684] GetProcessHeap () returned 0x630000 [0058.684] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0058.684] GetProcessHeap () returned 0x630000 [0058.684] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.684] GetProcessHeap () returned 0x630000 [0058.685] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.685] GetProcessHeap () returned 0x630000 [0058.685] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0058.685] GetProcessHeap () returned 0x630000 [0058.685] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0058.685] GetProcessHeap () returned 0x630000 [0058.685] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0058.685] GetProcessHeap () returned 0x630000 [0058.685] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0058.685] GetProcessHeap () returned 0x630000 [0058.685] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0058.685] GetProcessHeap () returned 0x630000 [0058.685] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0058.685] GetProcessHeap () returned 0x630000 [0058.685] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0058.685] GetProcessHeap () returned 0x630000 [0058.685] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0058.685] GetProcessHeap () returned 0x630000 [0058.685] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0058.685] GetProcessHeap () returned 0x630000 [0058.685] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ec40 | out: hHeap=0x630000) returned 1 [0058.685] GetProcessHeap () returned 0x630000 [0058.685] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0058.685] GetProcessHeap () returned 0x630000 [0058.685] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0058.685] GetProcessHeap () returned 0x630000 [0058.685] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0058.685] GetProcessHeap () returned 0x630000 [0058.685] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0058.685] GetProcessHeap () returned 0x630000 [0058.685] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0058.685] WriteFile (in: hFile=0x230, lpBuffer=0x6612d8*, nNumberOfBytesToWrite=0x38c, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6612d8*, lpNumberOfBytesWritten=0x243d864*=0x38c, lpOverlapped=0x0) returned 1 [0058.687] GetProcessHeap () returned 0x630000 [0058.687] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6612d8, Size=0x30) returned 0x6612d8 [0058.687] GetProcessHeap () returned 0x630000 [0058.687] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0058.687] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.687] GetProcessHeap () returned 0x630000 [0058.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x119e0) returned 0x661310 [0058.688] ReadFile (in: hFile=0x230, lpBuffer=0x661310, nNumberOfBytesToRead=0x119e0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661310*, lpNumberOfBytesRead=0x243d7e8*=0x119e0, lpOverlapped=0x0) returned 1 [0058.689] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.689] WriteFile (in: hFile=0x230, lpBuffer=0x661310*, nNumberOfBytesToWrite=0x119e0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661310*, lpNumberOfBytesWritten=0x243d7e4*=0x119e0, lpOverlapped=0x0) returned 1 [0058.690] GetProcessHeap () returned 0x630000 [0058.690] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661310 | out: hHeap=0x630000) returned 1 [0058.690] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.690] WriteFile (in: hFile=0x230, lpBuffer=0x6612d8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6612d8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0058.691] CloseHandle (hObject=0x230) returned 1 [0058.694] GetProcessHeap () returned 0x630000 [0058.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0058.694] GetProcessHeap () returned 0x630000 [0058.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655850 | out: hHeap=0x630000) returned 1 [0058.694] GetProcessHeap () returned 0x630000 [0058.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0058.694] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\WEStXX.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\WEStXX.mkv") returned="C:\\Users\\FD1HVy\\Videos\\WEStXX.mkv" [0058.694] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\WEStXX.mkv", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\WEStXX.mkv.happythreechoose") returned="C:\\Users\\FD1HVy\\Videos\\WEStXX.mkv.happythreechoose" [0058.694] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\WEStXX.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\westxx.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\WEStXX.mkv.happythreechoose" (normalized: "c:\\users\\fd1hvy\\videos\\westxx.mkv.happythreechoose"), dwFlags=0x1) returned 1 [0058.694] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\WEStXX.mkv" | out: pszPath="C:\\Users\\FD1HVy\\Videos") returned 1 [0058.694] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\") returned="" [0058.694] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Videos\\Decryption INFO.html" [0058.694] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\videos\\decryption info.html")) returned 0x20 [0058.695] GetProcessHeap () returned 0x630000 [0058.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0058.695] FindNextFileW (in: hFindFile=0x65b710, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468740a0, ftCreationTime.dwHighDateTime=0x1d5d432, ftLastAccessTime.dwLowDateTime=0xc51d7b90, ftLastAccessTime.dwHighDateTime=0x1d5c9f2, ftLastWriteTime.dwLowDateTime=0xc51d7b90, ftLastWriteTime.dwHighDateTime=0x1d5c9f2, nFileSizeHigh=0x0, nFileSizeLow=0xc672, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ygoN1.flv", cAlternateFileName="")) returned 1 [0058.695] lstrcmpiW (lpString1="ygoN1.flv", lpString2=".") returned 1 [0058.695] lstrcmpiW (lpString1="ygoN1.flv", lpString2="..") returned 1 [0058.695] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="ygoN1.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ygoN1.flv") returned="C:\\Users\\FD1HVy\\Videos\\ygoN1.flv" [0058.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ygoN1.flv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0058.695] GetProcessHeap () returned 0x630000 [0058.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x64c9f0 [0058.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ygoN1.flv", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ygoN1.flv", lpUsedDefaultChar=0x0) returned 10 [0058.695] lstrlenA (lpString="ygoN1.flv") returned 9 [0058.695] lstrlenA (lpString=".happythreechoose") returned 17 [0058.695] lstrcmpiW (lpString1="ygoN1.flv", lpString2="Decryption INFO.html") returned 1 [0058.695] lstrcmpiW (lpString1="ygoN1.flv", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0058.695] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0058.695] lstrcmpiW (lpString1="ygoN1.flv", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0058.695] GetProcessHeap () returned 0x630000 [0058.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0058.695] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\ygoN1.flv" (normalized: "c:\\users\\fd1hvy\\videos\\ygon1.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0058.695] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=50802) returned 1 [0058.695] GetProcessHeap () returned 0x630000 [0058.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655490 [0058.695] GetProcessHeap () returned 0x630000 [0058.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0058.695] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\ygoN1.flv") returned 32 [0058.695] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.695] GetProcessHeap () returned 0x630000 [0058.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0058.696] GetProcessHeap () returned 0x630000 [0058.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38e) returned 0x661310 [0058.696] lstrlenA (lpString="rsa_encrypt") returned 11 [0058.696] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0058.696] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0058.696] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0058.696] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0058.696] GetProcessHeap () returned 0x630000 [0058.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0058.696] lstrlenA (lpString="010001") returned 6 [0058.696] GetProcessHeap () returned 0x630000 [0058.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a1b8 [0058.696] GetProcessHeap () returned 0x630000 [0058.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.696] GetProcessHeap () returned 0x630000 [0058.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65df50 [0058.697] GetProcessHeap () returned 0x630000 [0058.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.697] GetProcessHeap () returned 0x630000 [0058.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e970 [0058.697] GetProcessHeap () returned 0x630000 [0058.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656b80 [0058.697] GetProcessHeap () returned 0x630000 [0058.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a218 [0058.697] GetProcessHeap () returned 0x630000 [0058.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0058.697] GetProcessHeap () returned 0x630000 [0058.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.697] GetProcessHeap () returned 0x630000 [0058.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0058.697] GetProcessHeap () returned 0x630000 [0058.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.697] GetProcessHeap () returned 0x630000 [0058.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657670 [0058.697] GetProcessHeap () returned 0x630000 [0058.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0058.697] GetProcessHeap () returned 0x630000 [0058.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0058.697] GetProcessHeap () returned 0x630000 [0058.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ec40 [0058.697] GetProcessHeap () returned 0x630000 [0058.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.697] GetProcessHeap () returned 0x630000 [0058.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0058.697] GetProcessHeap () returned 0x630000 [0058.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ec40 | out: hHeap=0x630000) returned 1 [0058.697] GetProcessHeap () returned 0x630000 [0058.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0058.697] GetProcessHeap () returned 0x630000 [0058.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65a870 [0058.697] GetProcessHeap () returned 0x630000 [0058.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0058.697] GetProcessHeap () returned 0x630000 [0058.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0058.698] GetProcessHeap () returned 0x630000 [0058.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0058.698] GetProcessHeap () returned 0x630000 [0058.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0058.698] GetProcessHeap () returned 0x630000 [0058.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ea90 [0058.698] GetProcessHeap () returned 0x630000 [0058.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a870 | out: hHeap=0x630000) returned 1 [0058.698] GetProcessHeap () returned 0x630000 [0058.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0058.698] GetProcessHeap () returned 0x630000 [0058.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea90 | out: hHeap=0x630000) returned 1 [0058.698] GetProcessHeap () returned 0x630000 [0058.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0058.698] GetProcessHeap () returned 0x630000 [0058.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0058.698] GetProcessHeap () returned 0x630000 [0058.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0058.698] GetProcessHeap () returned 0x630000 [0058.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0058.698] GetProcessHeap () returned 0x630000 [0058.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0e8 [0058.698] GetProcessHeap () returned 0x630000 [0058.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0e8 | out: hHeap=0x630000) returned 1 [0058.698] GetProcessHeap () returned 0x630000 [0058.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0058.698] GetProcessHeap () returned 0x630000 [0058.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0058.698] GetProcessHeap () returned 0x630000 [0058.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.698] GetProcessHeap () returned 0x630000 [0058.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.698] GetProcessHeap () returned 0x630000 [0058.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0058.698] GetProcessHeap () returned 0x630000 [0058.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0058.698] GetProcessHeap () returned 0x630000 [0058.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0058.699] GetProcessHeap () returned 0x630000 [0058.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0058.699] GetProcessHeap () returned 0x630000 [0058.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0058.699] GetProcessHeap () returned 0x630000 [0058.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0058.699] GetProcessHeap () returned 0x630000 [0058.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.699] GetProcessHeap () returned 0x630000 [0058.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.699] GetProcessHeap () returned 0x630000 [0058.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0058.699] GetProcessHeap () returned 0x630000 [0058.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0058.699] GetProcessHeap () returned 0x630000 [0058.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0058.699] GetProcessHeap () returned 0x630000 [0058.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0058.699] GetProcessHeap () returned 0x630000 [0058.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0058.699] GetProcessHeap () returned 0x630000 [0058.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0058.699] GetProcessHeap () returned 0x630000 [0058.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0058.699] GetProcessHeap () returned 0x630000 [0058.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0058.699] GetProcessHeap () returned 0x630000 [0058.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0058.699] GetProcessHeap () returned 0x630000 [0058.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0058.699] GetProcessHeap () returned 0x630000 [0058.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.699] GetProcessHeap () returned 0x630000 [0058.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.699] GetProcessHeap () returned 0x630000 [0058.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0058.699] GetProcessHeap () returned 0x630000 [0058.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0058.700] GetProcessHeap () returned 0x630000 [0058.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0058.700] GetProcessHeap () returned 0x630000 [0058.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0058.700] GetProcessHeap () returned 0x630000 [0058.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0058.700] GetProcessHeap () returned 0x630000 [0058.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0058.700] GetProcessHeap () returned 0x630000 [0058.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0058.700] GetProcessHeap () returned 0x630000 [0058.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0058.700] GetProcessHeap () returned 0x630000 [0058.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0058.700] GetProcessHeap () returned 0x630000 [0058.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0058.700] GetProcessHeap () returned 0x630000 [0058.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0058.700] GetProcessHeap () returned 0x630000 [0058.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0058.700] GetProcessHeap () returned 0x630000 [0058.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.700] GetProcessHeap () returned 0x630000 [0058.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.700] GetProcessHeap () returned 0x630000 [0058.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0058.700] GetProcessHeap () returned 0x630000 [0058.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0058.700] GetProcessHeap () returned 0x630000 [0058.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0058.700] GetProcessHeap () returned 0x630000 [0058.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0058.700] GetProcessHeap () returned 0x630000 [0058.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0058.700] GetProcessHeap () returned 0x630000 [0058.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0058.701] GetProcessHeap () returned 0x630000 [0058.701] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0058.701] GetProcessHeap () returned 0x630000 [0058.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0058.701] GetProcessHeap () returned 0x630000 [0058.701] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0058.701] GetProcessHeap () returned 0x630000 [0058.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0058.701] GetProcessHeap () returned 0x630000 [0058.701] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0058.701] GetProcessHeap () returned 0x630000 [0058.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0058.701] GetProcessHeap () returned 0x630000 [0058.701] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0058.701] GetProcessHeap () returned 0x630000 [0058.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0058.701] GetProcessHeap () returned 0x630000 [0058.701] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0058.701] GetProcessHeap () returned 0x630000 [0058.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0058.701] GetProcessHeap () returned 0x630000 [0058.701] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0058.701] GetProcessHeap () returned 0x630000 [0058.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0058.701] GetProcessHeap () returned 0x630000 [0058.701] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0058.701] GetProcessHeap () returned 0x630000 [0058.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0058.701] GetProcessHeap () returned 0x630000 [0058.701] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.701] GetProcessHeap () returned 0x630000 [0058.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.701] GetProcessHeap () returned 0x630000 [0058.701] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.701] GetProcessHeap () returned 0x630000 [0058.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.701] GetProcessHeap () returned 0x630000 [0058.702] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0058.702] GetProcessHeap () returned 0x630000 [0058.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0058.702] GetProcessHeap () returned 0x630000 [0058.702] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0058.702] GetProcessHeap () returned 0x630000 [0058.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0058.702] GetProcessHeap () returned 0x630000 [0058.702] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0058.702] GetProcessHeap () returned 0x630000 [0058.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0058.702] GetProcessHeap () returned 0x630000 [0058.702] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0058.702] GetProcessHeap () returned 0x630000 [0058.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0058.702] GetProcessHeap () returned 0x630000 [0058.702] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.702] GetProcessHeap () returned 0x630000 [0058.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.702] GetProcessHeap () returned 0x630000 [0058.702] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.702] GetProcessHeap () returned 0x630000 [0058.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.702] GetProcessHeap () returned 0x630000 [0058.702] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0058.702] GetProcessHeap () returned 0x630000 [0058.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0058.702] GetProcessHeap () returned 0x630000 [0058.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0058.702] GetProcessHeap () returned 0x630000 [0058.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0058.702] GetProcessHeap () returned 0x630000 [0058.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0058.702] GetProcessHeap () returned 0x630000 [0058.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0058.702] GetProcessHeap () returned 0x630000 [0058.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0058.703] GetProcessHeap () returned 0x630000 [0058.703] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0058.703] GetProcessHeap () returned 0x630000 [0058.703] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0058.703] GetProcessHeap () returned 0x630000 [0058.703] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0058.703] GetProcessHeap () returned 0x630000 [0058.703] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0058.703] GetProcessHeap () returned 0x630000 [0058.703] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.703] GetProcessHeap () returned 0x630000 [0058.703] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0058.703] WriteFile (in: hFile=0x230, lpBuffer=0x661310*, nNumberOfBytesToWrite=0x38e, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661310*, lpNumberOfBytesWritten=0x243d864*=0x38e, lpOverlapped=0x0) returned 1 [0058.705] GetProcessHeap () returned 0x630000 [0058.705] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x661310, Size=0x30) returned 0x661310 [0058.705] GetProcessHeap () returned 0x630000 [0058.705] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0058.705] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.705] GetProcessHeap () returned 0x630000 [0058.705] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc680) returned 0x661348 [0058.705] ReadFile (in: hFile=0x230, lpBuffer=0x661348, nNumberOfBytesToRead=0xc680, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661348*, lpNumberOfBytesRead=0x243d7e8*=0xc680, lpOverlapped=0x0) returned 1 [0058.705] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.705] WriteFile (in: hFile=0x230, lpBuffer=0x661348*, nNumberOfBytesToWrite=0xc680, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661348*, lpNumberOfBytesWritten=0x243d7e4*=0xc680, lpOverlapped=0x0) returned 1 [0058.707] GetProcessHeap () returned 0x630000 [0058.707] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661348 | out: hHeap=0x630000) returned 1 [0058.708] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.708] WriteFile (in: hFile=0x230, lpBuffer=0x661310*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661310*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0058.709] CloseHandle (hObject=0x230) returned 1 [0058.711] GetProcessHeap () returned 0x630000 [0058.711] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0058.711] GetProcessHeap () returned 0x630000 [0058.711] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655490 | out: hHeap=0x630000) returned 1 [0058.711] GetProcessHeap () returned 0x630000 [0058.711] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0058.711] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\ygoN1.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ygoN1.flv") returned="C:\\Users\\FD1HVy\\Videos\\ygoN1.flv" [0058.711] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\ygoN1.flv", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ygoN1.flv.happythreechoose") returned="C:\\Users\\FD1HVy\\Videos\\ygoN1.flv.happythreechoose" [0058.711] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\ygoN1.flv" (normalized: "c:\\users\\fd1hvy\\videos\\ygon1.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\ygoN1.flv.happythreechoose" (normalized: "c:\\users\\fd1hvy\\videos\\ygon1.flv.happythreechoose"), dwFlags=0x1) returned 1 [0058.712] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\ygoN1.flv" | out: pszPath="C:\\Users\\FD1HVy\\Videos") returned 1 [0058.712] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\") returned="" [0058.712] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Videos\\Decryption INFO.html" [0058.712] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\videos\\decryption info.html")) returned 0x20 [0058.712] GetProcessHeap () returned 0x630000 [0058.712] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0058.712] FindNextFileW (in: hFindFile=0x65b710, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c760870, ftCreationTime.dwHighDateTime=0x1d5c7a4, ftLastAccessTime.dwLowDateTime=0x91258c20, ftLastAccessTime.dwHighDateTime=0x1d5d23e, ftLastWriteTime.dwLowDateTime=0x91258c20, ftLastWriteTime.dwHighDateTime=0x1d5d23e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZAxZ0rXYnVPgZV", cAlternateFileName="ZAXZ0R~1")) returned 1 [0058.712] lstrcmpiW (lpString1="ZAxZ0rXYnVPgZV", lpString2=".") returned 1 [0058.712] lstrcmpiW (lpString1="ZAxZ0rXYnVPgZV", lpString2="..") returned 1 [0058.712] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="ZAxZ0rXYnVPgZV" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV") returned="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV" [0058.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ZAxZ0rXYnVPgZV", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0058.712] GetProcessHeap () returned 0x630000 [0058.712] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0058.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ZAxZ0rXYnVPgZV", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ZAxZ0rXYnVPgZV", lpUsedDefaultChar=0x0) returned 15 [0058.712] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ZAxZ0rXYnVPgZV", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 3 [0058.713] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ZAxZ0rXYnVPgZV", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0058.713] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ZAxZ0rXYnVPgZV", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0058.713] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ZAxZ0rXYnVPgZV", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 3 [0058.713] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ZAxZ0rXYnVPgZV", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 3 [0058.713] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ZAxZ0rXYnVPgZV", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0058.713] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ZAxZ0rXYnVPgZV", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0058.713] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ZAxZ0rXYnVPgZV", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 3 [0058.713] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ZAxZ0rXYnVPgZV", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 3 [0058.713] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ZAxZ0rXYnVPgZV", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 3 [0058.713] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ZAxZ0rXYnVPgZV", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 3 [0058.713] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ZAxZ0rXYnVPgZV", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 3 [0058.713] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ZAxZ0rXYnVPgZV", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 3 [0058.713] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ZAxZ0rXYnVPgZV", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 3 [0058.713] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ZAxZ0rXYnVPgZV", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 3 [0058.713] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ZAxZ0rXYnVPgZV", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 3 [0058.713] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ZAxZ0rXYnVPgZV", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 3 [0058.713] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ZAxZ0rXYnVPgZV", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 3 [0058.713] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ZAxZ0rXYnVPgZV", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0058.713] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ZAxZ0rXYnVPgZV", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0058.713] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ZAxZ0rXYnVPgZV", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0058.713] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ZAxZ0rXYnVPgZV", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0058.713] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ZAxZ0rXYnVPgZV", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0058.713] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ZAxZ0rXYnVPgZV", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0058.713] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ZAxZ0rXYnVPgZV", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 3 [0058.713] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ZAxZ0rXYnVPgZV", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 3 [0058.713] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ZAxZ0rXYnVPgZV", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0058.713] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ZAxZ0rXYnVPgZV", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0058.713] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ZAxZ0rXYnVPgZV", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 3 [0058.713] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ZAxZ0rXYnVPgZV", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 3 [0058.713] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ZAxZ0rXYnVPgZV", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 3 [0058.713] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ZAxZ0rXYnVPgZV", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0058.713] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ZAxZ0rXYnVPgZV", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0058.713] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ZAxZ0rXYnVPgZV", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0058.713] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ZAxZ0rXYnVPgZV", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0058.714] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ZAxZ0rXYnVPgZV", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0058.714] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ZAxZ0rXYnVPgZV", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0058.714] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ZAxZ0rXYnVPgZV", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0058.714] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ZAxZ0rXYnVPgZV", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0058.714] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ZAxZ0rXYnVPgZV", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 3 [0058.714] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ZAxZ0rXYnVPgZV", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0058.714] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ZAxZ0rXYnVPgZV", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 3 [0058.714] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ZAxZ0rXYnVPgZV", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0058.714] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\") returned="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\" [0058.714] GetProcessHeap () returned 0x630000 [0058.714] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a098 [0058.714] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\") returned 38 [0058.714] GetProcessHeap () returned 0x630000 [0058.714] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4e) returned 0x65f068 [0058.714] lstrcpyW (in: lpString1=0x65f068, lpString2="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\") returned="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\" [0058.714] GetProcessHeap () returned 0x630000 [0058.714] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0058.714] FindNextFileW (in: hFindFile=0x65b710, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c760870, ftCreationTime.dwHighDateTime=0x1d5c7a4, ftLastAccessTime.dwLowDateTime=0x91258c20, ftLastAccessTime.dwHighDateTime=0x1d5d23e, ftLastWriteTime.dwLowDateTime=0x91258c20, ftLastWriteTime.dwHighDateTime=0x1d5d23e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZAxZ0rXYnVPgZV", cAlternateFileName="ZAXZ0R~1")) returned 0 [0058.714] FindClose (in: hFindFile=0x65b710 | out: hFindFile=0x65b710) returned 1 [0058.714] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\") returned="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\" [0058.714] GetProcessHeap () returned 0x630000 [0058.714] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65f068 | out: hHeap=0x630000) returned 1 [0058.714] GetProcessHeap () returned 0x630000 [0058.714] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.714] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\") returned 38 [0058.714] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\*") returned="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\*" [0058.714] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c760870, ftCreationTime.dwHighDateTime=0x1d5c7a4, ftLastAccessTime.dwLowDateTime=0x91258c20, ftLastAccessTime.dwHighDateTime=0x1d5d23e, ftLastWriteTime.dwLowDateTime=0x91258c20, ftLastWriteTime.dwHighDateTime=0x1d5d23e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65bc10 [0058.715] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0058.715] FindNextFileW (in: hFindFile=0x65bc10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c760870, ftCreationTime.dwHighDateTime=0x1d5c7a4, ftLastAccessTime.dwLowDateTime=0x91258c20, ftLastAccessTime.dwHighDateTime=0x1d5d23e, ftLastWriteTime.dwLowDateTime=0x91258c20, ftLastWriteTime.dwHighDateTime=0x1d5d23e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.715] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0058.715] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0058.715] FindNextFileW (in: hFindFile=0x65bc10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bdf5e00, ftCreationTime.dwHighDateTime=0x1d5d4ad, ftLastAccessTime.dwLowDateTime=0x2f9d8b0, ftLastAccessTime.dwHighDateTime=0x1d5cef7, ftLastWriteTime.dwLowDateTime=0x2f9d8b0, ftLastWriteTime.dwHighDateTime=0x1d5cef7, nFileSizeHigh=0x0, nFileSizeLow=0x744b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1sMkujj.mkv", cAlternateFileName="")) returned 1 [0058.715] lstrcmpiW (lpString1="1sMkujj.mkv", lpString2=".") returned 1 [0058.715] lstrcmpiW (lpString1="1sMkujj.mkv", lpString2="..") returned 1 [0058.715] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\", lpString2="1sMkujj.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\1sMkujj.mkv") returned="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\1sMkujj.mkv" [0058.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1sMkujj.mkv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0058.715] GetProcessHeap () returned 0x630000 [0058.715] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0058.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1sMkujj.mkv", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1sMkujj.mkv", lpUsedDefaultChar=0x0) returned 12 [0058.715] lstrlenA (lpString="1sMkujj.mkv") returned 11 [0058.715] lstrlenA (lpString=".happythreechoose") returned 17 [0058.715] lstrcmpiW (lpString1="1sMkujj.mkv", lpString2="Decryption INFO.html") returned -1 [0058.715] lstrcmpiW (lpString1="1sMkujj.mkv", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned -1 [0058.715] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0058.715] lstrcmpiW (lpString1="1sMkujj.mkv", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0058.715] GetProcessHeap () returned 0x630000 [0058.715] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0058.715] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\1sMkujj.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\zaxz0rxynvpgzv\\1smkujj.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0058.715] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=29771) returned 1 [0058.715] GetProcessHeap () returned 0x630000 [0058.715] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655940 [0058.715] GetProcessHeap () returned 0x630000 [0058.715] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0058.715] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\1sMkujj.mkv") returned 49 [0058.715] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.716] GetProcessHeap () returned 0x630000 [0058.716] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0058.716] GetProcessHeap () returned 0x630000 [0058.716] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x661348 [0058.717] lstrlenA (lpString="rsa_encrypt") returned 11 [0058.717] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0058.717] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0058.717] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0058.717] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0058.717] GetProcessHeap () returned 0x630000 [0058.717] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0058.717] lstrlenA (lpString="010001") returned 6 [0058.717] GetProcessHeap () returned 0x630000 [0058.717] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a1e8 [0058.718] GetProcessHeap () returned 0x630000 [0058.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.718] GetProcessHeap () returned 0x630000 [0058.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0058.718] GetProcessHeap () returned 0x630000 [0058.718] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.718] GetProcessHeap () returned 0x630000 [0058.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e100 [0058.718] GetProcessHeap () returned 0x630000 [0058.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657328 [0058.718] GetProcessHeap () returned 0x630000 [0058.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a0d8 [0058.718] GetProcessHeap () returned 0x630000 [0058.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0058.718] GetProcessHeap () returned 0x630000 [0058.718] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0058.718] GetProcessHeap () returned 0x630000 [0058.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0058.718] GetProcessHeap () returned 0x630000 [0058.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.718] GetProcessHeap () returned 0x630000 [0058.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656a68 [0058.718] GetProcessHeap () returned 0x630000 [0058.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0058.718] GetProcessHeap () returned 0x630000 [0058.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0058.718] GetProcessHeap () returned 0x630000 [0058.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65eb20 [0058.718] GetProcessHeap () returned 0x630000 [0058.718] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.718] GetProcessHeap () returned 0x630000 [0058.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0058.718] GetProcessHeap () returned 0x630000 [0058.718] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0058.718] GetProcessHeap () returned 0x630000 [0058.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0058.718] GetProcessHeap () returned 0x630000 [0058.719] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65a810 [0058.719] GetProcessHeap () returned 0x630000 [0058.719] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0058.719] GetProcessHeap () returned 0x630000 [0058.719] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0058.719] GetProcessHeap () returned 0x630000 [0058.719] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0058.719] GetProcessHeap () returned 0x630000 [0058.719] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0058.719] GetProcessHeap () returned 0x630000 [0058.719] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e340 [0058.719] GetProcessHeap () returned 0x630000 [0058.719] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a810 | out: hHeap=0x630000) returned 1 [0058.719] GetProcessHeap () returned 0x630000 [0058.719] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0058.719] GetProcessHeap () returned 0x630000 [0058.719] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0058.719] GetProcessHeap () returned 0x630000 [0058.719] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0058.719] GetProcessHeap () returned 0x630000 [0058.719] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0058.719] GetProcessHeap () returned 0x630000 [0058.719] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.719] GetProcessHeap () returned 0x630000 [0058.719] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.719] GetProcessHeap () returned 0x630000 [0058.719] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0058.719] GetProcessHeap () returned 0x630000 [0058.719] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0058.719] GetProcessHeap () returned 0x630000 [0058.720] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.720] GetProcessHeap () returned 0x630000 [0058.720] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.720] GetProcessHeap () returned 0x630000 [0058.720] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0058.720] GetProcessHeap () returned 0x630000 [0058.720] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0058.720] GetProcessHeap () returned 0x630000 [0058.720] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0058.720] GetProcessHeap () returned 0x630000 [0058.720] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0058.720] GetProcessHeap () returned 0x630000 [0058.720] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0058.720] GetProcessHeap () returned 0x630000 [0058.720] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0058.720] GetProcessHeap () returned 0x630000 [0058.720] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0058.720] GetProcessHeap () returned 0x630000 [0058.720] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0058.720] GetProcessHeap () returned 0x630000 [0058.720] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0058.720] GetProcessHeap () returned 0x630000 [0058.720] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0058.720] GetProcessHeap () returned 0x630000 [0058.720] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0058.720] GetProcessHeap () returned 0x630000 [0058.720] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0058.720] GetProcessHeap () returned 0x630000 [0058.720] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.720] GetProcessHeap () returned 0x630000 [0058.720] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.720] GetProcessHeap () returned 0x630000 [0058.720] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0058.720] GetProcessHeap () returned 0x630000 [0058.720] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0058.720] GetProcessHeap () returned 0x630000 [0058.720] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0058.721] GetProcessHeap () returned 0x630000 [0058.721] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0058.721] GetProcessHeap () returned 0x630000 [0058.721] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0058.721] GetProcessHeap () returned 0x630000 [0058.721] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0058.721] GetProcessHeap () returned 0x630000 [0058.721] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0058.721] GetProcessHeap () returned 0x630000 [0058.721] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0058.721] GetProcessHeap () returned 0x630000 [0058.721] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0058.721] GetProcessHeap () returned 0x630000 [0058.721] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0058.721] GetProcessHeap () returned 0x630000 [0058.721] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.721] GetProcessHeap () returned 0x630000 [0058.721] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.721] GetProcessHeap () returned 0x630000 [0058.721] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0e8 [0058.721] GetProcessHeap () returned 0x630000 [0058.721] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0e8 | out: hHeap=0x630000) returned 1 [0058.721] GetProcessHeap () returned 0x630000 [0058.721] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0058.721] GetProcessHeap () returned 0x630000 [0058.721] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0058.721] GetProcessHeap () returned 0x630000 [0058.721] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.721] GetProcessHeap () returned 0x630000 [0058.721] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.721] GetProcessHeap () returned 0x630000 [0058.721] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0058.721] GetProcessHeap () returned 0x630000 [0058.721] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0058.721] GetProcessHeap () returned 0x630000 [0058.721] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.721] GetProcessHeap () returned 0x630000 [0058.721] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.722] GetProcessHeap () returned 0x630000 [0058.722] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0058.722] GetProcessHeap () returned 0x630000 [0058.722] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0058.722] GetProcessHeap () returned 0x630000 [0058.722] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.722] GetProcessHeap () returned 0x630000 [0058.722] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.722] GetProcessHeap () returned 0x630000 [0058.722] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.722] GetProcessHeap () returned 0x630000 [0058.722] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.722] GetProcessHeap () returned 0x630000 [0058.722] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0058.722] GetProcessHeap () returned 0x630000 [0058.722] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0058.722] GetProcessHeap () returned 0x630000 [0058.722] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.722] GetProcessHeap () returned 0x630000 [0058.722] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.722] GetProcessHeap () returned 0x630000 [0058.722] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0058.722] GetProcessHeap () returned 0x630000 [0058.722] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0058.722] GetProcessHeap () returned 0x630000 [0058.722] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.722] GetProcessHeap () returned 0x630000 [0058.722] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.722] GetProcessHeap () returned 0x630000 [0058.722] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0058.722] GetProcessHeap () returned 0x630000 [0058.722] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0058.722] GetProcessHeap () returned 0x630000 [0058.722] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.722] GetProcessHeap () returned 0x630000 [0058.722] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.722] GetProcessHeap () returned 0x630000 [0058.723] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.723] GetProcessHeap () returned 0x630000 [0058.723] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.723] GetProcessHeap () returned 0x630000 [0058.723] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.723] GetProcessHeap () returned 0x630000 [0058.723] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.723] GetProcessHeap () returned 0x630000 [0058.723] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0058.723] GetProcessHeap () returned 0x630000 [0058.723] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0058.723] GetProcessHeap () returned 0x630000 [0058.723] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0058.723] GetProcessHeap () returned 0x630000 [0058.723] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0058.723] GetProcessHeap () returned 0x630000 [0058.723] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.723] GetProcessHeap () returned 0x630000 [0058.723] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.723] GetProcessHeap () returned 0x630000 [0058.723] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0058.723] GetProcessHeap () returned 0x630000 [0058.723] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0058.723] GetProcessHeap () returned 0x630000 [0058.723] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0058.723] GetProcessHeap () returned 0x630000 [0058.723] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0058.723] GetProcessHeap () returned 0x630000 [0058.723] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0058.723] GetProcessHeap () returned 0x630000 [0058.723] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0058.723] GetProcessHeap () returned 0x630000 [0058.723] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0058.723] GetProcessHeap () returned 0x630000 [0058.723] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0058.723] GetProcessHeap () returned 0x630000 [0058.723] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0058.723] GetProcessHeap () returned 0x630000 [0058.724] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0058.724] GetProcessHeap () returned 0x630000 [0058.724] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0058.724] GetProcessHeap () returned 0x630000 [0058.724] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0058.724] GetProcessHeap () returned 0x630000 [0058.724] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0058.724] GetProcessHeap () returned 0x630000 [0058.724] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0058.724] GetProcessHeap () returned 0x630000 [0058.724] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0058.724] GetProcessHeap () returned 0x630000 [0058.724] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0058.724] GetProcessHeap () returned 0x630000 [0058.724] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0058.724] GetProcessHeap () returned 0x630000 [0058.724] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0058.724] GetProcessHeap () returned 0x630000 [0058.724] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0058.724] GetProcessHeap () returned 0x630000 [0058.724] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0058.724] GetProcessHeap () returned 0x630000 [0058.724] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0058.724] WriteFile (in: hFile=0x230, lpBuffer=0x661348*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661348*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0058.729] GetProcessHeap () returned 0x630000 [0058.729] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x661348, Size=0x30) returned 0x661348 [0058.729] GetProcessHeap () returned 0x630000 [0058.729] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0058.729] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.729] GetProcessHeap () returned 0x630000 [0058.729] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x744b) returned 0x661380 [0058.729] ReadFile (in: hFile=0x230, lpBuffer=0x661380, nNumberOfBytesToRead=0x744b, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661380*, lpNumberOfBytesRead=0x243d7e8*=0x744b, lpOverlapped=0x0) returned 1 [0058.730] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.730] WriteFile (in: hFile=0x230, lpBuffer=0x661380*, nNumberOfBytesToWrite=0x744b, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661380*, lpNumberOfBytesWritten=0x243d7e4*=0x744b, lpOverlapped=0x0) returned 1 [0058.731] GetProcessHeap () returned 0x630000 [0058.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661380 | out: hHeap=0x630000) returned 1 [0058.732] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.732] WriteFile (in: hFile=0x230, lpBuffer=0x661348*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661348*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0058.733] CloseHandle (hObject=0x230) returned 1 [0058.735] GetProcessHeap () returned 0x630000 [0058.735] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0058.735] GetProcessHeap () returned 0x630000 [0058.735] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655940 | out: hHeap=0x630000) returned 1 [0058.735] GetProcessHeap () returned 0x630000 [0058.735] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0058.735] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\1sMkujj.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\1sMkujj.mkv") returned="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\1sMkujj.mkv" [0058.735] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\1sMkujj.mkv", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\1sMkujj.mkv.happythreechoose") returned="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\1sMkujj.mkv.happythreechoose" [0058.735] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\1sMkujj.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\zaxz0rxynvpgzv\\1smkujj.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\1sMkujj.mkv.happythreechoose" (normalized: "c:\\users\\fd1hvy\\videos\\zaxz0rxynvpgzv\\1smkujj.mkv.happythreechoose"), dwFlags=0x1) returned 1 [0058.736] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\1sMkujj.mkv" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV") returned 1 [0058.736] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\") returned="" [0058.736] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\Decryption INFO.html" [0058.736] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\videos\\zaxz0rxynvpgzv\\decryption info.html")) returned 0xffffffff [0058.736] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\videos\\zaxz0rxynvpgzv\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0058.736] GetProcessHeap () returned 0x630000 [0058.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655b20 [0058.736] GetProcessHeap () returned 0x630000 [0058.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0058.743] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.744] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.744] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.744] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.744] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.745] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.745] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.745] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.745] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.745] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.745] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.745] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.745] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.745] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.745] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.745] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.745] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.745] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.746] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.746] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.746] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.746] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.746] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.746] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.746] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.746] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.746] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.746] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.746] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.746] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.746] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.747] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.747] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.747] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.747] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.747] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.747] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.748] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.748] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.748] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.748] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.748] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.749] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.749] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.749] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.749] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.749] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.749] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.749] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.749] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.749] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.749] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.749] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.749] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.749] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.749] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.750] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.750] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.750] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.750] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.750] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.751] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.751] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.751] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.751] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.751] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.751] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.751] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.751] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.751] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.751] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.751] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.752] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.752] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.752] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.752] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.752] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.752] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.752] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.752] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.752] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.752] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.752] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.752] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.752] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.753] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.754] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.754] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.754] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.754] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.754] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.754] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.754] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.754] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.754] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.754] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.754] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.754] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.754] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.755] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.755] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.755] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.755] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.755] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.755] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.755] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.755] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.755] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.755] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.755] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.755] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.755] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.755] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.756] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.756] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.756] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.756] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.756] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.756] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.756] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.756] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.756] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.757] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.757] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.757] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.757] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.757] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.757] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.757] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.757] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.757] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.757] GetProcessHeap () returned 0x630000 [0058.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655b20 | out: hHeap=0x630000) returned 1 [0058.757] GetProcessHeap () returned 0x630000 [0058.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0058.757] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0058.757] GetProcessHeap () returned 0x630000 [0058.758] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655850 [0058.758] GetProcessHeap () returned 0x630000 [0058.758] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0058.764] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.764] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.765] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.765] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.765] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.765] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.765] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.765] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.765] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.765] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.765] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.765] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.765] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.765] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.765] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.766] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.766] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.766] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.766] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.766] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.766] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.766] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.766] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.766] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.766] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.766] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.766] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.766] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.767] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.767] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.767] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.767] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.767] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.767] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.767] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.767] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.767] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.767] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.767] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.767] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.767] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.767] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.768] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.768] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.768] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.768] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.768] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.768] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.768] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.768] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.768] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.768] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.768] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.768] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.768] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.768] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.769] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.769] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.769] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.769] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.769] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.769] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.769] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.769] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.769] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.769] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.769] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.769] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.769] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.769] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.770] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.770] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.770] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.770] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.770] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.770] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.770] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.770] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.770] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.770] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.770] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.771] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.771] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.772] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.772] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.772] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.772] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.772] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.772] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.772] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.772] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.772] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.772] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.772] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.772] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.772] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.772] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.773] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.773] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.773] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.773] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.773] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.773] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.773] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.773] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.773] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.773] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.773] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.773] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.773] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.774] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.774] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.774] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.774] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.774] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.774] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.774] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.774] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.775] GetProcessHeap () returned 0x630000 [0058.775] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655850 | out: hHeap=0x630000) returned 1 [0058.775] GetProcessHeap () returned 0x630000 [0058.775] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0058.775] CloseHandle (hObject=0x230) returned 1 [0058.775] GetProcessHeap () returned 0x630000 [0058.775] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0058.775] FindNextFileW (in: hFindFile=0x65bc10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82afa020, ftCreationTime.dwHighDateTime=0x1d5d32b, ftLastAccessTime.dwLowDateTime=0x3bd555b0, ftLastAccessTime.dwHighDateTime=0x1d5c993, ftLastWriteTime.dwLowDateTime=0x3bd555b0, ftLastWriteTime.dwHighDateTime=0x1d5c993, nFileSizeHigh=0x0, nFileSizeLow=0xe643, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4g2yD587xs.avi", cAlternateFileName="4G2YD5~1.AVI")) returned 1 [0058.775] lstrcmpiW (lpString1="4g2yD587xs.avi", lpString2=".") returned 1 [0058.775] lstrcmpiW (lpString1="4g2yD587xs.avi", lpString2="..") returned 1 [0058.775] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\", lpString2="4g2yD587xs.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\4g2yD587xs.avi") returned="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\4g2yD587xs.avi" [0058.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4g2yD587xs.avi", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0058.775] GetProcessHeap () returned 0x630000 [0058.775] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0058.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4g2yD587xs.avi", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4g2yD587xs.avi", lpUsedDefaultChar=0x0) returned 15 [0058.776] lstrlenA (lpString="4g2yD587xs.avi") returned 14 [0058.776] lstrlenA (lpString=".happythreechoose") returned 17 [0058.776] lstrcmpiW (lpString1="4g2yD587xs.avi", lpString2="Decryption INFO.html") returned -1 [0058.776] lstrcmpiW (lpString1="4g2yD587xs.avi", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned -1 [0058.776] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0058.776] lstrcmpiW (lpString1="4g2yD587xs.avi", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0058.776] GetProcessHeap () returned 0x630000 [0058.776] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0058.776] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\4g2yD587xs.avi" (normalized: "c:\\users\\fd1hvy\\videos\\zaxz0rxynvpgzv\\4g2yd587xs.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0058.776] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=58947) returned 1 [0058.776] GetProcessHeap () returned 0x630000 [0058.776] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655760 [0058.776] GetProcessHeap () returned 0x630000 [0058.776] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0058.776] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\4g2yD587xs.avi") returned 52 [0058.776] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.776] GetProcessHeap () returned 0x630000 [0058.776] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0058.776] GetProcessHeap () returned 0x630000 [0058.776] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x661380 [0058.777] lstrlenA (lpString="rsa_encrypt") returned 11 [0058.777] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0058.778] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0058.778] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0058.778] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0058.778] GetProcessHeap () returned 0x630000 [0058.778] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0058.778] lstrlenA (lpString="010001") returned 6 [0058.778] GetProcessHeap () returned 0x630000 [0058.778] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a098 [0058.778] GetProcessHeap () returned 0x630000 [0058.778] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.778] GetProcessHeap () returned 0x630000 [0058.778] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e100 [0058.778] GetProcessHeap () returned 0x630000 [0058.778] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.778] GetProcessHeap () returned 0x630000 [0058.778] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e340 [0058.778] GetProcessHeap () returned 0x630000 [0058.778] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657670 [0058.779] GetProcessHeap () returned 0x630000 [0058.779] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a1b8 [0058.779] GetProcessHeap () returned 0x630000 [0058.779] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0058.779] GetProcessHeap () returned 0x630000 [0058.779] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.779] GetProcessHeap () returned 0x630000 [0058.779] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0058.779] GetProcessHeap () returned 0x630000 [0058.779] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.779] GetProcessHeap () returned 0x630000 [0058.779] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656a68 [0058.779] GetProcessHeap () returned 0x630000 [0058.779] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.779] GetProcessHeap () returned 0x630000 [0058.779] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0058.779] GetProcessHeap () returned 0x630000 [0058.779] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0058.779] GetProcessHeap () returned 0x630000 [0058.779] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.779] GetProcessHeap () returned 0x630000 [0058.779] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0058.779] GetProcessHeap () returned 0x630000 [0058.779] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0058.779] GetProcessHeap () returned 0x630000 [0058.779] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0058.779] GetProcessHeap () returned 0x630000 [0058.779] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65aab0 [0058.779] GetProcessHeap () returned 0x630000 [0058.779] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.779] GetProcessHeap () returned 0x630000 [0058.779] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0058.779] GetProcessHeap () returned 0x630000 [0058.779] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0058.779] GetProcessHeap () returned 0x630000 [0058.779] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0058.779] GetProcessHeap () returned 0x630000 [0058.779] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e730 [0058.779] GetProcessHeap () returned 0x630000 [0058.780] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65aab0 | out: hHeap=0x630000) returned 1 [0058.780] GetProcessHeap () returned 0x630000 [0058.780] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0058.780] GetProcessHeap () returned 0x630000 [0058.780] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0058.780] GetProcessHeap () returned 0x630000 [0058.780] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0058.780] GetProcessHeap () returned 0x630000 [0058.780] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0058.780] GetProcessHeap () returned 0x630000 [0058.780] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0058.780] GetProcessHeap () returned 0x630000 [0058.780] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0058.780] GetProcessHeap () returned 0x630000 [0058.780] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0058.780] GetProcessHeap () returned 0x630000 [0058.780] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0058.780] GetProcessHeap () returned 0x630000 [0058.780] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0058.780] GetProcessHeap () returned 0x630000 [0058.780] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0058.780] GetProcessHeap () returned 0x630000 [0058.780] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0058.780] GetProcessHeap () returned 0x630000 [0058.780] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0058.780] GetProcessHeap () returned 0x630000 [0058.780] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.780] GetProcessHeap () returned 0x630000 [0058.780] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.780] GetProcessHeap () returned 0x630000 [0058.780] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0058.780] GetProcessHeap () returned 0x630000 [0058.780] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0058.780] GetProcessHeap () returned 0x630000 [0058.780] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.780] GetProcessHeap () returned 0x630000 [0058.780] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.781] GetProcessHeap () returned 0x630000 [0058.781] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0058.781] GetProcessHeap () returned 0x630000 [0058.781] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0058.781] GetProcessHeap () returned 0x630000 [0058.781] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0058.781] GetProcessHeap () returned 0x630000 [0058.781] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0058.781] GetProcessHeap () returned 0x630000 [0058.781] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0058.781] GetProcessHeap () returned 0x630000 [0058.781] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0058.781] GetProcessHeap () returned 0x630000 [0058.781] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.781] GetProcessHeap () returned 0x630000 [0058.781] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.781] GetProcessHeap () returned 0x630000 [0058.781] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0058.781] GetProcessHeap () returned 0x630000 [0058.781] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0058.781] GetProcessHeap () returned 0x630000 [0058.781] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0058.781] GetProcessHeap () returned 0x630000 [0058.781] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0058.781] GetProcessHeap () returned 0x630000 [0058.781] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0058.782] GetProcessHeap () returned 0x630000 [0058.782] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0058.782] GetProcessHeap () returned 0x630000 [0058.782] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0058.782] GetProcessHeap () returned 0x630000 [0058.782] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0058.782] GetProcessHeap () returned 0x630000 [0058.782] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0058.782] GetProcessHeap () returned 0x630000 [0058.782] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0058.782] GetProcessHeap () returned 0x630000 [0058.782] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0058.782] GetProcessHeap () returned 0x630000 [0058.782] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0058.782] GetProcessHeap () returned 0x630000 [0058.782] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0058.782] GetProcessHeap () returned 0x630000 [0058.782] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0058.782] GetProcessHeap () returned 0x630000 [0058.782] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0058.782] GetProcessHeap () returned 0x630000 [0058.782] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0058.782] GetProcessHeap () returned 0x630000 [0058.782] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.782] GetProcessHeap () returned 0x630000 [0058.782] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.782] GetProcessHeap () returned 0x630000 [0058.782] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0058.782] GetProcessHeap () returned 0x630000 [0058.782] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0058.782] GetProcessHeap () returned 0x630000 [0058.782] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.782] GetProcessHeap () returned 0x630000 [0058.782] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.782] GetProcessHeap () returned 0x630000 [0058.782] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0058.783] GetProcessHeap () returned 0x630000 [0058.783] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0058.783] GetProcessHeap () returned 0x630000 [0058.783] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0058.783] GetProcessHeap () returned 0x630000 [0058.783] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0058.783] GetProcessHeap () returned 0x630000 [0058.783] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.783] GetProcessHeap () returned 0x630000 [0058.783] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.783] GetProcessHeap () returned 0x630000 [0058.783] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0058.783] GetProcessHeap () returned 0x630000 [0058.783] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0058.783] GetProcessHeap () returned 0x630000 [0058.783] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.783] GetProcessHeap () returned 0x630000 [0058.783] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.783] GetProcessHeap () returned 0x630000 [0058.783] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0058.783] GetProcessHeap () returned 0x630000 [0058.783] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0058.783] GetProcessHeap () returned 0x630000 [0058.783] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0058.783] GetProcessHeap () returned 0x630000 [0058.783] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0058.783] GetProcessHeap () returned 0x630000 [0058.783] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0058.783] GetProcessHeap () returned 0x630000 [0058.783] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0058.783] GetProcessHeap () returned 0x630000 [0058.783] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0058.783] GetProcessHeap () returned 0x630000 [0058.783] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0058.783] GetProcessHeap () returned 0x630000 [0058.783] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.783] GetProcessHeap () returned 0x630000 [0058.783] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.784] GetProcessHeap () returned 0x630000 [0058.784] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.784] GetProcessHeap () returned 0x630000 [0058.784] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.784] GetProcessHeap () returned 0x630000 [0058.784] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0058.784] GetProcessHeap () returned 0x630000 [0058.784] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0058.784] GetProcessHeap () returned 0x630000 [0058.784] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0058.784] GetProcessHeap () returned 0x630000 [0058.784] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0058.784] GetProcessHeap () returned 0x630000 [0058.784] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0058.784] GetProcessHeap () returned 0x630000 [0058.784] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0058.784] GetProcessHeap () returned 0x630000 [0058.784] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.784] GetProcessHeap () returned 0x630000 [0058.784] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.784] GetProcessHeap () returned 0x630000 [0058.784] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.784] GetProcessHeap () returned 0x630000 [0058.784] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.784] GetProcessHeap () returned 0x630000 [0058.784] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0e8 [0058.784] GetProcessHeap () returned 0x630000 [0058.784] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0e8 | out: hHeap=0x630000) returned 1 [0058.784] GetProcessHeap () returned 0x630000 [0058.784] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.784] GetProcessHeap () returned 0x630000 [0058.784] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.784] GetProcessHeap () returned 0x630000 [0058.784] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0058.784] GetProcessHeap () returned 0x630000 [0058.784] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0058.784] GetProcessHeap () returned 0x630000 [0058.784] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0058.785] GetProcessHeap () returned 0x630000 [0058.785] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0058.785] GetProcessHeap () returned 0x630000 [0058.785] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0058.785] GetProcessHeap () returned 0x630000 [0058.785] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0058.785] GetProcessHeap () returned 0x630000 [0058.785] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0058.785] GetProcessHeap () returned 0x630000 [0058.785] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0058.785] GetProcessHeap () returned 0x630000 [0058.785] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0058.785] GetProcessHeap () returned 0x630000 [0058.785] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.785] GetProcessHeap () returned 0x630000 [0058.785] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0058.785] WriteFile (in: hFile=0x230, lpBuffer=0x661380*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661380*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0058.787] GetProcessHeap () returned 0x630000 [0058.787] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x661380, Size=0x30) returned 0x661380 [0058.787] GetProcessHeap () returned 0x630000 [0058.787] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0058.787] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.787] GetProcessHeap () returned 0x630000 [0058.787] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe643) returned 0x6613b8 [0058.790] ReadFile (in: hFile=0x230, lpBuffer=0x6613b8, nNumberOfBytesToRead=0xe643, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x6613b8*, lpNumberOfBytesRead=0x243d7e8*=0xe643, lpOverlapped=0x0) returned 1 [0058.791] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.791] WriteFile (in: hFile=0x230, lpBuffer=0x6613b8*, nNumberOfBytesToWrite=0xe643, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x6613b8*, lpNumberOfBytesWritten=0x243d7e4*=0xe643, lpOverlapped=0x0) returned 1 [0058.792] GetProcessHeap () returned 0x630000 [0058.792] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6613b8 | out: hHeap=0x630000) returned 1 [0058.792] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.792] WriteFile (in: hFile=0x230, lpBuffer=0x661380*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661380*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0058.793] CloseHandle (hObject=0x230) returned 1 [0058.795] GetProcessHeap () returned 0x630000 [0058.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0058.795] GetProcessHeap () returned 0x630000 [0058.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655760 | out: hHeap=0x630000) returned 1 [0058.795] GetProcessHeap () returned 0x630000 [0058.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0058.795] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\4g2yD587xs.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\4g2yD587xs.avi") returned="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\4g2yD587xs.avi" [0058.795] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\4g2yD587xs.avi", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\4g2yD587xs.avi.happythreechoose") returned="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\4g2yD587xs.avi.happythreechoose" [0058.795] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\4g2yD587xs.avi" (normalized: "c:\\users\\fd1hvy\\videos\\zaxz0rxynvpgzv\\4g2yd587xs.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\4g2yD587xs.avi.happythreechoose" (normalized: "c:\\users\\fd1hvy\\videos\\zaxz0rxynvpgzv\\4g2yd587xs.avi.happythreechoose"), dwFlags=0x1) returned 1 [0058.796] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\4g2yD587xs.avi" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV") returned 1 [0058.796] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\") returned="" [0058.796] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\Decryption INFO.html" [0058.796] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\videos\\zaxz0rxynvpgzv\\decryption info.html")) returned 0x20 [0058.796] GetProcessHeap () returned 0x630000 [0058.796] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0058.796] FindNextFileW (in: hFindFile=0x65bc10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c47d640, ftCreationTime.dwHighDateTime=0x1d5d3e3, ftLastAccessTime.dwLowDateTime=0xf760fae0, ftLastAccessTime.dwHighDateTime=0x1d5d065, ftLastWriteTime.dwLowDateTime=0xf760fae0, ftLastWriteTime.dwHighDateTime=0x1d5d065, nFileSizeHigh=0x0, nFileSizeLow=0x950a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5sZffBto.mkv", cAlternateFileName="")) returned 1 [0058.796] lstrcmpiW (lpString1="5sZffBto.mkv", lpString2=".") returned 1 [0058.796] lstrcmpiW (lpString1="5sZffBto.mkv", lpString2="..") returned 1 [0058.796] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\", lpString2="5sZffBto.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\5sZffBto.mkv") returned="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\5sZffBto.mkv" [0058.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="5sZffBto.mkv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0058.797] GetProcessHeap () returned 0x630000 [0058.797] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd) returned 0x64c9f0 [0058.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="5sZffBto.mkv", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5sZffBto.mkv", lpUsedDefaultChar=0x0) returned 13 [0058.797] lstrlenA (lpString="5sZffBto.mkv") returned 12 [0058.797] lstrlenA (lpString=".happythreechoose") returned 17 [0058.797] lstrcmpiW (lpString1="5sZffBto.mkv", lpString2="Decryption INFO.html") returned -1 [0058.797] lstrcmpiW (lpString1="5sZffBto.mkv", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0058.797] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0058.797] lstrcmpiW (lpString1="5sZffBto.mkv", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0058.797] GetProcessHeap () returned 0x630000 [0058.797] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0058.797] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\5sZffBto.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\zaxz0rxynvpgzv\\5szffbto.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0058.797] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=38154) returned 1 [0058.797] GetProcessHeap () returned 0x630000 [0058.797] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6557d8 [0058.797] GetProcessHeap () returned 0x630000 [0058.797] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0058.797] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\5sZffBto.mkv") returned 50 [0058.797] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.797] GetProcessHeap () returned 0x630000 [0058.797] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0058.797] GetProcessHeap () returned 0x630000 [0058.797] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x386) returned 0x6613b8 [0058.798] lstrlenA (lpString="rsa_encrypt") returned 11 [0058.798] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0058.798] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0058.798] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0058.798] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0058.798] GetProcessHeap () returned 0x630000 [0058.798] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0058.798] lstrlenA (lpString="010001") returned 6 [0058.798] GetProcessHeap () returned 0x630000 [0058.798] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a1b8 [0058.798] GetProcessHeap () returned 0x630000 [0058.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.799] GetProcessHeap () returned 0x630000 [0058.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea90 [0058.799] GetProcessHeap () returned 0x630000 [0058.799] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.799] GetProcessHeap () returned 0x630000 [0058.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0058.799] GetProcessHeap () returned 0x630000 [0058.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657328 [0058.799] GetProcessHeap () returned 0x630000 [0058.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a168 [0058.799] GetProcessHeap () returned 0x630000 [0058.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0058.799] GetProcessHeap () returned 0x630000 [0058.799] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0058.799] GetProcessHeap () returned 0x630000 [0058.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0058.799] GetProcessHeap () returned 0x630000 [0058.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.799] GetProcessHeap () returned 0x630000 [0058.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657210 [0058.799] GetProcessHeap () returned 0x630000 [0058.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0058.799] GetProcessHeap () returned 0x630000 [0058.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0058.799] GetProcessHeap () returned 0x630000 [0058.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0058.799] GetProcessHeap () returned 0x630000 [0058.799] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.799] GetProcessHeap () returned 0x630000 [0058.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0058.799] GetProcessHeap () returned 0x630000 [0058.799] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0058.799] GetProcessHeap () returned 0x630000 [0058.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.799] GetProcessHeap () returned 0x630000 [0058.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65a798 [0058.799] GetProcessHeap () returned 0x630000 [0058.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0058.800] GetProcessHeap () returned 0x630000 [0058.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.800] GetProcessHeap () returned 0x630000 [0058.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.800] GetProcessHeap () returned 0x630000 [0058.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.800] GetProcessHeap () returned 0x630000 [0058.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e730 [0058.800] GetProcessHeap () returned 0x630000 [0058.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a798 | out: hHeap=0x630000) returned 1 [0058.800] GetProcessHeap () returned 0x630000 [0058.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0058.800] GetProcessHeap () returned 0x630000 [0058.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0058.800] GetProcessHeap () returned 0x630000 [0058.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.800] GetProcessHeap () returned 0x630000 [0058.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.800] GetProcessHeap () returned 0x630000 [0058.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0058.800] GetProcessHeap () returned 0x630000 [0058.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0058.800] GetProcessHeap () returned 0x630000 [0058.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0058.800] GetProcessHeap () returned 0x630000 [0058.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0058.800] GetProcessHeap () returned 0x630000 [0058.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0058.800] GetProcessHeap () returned 0x630000 [0058.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0058.800] GetProcessHeap () returned 0x630000 [0058.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.800] GetProcessHeap () returned 0x630000 [0058.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.800] GetProcessHeap () returned 0x630000 [0058.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.800] GetProcessHeap () returned 0x630000 [0058.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.801] GetProcessHeap () returned 0x630000 [0058.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0058.801] GetProcessHeap () returned 0x630000 [0058.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0058.801] GetProcessHeap () returned 0x630000 [0058.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0058.801] GetProcessHeap () returned 0x630000 [0058.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0058.801] GetProcessHeap () returned 0x630000 [0058.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0058.801] GetProcessHeap () returned 0x630000 [0058.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0058.801] GetProcessHeap () returned 0x630000 [0058.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0058.801] GetProcessHeap () returned 0x630000 [0058.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0058.801] GetProcessHeap () returned 0x630000 [0058.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0058.801] GetProcessHeap () returned 0x630000 [0058.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0058.801] GetProcessHeap () returned 0x630000 [0058.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.801] GetProcessHeap () returned 0x630000 [0058.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.801] GetProcessHeap () returned 0x630000 [0058.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.801] GetProcessHeap () returned 0x630000 [0058.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.801] GetProcessHeap () returned 0x630000 [0058.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.801] GetProcessHeap () returned 0x630000 [0058.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.801] GetProcessHeap () returned 0x630000 [0058.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0058.801] GetProcessHeap () returned 0x630000 [0058.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0058.802] GetProcessHeap () returned 0x630000 [0058.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0058.802] GetProcessHeap () returned 0x630000 [0058.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0058.802] GetProcessHeap () returned 0x630000 [0058.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.802] GetProcessHeap () returned 0x630000 [0058.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.802] GetProcessHeap () returned 0x630000 [0058.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0058.802] GetProcessHeap () returned 0x630000 [0058.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0058.802] GetProcessHeap () returned 0x630000 [0058.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0058.802] GetProcessHeap () returned 0x630000 [0058.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0058.802] GetProcessHeap () returned 0x630000 [0058.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0058.802] GetProcessHeap () returned 0x630000 [0058.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0058.802] GetProcessHeap () returned 0x630000 [0058.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0058.802] GetProcessHeap () returned 0x630000 [0058.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0058.802] GetProcessHeap () returned 0x630000 [0058.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0058.802] GetProcessHeap () returned 0x630000 [0058.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0058.802] GetProcessHeap () returned 0x630000 [0058.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.802] GetProcessHeap () returned 0x630000 [0058.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.802] GetProcessHeap () returned 0x630000 [0058.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0058.802] GetProcessHeap () returned 0x630000 [0058.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0058.803] GetProcessHeap () returned 0x630000 [0058.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0058.803] GetProcessHeap () returned 0x630000 [0058.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0058.803] GetProcessHeap () returned 0x630000 [0058.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.803] GetProcessHeap () returned 0x630000 [0058.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.803] GetProcessHeap () returned 0x630000 [0058.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.803] GetProcessHeap () returned 0x630000 [0058.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.803] GetProcessHeap () returned 0x630000 [0058.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.803] GetProcessHeap () returned 0x630000 [0058.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.803] GetProcessHeap () returned 0x630000 [0058.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.803] GetProcessHeap () returned 0x630000 [0058.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.803] GetProcessHeap () returned 0x630000 [0058.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.803] GetProcessHeap () returned 0x630000 [0058.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.803] GetProcessHeap () returned 0x630000 [0058.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0058.803] GetProcessHeap () returned 0x630000 [0058.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0058.803] GetProcessHeap () returned 0x630000 [0058.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0058.803] GetProcessHeap () returned 0x630000 [0058.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0058.803] GetProcessHeap () returned 0x630000 [0058.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0058.803] GetProcessHeap () returned 0x630000 [0058.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0058.804] GetProcessHeap () returned 0x630000 [0058.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.804] GetProcessHeap () returned 0x630000 [0058.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.804] GetProcessHeap () returned 0x630000 [0058.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0058.804] GetProcessHeap () returned 0x630000 [0058.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0058.804] GetProcessHeap () returned 0x630000 [0058.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0058.804] GetProcessHeap () returned 0x630000 [0058.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0058.804] GetProcessHeap () returned 0x630000 [0058.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0058.804] GetProcessHeap () returned 0x630000 [0058.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0058.804] GetProcessHeap () returned 0x630000 [0058.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0058.804] GetProcessHeap () returned 0x630000 [0058.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0058.804] GetProcessHeap () returned 0x630000 [0058.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.804] GetProcessHeap () returned 0x630000 [0058.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.804] GetProcessHeap () returned 0x630000 [0058.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0058.804] GetProcessHeap () returned 0x630000 [0058.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0058.804] GetProcessHeap () returned 0x630000 [0058.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.804] GetProcessHeap () returned 0x630000 [0058.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.804] GetProcessHeap () returned 0x630000 [0058.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0058.804] GetProcessHeap () returned 0x630000 [0058.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0058.805] GetProcessHeap () returned 0x630000 [0058.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0058.805] GetProcessHeap () returned 0x630000 [0058.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0058.805] GetProcessHeap () returned 0x630000 [0058.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0058.805] GetProcessHeap () returned 0x630000 [0058.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0058.805] GetProcessHeap () returned 0x630000 [0058.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0058.805] GetProcessHeap () returned 0x630000 [0058.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea90 | out: hHeap=0x630000) returned 1 [0058.805] GetProcessHeap () returned 0x630000 [0058.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0058.805] GetProcessHeap () returned 0x630000 [0058.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.805] GetProcessHeap () returned 0x630000 [0058.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0058.805] WriteFile (in: hFile=0x230, lpBuffer=0x6613b8*, nNumberOfBytesToWrite=0x386, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6613b8*, lpNumberOfBytesWritten=0x243d864*=0x386, lpOverlapped=0x0) returned 1 [0058.807] GetProcessHeap () returned 0x630000 [0058.807] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6613b8, Size=0x30) returned 0x6613b8 [0058.807] GetProcessHeap () returned 0x630000 [0058.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0058.807] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.807] GetProcessHeap () returned 0x630000 [0058.807] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9510) returned 0x6613f0 [0058.807] ReadFile (in: hFile=0x230, lpBuffer=0x6613f0, nNumberOfBytesToRead=0x9510, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x6613f0*, lpNumberOfBytesRead=0x243d7e8*=0x9510, lpOverlapped=0x0) returned 1 [0058.808] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.808] WriteFile (in: hFile=0x230, lpBuffer=0x6613f0*, nNumberOfBytesToWrite=0x9510, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x6613f0*, lpNumberOfBytesWritten=0x243d7e4*=0x9510, lpOverlapped=0x0) returned 1 [0058.809] GetProcessHeap () returned 0x630000 [0058.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6613f0 | out: hHeap=0x630000) returned 1 [0058.811] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.811] WriteFile (in: hFile=0x230, lpBuffer=0x6613b8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6613b8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0058.812] CloseHandle (hObject=0x230) returned 1 [0058.837] GetProcessHeap () returned 0x630000 [0058.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0058.837] GetProcessHeap () returned 0x630000 [0058.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6557d8 | out: hHeap=0x630000) returned 1 [0058.837] GetProcessHeap () returned 0x630000 [0058.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0058.837] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\5sZffBto.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\5sZffBto.mkv") returned="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\5sZffBto.mkv" [0058.837] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\5sZffBto.mkv", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\5sZffBto.mkv.happythreechoose") returned="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\5sZffBto.mkv.happythreechoose" [0058.837] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\5sZffBto.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\zaxz0rxynvpgzv\\5szffbto.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\5sZffBto.mkv.happythreechoose" (normalized: "c:\\users\\fd1hvy\\videos\\zaxz0rxynvpgzv\\5szffbto.mkv.happythreechoose"), dwFlags=0x1) returned 1 [0058.838] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\5sZffBto.mkv" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV") returned 1 [0058.838] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\") returned="" [0058.838] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\Decryption INFO.html" [0058.838] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\videos\\zaxz0rxynvpgzv\\decryption info.html")) returned 0x20 [0058.838] GetProcessHeap () returned 0x630000 [0058.838] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0058.838] FindNextFileW (in: hFindFile=0x65bc10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10c35380, ftCreationTime.dwHighDateTime=0x1d5d78b, ftLastAccessTime.dwLowDateTime=0xca5615c0, ftLastAccessTime.dwHighDateTime=0x1d5c99f, ftLastWriteTime.dwLowDateTime=0xca5615c0, ftLastWriteTime.dwHighDateTime=0x1d5c99f, nFileSizeHigh=0x0, nFileSizeLow=0x16037, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bzxOp9untVOIhbj F.mkv", cAlternateFileName="BZXOP9~1.MKV")) returned 1 [0058.838] lstrcmpiW (lpString1="bzxOp9untVOIhbj F.mkv", lpString2=".") returned 1 [0058.838] lstrcmpiW (lpString1="bzxOp9untVOIhbj F.mkv", lpString2="..") returned 1 [0058.838] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\", lpString2="bzxOp9untVOIhbj F.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\bzxOp9untVOIhbj F.mkv") returned="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\bzxOp9untVOIhbj F.mkv" [0058.838] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bzxOp9untVOIhbj F.mkv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0058.838] GetProcessHeap () returned 0x630000 [0058.838] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x645fd8 [0058.838] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bzxOp9untVOIhbj F.mkv", cchWideChar=-1, lpMultiByteStr=0x645fd8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bzxOp9untVOIhbj F.mkv", lpUsedDefaultChar=0x0) returned 22 [0058.838] lstrlenA (lpString="bzxOp9untVOIhbj F.mkv") returned 21 [0058.838] lstrlenA (lpString=".happythreechoose") returned 17 [0058.839] lstrlenA (lpString=".happythreechoose") returned 17 [0058.839] lstrlenA (lpString="bzxOp9untVOIhbj F.mkv") returned 21 [0058.839] lstrcmpiA (lpString1="p9untVOIhbj F.mkv", lpString2=".happythreechoose") returned 1 [0058.839] lstrcmpiW (lpString1="bzxOp9untVOIhbj F.mkv", lpString2="Decryption INFO.html") returned -1 [0058.839] lstrcmpiW (lpString1="bzxOp9untVOIhbj F.mkv", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0058.839] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0058.839] lstrcmpiW (lpString1="bzxOp9untVOIhbj F.mkv", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0058.839] GetProcessHeap () returned 0x630000 [0058.839] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0058.839] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\bzxOp9untVOIhbj F.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\zaxz0rxynvpgzv\\bzxop9untvoihbj f.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0058.839] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=90167) returned 1 [0058.839] GetProcessHeap () returned 0x630000 [0058.839] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655b20 [0058.839] GetProcessHeap () returned 0x630000 [0058.839] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0058.839] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\bzxOp9untVOIhbj F.mkv") returned 59 [0058.839] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.839] GetProcessHeap () returned 0x630000 [0058.839] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0058.839] GetProcessHeap () returned 0x630000 [0058.839] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x6613f0 [0058.840] lstrlenA (lpString="rsa_encrypt") returned 11 [0058.840] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0058.841] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0058.841] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0058.841] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0058.841] GetProcessHeap () returned 0x630000 [0058.841] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0058.841] lstrlenA (lpString="010001") returned 6 [0058.841] GetProcessHeap () returned 0x630000 [0058.841] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a058 [0058.841] GetProcessHeap () returned 0x630000 [0058.841] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.841] GetProcessHeap () returned 0x630000 [0058.841] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e8e0 [0058.841] GetProcessHeap () returned 0x630000 [0058.841] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.841] GetProcessHeap () returned 0x630000 [0058.841] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e610 [0058.841] GetProcessHeap () returned 0x630000 [0058.841] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657440 [0058.842] GetProcessHeap () returned 0x630000 [0058.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a0d8 [0058.842] GetProcessHeap () returned 0x630000 [0058.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0058.842] GetProcessHeap () returned 0x630000 [0058.842] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0058.842] GetProcessHeap () returned 0x630000 [0058.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0058.842] GetProcessHeap () returned 0x630000 [0058.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.842] GetProcessHeap () returned 0x630000 [0058.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657328 [0058.842] GetProcessHeap () returned 0x630000 [0058.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.842] GetProcessHeap () returned 0x630000 [0058.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0058.842] GetProcessHeap () returned 0x630000 [0058.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e730 [0058.842] GetProcessHeap () returned 0x630000 [0058.842] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.842] GetProcessHeap () returned 0x630000 [0058.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0058.842] GetProcessHeap () returned 0x630000 [0058.842] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0058.842] GetProcessHeap () returned 0x630000 [0058.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.842] GetProcessHeap () returned 0x630000 [0058.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0058.842] GetProcessHeap () returned 0x630000 [0058.842] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.842] GetProcessHeap () returned 0x630000 [0058.842] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.842] GetProcessHeap () returned 0x630000 [0058.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0058.842] GetProcessHeap () returned 0x630000 [0058.842] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0058.842] GetProcessHeap () returned 0x630000 [0058.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65de30 [0058.842] GetProcessHeap () returned 0x630000 [0058.842] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0058.843] GetProcessHeap () returned 0x630000 [0058.843] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0058.843] GetProcessHeap () returned 0x630000 [0058.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0058.843] GetProcessHeap () returned 0x630000 [0058.843] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0058.843] GetProcessHeap () returned 0x630000 [0058.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0058.843] GetProcessHeap () returned 0x630000 [0058.843] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.843] GetProcessHeap () returned 0x630000 [0058.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.843] GetProcessHeap () returned 0x630000 [0058.843] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0058.843] GetProcessHeap () returned 0x630000 [0058.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0058.843] GetProcessHeap () returned 0x630000 [0058.843] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0058.843] GetProcessHeap () returned 0x630000 [0058.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0058.843] GetProcessHeap () returned 0x630000 [0058.843] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0058.843] GetProcessHeap () returned 0x630000 [0058.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0058.843] GetProcessHeap () returned 0x630000 [0058.843] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.843] GetProcessHeap () returned 0x630000 [0058.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.843] GetProcessHeap () returned 0x630000 [0058.843] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0058.843] GetProcessHeap () returned 0x630000 [0058.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0058.843] GetProcessHeap () returned 0x630000 [0058.843] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0058.843] GetProcessHeap () returned 0x630000 [0058.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0058.843] GetProcessHeap () returned 0x630000 [0058.844] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0058.844] GetProcessHeap () returned 0x630000 [0058.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0058.844] GetProcessHeap () returned 0x630000 [0058.844] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0058.844] GetProcessHeap () returned 0x630000 [0058.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0058.844] GetProcessHeap () returned 0x630000 [0058.844] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0058.844] GetProcessHeap () returned 0x630000 [0058.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0058.844] GetProcessHeap () returned 0x630000 [0058.844] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.844] GetProcessHeap () returned 0x630000 [0058.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.844] GetProcessHeap () returned 0x630000 [0058.844] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.844] GetProcessHeap () returned 0x630000 [0058.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.844] GetProcessHeap () returned 0x630000 [0058.844] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0058.844] GetProcessHeap () returned 0x630000 [0058.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0058.844] GetProcessHeap () returned 0x630000 [0058.844] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0058.844] GetProcessHeap () returned 0x630000 [0058.845] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0058.845] GetProcessHeap () returned 0x630000 [0058.845] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.845] GetProcessHeap () returned 0x630000 [0058.845] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.845] GetProcessHeap () returned 0x630000 [0058.845] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0058.845] GetProcessHeap () returned 0x630000 [0058.845] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0058.845] GetProcessHeap () returned 0x630000 [0058.845] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0058.845] GetProcessHeap () returned 0x630000 [0058.845] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0058.845] GetProcessHeap () returned 0x630000 [0058.845] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.845] GetProcessHeap () returned 0x630000 [0058.845] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.845] GetProcessHeap () returned 0x630000 [0058.845] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.845] GetProcessHeap () returned 0x630000 [0058.845] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.845] GetProcessHeap () returned 0x630000 [0058.845] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0058.845] GetProcessHeap () returned 0x630000 [0058.845] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0058.845] GetProcessHeap () returned 0x630000 [0058.845] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0058.845] GetProcessHeap () returned 0x630000 [0058.845] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0058.845] GetProcessHeap () returned 0x630000 [0058.845] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0058.845] GetProcessHeap () returned 0x630000 [0058.845] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0058.845] GetProcessHeap () returned 0x630000 [0058.845] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0058.845] GetProcessHeap () returned 0x630000 [0058.845] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0058.845] GetProcessHeap () returned 0x630000 [0058.846] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0058.846] GetProcessHeap () returned 0x630000 [0058.846] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0058.846] GetProcessHeap () returned 0x630000 [0058.846] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0058.846] GetProcessHeap () returned 0x630000 [0058.846] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0058.846] GetProcessHeap () returned 0x630000 [0058.846] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0058.846] GetProcessHeap () returned 0x630000 [0058.846] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0058.846] GetProcessHeap () returned 0x630000 [0058.846] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0058.846] GetProcessHeap () returned 0x630000 [0058.846] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0058.846] GetProcessHeap () returned 0x630000 [0058.846] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0058.846] GetProcessHeap () returned 0x630000 [0058.846] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0058.846] GetProcessHeap () returned 0x630000 [0058.846] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0058.846] GetProcessHeap () returned 0x630000 [0058.846] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0058.846] GetProcessHeap () returned 0x630000 [0058.846] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.846] GetProcessHeap () returned 0x630000 [0058.846] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.846] GetProcessHeap () returned 0x630000 [0058.846] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0058.846] GetProcessHeap () returned 0x630000 [0058.846] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0058.846] GetProcessHeap () returned 0x630000 [0058.846] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0058.846] GetProcessHeap () returned 0x630000 [0058.846] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0058.846] GetProcessHeap () returned 0x630000 [0058.846] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0058.846] GetProcessHeap () returned 0x630000 [0058.847] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0058.847] GetProcessHeap () returned 0x630000 [0058.847] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0058.847] GetProcessHeap () returned 0x630000 [0058.847] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0058.847] GetProcessHeap () returned 0x630000 [0058.847] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0058.847] GetProcessHeap () returned 0x630000 [0058.847] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0058.847] GetProcessHeap () returned 0x630000 [0058.847] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0058.847] GetProcessHeap () returned 0x630000 [0058.847] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0058.847] GetProcessHeap () returned 0x630000 [0058.847] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0058.847] GetProcessHeap () returned 0x630000 [0058.847] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0058.847] GetProcessHeap () returned 0x630000 [0058.847] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.847] GetProcessHeap () returned 0x630000 [0058.847] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.847] GetProcessHeap () returned 0x630000 [0058.847] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0058.847] GetProcessHeap () returned 0x630000 [0058.847] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0058.847] GetProcessHeap () returned 0x630000 [0058.847] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0058.847] GetProcessHeap () returned 0x630000 [0058.847] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0058.847] GetProcessHeap () returned 0x630000 [0058.847] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0058.847] GetProcessHeap () returned 0x630000 [0058.847] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0058.847] GetProcessHeap () returned 0x630000 [0058.847] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0058.847] GetProcessHeap () returned 0x630000 [0058.847] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0058.848] GetProcessHeap () returned 0x630000 [0058.848] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0058.848] GetProcessHeap () returned 0x630000 [0058.848] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0058.848] GetProcessHeap () returned 0x630000 [0058.848] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0058.848] GetProcessHeap () returned 0x630000 [0058.848] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0058.848] GetProcessHeap () returned 0x630000 [0058.848] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0058.848] GetProcessHeap () returned 0x630000 [0058.848] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.848] GetProcessHeap () returned 0x630000 [0058.848] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0058.848] WriteFile (in: hFile=0x230, lpBuffer=0x6613f0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6613f0*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0058.850] GetProcessHeap () returned 0x630000 [0058.850] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6613f0, Size=0x30) returned 0x6613f0 [0058.850] GetProcessHeap () returned 0x630000 [0058.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0058.850] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.850] GetProcessHeap () returned 0x630000 [0058.850] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16037) returned 0x661428 [0058.852] ReadFile (in: hFile=0x230, lpBuffer=0x661428, nNumberOfBytesToRead=0x16037, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661428*, lpNumberOfBytesRead=0x243d7e8*=0x16037, lpOverlapped=0x0) returned 1 [0058.853] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.853] WriteFile (in: hFile=0x230, lpBuffer=0x661428*, nNumberOfBytesToWrite=0x16037, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661428*, lpNumberOfBytesWritten=0x243d7e4*=0x16037, lpOverlapped=0x0) returned 1 [0058.855] GetProcessHeap () returned 0x630000 [0058.855] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661428 | out: hHeap=0x630000) returned 1 [0058.855] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.855] WriteFile (in: hFile=0x230, lpBuffer=0x6613f0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6613f0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0058.856] CloseHandle (hObject=0x230) returned 1 [0058.859] GetProcessHeap () returned 0x630000 [0058.859] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0058.859] GetProcessHeap () returned 0x630000 [0058.859] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655b20 | out: hHeap=0x630000) returned 1 [0058.859] GetProcessHeap () returned 0x630000 [0058.859] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0058.859] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\bzxOp9untVOIhbj F.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\bzxOp9untVOIhbj F.mkv") returned="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\bzxOp9untVOIhbj F.mkv" [0058.859] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\bzxOp9untVOIhbj F.mkv", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\bzxOp9untVOIhbj F.mkv.happythreechoose") returned="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\bzxOp9untVOIhbj F.mkv.happythreechoose" [0058.859] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\bzxOp9untVOIhbj F.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\zaxz0rxynvpgzv\\bzxop9untvoihbj f.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\bzxOp9untVOIhbj F.mkv.happythreechoose" (normalized: "c:\\users\\fd1hvy\\videos\\zaxz0rxynvpgzv\\bzxop9untvoihbj f.mkv.happythreechoose"), dwFlags=0x1) returned 1 [0058.860] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\bzxOp9untVOIhbj F.mkv" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV") returned 1 [0058.860] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\") returned="" [0058.860] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\Decryption INFO.html" [0058.860] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\videos\\zaxz0rxynvpgzv\\decryption info.html")) returned 0x20 [0058.860] GetProcessHeap () returned 0x630000 [0058.860] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645fd8 | out: hHeap=0x630000) returned 1 [0058.860] FindNextFileW (in: hFindFile=0x65bc10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb719b550, ftCreationTime.dwHighDateTime=0x1d5cfa0, ftLastAccessTime.dwLowDateTime=0x46f008b0, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0x46f008b0, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0x1ffe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="efH5Ob.flv", cAlternateFileName="")) returned 1 [0058.860] lstrcmpiW (lpString1="efH5Ob.flv", lpString2=".") returned 1 [0058.860] lstrcmpiW (lpString1="efH5Ob.flv", lpString2="..") returned 1 [0058.860] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\", lpString2="efH5Ob.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\efH5Ob.flv") returned="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\efH5Ob.flv" [0058.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efH5Ob.flv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0058.860] GetProcessHeap () returned 0x630000 [0058.860] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb) returned 0x64ca20 [0058.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="efH5Ob.flv", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="efH5Ob.flv", lpUsedDefaultChar=0x0) returned 11 [0058.860] lstrlenA (lpString="efH5Ob.flv") returned 10 [0058.860] lstrlenA (lpString=".happythreechoose") returned 17 [0058.860] lstrcmpiW (lpString1="efH5Ob.flv", lpString2="Decryption INFO.html") returned 1 [0058.861] lstrcmpiW (lpString1="efH5Ob.flv", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0058.861] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0058.861] lstrcmpiW (lpString1="efH5Ob.flv", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0058.861] GetProcessHeap () returned 0x630000 [0058.861] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0058.861] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\efH5Ob.flv" (normalized: "c:\\users\\fd1hvy\\videos\\zaxz0rxynvpgzv\\efh5ob.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0058.861] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=8190) returned 1 [0058.861] GetProcessHeap () returned 0x630000 [0058.861] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655940 [0058.861] GetProcessHeap () returned 0x630000 [0058.861] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0058.861] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\efH5Ob.flv") returned 48 [0058.861] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.861] GetProcessHeap () returned 0x630000 [0058.861] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0058.861] GetProcessHeap () returned 0x630000 [0058.861] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x382) returned 0x661428 [0058.861] lstrlenA (lpString="rsa_encrypt") returned 11 [0058.861] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0058.862] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0058.862] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0058.862] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0058.862] GetProcessHeap () returned 0x630000 [0058.862] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0058.862] lstrlenA (lpString="010001") returned 6 [0058.862] GetProcessHeap () returned 0x630000 [0058.862] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a168 [0058.862] GetProcessHeap () returned 0x630000 [0058.862] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.862] GetProcessHeap () returned 0x630000 [0058.862] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ebb0 [0058.862] GetProcessHeap () returned 0x630000 [0058.862] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.862] GetProcessHeap () returned 0x630000 [0058.862] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea90 [0058.862] GetProcessHeap () returned 0x630000 [0058.862] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656950 [0058.862] GetProcessHeap () returned 0x630000 [0058.862] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a1d8 [0058.862] GetProcessHeap () returned 0x630000 [0058.862] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0058.862] GetProcessHeap () returned 0x630000 [0058.862] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0058.862] GetProcessHeap () returned 0x630000 [0058.862] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0058.863] GetProcessHeap () returned 0x630000 [0058.863] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.863] GetProcessHeap () returned 0x630000 [0058.863] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656c98 [0058.863] GetProcessHeap () returned 0x630000 [0058.863] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.863] GetProcessHeap () returned 0x630000 [0058.863] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0058.863] GetProcessHeap () returned 0x630000 [0058.863] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e610 [0058.863] GetProcessHeap () returned 0x630000 [0058.863] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.863] GetProcessHeap () returned 0x630000 [0058.863] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0058.863] GetProcessHeap () returned 0x630000 [0058.863] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0058.863] GetProcessHeap () returned 0x630000 [0058.863] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0058.863] GetProcessHeap () returned 0x630000 [0058.863] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65a888 [0058.863] GetProcessHeap () returned 0x630000 [0058.863] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.863] GetProcessHeap () returned 0x630000 [0058.863] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0058.863] GetProcessHeap () returned 0x630000 [0058.863] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0058.863] GetProcessHeap () returned 0x630000 [0058.863] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0058.863] GetProcessHeap () returned 0x630000 [0058.863] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e580 [0058.863] GetProcessHeap () returned 0x630000 [0058.863] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a888 | out: hHeap=0x630000) returned 1 [0058.863] GetProcessHeap () returned 0x630000 [0058.863] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0058.863] GetProcessHeap () returned 0x630000 [0058.863] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0058.863] GetProcessHeap () returned 0x630000 [0058.863] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.863] GetProcessHeap () returned 0x630000 [0058.864] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.864] GetProcessHeap () returned 0x630000 [0058.864] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0e8 [0058.864] GetProcessHeap () returned 0x630000 [0058.864] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0e8 | out: hHeap=0x630000) returned 1 [0058.864] GetProcessHeap () returned 0x630000 [0058.864] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.864] GetProcessHeap () returned 0x630000 [0058.864] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.864] GetProcessHeap () returned 0x630000 [0058.864] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0058.864] GetProcessHeap () returned 0x630000 [0058.864] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0058.864] GetProcessHeap () returned 0x630000 [0058.864] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0058.864] GetProcessHeap () returned 0x630000 [0058.864] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0058.864] GetProcessHeap () returned 0x630000 [0058.864] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0058.864] GetProcessHeap () returned 0x630000 [0058.864] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0058.864] GetProcessHeap () returned 0x630000 [0058.864] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0058.864] GetProcessHeap () returned 0x630000 [0058.864] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0058.864] GetProcessHeap () returned 0x630000 [0058.864] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0058.864] GetProcessHeap () returned 0x630000 [0058.864] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0058.864] GetProcessHeap () returned 0x630000 [0058.864] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0058.864] GetProcessHeap () returned 0x630000 [0058.864] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0058.864] GetProcessHeap () returned 0x630000 [0058.864] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0058.864] GetProcessHeap () returned 0x630000 [0058.864] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0058.865] GetProcessHeap () returned 0x630000 [0058.865] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0058.865] GetProcessHeap () returned 0x630000 [0058.865] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0058.865] GetProcessHeap () returned 0x630000 [0058.865] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0058.865] GetProcessHeap () returned 0x630000 [0058.865] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0058.865] GetProcessHeap () returned 0x630000 [0058.865] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0058.865] GetProcessHeap () returned 0x630000 [0058.865] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0058.865] GetProcessHeap () returned 0x630000 [0058.865] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0058.865] GetProcessHeap () returned 0x630000 [0058.865] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0058.865] GetProcessHeap () returned 0x630000 [0058.865] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0058.865] GetProcessHeap () returned 0x630000 [0058.865] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0058.865] GetProcessHeap () returned 0x630000 [0058.865] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0058.865] GetProcessHeap () returned 0x630000 [0058.865] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0058.865] GetProcessHeap () returned 0x630000 [0058.865] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0e8 [0058.865] GetProcessHeap () returned 0x630000 [0058.865] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0e8 | out: hHeap=0x630000) returned 1 [0058.865] GetProcessHeap () returned 0x630000 [0058.865] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0058.865] GetProcessHeap () returned 0x630000 [0058.865] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0058.865] GetProcessHeap () returned 0x630000 [0058.865] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.865] GetProcessHeap () returned 0x630000 [0058.865] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.865] GetProcessHeap () returned 0x630000 [0058.865] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0058.866] GetProcessHeap () returned 0x630000 [0058.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0058.866] GetProcessHeap () returned 0x630000 [0058.866] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0058.866] GetProcessHeap () returned 0x630000 [0058.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0058.866] GetProcessHeap () returned 0x630000 [0058.866] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0058.866] GetProcessHeap () returned 0x630000 [0058.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0058.866] GetProcessHeap () returned 0x630000 [0058.866] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.866] GetProcessHeap () returned 0x630000 [0058.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.866] GetProcessHeap () returned 0x630000 [0058.866] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0058.866] GetProcessHeap () returned 0x630000 [0058.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0058.866] GetProcessHeap () returned 0x630000 [0058.866] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0058.866] GetProcessHeap () returned 0x630000 [0058.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0058.866] GetProcessHeap () returned 0x630000 [0058.866] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0058.866] GetProcessHeap () returned 0x630000 [0058.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0058.866] GetProcessHeap () returned 0x630000 [0058.866] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0058.866] GetProcessHeap () returned 0x630000 [0058.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0058.866] GetProcessHeap () returned 0x630000 [0058.866] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0058.866] GetProcessHeap () returned 0x630000 [0058.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0058.866] GetProcessHeap () returned 0x630000 [0058.866] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.866] GetProcessHeap () returned 0x630000 [0058.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.867] GetProcessHeap () returned 0x630000 [0058.867] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.867] GetProcessHeap () returned 0x630000 [0058.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.867] GetProcessHeap () returned 0x630000 [0058.867] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0058.867] GetProcessHeap () returned 0x630000 [0058.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0058.867] GetProcessHeap () returned 0x630000 [0058.867] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0058.867] GetProcessHeap () returned 0x630000 [0058.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0058.867] GetProcessHeap () returned 0x630000 [0058.867] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0058.867] GetProcessHeap () returned 0x630000 [0058.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0058.867] GetProcessHeap () returned 0x630000 [0058.867] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0058.867] GetProcessHeap () returned 0x630000 [0058.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0058.867] GetProcessHeap () returned 0x630000 [0058.867] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0058.867] GetProcessHeap () returned 0x630000 [0058.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0058.867] GetProcessHeap () returned 0x630000 [0058.867] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.867] GetProcessHeap () returned 0x630000 [0058.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.867] GetProcessHeap () returned 0x630000 [0058.867] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0058.867] GetProcessHeap () returned 0x630000 [0058.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0058.867] GetProcessHeap () returned 0x630000 [0058.867] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0058.867] GetProcessHeap () returned 0x630000 [0058.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0058.868] GetProcessHeap () returned 0x630000 [0058.868] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0058.868] GetProcessHeap () returned 0x630000 [0058.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0058.868] GetProcessHeap () returned 0x630000 [0058.868] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0058.868] GetProcessHeap () returned 0x630000 [0058.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0058.868] GetProcessHeap () returned 0x630000 [0058.868] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0058.868] GetProcessHeap () returned 0x630000 [0058.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0058.868] GetProcessHeap () returned 0x630000 [0058.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0058.868] GetProcessHeap () returned 0x630000 [0058.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0058.868] GetProcessHeap () returned 0x630000 [0058.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0058.868] GetProcessHeap () returned 0x630000 [0058.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0058.868] GetProcessHeap () returned 0x630000 [0058.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0058.868] GetProcessHeap () returned 0x630000 [0058.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea90 | out: hHeap=0x630000) returned 1 [0058.868] GetProcessHeap () returned 0x630000 [0058.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0058.868] GetProcessHeap () returned 0x630000 [0058.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0058.868] GetProcessHeap () returned 0x630000 [0058.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0058.868] GetProcessHeap () returned 0x630000 [0058.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0058.868] GetProcessHeap () returned 0x630000 [0058.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0058.868] WriteFile (in: hFile=0x230, lpBuffer=0x661428*, nNumberOfBytesToWrite=0x382, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661428*, lpNumberOfBytesWritten=0x243d864*=0x382, lpOverlapped=0x0) returned 1 [0058.892] GetProcessHeap () returned 0x630000 [0058.892] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x661428, Size=0x30) returned 0x661428 [0058.892] GetProcessHeap () returned 0x630000 [0058.892] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0058.892] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.892] GetProcessHeap () returned 0x630000 [0058.892] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2000) returned 0x661460 [0058.892] ReadFile (in: hFile=0x230, lpBuffer=0x661460, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661460*, lpNumberOfBytesRead=0x243d7e8*=0x2000, lpOverlapped=0x0) returned 1 [0058.892] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.892] WriteFile (in: hFile=0x230, lpBuffer=0x661460*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661460*, lpNumberOfBytesWritten=0x243d7e4*=0x2000, lpOverlapped=0x0) returned 1 [0058.893] GetProcessHeap () returned 0x630000 [0058.894] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661460 | out: hHeap=0x630000) returned 1 [0058.894] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.894] WriteFile (in: hFile=0x230, lpBuffer=0x661428*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661428*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0058.895] CloseHandle (hObject=0x230) returned 1 [0058.896] GetProcessHeap () returned 0x630000 [0058.896] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0058.896] GetProcessHeap () returned 0x630000 [0058.896] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655940 | out: hHeap=0x630000) returned 1 [0058.896] GetProcessHeap () returned 0x630000 [0058.896] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0058.896] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\efH5Ob.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\efH5Ob.flv") returned="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\efH5Ob.flv" [0058.896] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\efH5Ob.flv", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\efH5Ob.flv.happythreechoose") returned="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\efH5Ob.flv.happythreechoose" [0058.896] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\efH5Ob.flv" (normalized: "c:\\users\\fd1hvy\\videos\\zaxz0rxynvpgzv\\efh5ob.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\efH5Ob.flv.happythreechoose" (normalized: "c:\\users\\fd1hvy\\videos\\zaxz0rxynvpgzv\\efh5ob.flv.happythreechoose"), dwFlags=0x1) returned 1 [0058.897] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\efH5Ob.flv" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV") returned 1 [0058.897] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\") returned="" [0058.897] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\Decryption INFO.html" [0058.897] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\videos\\zaxz0rxynvpgzv\\decryption info.html")) returned 0x20 [0058.897] GetProcessHeap () returned 0x630000 [0058.897] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0058.897] FindNextFileW (in: hFindFile=0x65bc10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25880ba0, ftCreationTime.dwHighDateTime=0x1d5cc3a, ftLastAccessTime.dwLowDateTime=0x461acc00, ftLastAccessTime.dwHighDateTime=0x1d5d61b, ftLastWriteTime.dwLowDateTime=0x461acc00, ftLastWriteTime.dwHighDateTime=0x1d5d61b, nFileSizeHigh=0x0, nFileSizeLow=0xc504, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jmWzL1bQAqeYuG2xcrwI.avi", cAlternateFileName="JMWZL1~1.AVI")) returned 1 [0058.897] lstrcmpiW (lpString1="jmWzL1bQAqeYuG2xcrwI.avi", lpString2=".") returned 1 [0058.897] lstrcmpiW (lpString1="jmWzL1bQAqeYuG2xcrwI.avi", lpString2="..") returned 1 [0058.897] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\", lpString2="jmWzL1bQAqeYuG2xcrwI.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\jmWzL1bQAqeYuG2xcrwI.avi") returned="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\jmWzL1bQAqeYuG2xcrwI.avi" [0058.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="jmWzL1bQAqeYuG2xcrwI.avi", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0058.897] GetProcessHeap () returned 0x630000 [0058.897] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x19) returned 0x651f10 [0058.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="jmWzL1bQAqeYuG2xcrwI.avi", cchWideChar=-1, lpMultiByteStr=0x651f10, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jmWzL1bQAqeYuG2xcrwI.avi", lpUsedDefaultChar=0x0) returned 25 [0058.897] lstrlenA (lpString="jmWzL1bQAqeYuG2xcrwI.avi") returned 24 [0058.897] lstrlenA (lpString=".happythreechoose") returned 17 [0058.897] lstrlenA (lpString=".happythreechoose") returned 17 [0058.897] lstrlenA (lpString="jmWzL1bQAqeYuG2xcrwI.avi") returned 24 [0058.897] lstrcmpiA (lpString1="QAqeYuG2xcrwI.avi", lpString2=".happythreechoose") returned 1 [0058.897] lstrcmpiW (lpString1="jmWzL1bQAqeYuG2xcrwI.avi", lpString2="Decryption INFO.html") returned 1 [0058.897] lstrcmpiW (lpString1="jmWzL1bQAqeYuG2xcrwI.avi", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0058.897] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0058.897] lstrcmpiW (lpString1="jmWzL1bQAqeYuG2xcrwI.avi", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0058.897] GetProcessHeap () returned 0x630000 [0058.897] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0058.898] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\jmWzL1bQAqeYuG2xcrwI.avi" (normalized: "c:\\users\\fd1hvy\\videos\\zaxz0rxynvpgzv\\jmwzl1bqaqeyug2xcrwi.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0058.898] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=50436) returned 1 [0058.898] GetProcessHeap () returned 0x630000 [0058.898] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6558c8 [0058.898] GetProcessHeap () returned 0x630000 [0058.898] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0058.898] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\jmWzL1bQAqeYuG2xcrwI.avi") returned 62 [0058.898] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.898] GetProcessHeap () returned 0x630000 [0058.898] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0058.898] GetProcessHeap () returned 0x630000 [0058.898] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38c) returned 0x661460 [0058.898] lstrlenA (lpString="rsa_encrypt") returned 11 [0058.898] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0058.899] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0058.899] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0058.899] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0058.899] GetProcessHeap () returned 0x630000 [0058.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0058.899] lstrlenA (lpString="010001") returned 6 [0058.899] GetProcessHeap () returned 0x630000 [0058.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a138 [0058.899] GetProcessHeap () returned 0x630000 [0058.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.899] GetProcessHeap () returned 0x630000 [0058.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ecd0 [0058.899] GetProcessHeap () returned 0x630000 [0058.899] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.899] GetProcessHeap () returned 0x630000 [0058.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e610 [0058.899] GetProcessHeap () returned 0x630000 [0058.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657210 [0058.899] GetProcessHeap () returned 0x630000 [0058.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a058 [0058.899] GetProcessHeap () returned 0x630000 [0058.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0058.899] GetProcessHeap () returned 0x630000 [0058.899] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.899] GetProcessHeap () returned 0x630000 [0058.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0058.899] GetProcessHeap () returned 0x630000 [0058.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.899] GetProcessHeap () returned 0x630000 [0058.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657328 [0058.899] GetProcessHeap () returned 0x630000 [0058.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.900] GetProcessHeap () returned 0x630000 [0058.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0058.900] GetProcessHeap () returned 0x630000 [0058.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65df50 [0058.900] GetProcessHeap () returned 0x630000 [0058.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.900] GetProcessHeap () returned 0x630000 [0058.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0058.900] GetProcessHeap () returned 0x630000 [0058.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0058.900] GetProcessHeap () returned 0x630000 [0058.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0058.900] GetProcessHeap () returned 0x630000 [0058.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0058.900] GetProcessHeap () returned 0x630000 [0058.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.900] GetProcessHeap () returned 0x630000 [0058.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0058.900] GetProcessHeap () returned 0x630000 [0058.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0058.900] GetProcessHeap () returned 0x630000 [0058.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0058.900] GetProcessHeap () returned 0x630000 [0058.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e730 [0058.900] GetProcessHeap () returned 0x630000 [0058.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0058.900] GetProcessHeap () returned 0x630000 [0058.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0058.900] GetProcessHeap () returned 0x630000 [0058.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0058.900] GetProcessHeap () returned 0x630000 [0058.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0058.900] GetProcessHeap () returned 0x630000 [0058.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0058.900] GetProcessHeap () returned 0x630000 [0058.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0058.900] GetProcessHeap () returned 0x630000 [0058.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0058.900] GetProcessHeap () returned 0x630000 [0058.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0058.901] GetProcessHeap () returned 0x630000 [0058.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0058.901] GetProcessHeap () returned 0x630000 [0058.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.901] GetProcessHeap () returned 0x630000 [0058.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.901] GetProcessHeap () returned 0x630000 [0058.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0058.901] GetProcessHeap () returned 0x630000 [0058.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0058.901] GetProcessHeap () returned 0x630000 [0058.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.901] GetProcessHeap () returned 0x630000 [0058.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.901] GetProcessHeap () returned 0x630000 [0058.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0058.901] GetProcessHeap () returned 0x630000 [0058.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0058.901] GetProcessHeap () returned 0x630000 [0058.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0058.901] GetProcessHeap () returned 0x630000 [0058.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0058.901] GetProcessHeap () returned 0x630000 [0058.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.901] GetProcessHeap () returned 0x630000 [0058.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.901] GetProcessHeap () returned 0x630000 [0058.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.901] GetProcessHeap () returned 0x630000 [0058.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.901] GetProcessHeap () returned 0x630000 [0058.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0058.901] GetProcessHeap () returned 0x630000 [0058.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0058.901] GetProcessHeap () returned 0x630000 [0058.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0058.902] GetProcessHeap () returned 0x630000 [0058.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0058.902] GetProcessHeap () returned 0x630000 [0058.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.902] GetProcessHeap () returned 0x630000 [0058.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.902] GetProcessHeap () returned 0x630000 [0058.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.902] GetProcessHeap () returned 0x630000 [0058.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.902] GetProcessHeap () returned 0x630000 [0058.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0058.902] GetProcessHeap () returned 0x630000 [0058.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0058.902] GetProcessHeap () returned 0x630000 [0058.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.902] GetProcessHeap () returned 0x630000 [0058.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.902] GetProcessHeap () returned 0x630000 [0058.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0058.902] GetProcessHeap () returned 0x630000 [0058.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0058.902] GetProcessHeap () returned 0x630000 [0058.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0058.902] GetProcessHeap () returned 0x630000 [0058.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0058.902] GetProcessHeap () returned 0x630000 [0058.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0058.902] GetProcessHeap () returned 0x630000 [0058.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0058.902] GetProcessHeap () returned 0x630000 [0058.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0058.902] GetProcessHeap () returned 0x630000 [0058.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0058.902] GetProcessHeap () returned 0x630000 [0058.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.903] GetProcessHeap () returned 0x630000 [0058.903] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.903] GetProcessHeap () returned 0x630000 [0058.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0058.903] GetProcessHeap () returned 0x630000 [0058.903] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0058.903] GetProcessHeap () returned 0x630000 [0058.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.903] GetProcessHeap () returned 0x630000 [0058.903] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.903] GetProcessHeap () returned 0x630000 [0058.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0058.903] GetProcessHeap () returned 0x630000 [0058.903] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0058.903] GetProcessHeap () returned 0x630000 [0058.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.903] GetProcessHeap () returned 0x630000 [0058.903] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.903] GetProcessHeap () returned 0x630000 [0058.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0058.903] GetProcessHeap () returned 0x630000 [0058.903] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0058.903] GetProcessHeap () returned 0x630000 [0058.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0058.903] GetProcessHeap () returned 0x630000 [0058.903] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0058.903] GetProcessHeap () returned 0x630000 [0058.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0058.903] GetProcessHeap () returned 0x630000 [0058.903] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0058.903] GetProcessHeap () returned 0x630000 [0058.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0058.903] GetProcessHeap () returned 0x630000 [0058.903] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0058.903] GetProcessHeap () returned 0x630000 [0058.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0058.903] GetProcessHeap () returned 0x630000 [0058.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0058.904] GetProcessHeap () returned 0x630000 [0058.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0058.904] GetProcessHeap () returned 0x630000 [0058.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0058.904] GetProcessHeap () returned 0x630000 [0058.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.904] GetProcessHeap () returned 0x630000 [0058.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.904] GetProcessHeap () returned 0x630000 [0058.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0058.904] GetProcessHeap () returned 0x630000 [0058.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0058.904] GetProcessHeap () returned 0x630000 [0058.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0058.904] GetProcessHeap () returned 0x630000 [0058.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0058.904] GetProcessHeap () returned 0x630000 [0058.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0058.904] GetProcessHeap () returned 0x630000 [0058.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0058.904] GetProcessHeap () returned 0x630000 [0058.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0058.904] GetProcessHeap () returned 0x630000 [0058.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0058.904] GetProcessHeap () returned 0x630000 [0058.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0058.904] GetProcessHeap () returned 0x630000 [0058.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0058.904] GetProcessHeap () returned 0x630000 [0058.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.904] GetProcessHeap () returned 0x630000 [0058.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.904] GetProcessHeap () returned 0x630000 [0058.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0e8 [0058.904] GetProcessHeap () returned 0x630000 [0058.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0e8 | out: hHeap=0x630000) returned 1 [0058.904] GetProcessHeap () returned 0x630000 [0058.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0058.905] GetProcessHeap () returned 0x630000 [0058.905] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0058.905] GetProcessHeap () returned 0x630000 [0058.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.905] GetProcessHeap () returned 0x630000 [0058.905] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.905] GetProcessHeap () returned 0x630000 [0058.905] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0058.905] GetProcessHeap () returned 0x630000 [0058.905] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0058.905] GetProcessHeap () returned 0x630000 [0058.905] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0058.905] GetProcessHeap () returned 0x630000 [0058.905] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0058.905] GetProcessHeap () returned 0x630000 [0058.905] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0058.905] GetProcessHeap () returned 0x630000 [0058.905] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0058.905] GetProcessHeap () returned 0x630000 [0058.905] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0058.905] GetProcessHeap () returned 0x630000 [0058.905] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ecd0 | out: hHeap=0x630000) returned 1 [0058.905] GetProcessHeap () returned 0x630000 [0058.905] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0058.905] GetProcessHeap () returned 0x630000 [0058.905] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0058.905] GetProcessHeap () returned 0x630000 [0058.905] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0058.905] WriteFile (in: hFile=0x230, lpBuffer=0x661460*, nNumberOfBytesToWrite=0x38c, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661460*, lpNumberOfBytesWritten=0x243d864*=0x38c, lpOverlapped=0x0) returned 1 [0058.908] GetProcessHeap () returned 0x630000 [0058.908] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x661460, Size=0x30) returned 0x661460 [0058.908] GetProcessHeap () returned 0x630000 [0058.908] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0058.908] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.908] GetProcessHeap () returned 0x630000 [0058.908] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc510) returned 0x661498 [0058.908] ReadFile (in: hFile=0x230, lpBuffer=0x661498, nNumberOfBytesToRead=0xc510, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661498*, lpNumberOfBytesRead=0x243d7e8*=0xc510, lpOverlapped=0x0) returned 1 [0058.909] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.909] WriteFile (in: hFile=0x230, lpBuffer=0x661498*, nNumberOfBytesToWrite=0xc510, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661498*, lpNumberOfBytesWritten=0x243d7e4*=0xc510, lpOverlapped=0x0) returned 1 [0058.910] GetProcessHeap () returned 0x630000 [0058.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661498 | out: hHeap=0x630000) returned 1 [0058.910] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.910] WriteFile (in: hFile=0x230, lpBuffer=0x661460*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661460*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0058.911] CloseHandle (hObject=0x230) returned 1 [0058.913] GetProcessHeap () returned 0x630000 [0058.913] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0058.913] GetProcessHeap () returned 0x630000 [0058.913] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6558c8 | out: hHeap=0x630000) returned 1 [0058.913] GetProcessHeap () returned 0x630000 [0058.913] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0058.913] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\jmWzL1bQAqeYuG2xcrwI.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\jmWzL1bQAqeYuG2xcrwI.avi") returned="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\jmWzL1bQAqeYuG2xcrwI.avi" [0058.914] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\jmWzL1bQAqeYuG2xcrwI.avi", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\jmWzL1bQAqeYuG2xcrwI.avi.happythreechoose") returned="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\jmWzL1bQAqeYuG2xcrwI.avi.happythreechoose" [0058.914] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\jmWzL1bQAqeYuG2xcrwI.avi" (normalized: "c:\\users\\fd1hvy\\videos\\zaxz0rxynvpgzv\\jmwzl1bqaqeyug2xcrwi.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\jmWzL1bQAqeYuG2xcrwI.avi.happythreechoose" (normalized: "c:\\users\\fd1hvy\\videos\\zaxz0rxynvpgzv\\jmwzl1bqaqeyug2xcrwi.avi.happythreechoose"), dwFlags=0x1) returned 1 [0058.914] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\jmWzL1bQAqeYuG2xcrwI.avi" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV") returned 1 [0058.914] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\") returned="" [0058.914] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\Decryption INFO.html" [0058.914] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\ZAxZ0rXYnVPgZV\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\videos\\zaxz0rxynvpgzv\\decryption info.html")) returned 0x20 [0058.914] GetProcessHeap () returned 0x630000 [0058.914] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f10 | out: hHeap=0x630000) returned 1 [0058.914] FindNextFileW (in: hFindFile=0x65bc10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25880ba0, ftCreationTime.dwHighDateTime=0x1d5cc3a, ftLastAccessTime.dwLowDateTime=0x461acc00, ftLastAccessTime.dwHighDateTime=0x1d5d61b, ftLastWriteTime.dwLowDateTime=0x461acc00, ftLastWriteTime.dwHighDateTime=0x1d5d61b, nFileSizeHigh=0x0, nFileSizeLow=0xc504, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jmWzL1bQAqeYuG2xcrwI.avi", cAlternateFileName="JMWZL1~1.AVI")) returned 0 [0058.914] FindClose (in: hFindFile=0x65bc10 | out: hFindFile=0x65bc10) returned 1 [0058.915] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\" [0058.915] GetProcessHeap () returned 0x630000 [0058.915] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eeb0 | out: hHeap=0x630000) returned 1 [0058.915] GetProcessHeap () returned 0x630000 [0058.915] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0058.915] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\") returned 37 [0058.915] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\*") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\*" [0058.915] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x473fa2c0, ftCreationTime.dwHighDateTime=0x1d5c97f, ftLastAccessTime.dwLowDateTime=0x6637c990, ftLastAccessTime.dwHighDateTime=0x1d5d2ea, ftLastWriteTime.dwLowDateTime=0x6637c990, ftLastWriteTime.dwHighDateTime=0x1d5d2ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65b690 [0058.915] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0058.915] FindNextFileW (in: hFindFile=0x65b690, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x473fa2c0, ftCreationTime.dwHighDateTime=0x1d5c97f, ftLastAccessTime.dwLowDateTime=0x6637c990, ftLastAccessTime.dwHighDateTime=0x1d5d2ea, ftLastWriteTime.dwLowDateTime=0x6637c990, ftLastWriteTime.dwHighDateTime=0x1d5d2ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.915] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0058.915] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0058.915] FindNextFileW (in: hFindFile=0x65b690, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca8aa7a0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0xc05a2e20, ftLastAccessTime.dwHighDateTime=0x1d5c9a5, ftLastWriteTime.dwLowDateTime=0xc05a2e20, ftLastWriteTime.dwHighDateTime=0x1d5c9a5, nFileSizeHigh=0x0, nFileSizeLow=0x173ae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-DhI9VRldgAPXhW-bxcS.swf", cAlternateFileName="-DHI9V~1.SWF")) returned 1 [0058.915] lstrcmpiW (lpString1="-DhI9VRldgAPXhW-bxcS.swf", lpString2=".") returned 1 [0058.915] lstrcmpiW (lpString1="-DhI9VRldgAPXhW-bxcS.swf", lpString2="..") returned 1 [0058.915] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\", lpString2="-DhI9VRldgAPXhW-bxcS.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\-DhI9VRldgAPXhW-bxcS.swf") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\-DhI9VRldgAPXhW-bxcS.swf" [0058.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="-DhI9VRldgAPXhW-bxcS.swf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0058.915] GetProcessHeap () returned 0x630000 [0058.915] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x19) returned 0x651e48 [0058.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="-DhI9VRldgAPXhW-bxcS.swf", cchWideChar=-1, lpMultiByteStr=0x651e48, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-DhI9VRldgAPXhW-bxcS.swf", lpUsedDefaultChar=0x0) returned 25 [0058.915] lstrlenA (lpString="-DhI9VRldgAPXhW-bxcS.swf") returned 24 [0058.915] lstrlenA (lpString=".happythreechoose") returned 17 [0058.915] lstrlenA (lpString=".happythreechoose") returned 17 [0058.915] lstrlenA (lpString="-DhI9VRldgAPXhW-bxcS.swf") returned 24 [0058.915] lstrcmpiA (lpString1="ldgAPXhW-bxcS.swf", lpString2=".happythreechoose") returned 1 [0058.915] lstrcmpiW (lpString1="-DhI9VRldgAPXhW-bxcS.swf", lpString2="Decryption INFO.html") returned 1 [0058.915] lstrcmpiW (lpString1="-DhI9VRldgAPXhW-bxcS.swf", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0058.915] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0058.916] lstrcmpiW (lpString1="-DhI9VRldgAPXhW-bxcS.swf", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0058.916] GetProcessHeap () returned 0x630000 [0058.916] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x652000 [0058.916] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\-DhI9VRldgAPXhW-bxcS.swf" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\-dhi9vrldgapxhw-bxcs.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0058.916] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=95150) returned 1 [0058.916] GetProcessHeap () returned 0x630000 [0058.916] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6555f8 [0058.916] GetProcessHeap () returned 0x630000 [0058.916] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0058.916] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\-DhI9VRldgAPXhW-bxcS.swf") returned 61 [0058.916] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.916] GetProcessHeap () returned 0x630000 [0058.916] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0058.916] GetProcessHeap () returned 0x630000 [0058.916] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x661498 [0058.916] lstrlenA (lpString="rsa_encrypt") returned 11 [0058.916] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0058.917] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0058.917] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0058.917] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0058.917] GetProcessHeap () returned 0x630000 [0058.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0058.917] lstrlenA (lpString="010001") returned 6 [0058.917] GetProcessHeap () returned 0x630000 [0058.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a148 [0058.917] GetProcessHeap () returned 0x630000 [0058.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.917] GetProcessHeap () returned 0x630000 [0058.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0058.917] GetProcessHeap () returned 0x630000 [0058.917] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.917] GetProcessHeap () returned 0x630000 [0058.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea90 [0058.917] GetProcessHeap () returned 0x630000 [0058.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656c98 [0058.917] GetProcessHeap () returned 0x630000 [0058.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a238 [0058.917] GetProcessHeap () returned 0x630000 [0058.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0058.917] GetProcessHeap () returned 0x630000 [0058.917] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0058.917] GetProcessHeap () returned 0x630000 [0058.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0058.917] GetProcessHeap () returned 0x630000 [0058.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0058.917] GetProcessHeap () returned 0x630000 [0058.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656fe0 [0058.918] GetProcessHeap () returned 0x630000 [0058.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.918] GetProcessHeap () returned 0x630000 [0058.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0058.918] GetProcessHeap () returned 0x630000 [0058.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e6a0 [0058.918] GetProcessHeap () returned 0x630000 [0058.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0058.918] GetProcessHeap () returned 0x630000 [0058.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0058.918] GetProcessHeap () returned 0x630000 [0058.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e6a0 | out: hHeap=0x630000) returned 1 [0058.918] GetProcessHeap () returned 0x630000 [0058.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0058.918] GetProcessHeap () returned 0x630000 [0058.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0058.918] GetProcessHeap () returned 0x630000 [0058.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.918] GetProcessHeap () returned 0x630000 [0058.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0058.918] GetProcessHeap () returned 0x630000 [0058.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0058.918] GetProcessHeap () returned 0x630000 [0058.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0058.918] GetProcessHeap () returned 0x630000 [0058.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e730 [0058.918] GetProcessHeap () returned 0x630000 [0058.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0058.918] GetProcessHeap () returned 0x630000 [0058.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0058.918] GetProcessHeap () returned 0x630000 [0058.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0058.918] GetProcessHeap () returned 0x630000 [0058.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.918] GetProcessHeap () returned 0x630000 [0058.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.918] GetProcessHeap () returned 0x630000 [0058.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0058.919] GetProcessHeap () returned 0x630000 [0058.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0058.919] GetProcessHeap () returned 0x630000 [0058.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0058.919] GetProcessHeap () returned 0x630000 [0058.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0058.919] GetProcessHeap () returned 0x630000 [0058.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0058.919] GetProcessHeap () returned 0x630000 [0058.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0058.919] GetProcessHeap () returned 0x630000 [0058.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0058.919] GetProcessHeap () returned 0x630000 [0058.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0058.919] GetProcessHeap () returned 0x630000 [0058.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0058.919] GetProcessHeap () returned 0x630000 [0058.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0058.919] GetProcessHeap () returned 0x630000 [0058.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.919] GetProcessHeap () returned 0x630000 [0058.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.919] GetProcessHeap () returned 0x630000 [0058.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0058.919] GetProcessHeap () returned 0x630000 [0058.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0058.919] GetProcessHeap () returned 0x630000 [0058.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0058.919] GetProcessHeap () returned 0x630000 [0058.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0058.919] GetProcessHeap () returned 0x630000 [0058.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.919] GetProcessHeap () returned 0x630000 [0058.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.919] GetProcessHeap () returned 0x630000 [0058.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0058.919] GetProcessHeap () returned 0x630000 [0058.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0058.920] GetProcessHeap () returned 0x630000 [0058.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.920] GetProcessHeap () returned 0x630000 [0058.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.920] GetProcessHeap () returned 0x630000 [0058.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0058.920] GetProcessHeap () returned 0x630000 [0058.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0058.920] GetProcessHeap () returned 0x630000 [0058.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0e8 [0058.920] GetProcessHeap () returned 0x630000 [0058.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0e8 | out: hHeap=0x630000) returned 1 [0058.920] GetProcessHeap () returned 0x630000 [0058.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0058.920] GetProcessHeap () returned 0x630000 [0058.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0058.920] GetProcessHeap () returned 0x630000 [0058.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0058.920] GetProcessHeap () returned 0x630000 [0058.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0058.920] GetProcessHeap () returned 0x630000 [0058.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0058.920] GetProcessHeap () returned 0x630000 [0058.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0058.920] GetProcessHeap () returned 0x630000 [0058.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0058.920] GetProcessHeap () returned 0x630000 [0058.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0058.920] GetProcessHeap () returned 0x630000 [0058.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.920] GetProcessHeap () returned 0x630000 [0058.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.920] GetProcessHeap () returned 0x630000 [0058.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0058.920] GetProcessHeap () returned 0x630000 [0058.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0058.921] GetProcessHeap () returned 0x630000 [0058.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.921] GetProcessHeap () returned 0x630000 [0058.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.921] GetProcessHeap () returned 0x630000 [0058.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0058.921] GetProcessHeap () returned 0x630000 [0058.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0058.921] GetProcessHeap () returned 0x630000 [0058.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0058.921] GetProcessHeap () returned 0x630000 [0058.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0058.921] GetProcessHeap () returned 0x630000 [0058.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0058.921] GetProcessHeap () returned 0x630000 [0058.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0058.921] GetProcessHeap () returned 0x630000 [0058.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0058.921] GetProcessHeap () returned 0x630000 [0058.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0058.921] GetProcessHeap () returned 0x630000 [0058.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0058.921] GetProcessHeap () returned 0x630000 [0058.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0058.921] GetProcessHeap () returned 0x630000 [0058.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0058.921] GetProcessHeap () returned 0x630000 [0058.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0058.921] GetProcessHeap () returned 0x630000 [0058.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0058.921] GetProcessHeap () returned 0x630000 [0058.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0058.921] GetProcessHeap () returned 0x630000 [0058.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0058.921] GetProcessHeap () returned 0x630000 [0058.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0058.921] GetProcessHeap () returned 0x630000 [0058.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0058.922] GetProcessHeap () returned 0x630000 [0058.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0058.922] GetProcessHeap () returned 0x630000 [0058.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0058.922] GetProcessHeap () returned 0x630000 [0058.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0058.922] GetProcessHeap () returned 0x630000 [0058.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.922] GetProcessHeap () returned 0x630000 [0058.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.924] GetProcessHeap () returned 0x630000 [0058.925] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0058.925] GetProcessHeap () returned 0x630000 [0058.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0058.925] GetProcessHeap () returned 0x630000 [0058.925] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0058.925] GetProcessHeap () returned 0x630000 [0058.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0058.925] GetProcessHeap () returned 0x630000 [0058.925] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0058.925] GetProcessHeap () returned 0x630000 [0058.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0058.925] GetProcessHeap () returned 0x630000 [0058.925] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0058.925] GetProcessHeap () returned 0x630000 [0058.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0058.925] GetProcessHeap () returned 0x630000 [0058.925] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0058.925] GetProcessHeap () returned 0x630000 [0058.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0058.925] GetProcessHeap () returned 0x630000 [0058.925] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0058.925] GetProcessHeap () returned 0x630000 [0058.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0058.925] GetProcessHeap () returned 0x630000 [0058.925] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0058.925] GetProcessHeap () returned 0x630000 [0058.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0058.925] GetProcessHeap () returned 0x630000 [0058.925] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0058.925] GetProcessHeap () returned 0x630000 [0058.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0058.925] GetProcessHeap () returned 0x630000 [0058.925] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0058.925] GetProcessHeap () returned 0x630000 [0058.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0058.925] GetProcessHeap () returned 0x630000 [0058.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0058.925] GetProcessHeap () returned 0x630000 [0058.926] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0058.926] GetProcessHeap () returned 0x630000 [0058.926] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0058.926] GetProcessHeap () returned 0x630000 [0058.926] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0058.926] GetProcessHeap () returned 0x630000 [0058.926] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0058.926] GetProcessHeap () returned 0x630000 [0058.926] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea90 | out: hHeap=0x630000) returned 1 [0058.926] GetProcessHeap () returned 0x630000 [0058.926] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0058.926] GetProcessHeap () returned 0x630000 [0058.926] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0058.926] GetProcessHeap () returned 0x630000 [0058.926] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0058.926] GetProcessHeap () returned 0x630000 [0058.926] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0058.926] GetProcessHeap () returned 0x630000 [0058.926] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0058.926] WriteFile (in: hFile=0x230, lpBuffer=0x661498*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661498*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0058.929] GetProcessHeap () returned 0x630000 [0058.929] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x661498, Size=0x30) returned 0x661498 [0058.929] GetProcessHeap () returned 0x630000 [0058.929] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0058.929] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.929] GetProcessHeap () returned 0x630000 [0058.929] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x173ae) returned 0x6614d0 [0058.929] ReadFile (in: hFile=0x230, lpBuffer=0x6614d0, nNumberOfBytesToRead=0x173ae, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x6614d0*, lpNumberOfBytesRead=0x243d7e8*=0x173ae, lpOverlapped=0x0) returned 1 [0058.930] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0058.930] WriteFile (in: hFile=0x230, lpBuffer=0x6614d0*, nNumberOfBytesToWrite=0x173ae, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x6614d0*, lpNumberOfBytesWritten=0x243d7e4*=0x173ae, lpOverlapped=0x0) returned 1 [0058.932] GetProcessHeap () returned 0x630000 [0058.932] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6614d0 | out: hHeap=0x630000) returned 1 [0058.932] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0058.932] WriteFile (in: hFile=0x230, lpBuffer=0x661498*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661498*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0058.933] CloseHandle (hObject=0x230) returned 1 [0058.936] GetProcessHeap () returned 0x630000 [0058.936] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x652000 | out: hHeap=0x630000) returned 1 [0058.936] GetProcessHeap () returned 0x630000 [0058.936] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6555f8 | out: hHeap=0x630000) returned 1 [0058.936] GetProcessHeap () returned 0x630000 [0058.936] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0058.936] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\-DhI9VRldgAPXhW-bxcS.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\-DhI9VRldgAPXhW-bxcS.swf") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\-DhI9VRldgAPXhW-bxcS.swf" [0058.936] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\-DhI9VRldgAPXhW-bxcS.swf", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\-DhI9VRldgAPXhW-bxcS.swf.happythreechoose") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\-DhI9VRldgAPXhW-bxcS.swf.happythreechoose" [0058.936] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\-DhI9VRldgAPXhW-bxcS.swf" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\-dhi9vrldgapxhw-bxcs.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\-DhI9VRldgAPXhW-bxcS.swf.happythreechoose" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\-dhi9vrldgapxhw-bxcs.swf.happythreechoose"), dwFlags=0x1) returned 1 [0058.937] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\-DhI9VRldgAPXhW-bxcS.swf" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M") returned 1 [0058.937] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\") returned="" [0058.937] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\Decryption INFO.html" [0058.937] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\decryption info.html")) returned 0xffffffff [0058.937] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0058.937] GetProcessHeap () returned 0x630000 [0058.937] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655a30 [0058.937] GetProcessHeap () returned 0x630000 [0058.938] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0058.945] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.945] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.946] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.946] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.946] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.946] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.946] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.946] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.946] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.946] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.946] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.946] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.946] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.947] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.947] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.947] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.947] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.947] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.947] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.947] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.947] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.947] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.947] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.947] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.947] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.947] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.948] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.948] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.948] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.948] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.948] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.948] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.948] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.948] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.948] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.948] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.948] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.949] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.950] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.950] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.950] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.950] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.950] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.950] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.950] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.950] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.950] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.950] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.950] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.950] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.951] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.951] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.951] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.951] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.951] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.951] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.951] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.951] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.951] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.951] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.951] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.951] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.952] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.952] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.952] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.952] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.952] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.952] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.952] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.952] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.952] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.952] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.952] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.952] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.952] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.953] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.953] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.953] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.953] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.953] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.953] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.953] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.953] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.966] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.966] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.966] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.966] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.966] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.966] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.966] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.966] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.966] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.966] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.966] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.967] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.967] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.967] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.967] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.967] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.967] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.967] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.967] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.967] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.967] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.967] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.967] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.967] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.968] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.968] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.968] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.968] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.968] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.968] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.968] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.968] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.968] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.968] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.968] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.968] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.968] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.969] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.969] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.969] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.969] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.969] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.969] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.969] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.969] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.969] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.969] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.970] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.970] GetProcessHeap () returned 0x630000 [0058.970] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655a30 | out: hHeap=0x630000) returned 1 [0058.970] GetProcessHeap () returned 0x630000 [0058.970] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0058.970] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0058.970] GetProcessHeap () returned 0x630000 [0058.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655418 [0058.970] GetProcessHeap () returned 0x630000 [0058.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0058.977] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.977] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.977] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.977] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.977] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.977] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.977] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.977] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.977] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.978] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.978] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.978] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.978] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.978] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.978] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.978] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.978] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.978] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.978] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.978] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.978] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.978] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.978] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.979] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.979] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.979] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.979] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.979] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.979] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.979] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.979] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.979] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.979] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.979] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.979] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.979] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.979] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.980] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.980] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.980] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.980] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.980] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.980] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.980] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.980] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.980] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.980] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.980] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.980] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.980] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.980] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.981] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.981] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.981] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.981] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.981] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.981] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.981] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.981] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.981] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.981] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0058.981] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.011] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.011] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.011] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.011] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.011] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.011] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.011] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.012] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.012] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.012] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.012] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.012] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.012] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.012] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.012] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.012] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.012] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.012] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.012] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.014] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.014] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.014] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.014] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.014] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.014] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.014] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.014] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.014] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.014] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.014] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.014] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.014] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.014] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.015] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.015] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.015] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.015] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.015] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.015] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.015] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.015] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.015] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.015] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.089] GetProcessHeap () returned 0x630000 [0059.090] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655418 | out: hHeap=0x630000) returned 1 [0059.090] GetProcessHeap () returned 0x630000 [0059.090] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.090] CloseHandle (hObject=0x230) returned 1 [0059.091] GetProcessHeap () returned 0x630000 [0059.091] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0059.091] FindNextFileW (in: hFindFile=0x65b690, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f027e60, ftCreationTime.dwHighDateTime=0x1d5cbaa, ftLastAccessTime.dwLowDateTime=0xc5f81100, ftLastAccessTime.dwHighDateTime=0x1d5cc4b, ftLastWriteTime.dwLowDateTime=0xc5f81100, ftLastWriteTime.dwHighDateTime=0x1d5cc4b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="G9kX78tzKIbuOa", cAlternateFileName="G9KX78~1")) returned 1 [0059.091] lstrcmpiW (lpString1="G9kX78tzKIbuOa", lpString2=".") returned 1 [0059.091] lstrcmpiW (lpString1="G9kX78tzKIbuOa", lpString2="..") returned 1 [0059.092] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\", lpString2="G9kX78tzKIbuOa" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa" [0059.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="G9kX78tzKIbuOa", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0059.092] GetProcessHeap () returned 0x630000 [0059.092] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0059.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="G9kX78tzKIbuOa", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="G9kX78tzKIbuOa", lpUsedDefaultChar=0x0) returned 15 [0059.092] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="G9kX78tzKIbuOa", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0059.092] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="G9kX78tzKIbuOa", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0059.092] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="G9kX78tzKIbuOa", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0059.092] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="G9kX78tzKIbuOa", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0059.092] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="G9kX78tzKIbuOa", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0059.092] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="G9kX78tzKIbuOa", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0059.092] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="G9kX78tzKIbuOa", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0059.093] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="G9kX78tzKIbuOa", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0059.093] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="G9kX78tzKIbuOa", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0059.093] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="G9kX78tzKIbuOa", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0059.093] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="G9kX78tzKIbuOa", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0059.093] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="G9kX78tzKIbuOa", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0059.093] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="G9kX78tzKIbuOa", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0059.093] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="G9kX78tzKIbuOa", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0059.093] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="G9kX78tzKIbuOa", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0059.093] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="G9kX78tzKIbuOa", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0059.093] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="G9kX78tzKIbuOa", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0059.095] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="G9kX78tzKIbuOa", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0059.096] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="G9kX78tzKIbuOa", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0059.096] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="G9kX78tzKIbuOa", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0059.096] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="G9kX78tzKIbuOa", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0059.096] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="G9kX78tzKIbuOa", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0059.096] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="G9kX78tzKIbuOa", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0059.096] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="G9kX78tzKIbuOa", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0059.096] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="G9kX78tzKIbuOa", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0059.096] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="G9kX78tzKIbuOa", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0059.096] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="G9kX78tzKIbuOa", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0059.096] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="G9kX78tzKIbuOa", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0059.096] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="G9kX78tzKIbuOa", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0059.096] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="G9kX78tzKIbuOa", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0059.097] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="G9kX78tzKIbuOa", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0059.098] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="G9kX78tzKIbuOa", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0059.098] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="G9kX78tzKIbuOa", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0059.103] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="G9kX78tzKIbuOa", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0059.108] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="G9kX78tzKIbuOa", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0059.112] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="G9kX78tzKIbuOa", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0059.112] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="G9kX78tzKIbuOa", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0059.112] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="G9kX78tzKIbuOa", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0059.112] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="G9kX78tzKIbuOa", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0059.112] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="G9kX78tzKIbuOa", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0059.112] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="G9kX78tzKIbuOa", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0059.112] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="G9kX78tzKIbuOa", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0059.112] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="G9kX78tzKIbuOa", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0059.112] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\" [0059.112] GetProcessHeap () returned 0x630000 [0059.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a088 [0059.112] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\") returned 52 [0059.112] GetProcessHeap () returned 0x630000 [0059.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6a) returned 0x655940 [0059.112] lstrcpyW (in: lpString1=0x655940, lpString2="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\" [0059.112] GetProcessHeap () returned 0x630000 [0059.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0059.112] FindNextFileW (in: hFindFile=0x65b690, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86d55cb0, ftCreationTime.dwHighDateTime=0x1d5d6a7, ftLastAccessTime.dwLowDateTime=0x71305bf0, ftLastAccessTime.dwHighDateTime=0x1d5d00b, ftLastWriteTime.dwLowDateTime=0x71305bf0, ftLastWriteTime.dwHighDateTime=0x1d5d00b, nFileSizeHigh=0x0, nFileSizeLow=0x18a00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="gQrFx0vJ3tbk.flv", cAlternateFileName="GQRFX0~1.FLV")) returned 1 [0059.112] lstrcmpiW (lpString1="gQrFx0vJ3tbk.flv", lpString2=".") returned 1 [0059.112] lstrcmpiW (lpString1="gQrFx0vJ3tbk.flv", lpString2="..") returned 1 [0059.113] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\", lpString2="gQrFx0vJ3tbk.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\gQrFx0vJ3tbk.flv") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\gQrFx0vJ3tbk.flv" [0059.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gQrFx0vJ3tbk.flv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0059.113] GetProcessHeap () returned 0x630000 [0059.113] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11) returned 0x645cd8 [0059.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gQrFx0vJ3tbk.flv", cchWideChar=-1, lpMultiByteStr=0x645cd8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gQrFx0vJ3tbk.flv", lpUsedDefaultChar=0x0) returned 17 [0059.113] lstrlenA (lpString="gQrFx0vJ3tbk.flv") returned 16 [0059.113] lstrlenA (lpString=".happythreechoose") returned 17 [0059.113] lstrcmpiW (lpString1="gQrFx0vJ3tbk.flv", lpString2="Decryption INFO.html") returned 1 [0059.113] lstrcmpiW (lpString1="gQrFx0vJ3tbk.flv", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0059.113] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0059.113] lstrcmpiW (lpString1="gQrFx0vJ3tbk.flv", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0059.113] GetProcessHeap () returned 0x630000 [0059.113] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0059.113] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\gQrFx0vJ3tbk.flv" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\gqrfx0vj3tbk.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0059.113] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=100864) returned 1 [0059.113] GetProcessHeap () returned 0x630000 [0059.113] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6559b8 [0059.113] GetProcessHeap () returned 0x630000 [0059.113] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.113] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\gQrFx0vJ3tbk.flv") returned 53 [0059.113] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.113] GetProcessHeap () returned 0x630000 [0059.114] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0059.114] GetProcessHeap () returned 0x630000 [0059.114] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x6614d0 [0059.114] lstrlenA (lpString="rsa_encrypt") returned 11 [0059.114] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0059.114] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0059.114] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0059.114] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0059.114] GetProcessHeap () returned 0x630000 [0059.114] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0059.114] lstrlenA (lpString="010001") returned 6 [0059.114] GetProcessHeap () returned 0x630000 [0059.114] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a0c8 [0059.115] GetProcessHeap () returned 0x630000 [0059.115] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0059.115] GetProcessHeap () returned 0x630000 [0059.115] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ec40 [0059.115] GetProcessHeap () returned 0x630000 [0059.115] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0059.115] GetProcessHeap () returned 0x630000 [0059.115] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea90 [0059.115] GetProcessHeap () returned 0x630000 [0059.115] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657558 [0059.115] GetProcessHeap () returned 0x630000 [0059.115] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a218 [0059.115] GetProcessHeap () returned 0x630000 [0059.115] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0059.115] GetProcessHeap () returned 0x630000 [0059.115] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.115] GetProcessHeap () returned 0x630000 [0059.115] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0059.115] GetProcessHeap () returned 0x630000 [0059.115] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0059.115] GetProcessHeap () returned 0x630000 [0059.115] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657210 [0059.115] GetProcessHeap () returned 0x630000 [0059.115] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.115] GetProcessHeap () returned 0x630000 [0059.115] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0059.115] GetProcessHeap () returned 0x630000 [0059.115] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e580 [0059.115] GetProcessHeap () returned 0x630000 [0059.115] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0059.115] GetProcessHeap () returned 0x630000 [0059.115] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0059.115] GetProcessHeap () returned 0x630000 [0059.115] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0059.115] GetProcessHeap () returned 0x630000 [0059.115] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0059.115] GetProcessHeap () returned 0x630000 [0059.115] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0059.115] GetProcessHeap () returned 0x630000 [0059.116] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.116] GetProcessHeap () returned 0x630000 [0059.116] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.116] GetProcessHeap () returned 0x630000 [0059.116] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0059.116] GetProcessHeap () returned 0x630000 [0059.116] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0059.116] GetProcessHeap () returned 0x630000 [0059.116] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e100 [0059.116] GetProcessHeap () returned 0x630000 [0059.116] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0059.116] GetProcessHeap () returned 0x630000 [0059.116] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0059.116] GetProcessHeap () returned 0x630000 [0059.116] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0059.116] GetProcessHeap () returned 0x630000 [0059.116] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0059.116] GetProcessHeap () returned 0x630000 [0059.116] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0059.116] GetProcessHeap () returned 0x630000 [0059.116] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0059.116] GetProcessHeap () returned 0x630000 [0059.116] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0059.116] GetProcessHeap () returned 0x630000 [0059.116] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.116] GetProcessHeap () returned 0x630000 [0059.116] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.116] GetProcessHeap () returned 0x630000 [0059.116] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0059.116] GetProcessHeap () returned 0x630000 [0059.116] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0059.116] GetProcessHeap () returned 0x630000 [0059.116] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0059.116] GetProcessHeap () returned 0x630000 [0059.116] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0059.116] GetProcessHeap () returned 0x630000 [0059.116] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.117] GetProcessHeap () returned 0x630000 [0059.117] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.117] GetProcessHeap () returned 0x630000 [0059.117] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.117] GetProcessHeap () returned 0x630000 [0059.117] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.117] GetProcessHeap () returned 0x630000 [0059.117] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.117] GetProcessHeap () returned 0x630000 [0059.117] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.117] GetProcessHeap () returned 0x630000 [0059.117] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0059.117] GetProcessHeap () returned 0x630000 [0059.117] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0059.117] GetProcessHeap () returned 0x630000 [0059.117] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.117] GetProcessHeap () returned 0x630000 [0059.117] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.117] GetProcessHeap () returned 0x630000 [0059.117] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.117] GetProcessHeap () returned 0x630000 [0059.117] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.117] GetProcessHeap () returned 0x630000 [0059.117] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0059.117] GetProcessHeap () returned 0x630000 [0059.117] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0059.117] GetProcessHeap () returned 0x630000 [0059.117] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0059.117] GetProcessHeap () returned 0x630000 [0059.117] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0059.117] GetProcessHeap () returned 0x630000 [0059.117] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0059.117] GetProcessHeap () returned 0x630000 [0059.117] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0059.117] GetProcessHeap () returned 0x630000 [0059.117] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0059.117] GetProcessHeap () returned 0x630000 [0059.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.118] GetProcessHeap () returned 0x630000 [0059.118] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.118] GetProcessHeap () returned 0x630000 [0059.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.118] GetProcessHeap () returned 0x630000 [0059.118] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0059.118] GetProcessHeap () returned 0x630000 [0059.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0059.118] GetProcessHeap () returned 0x630000 [0059.118] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0059.118] GetProcessHeap () returned 0x630000 [0059.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0059.118] GetProcessHeap () returned 0x630000 [0059.118] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0059.118] GetProcessHeap () returned 0x630000 [0059.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0059.118] GetProcessHeap () returned 0x630000 [0059.118] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.118] GetProcessHeap () returned 0x630000 [0059.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.118] GetProcessHeap () returned 0x630000 [0059.118] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0059.118] GetProcessHeap () returned 0x630000 [0059.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0059.118] GetProcessHeap () returned 0x630000 [0059.118] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.118] GetProcessHeap () returned 0x630000 [0059.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.118] GetProcessHeap () returned 0x630000 [0059.118] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0059.118] GetProcessHeap () returned 0x630000 [0059.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0059.118] GetProcessHeap () returned 0x630000 [0059.118] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0059.118] GetProcessHeap () returned 0x630000 [0059.119] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0059.119] GetProcessHeap () returned 0x630000 [0059.119] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.119] GetProcessHeap () returned 0x630000 [0059.119] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.119] GetProcessHeap () returned 0x630000 [0059.119] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0059.119] GetProcessHeap () returned 0x630000 [0059.119] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0059.119] GetProcessHeap () returned 0x630000 [0059.119] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0059.119] GetProcessHeap () returned 0x630000 [0059.119] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.119] GetProcessHeap () returned 0x630000 [0059.119] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0059.119] GetProcessHeap () returned 0x630000 [0059.119] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0059.119] GetProcessHeap () returned 0x630000 [0059.119] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0059.119] GetProcessHeap () returned 0x630000 [0059.119] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0059.119] GetProcessHeap () returned 0x630000 [0059.119] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0059.119] GetProcessHeap () returned 0x630000 [0059.119] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0059.119] GetProcessHeap () returned 0x630000 [0059.119] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0059.119] GetProcessHeap () returned 0x630000 [0059.119] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0059.119] GetProcessHeap () returned 0x630000 [0059.119] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0059.119] GetProcessHeap () returned 0x630000 [0059.119] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0059.119] GetProcessHeap () returned 0x630000 [0059.119] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0059.119] GetProcessHeap () returned 0x630000 [0059.119] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0059.119] GetProcessHeap () returned 0x630000 [0059.120] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0059.120] GetProcessHeap () returned 0x630000 [0059.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0059.120] GetProcessHeap () returned 0x630000 [0059.120] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0059.120] GetProcessHeap () returned 0x630000 [0059.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0059.120] GetProcessHeap () returned 0x630000 [0059.120] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0059.120] GetProcessHeap () returned 0x630000 [0059.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0059.120] GetProcessHeap () returned 0x630000 [0059.120] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.120] GetProcessHeap () returned 0x630000 [0059.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.120] GetProcessHeap () returned 0x630000 [0059.120] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0059.120] GetProcessHeap () returned 0x630000 [0059.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0059.120] GetProcessHeap () returned 0x630000 [0059.120] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0059.120] GetProcessHeap () returned 0x630000 [0059.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0059.120] GetProcessHeap () returned 0x630000 [0059.120] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0059.120] GetProcessHeap () returned 0x630000 [0059.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0059.120] GetProcessHeap () returned 0x630000 [0059.120] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0059.120] GetProcessHeap () returned 0x630000 [0059.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0059.120] GetProcessHeap () returned 0x630000 [0059.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0059.120] GetProcessHeap () returned 0x630000 [0059.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0059.120] GetProcessHeap () returned 0x630000 [0059.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0059.121] GetProcessHeap () returned 0x630000 [0059.121] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0059.121] GetProcessHeap () returned 0x630000 [0059.121] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0059.121] GetProcessHeap () returned 0x630000 [0059.121] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea90 | out: hHeap=0x630000) returned 1 [0059.121] GetProcessHeap () returned 0x630000 [0059.121] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0059.121] GetProcessHeap () returned 0x630000 [0059.121] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ec40 | out: hHeap=0x630000) returned 1 [0059.121] GetProcessHeap () returned 0x630000 [0059.121] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0059.121] GetProcessHeap () returned 0x630000 [0059.121] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0059.121] GetProcessHeap () returned 0x630000 [0059.121] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0059.121] WriteFile (in: hFile=0x230, lpBuffer=0x6614d0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6614d0*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0059.123] GetProcessHeap () returned 0x630000 [0059.123] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6614d0, Size=0x30) returned 0x6614d0 [0059.123] GetProcessHeap () returned 0x630000 [0059.123] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0059.123] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.123] GetProcessHeap () returned 0x630000 [0059.123] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18a00) returned 0x661508 [0059.124] ReadFile (in: hFile=0x230, lpBuffer=0x661508, nNumberOfBytesToRead=0x18a00, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661508*, lpNumberOfBytesRead=0x243d7e8*=0x18a00, lpOverlapped=0x0) returned 1 [0059.125] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.125] WriteFile (in: hFile=0x230, lpBuffer=0x661508*, nNumberOfBytesToWrite=0x18a00, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661508*, lpNumberOfBytesWritten=0x243d7e4*=0x18a00, lpOverlapped=0x0) returned 1 [0059.127] GetProcessHeap () returned 0x630000 [0059.127] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661508 | out: hHeap=0x630000) returned 1 [0059.129] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.129] WriteFile (in: hFile=0x230, lpBuffer=0x6614d0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6614d0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0059.130] CloseHandle (hObject=0x230) returned 1 [0059.133] GetProcessHeap () returned 0x630000 [0059.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0059.133] GetProcessHeap () returned 0x630000 [0059.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6559b8 | out: hHeap=0x630000) returned 1 [0059.133] GetProcessHeap () returned 0x630000 [0059.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.133] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\gQrFx0vJ3tbk.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\gQrFx0vJ3tbk.flv") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\gQrFx0vJ3tbk.flv" [0059.133] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\gQrFx0vJ3tbk.flv", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\gQrFx0vJ3tbk.flv.happythreechoose") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\gQrFx0vJ3tbk.flv.happythreechoose" [0059.133] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\gQrFx0vJ3tbk.flv" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\gqrfx0vj3tbk.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\gQrFx0vJ3tbk.flv.happythreechoose" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\gqrfx0vj3tbk.flv.happythreechoose"), dwFlags=0x1) returned 1 [0059.134] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\gQrFx0vJ3tbk.flv" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M") returned 1 [0059.134] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\") returned="" [0059.134] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\Decryption INFO.html" [0059.134] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\decryption info.html")) returned 0x20 [0059.134] GetProcessHeap () returned 0x630000 [0059.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645cd8 | out: hHeap=0x630000) returned 1 [0059.134] FindNextFileW (in: hFindFile=0x65b690, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a10c440, ftCreationTime.dwHighDateTime=0x1d5cf23, ftLastAccessTime.dwLowDateTime=0xeb266180, ftLastAccessTime.dwHighDateTime=0x1d5d7f8, ftLastWriteTime.dwLowDateTime=0xeb266180, ftLastWriteTime.dwHighDateTime=0x1d5d7f8, nFileSizeHigh=0x0, nFileSizeLow=0xa0dd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HZoz_t2tX2n5.mp4", cAlternateFileName="HZOZ_T~1.MP4")) returned 1 [0059.134] lstrcmpiW (lpString1="HZoz_t2tX2n5.mp4", lpString2=".") returned 1 [0059.134] lstrcmpiW (lpString1="HZoz_t2tX2n5.mp4", lpString2="..") returned 1 [0059.134] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\", lpString2="HZoz_t2tX2n5.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\HZoz_t2tX2n5.mp4") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\HZoz_t2tX2n5.mp4" [0059.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HZoz_t2tX2n5.mp4", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0059.134] GetProcessHeap () returned 0x630000 [0059.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11) returned 0x645e78 [0059.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HZoz_t2tX2n5.mp4", cchWideChar=-1, lpMultiByteStr=0x645e78, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HZoz_t2tX2n5.mp4", lpUsedDefaultChar=0x0) returned 17 [0059.134] lstrlenA (lpString="HZoz_t2tX2n5.mp4") returned 16 [0059.134] lstrlenA (lpString=".happythreechoose") returned 17 [0059.134] lstrcmpiW (lpString1="HZoz_t2tX2n5.mp4", lpString2="Decryption INFO.html") returned 1 [0059.134] lstrcmpiW (lpString1="HZoz_t2tX2n5.mp4", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0059.134] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0059.134] lstrcmpiW (lpString1="HZoz_t2tX2n5.mp4", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0059.134] GetProcessHeap () returned 0x630000 [0059.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0059.134] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\HZoz_t2tX2n5.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\hzoz_t2tx2n5.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0059.135] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=41181) returned 1 [0059.135] GetProcessHeap () returned 0x630000 [0059.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655580 [0059.135] GetProcessHeap () returned 0x630000 [0059.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.135] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\HZoz_t2tX2n5.mp4") returned 53 [0059.135] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.135] GetProcessHeap () returned 0x630000 [0059.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0059.135] GetProcessHeap () returned 0x630000 [0059.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x661508 [0059.136] lstrlenA (lpString="rsa_encrypt") returned 11 [0059.136] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0059.137] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0059.137] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0059.137] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0059.137] GetProcessHeap () returned 0x630000 [0059.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0059.137] lstrlenA (lpString="010001") returned 6 [0059.137] GetProcessHeap () returned 0x630000 [0059.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a1b8 [0059.137] GetProcessHeap () returned 0x630000 [0059.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0059.137] GetProcessHeap () returned 0x630000 [0059.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e190 [0059.137] GetProcessHeap () returned 0x630000 [0059.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0059.137] GetProcessHeap () returned 0x630000 [0059.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e850 [0059.137] GetProcessHeap () returned 0x630000 [0059.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656ec8 [0059.137] GetProcessHeap () returned 0x630000 [0059.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a1e8 [0059.137] GetProcessHeap () returned 0x630000 [0059.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0059.137] GetProcessHeap () returned 0x630000 [0059.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0059.137] GetProcessHeap () returned 0x630000 [0059.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0059.137] GetProcessHeap () returned 0x630000 [0059.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0059.137] GetProcessHeap () returned 0x630000 [0059.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657558 [0059.137] GetProcessHeap () returned 0x630000 [0059.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0059.138] GetProcessHeap () returned 0x630000 [0059.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0059.138] GetProcessHeap () returned 0x630000 [0059.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e460 [0059.138] GetProcessHeap () returned 0x630000 [0059.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0059.138] GetProcessHeap () returned 0x630000 [0059.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0059.138] GetProcessHeap () returned 0x630000 [0059.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e460 | out: hHeap=0x630000) returned 1 [0059.138] GetProcessHeap () returned 0x630000 [0059.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0059.138] GetProcessHeap () returned 0x630000 [0059.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0059.138] GetProcessHeap () returned 0x630000 [0059.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0059.138] GetProcessHeap () returned 0x630000 [0059.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0059.138] GetProcessHeap () returned 0x630000 [0059.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0059.138] GetProcessHeap () returned 0x630000 [0059.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0059.138] GetProcessHeap () returned 0x630000 [0059.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e8e0 [0059.138] GetProcessHeap () returned 0x630000 [0059.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0059.138] GetProcessHeap () returned 0x630000 [0059.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0059.138] GetProcessHeap () returned 0x630000 [0059.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0059.138] GetProcessHeap () returned 0x630000 [0059.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0059.138] GetProcessHeap () returned 0x630000 [0059.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0059.138] GetProcessHeap () returned 0x630000 [0059.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0059.138] GetProcessHeap () returned 0x630000 [0059.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0059.139] GetProcessHeap () returned 0x630000 [0059.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.139] GetProcessHeap () returned 0x630000 [0059.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.139] GetProcessHeap () returned 0x630000 [0059.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.139] GetProcessHeap () returned 0x630000 [0059.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.139] GetProcessHeap () returned 0x630000 [0059.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0059.139] GetProcessHeap () returned 0x630000 [0059.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0059.139] GetProcessHeap () returned 0x630000 [0059.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0059.139] GetProcessHeap () returned 0x630000 [0059.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0059.139] GetProcessHeap () returned 0x630000 [0059.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0059.139] GetProcessHeap () returned 0x630000 [0059.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0059.139] GetProcessHeap () returned 0x630000 [0059.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0059.139] GetProcessHeap () returned 0x630000 [0059.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.139] GetProcessHeap () returned 0x630000 [0059.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0059.139] GetProcessHeap () returned 0x630000 [0059.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0059.139] GetProcessHeap () returned 0x630000 [0059.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.139] GetProcessHeap () returned 0x630000 [0059.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.139] GetProcessHeap () returned 0x630000 [0059.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0059.139] GetProcessHeap () returned 0x630000 [0059.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0059.140] GetProcessHeap () returned 0x630000 [0059.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0059.140] GetProcessHeap () returned 0x630000 [0059.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0059.140] GetProcessHeap () returned 0x630000 [0059.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.140] GetProcessHeap () returned 0x630000 [0059.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.140] GetProcessHeap () returned 0x630000 [0059.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0059.140] GetProcessHeap () returned 0x630000 [0059.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0059.140] GetProcessHeap () returned 0x630000 [0059.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0059.140] GetProcessHeap () returned 0x630000 [0059.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0059.140] GetProcessHeap () returned 0x630000 [0059.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.140] GetProcessHeap () returned 0x630000 [0059.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.140] GetProcessHeap () returned 0x630000 [0059.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0059.140] GetProcessHeap () returned 0x630000 [0059.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0059.140] GetProcessHeap () returned 0x630000 [0059.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0059.140] GetProcessHeap () returned 0x630000 [0059.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.140] GetProcessHeap () returned 0x630000 [0059.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0059.140] GetProcessHeap () returned 0x630000 [0059.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0059.140] GetProcessHeap () returned 0x630000 [0059.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.140] GetProcessHeap () returned 0x630000 [0059.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.140] GetProcessHeap () returned 0x630000 [0059.141] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0059.141] GetProcessHeap () returned 0x630000 [0059.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0059.141] GetProcessHeap () returned 0x630000 [0059.141] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0059.141] GetProcessHeap () returned 0x630000 [0059.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0059.141] GetProcessHeap () returned 0x630000 [0059.141] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0059.141] GetProcessHeap () returned 0x630000 [0059.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0059.141] GetProcessHeap () returned 0x630000 [0059.141] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0059.141] GetProcessHeap () returned 0x630000 [0059.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.141] GetProcessHeap () returned 0x630000 [0059.141] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0059.141] GetProcessHeap () returned 0x630000 [0059.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.141] GetProcessHeap () returned 0x630000 [0059.141] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0059.141] GetProcessHeap () returned 0x630000 [0059.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0059.141] GetProcessHeap () returned 0x630000 [0059.141] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.141] GetProcessHeap () returned 0x630000 [0059.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.142] GetProcessHeap () returned 0x630000 [0059.142] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0059.142] GetProcessHeap () returned 0x630000 [0059.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0059.142] GetProcessHeap () returned 0x630000 [0059.142] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0059.142] GetProcessHeap () returned 0x630000 [0059.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0059.142] GetProcessHeap () returned 0x630000 [0059.142] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0059.142] GetProcessHeap () returned 0x630000 [0059.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0059.142] GetProcessHeap () returned 0x630000 [0059.142] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.142] GetProcessHeap () returned 0x630000 [0059.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.142] GetProcessHeap () returned 0x630000 [0059.142] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.142] GetProcessHeap () returned 0x630000 [0059.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.142] GetProcessHeap () returned 0x630000 [0059.142] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.142] GetProcessHeap () returned 0x630000 [0059.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.142] GetProcessHeap () returned 0x630000 [0059.142] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0059.142] GetProcessHeap () returned 0x630000 [0059.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0059.142] GetProcessHeap () returned 0x630000 [0059.142] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0059.142] GetProcessHeap () returned 0x630000 [0059.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0059.142] GetProcessHeap () returned 0x630000 [0059.142] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0059.142] GetProcessHeap () returned 0x630000 [0059.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0059.142] GetProcessHeap () returned 0x630000 [0059.143] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.143] GetProcessHeap () returned 0x630000 [0059.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.143] GetProcessHeap () returned 0x630000 [0059.143] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0059.143] GetProcessHeap () returned 0x630000 [0059.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.143] GetProcessHeap () returned 0x630000 [0059.143] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0059.143] GetProcessHeap () returned 0x630000 [0059.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0059.143] GetProcessHeap () returned 0x630000 [0059.143] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0059.143] GetProcessHeap () returned 0x630000 [0059.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0059.143] GetProcessHeap () returned 0x630000 [0059.143] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0059.143] GetProcessHeap () returned 0x630000 [0059.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0059.143] GetProcessHeap () returned 0x630000 [0059.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0059.143] GetProcessHeap () returned 0x630000 [0059.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0059.143] GetProcessHeap () returned 0x630000 [0059.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0059.143] GetProcessHeap () returned 0x630000 [0059.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0059.143] GetProcessHeap () returned 0x630000 [0059.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0059.143] GetProcessHeap () returned 0x630000 [0059.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0059.143] GetProcessHeap () returned 0x630000 [0059.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0059.143] GetProcessHeap () returned 0x630000 [0059.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0059.143] GetProcessHeap () returned 0x630000 [0059.144] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0059.144] GetProcessHeap () returned 0x630000 [0059.144] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.144] GetProcessHeap () returned 0x630000 [0059.144] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0059.144] WriteFile (in: hFile=0x230, lpBuffer=0x661508*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661508*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0059.146] GetProcessHeap () returned 0x630000 [0059.146] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x661508, Size=0x30) returned 0x661508 [0059.146] GetProcessHeap () returned 0x630000 [0059.146] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0059.146] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.146] GetProcessHeap () returned 0x630000 [0059.146] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa0dd) returned 0x661540 [0059.147] ReadFile (in: hFile=0x230, lpBuffer=0x661540, nNumberOfBytesToRead=0xa0dd, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661540*, lpNumberOfBytesRead=0x243d7e8*=0xa0dd, lpOverlapped=0x0) returned 1 [0059.147] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.147] WriteFile (in: hFile=0x230, lpBuffer=0x661540*, nNumberOfBytesToWrite=0xa0dd, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661540*, lpNumberOfBytesWritten=0x243d7e4*=0xa0dd, lpOverlapped=0x0) returned 1 [0059.149] GetProcessHeap () returned 0x630000 [0059.149] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661540 | out: hHeap=0x630000) returned 1 [0059.150] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.150] WriteFile (in: hFile=0x230, lpBuffer=0x661508*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661508*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0059.151] CloseHandle (hObject=0x230) returned 1 [0059.153] GetProcessHeap () returned 0x630000 [0059.153] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0059.153] GetProcessHeap () returned 0x630000 [0059.153] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655580 | out: hHeap=0x630000) returned 1 [0059.153] GetProcessHeap () returned 0x630000 [0059.153] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.153] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\HZoz_t2tX2n5.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\HZoz_t2tX2n5.mp4") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\HZoz_t2tX2n5.mp4" [0059.153] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\HZoz_t2tX2n5.mp4", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\HZoz_t2tX2n5.mp4.happythreechoose") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\HZoz_t2tX2n5.mp4.happythreechoose" [0059.154] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\HZoz_t2tX2n5.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\hzoz_t2tx2n5.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\HZoz_t2tX2n5.mp4.happythreechoose" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\hzoz_t2tx2n5.mp4.happythreechoose"), dwFlags=0x1) returned 1 [0059.154] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\HZoz_t2tX2n5.mp4" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M") returned 1 [0059.154] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\") returned="" [0059.154] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\Decryption INFO.html" [0059.154] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\decryption info.html")) returned 0x20 [0059.154] GetProcessHeap () returned 0x630000 [0059.154] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645e78 | out: hHeap=0x630000) returned 1 [0059.154] FindNextFileW (in: hFindFile=0x65b690, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d8b3930, ftCreationTime.dwHighDateTime=0x1d5c852, ftLastAccessTime.dwLowDateTime=0xafa525e0, ftLastAccessTime.dwHighDateTime=0x1d5d57a, ftLastWriteTime.dwLowDateTime=0xafa525e0, ftLastWriteTime.dwHighDateTime=0x1d5d57a, nFileSizeHigh=0x0, nFileSizeLow=0xd2c2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ibcl6vOksMSziPl_5.avi", cAlternateFileName="IBCL6V~1.AVI")) returned 1 [0059.154] lstrcmpiW (lpString1="ibcl6vOksMSziPl_5.avi", lpString2=".") returned 1 [0059.155] lstrcmpiW (lpString1="ibcl6vOksMSziPl_5.avi", lpString2="..") returned 1 [0059.155] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\", lpString2="ibcl6vOksMSziPl_5.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\ibcl6vOksMSziPl_5.avi") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\ibcl6vOksMSziPl_5.avi" [0059.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ibcl6vOksMSziPl_5.avi", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0059.155] GetProcessHeap () returned 0x630000 [0059.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x645e58 [0059.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ibcl6vOksMSziPl_5.avi", cchWideChar=-1, lpMultiByteStr=0x645e58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ibcl6vOksMSziPl_5.avi", lpUsedDefaultChar=0x0) returned 22 [0059.155] lstrlenA (lpString="ibcl6vOksMSziPl_5.avi") returned 21 [0059.155] lstrlenA (lpString=".happythreechoose") returned 17 [0059.155] lstrlenA (lpString=".happythreechoose") returned 17 [0059.155] lstrlenA (lpString="ibcl6vOksMSziPl_5.avi") returned 21 [0059.155] lstrcmpiA (lpString1="6vOksMSziPl_5.avi", lpString2=".happythreechoose") returned 1 [0059.155] lstrcmpiW (lpString1="ibcl6vOksMSziPl_5.avi", lpString2="Decryption INFO.html") returned 1 [0059.155] lstrcmpiW (lpString1="ibcl6vOksMSziPl_5.avi", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0059.155] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0059.155] lstrcmpiW (lpString1="ibcl6vOksMSziPl_5.avi", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0059.155] GetProcessHeap () returned 0x630000 [0059.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0059.155] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\ibcl6vOksMSziPl_5.avi" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\ibcl6voksmszipl_5.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0059.155] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=53954) returned 1 [0059.155] GetProcessHeap () returned 0x630000 [0059.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655418 [0059.155] GetProcessHeap () returned 0x630000 [0059.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.155] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\ibcl6vOksMSziPl_5.avi") returned 58 [0059.155] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.155] GetProcessHeap () returned 0x630000 [0059.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0059.155] GetProcessHeap () returned 0x630000 [0059.156] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38e) returned 0x661540 [0059.157] lstrlenA (lpString="rsa_encrypt") returned 11 [0059.157] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0059.157] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0059.157] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0059.157] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0059.157] GetProcessHeap () returned 0x630000 [0059.157] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0059.158] lstrlenA (lpString="010001") returned 6 [0059.158] GetProcessHeap () returned 0x630000 [0059.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a218 [0059.158] GetProcessHeap () returned 0x630000 [0059.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0059.158] GetProcessHeap () returned 0x630000 [0059.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e610 [0059.158] GetProcessHeap () returned 0x630000 [0059.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0059.158] GetProcessHeap () returned 0x630000 [0059.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e730 [0059.158] GetProcessHeap () returned 0x630000 [0059.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656950 [0059.158] GetProcessHeap () returned 0x630000 [0059.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a238 [0059.158] GetProcessHeap () returned 0x630000 [0059.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0059.158] GetProcessHeap () returned 0x630000 [0059.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0059.158] GetProcessHeap () returned 0x630000 [0059.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0059.158] GetProcessHeap () returned 0x630000 [0059.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0059.158] GetProcessHeap () returned 0x630000 [0059.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656b80 [0059.158] GetProcessHeap () returned 0x630000 [0059.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0059.158] GetProcessHeap () returned 0x630000 [0059.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0059.158] GetProcessHeap () returned 0x630000 [0059.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea00 [0059.158] GetProcessHeap () returned 0x630000 [0059.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0059.158] GetProcessHeap () returned 0x630000 [0059.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0059.158] GetProcessHeap () returned 0x630000 [0059.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0059.159] GetProcessHeap () returned 0x630000 [0059.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0059.159] GetProcessHeap () returned 0x630000 [0059.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0059.159] GetProcessHeap () returned 0x630000 [0059.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0059.159] GetProcessHeap () returned 0x630000 [0059.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0059.159] GetProcessHeap () returned 0x630000 [0059.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0059.159] GetProcessHeap () returned 0x630000 [0059.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0059.159] GetProcessHeap () returned 0x630000 [0059.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e7c0 [0059.159] GetProcessHeap () returned 0x630000 [0059.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0059.159] GetProcessHeap () returned 0x630000 [0059.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0059.159] GetProcessHeap () returned 0x630000 [0059.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e7c0 | out: hHeap=0x630000) returned 1 [0059.159] GetProcessHeap () returned 0x630000 [0059.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0059.159] GetProcessHeap () returned 0x630000 [0059.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0059.159] GetProcessHeap () returned 0x630000 [0059.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0059.159] GetProcessHeap () returned 0x630000 [0059.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0059.159] GetProcessHeap () returned 0x630000 [0059.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0059.159] GetProcessHeap () returned 0x630000 [0059.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0059.159] GetProcessHeap () returned 0x630000 [0059.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0059.159] GetProcessHeap () returned 0x630000 [0059.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0059.159] GetProcessHeap () returned 0x630000 [0059.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0059.160] GetProcessHeap () returned 0x630000 [0059.160] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0059.160] GetProcessHeap () returned 0x630000 [0059.160] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0059.160] GetProcessHeap () returned 0x630000 [0059.160] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0059.160] GetProcessHeap () returned 0x630000 [0059.160] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.160] GetProcessHeap () returned 0x630000 [0059.160] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.160] GetProcessHeap () returned 0x630000 [0059.160] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0059.160] GetProcessHeap () returned 0x630000 [0059.160] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0059.160] GetProcessHeap () returned 0x630000 [0059.160] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0059.160] GetProcessHeap () returned 0x630000 [0059.160] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0059.160] GetProcessHeap () returned 0x630000 [0059.160] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0059.160] GetProcessHeap () returned 0x630000 [0059.160] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0059.160] GetProcessHeap () returned 0x630000 [0059.160] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0059.160] GetProcessHeap () returned 0x630000 [0059.160] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0059.160] GetProcessHeap () returned 0x630000 [0059.160] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0059.160] GetProcessHeap () returned 0x630000 [0059.160] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0059.160] GetProcessHeap () returned 0x630000 [0059.160] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.160] GetProcessHeap () returned 0x630000 [0059.160] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.160] GetProcessHeap () returned 0x630000 [0059.160] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0059.160] GetProcessHeap () returned 0x630000 [0059.161] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0059.161] GetProcessHeap () returned 0x630000 [0059.161] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.161] GetProcessHeap () returned 0x630000 [0059.161] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.161] GetProcessHeap () returned 0x630000 [0059.161] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0059.161] GetProcessHeap () returned 0x630000 [0059.161] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0059.161] GetProcessHeap () returned 0x630000 [0059.161] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0059.161] GetProcessHeap () returned 0x630000 [0059.161] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.161] GetProcessHeap () returned 0x630000 [0059.161] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0059.161] GetProcessHeap () returned 0x630000 [0059.161] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0059.161] GetProcessHeap () returned 0x630000 [0059.161] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0059.161] GetProcessHeap () returned 0x630000 [0059.161] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0059.161] GetProcessHeap () returned 0x630000 [0059.161] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.161] GetProcessHeap () returned 0x630000 [0059.161] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.161] GetProcessHeap () returned 0x630000 [0059.161] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0059.161] GetProcessHeap () returned 0x630000 [0059.161] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0059.161] GetProcessHeap () returned 0x630000 [0059.161] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0059.161] GetProcessHeap () returned 0x630000 [0059.161] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.161] GetProcessHeap () returned 0x630000 [0059.161] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0059.161] GetProcessHeap () returned 0x630000 [0059.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0059.162] GetProcessHeap () returned 0x630000 [0059.162] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0059.162] GetProcessHeap () returned 0x630000 [0059.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0059.162] GetProcessHeap () returned 0x630000 [0059.162] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0059.162] GetProcessHeap () returned 0x630000 [0059.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0059.162] GetProcessHeap () returned 0x630000 [0059.162] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.162] GetProcessHeap () returned 0x630000 [0059.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.162] GetProcessHeap () returned 0x630000 [0059.162] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0e8 [0059.162] GetProcessHeap () returned 0x630000 [0059.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0e8 | out: hHeap=0x630000) returned 1 [0059.162] GetProcessHeap () returned 0x630000 [0059.162] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0059.162] GetProcessHeap () returned 0x630000 [0059.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0059.162] GetProcessHeap () returned 0x630000 [0059.162] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0059.162] GetProcessHeap () returned 0x630000 [0059.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0059.162] GetProcessHeap () returned 0x630000 [0059.162] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0059.162] GetProcessHeap () returned 0x630000 [0059.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0059.162] GetProcessHeap () returned 0x630000 [0059.162] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0059.163] GetProcessHeap () returned 0x630000 [0059.163] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0059.163] GetProcessHeap () returned 0x630000 [0059.163] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0059.163] GetProcessHeap () returned 0x630000 [0059.163] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0059.163] GetProcessHeap () returned 0x630000 [0059.163] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0059.163] GetProcessHeap () returned 0x630000 [0059.163] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.163] GetProcessHeap () returned 0x630000 [0059.163] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0059.163] GetProcessHeap () returned 0x630000 [0059.163] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0059.163] GetProcessHeap () returned 0x630000 [0059.163] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0059.163] GetProcessHeap () returned 0x630000 [0059.163] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0059.163] GetProcessHeap () returned 0x630000 [0059.163] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0059.163] GetProcessHeap () returned 0x630000 [0059.163] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0059.163] GetProcessHeap () returned 0x630000 [0059.163] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0059.163] GetProcessHeap () returned 0x630000 [0059.163] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0059.163] GetProcessHeap () returned 0x630000 [0059.163] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0059.163] GetProcessHeap () returned 0x630000 [0059.163] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0059.164] GetProcessHeap () returned 0x630000 [0059.164] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0059.164] GetProcessHeap () returned 0x630000 [0059.164] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0059.164] GetProcessHeap () returned 0x630000 [0059.164] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0059.164] GetProcessHeap () returned 0x630000 [0059.164] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0059.164] GetProcessHeap () returned 0x630000 [0059.164] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0059.164] GetProcessHeap () returned 0x630000 [0059.164] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0059.164] GetProcessHeap () returned 0x630000 [0059.164] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0059.164] GetProcessHeap () returned 0x630000 [0059.164] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0059.164] GetProcessHeap () returned 0x630000 [0059.164] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0059.164] GetProcessHeap () returned 0x630000 [0059.164] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0059.164] GetProcessHeap () returned 0x630000 [0059.164] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0059.164] GetProcessHeap () returned 0x630000 [0059.164] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0059.164] GetProcessHeap () returned 0x630000 [0059.164] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0059.164] GetProcessHeap () returned 0x630000 [0059.164] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0059.164] GetProcessHeap () returned 0x630000 [0059.164] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0059.164] GetProcessHeap () returned 0x630000 [0059.164] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.164] GetProcessHeap () returned 0x630000 [0059.164] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0059.164] WriteFile (in: hFile=0x230, lpBuffer=0x661540*, nNumberOfBytesToWrite=0x38e, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661540*, lpNumberOfBytesWritten=0x243d864*=0x38e, lpOverlapped=0x0) returned 1 [0059.167] GetProcessHeap () returned 0x630000 [0059.167] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x661540, Size=0x30) returned 0x661540 [0059.167] GetProcessHeap () returned 0x630000 [0059.168] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0059.168] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.168] GetProcessHeap () returned 0x630000 [0059.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd2d0) returned 0x661578 [0059.168] ReadFile (in: hFile=0x230, lpBuffer=0x661578, nNumberOfBytesToRead=0xd2d0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661578*, lpNumberOfBytesRead=0x243d7e8*=0xd2d0, lpOverlapped=0x0) returned 1 [0059.169] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.169] WriteFile (in: hFile=0x230, lpBuffer=0x661578*, nNumberOfBytesToWrite=0xd2d0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661578*, lpNumberOfBytesWritten=0x243d7e4*=0xd2d0, lpOverlapped=0x0) returned 1 [0059.171] GetProcessHeap () returned 0x630000 [0059.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661578 | out: hHeap=0x630000) returned 1 [0059.171] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.171] WriteFile (in: hFile=0x230, lpBuffer=0x661540*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661540*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0059.176] CloseHandle (hObject=0x230) returned 1 [0059.178] GetProcessHeap () returned 0x630000 [0059.178] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0059.178] GetProcessHeap () returned 0x630000 [0059.178] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655418 | out: hHeap=0x630000) returned 1 [0059.178] GetProcessHeap () returned 0x630000 [0059.178] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.178] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\ibcl6vOksMSziPl_5.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\ibcl6vOksMSziPl_5.avi") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\ibcl6vOksMSziPl_5.avi" [0059.178] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\ibcl6vOksMSziPl_5.avi", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\ibcl6vOksMSziPl_5.avi.happythreechoose") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\ibcl6vOksMSziPl_5.avi.happythreechoose" [0059.179] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\ibcl6vOksMSziPl_5.avi" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\ibcl6voksmszipl_5.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\ibcl6vOksMSziPl_5.avi.happythreechoose" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\ibcl6voksmszipl_5.avi.happythreechoose"), dwFlags=0x1) returned 1 [0059.179] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\ibcl6vOksMSziPl_5.avi" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M") returned 1 [0059.179] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\") returned="" [0059.179] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\Decryption INFO.html" [0059.179] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\decryption info.html")) returned 0x20 [0059.179] GetProcessHeap () returned 0x630000 [0059.179] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645e58 | out: hHeap=0x630000) returned 1 [0059.179] FindNextFileW (in: hFindFile=0x65b690, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ab4db10, ftCreationTime.dwHighDateTime=0x1d5ca3c, ftLastAccessTime.dwLowDateTime=0xd58b56b0, ftLastAccessTime.dwHighDateTime=0x1d5cffa, ftLastWriteTime.dwLowDateTime=0xd58b56b0, ftLastWriteTime.dwHighDateTime=0x1d5cffa, nFileSizeHigh=0x0, nFileSizeLow=0x13af6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MFp-.swf", cAlternateFileName="")) returned 1 [0059.179] lstrcmpiW (lpString1="MFp-.swf", lpString2=".") returned 1 [0059.179] lstrcmpiW (lpString1="MFp-.swf", lpString2="..") returned 1 [0059.179] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\", lpString2="MFp-.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\MFp-.swf") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\MFp-.swf" [0059.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MFp-.swf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0059.180] GetProcessHeap () returned 0x630000 [0059.180] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9) returned 0x64ca20 [0059.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MFp-.swf", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MFp-.swf", lpUsedDefaultChar=0x0) returned 9 [0059.180] lstrlenA (lpString="MFp-.swf") returned 8 [0059.180] lstrlenA (lpString=".happythreechoose") returned 17 [0059.180] lstrcmpiW (lpString1="MFp-.swf", lpString2="Decryption INFO.html") returned 1 [0059.180] lstrcmpiW (lpString1="MFp-.swf", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0059.180] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0059.180] lstrcmpiW (lpString1="MFp-.swf", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0059.180] GetProcessHeap () returned 0x630000 [0059.180] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0059.180] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\MFp-.swf" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\mfp-.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0059.180] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=80630) returned 1 [0059.180] GetProcessHeap () returned 0x630000 [0059.180] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655850 [0059.180] GetProcessHeap () returned 0x630000 [0059.180] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0059.180] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\MFp-.swf") returned 45 [0059.180] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.180] GetProcessHeap () returned 0x630000 [0059.180] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0059.180] GetProcessHeap () returned 0x630000 [0059.180] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x65a6c0 [0059.180] lstrlenA (lpString="rsa_encrypt") returned 11 [0059.180] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0059.181] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0059.181] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0059.181] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0059.181] GetProcessHeap () returned 0x630000 [0059.181] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0059.181] lstrlenA (lpString="010001") returned 6 [0059.181] GetProcessHeap () returned 0x630000 [0059.181] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a058 [0059.181] GetProcessHeap () returned 0x630000 [0059.181] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.181] GetProcessHeap () returned 0x630000 [0059.181] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e3d0 [0059.181] GetProcessHeap () returned 0x630000 [0059.181] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.181] GetProcessHeap () returned 0x630000 [0059.181] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65eb20 [0059.181] GetProcessHeap () returned 0x630000 [0059.181] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657328 [0059.181] GetProcessHeap () returned 0x630000 [0059.181] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a0f8 [0059.181] GetProcessHeap () returned 0x630000 [0059.182] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0059.182] GetProcessHeap () returned 0x630000 [0059.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0059.182] GetProcessHeap () returned 0x630000 [0059.182] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0059.182] GetProcessHeap () returned 0x630000 [0059.182] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.182] GetProcessHeap () returned 0x630000 [0059.182] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657440 [0059.182] GetProcessHeap () returned 0x630000 [0059.182] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0059.182] GetProcessHeap () returned 0x630000 [0059.182] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0059.182] GetProcessHeap () returned 0x630000 [0059.182] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e460 [0059.182] GetProcessHeap () returned 0x630000 [0059.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.182] GetProcessHeap () returned 0x630000 [0059.182] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0059.182] GetProcessHeap () returned 0x630000 [0059.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e460 | out: hHeap=0x630000) returned 1 [0059.182] GetProcessHeap () returned 0x630000 [0059.182] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.182] GetProcessHeap () returned 0x630000 [0059.182] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cec8 [0059.182] GetProcessHeap () returned 0x630000 [0059.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0059.182] GetProcessHeap () returned 0x630000 [0059.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.182] GetProcessHeap () returned 0x630000 [0059.182] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.182] GetProcessHeap () returned 0x630000 [0059.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.182] GetProcessHeap () returned 0x630000 [0059.182] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e460 [0059.182] GetProcessHeap () returned 0x630000 [0059.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cec8 | out: hHeap=0x630000) returned 1 [0059.182] GetProcessHeap () returned 0x630000 [0059.182] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0059.183] GetProcessHeap () returned 0x630000 [0059.183] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e460 | out: hHeap=0x630000) returned 1 [0059.183] GetProcessHeap () returned 0x630000 [0059.183] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0059.183] GetProcessHeap () returned 0x630000 [0059.183] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0059.183] GetProcessHeap () returned 0x630000 [0059.183] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0059.183] GetProcessHeap () returned 0x630000 [0059.183] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0059.183] GetProcessHeap () returned 0x630000 [0059.183] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0059.183] GetProcessHeap () returned 0x630000 [0059.183] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0059.183] GetProcessHeap () returned 0x630000 [0059.183] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0059.183] GetProcessHeap () returned 0x630000 [0059.183] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0059.183] GetProcessHeap () returned 0x630000 [0059.183] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0059.183] GetProcessHeap () returned 0x630000 [0059.183] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0059.183] GetProcessHeap () returned 0x630000 [0059.183] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0059.183] GetProcessHeap () returned 0x630000 [0059.183] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0059.183] GetProcessHeap () returned 0x630000 [0059.183] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0059.183] GetProcessHeap () returned 0x630000 [0059.183] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0059.183] GetProcessHeap () returned 0x630000 [0059.183] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0059.183] GetProcessHeap () returned 0x630000 [0059.183] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0059.183] GetProcessHeap () returned 0x630000 [0059.183] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0059.184] GetProcessHeap () returned 0x630000 [0059.184] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0059.184] GetProcessHeap () returned 0x630000 [0059.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0059.184] GetProcessHeap () returned 0x630000 [0059.184] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0059.184] GetProcessHeap () returned 0x630000 [0059.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.184] GetProcessHeap () returned 0x630000 [0059.184] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.184] GetProcessHeap () returned 0x630000 [0059.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.184] GetProcessHeap () returned 0x630000 [0059.184] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.184] GetProcessHeap () returned 0x630000 [0059.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0059.184] GetProcessHeap () returned 0x630000 [0059.184] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0059.184] GetProcessHeap () returned 0x630000 [0059.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0059.184] GetProcessHeap () returned 0x630000 [0059.184] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0059.184] GetProcessHeap () returned 0x630000 [0059.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0059.184] GetProcessHeap () returned 0x630000 [0059.184] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0059.184] GetProcessHeap () returned 0x630000 [0059.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.184] GetProcessHeap () returned 0x630000 [0059.184] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.184] GetProcessHeap () returned 0x630000 [0059.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0059.184] GetProcessHeap () returned 0x630000 [0059.184] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0059.184] GetProcessHeap () returned 0x630000 [0059.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0059.184] GetProcessHeap () returned 0x630000 [0059.185] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0059.185] GetProcessHeap () returned 0x630000 [0059.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0059.185] GetProcessHeap () returned 0x630000 [0059.185] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0059.185] GetProcessHeap () returned 0x630000 [0059.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.185] GetProcessHeap () returned 0x630000 [0059.185] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.185] GetProcessHeap () returned 0x630000 [0059.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0059.185] GetProcessHeap () returned 0x630000 [0059.185] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0059.185] GetProcessHeap () returned 0x630000 [0059.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0059.185] GetProcessHeap () returned 0x630000 [0059.185] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0059.185] GetProcessHeap () returned 0x630000 [0059.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0059.185] GetProcessHeap () returned 0x630000 [0059.185] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0059.185] GetProcessHeap () returned 0x630000 [0059.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.185] GetProcessHeap () returned 0x630000 [0059.185] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.185] GetProcessHeap () returned 0x630000 [0059.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.185] GetProcessHeap () returned 0x630000 [0059.185] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.185] GetProcessHeap () returned 0x630000 [0059.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0059.185] GetProcessHeap () returned 0x630000 [0059.185] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0059.185] GetProcessHeap () returned 0x630000 [0059.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0059.185] GetProcessHeap () returned 0x630000 [0059.185] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0059.185] GetProcessHeap () returned 0x630000 [0059.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0059.186] GetProcessHeap () returned 0x630000 [0059.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0059.186] GetProcessHeap () returned 0x630000 [0059.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0059.186] GetProcessHeap () returned 0x630000 [0059.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0059.186] GetProcessHeap () returned 0x630000 [0059.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0059.186] GetProcessHeap () returned 0x630000 [0059.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0059.186] GetProcessHeap () returned 0x630000 [0059.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.186] GetProcessHeap () returned 0x630000 [0059.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.186] GetProcessHeap () returned 0x630000 [0059.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.186] GetProcessHeap () returned 0x630000 [0059.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.186] GetProcessHeap () returned 0x630000 [0059.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0059.186] GetProcessHeap () returned 0x630000 [0059.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0059.186] GetProcessHeap () returned 0x630000 [0059.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0059.186] GetProcessHeap () returned 0x630000 [0059.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.186] GetProcessHeap () returned 0x630000 [0059.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0059.186] GetProcessHeap () returned 0x630000 [0059.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0059.186] GetProcessHeap () returned 0x630000 [0059.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0059.186] GetProcessHeap () returned 0x630000 [0059.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0059.186] GetProcessHeap () returned 0x630000 [0059.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0059.186] GetProcessHeap () returned 0x630000 [0059.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0059.187] GetProcessHeap () returned 0x630000 [0059.187] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0059.187] GetProcessHeap () returned 0x630000 [0059.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.187] GetProcessHeap () returned 0x630000 [0059.187] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.187] GetProcessHeap () returned 0x630000 [0059.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.187] GetProcessHeap () returned 0x630000 [0059.187] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0059.187] GetProcessHeap () returned 0x630000 [0059.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0059.187] GetProcessHeap () returned 0x630000 [0059.187] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0059.187] GetProcessHeap () returned 0x630000 [0059.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0059.187] GetProcessHeap () returned 0x630000 [0059.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0059.187] GetProcessHeap () returned 0x630000 [0059.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0059.187] GetProcessHeap () returned 0x630000 [0059.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0059.187] GetProcessHeap () returned 0x630000 [0059.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0059.187] GetProcessHeap () returned 0x630000 [0059.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0059.187] GetProcessHeap () returned 0x630000 [0059.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0059.187] GetProcessHeap () returned 0x630000 [0059.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0059.187] GetProcessHeap () returned 0x630000 [0059.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0059.188] GetProcessHeap () returned 0x630000 [0059.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0059.188] GetProcessHeap () returned 0x630000 [0059.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0059.188] GetProcessHeap () returned 0x630000 [0059.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0059.188] WriteFile (in: hFile=0x230, lpBuffer=0x65a6c0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65a6c0*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0059.190] GetProcessHeap () returned 0x630000 [0059.190] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65a6c0, Size=0x30) returned 0x65a6c0 [0059.190] GetProcessHeap () returned 0x630000 [0059.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0059.190] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.190] GetProcessHeap () returned 0x630000 [0059.190] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x13af6) returned 0x661578 [0059.191] ReadFile (in: hFile=0x230, lpBuffer=0x661578, nNumberOfBytesToRead=0x13af6, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661578*, lpNumberOfBytesRead=0x243d7e8*=0x13af6, lpOverlapped=0x0) returned 1 [0059.191] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.191] WriteFile (in: hFile=0x230, lpBuffer=0x661578*, nNumberOfBytesToWrite=0x13af6, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661578*, lpNumberOfBytesWritten=0x243d7e4*=0x13af6, lpOverlapped=0x0) returned 1 [0059.193] GetProcessHeap () returned 0x630000 [0059.194] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661578 | out: hHeap=0x630000) returned 1 [0059.194] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.194] WriteFile (in: hFile=0x230, lpBuffer=0x65a6c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65a6c0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0059.195] CloseHandle (hObject=0x230) returned 1 [0059.197] GetProcessHeap () returned 0x630000 [0059.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0059.197] GetProcessHeap () returned 0x630000 [0059.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655850 | out: hHeap=0x630000) returned 1 [0059.197] GetProcessHeap () returned 0x630000 [0059.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0059.198] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\MFp-.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\MFp-.swf") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\MFp-.swf" [0059.198] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\MFp-.swf", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\MFp-.swf.happythreechoose") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\MFp-.swf.happythreechoose" [0059.198] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\MFp-.swf" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\mfp-.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\MFp-.swf.happythreechoose" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\mfp-.swf.happythreechoose"), dwFlags=0x1) returned 1 [0059.198] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\MFp-.swf" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M") returned 1 [0059.198] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\") returned="" [0059.198] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\Decryption INFO.html" [0059.198] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\decryption info.html")) returned 0x20 [0059.199] GetProcessHeap () returned 0x630000 [0059.199] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0059.199] FindNextFileW (in: hFindFile=0x65b690, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c90f0c0, ftCreationTime.dwHighDateTime=0x1d5d6a2, ftLastAccessTime.dwLowDateTime=0x64917490, ftLastAccessTime.dwHighDateTime=0x1d5d503, ftLastWriteTime.dwLowDateTime=0x64917490, ftLastWriteTime.dwHighDateTime=0x1d5d503, nFileSizeHigh=0x0, nFileSizeLow=0xfde7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tMv6GBWCSo.swf", cAlternateFileName="TMV6GB~1.SWF")) returned 1 [0059.199] lstrcmpiW (lpString1="tMv6GBWCSo.swf", lpString2=".") returned 1 [0059.199] lstrcmpiW (lpString1="tMv6GBWCSo.swf", lpString2="..") returned 1 [0059.199] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\", lpString2="tMv6GBWCSo.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\tMv6GBWCSo.swf") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\tMv6GBWCSo.swf" [0059.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tMv6GBWCSo.swf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0059.199] GetProcessHeap () returned 0x630000 [0059.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0059.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tMv6GBWCSo.swf", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tMv6GBWCSo.swf", lpUsedDefaultChar=0x0) returned 15 [0059.199] lstrlenA (lpString="tMv6GBWCSo.swf") returned 14 [0059.199] lstrlenA (lpString=".happythreechoose") returned 17 [0059.199] lstrcmpiW (lpString1="tMv6GBWCSo.swf", lpString2="Decryption INFO.html") returned 1 [0059.199] lstrcmpiW (lpString1="tMv6GBWCSo.swf", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0059.199] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0059.199] lstrcmpiW (lpString1="tMv6GBWCSo.swf", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0059.199] GetProcessHeap () returned 0x630000 [0059.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651ec0 [0059.199] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\tMv6GBWCSo.swf" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\tmv6gbwcso.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0059.199] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=64999) returned 1 [0059.199] GetProcessHeap () returned 0x630000 [0059.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6555f8 [0059.199] GetProcessHeap () returned 0x630000 [0059.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0059.199] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\tMv6GBWCSo.swf") returned 51 [0059.199] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.199] GetProcessHeap () returned 0x630000 [0059.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0059.200] GetProcessHeap () returned 0x630000 [0059.200] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x65a6f8 [0059.200] lstrlenA (lpString="rsa_encrypt") returned 11 [0059.200] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0059.200] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0059.200] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0059.200] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0059.200] GetProcessHeap () returned 0x630000 [0059.200] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0059.200] lstrlenA (lpString="010001") returned 6 [0059.200] GetProcessHeap () returned 0x630000 [0059.200] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a228 [0059.200] GetProcessHeap () returned 0x630000 [0059.200] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.201] GetProcessHeap () returned 0x630000 [0059.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0059.201] GetProcessHeap () returned 0x630000 [0059.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.201] GetProcessHeap () returned 0x630000 [0059.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0059.201] GetProcessHeap () returned 0x630000 [0059.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657670 [0059.201] GetProcessHeap () returned 0x630000 [0059.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a068 [0059.201] GetProcessHeap () returned 0x630000 [0059.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0059.201] GetProcessHeap () returned 0x630000 [0059.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0059.201] GetProcessHeap () returned 0x630000 [0059.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0059.201] GetProcessHeap () returned 0x630000 [0059.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.201] GetProcessHeap () returned 0x630000 [0059.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656950 [0059.201] GetProcessHeap () returned 0x630000 [0059.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.201] GetProcessHeap () returned 0x630000 [0059.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0059.201] GetProcessHeap () returned 0x630000 [0059.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ec40 [0059.201] GetProcessHeap () returned 0x630000 [0059.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.201] GetProcessHeap () returned 0x630000 [0059.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0059.201] GetProcessHeap () returned 0x630000 [0059.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ec40 | out: hHeap=0x630000) returned 1 [0059.201] GetProcessHeap () returned 0x630000 [0059.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.201] GetProcessHeap () returned 0x630000 [0059.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x661740 [0059.201] GetProcessHeap () returned 0x630000 [0059.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.201] GetProcessHeap () returned 0x630000 [0059.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.201] GetProcessHeap () returned 0x630000 [0059.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0059.202] GetProcessHeap () returned 0x630000 [0059.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0059.202] GetProcessHeap () returned 0x630000 [0059.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e460 [0059.202] GetProcessHeap () returned 0x630000 [0059.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661740 | out: hHeap=0x630000) returned 1 [0059.202] GetProcessHeap () returned 0x630000 [0059.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0059.202] GetProcessHeap () returned 0x630000 [0059.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e460 | out: hHeap=0x630000) returned 1 [0059.202] GetProcessHeap () returned 0x630000 [0059.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0059.202] GetProcessHeap () returned 0x630000 [0059.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0059.202] GetProcessHeap () returned 0x630000 [0059.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0059.202] GetProcessHeap () returned 0x630000 [0059.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.202] GetProcessHeap () returned 0x630000 [0059.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0059.202] GetProcessHeap () returned 0x630000 [0059.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0059.202] GetProcessHeap () returned 0x630000 [0059.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0059.202] GetProcessHeap () returned 0x630000 [0059.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0059.202] GetProcessHeap () returned 0x630000 [0059.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0059.202] GetProcessHeap () returned 0x630000 [0059.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0059.202] GetProcessHeap () returned 0x630000 [0059.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0059.202] GetProcessHeap () returned 0x630000 [0059.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0059.202] GetProcessHeap () returned 0x630000 [0059.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0059.202] GetProcessHeap () returned 0x630000 [0059.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0059.203] GetProcessHeap () returned 0x630000 [0059.203] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0059.203] GetProcessHeap () returned 0x630000 [0059.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0059.203] GetProcessHeap () returned 0x630000 [0059.203] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0059.203] GetProcessHeap () returned 0x630000 [0059.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0059.203] GetProcessHeap () returned 0x630000 [0059.203] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0059.203] GetProcessHeap () returned 0x630000 [0059.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0059.203] GetProcessHeap () returned 0x630000 [0059.203] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0059.203] GetProcessHeap () returned 0x630000 [0059.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0059.203] GetProcessHeap () returned 0x630000 [0059.203] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.203] GetProcessHeap () returned 0x630000 [0059.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.203] GetProcessHeap () returned 0x630000 [0059.203] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0059.203] GetProcessHeap () returned 0x630000 [0059.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0059.203] GetProcessHeap () returned 0x630000 [0059.203] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.203] GetProcessHeap () returned 0x630000 [0059.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.203] GetProcessHeap () returned 0x630000 [0059.203] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0059.203] GetProcessHeap () returned 0x630000 [0059.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0059.203] GetProcessHeap () returned 0x630000 [0059.203] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0059.204] GetProcessHeap () returned 0x630000 [0059.204] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0059.204] GetProcessHeap () returned 0x630000 [0059.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0059.204] GetProcessHeap () returned 0x630000 [0059.204] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.204] GetProcessHeap () returned 0x630000 [0059.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0059.204] GetProcessHeap () returned 0x630000 [0059.204] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0059.204] GetProcessHeap () returned 0x630000 [0059.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0059.204] GetProcessHeap () returned 0x630000 [0059.204] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0059.204] GetProcessHeap () returned 0x630000 [0059.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.204] GetProcessHeap () returned 0x630000 [0059.204] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.204] GetProcessHeap () returned 0x630000 [0059.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0059.204] GetProcessHeap () returned 0x630000 [0059.204] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0059.204] GetProcessHeap () returned 0x630000 [0059.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.204] GetProcessHeap () returned 0x630000 [0059.204] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.204] GetProcessHeap () returned 0x630000 [0059.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0059.204] GetProcessHeap () returned 0x630000 [0059.204] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0059.204] GetProcessHeap () returned 0x630000 [0059.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.204] GetProcessHeap () returned 0x630000 [0059.204] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.204] GetProcessHeap () returned 0x630000 [0059.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.204] GetProcessHeap () returned 0x630000 [0059.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.205] GetProcessHeap () returned 0x630000 [0059.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0059.205] GetProcessHeap () returned 0x630000 [0059.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0059.205] GetProcessHeap () returned 0x630000 [0059.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0059.205] GetProcessHeap () returned 0x630000 [0059.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0059.205] GetProcessHeap () returned 0x630000 [0059.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0059.205] GetProcessHeap () returned 0x630000 [0059.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0059.205] GetProcessHeap () returned 0x630000 [0059.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0059.205] GetProcessHeap () returned 0x630000 [0059.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0059.205] GetProcessHeap () returned 0x630000 [0059.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0059.205] GetProcessHeap () returned 0x630000 [0059.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.205] GetProcessHeap () returned 0x630000 [0059.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.205] GetProcessHeap () returned 0x630000 [0059.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.205] GetProcessHeap () returned 0x630000 [0059.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0059.205] GetProcessHeap () returned 0x630000 [0059.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0059.205] GetProcessHeap () returned 0x630000 [0059.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.205] GetProcessHeap () returned 0x630000 [0059.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.205] GetProcessHeap () returned 0x630000 [0059.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0059.205] GetProcessHeap () returned 0x630000 [0059.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0059.205] GetProcessHeap () returned 0x630000 [0059.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.206] GetProcessHeap () returned 0x630000 [0059.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.206] GetProcessHeap () returned 0x630000 [0059.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0059.206] GetProcessHeap () returned 0x630000 [0059.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0059.206] GetProcessHeap () returned 0x630000 [0059.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0e8 [0059.206] GetProcessHeap () returned 0x630000 [0059.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0e8 | out: hHeap=0x630000) returned 1 [0059.206] GetProcessHeap () returned 0x630000 [0059.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.206] GetProcessHeap () returned 0x630000 [0059.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.206] GetProcessHeap () returned 0x630000 [0059.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.206] GetProcessHeap () returned 0x630000 [0059.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.206] GetProcessHeap () returned 0x630000 [0059.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0059.206] GetProcessHeap () returned 0x630000 [0059.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0059.206] GetProcessHeap () returned 0x630000 [0059.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0059.206] GetProcessHeap () returned 0x630000 [0059.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0059.206] GetProcessHeap () returned 0x630000 [0059.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0059.206] GetProcessHeap () returned 0x630000 [0059.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0059.206] GetProcessHeap () returned 0x630000 [0059.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0059.206] GetProcessHeap () returned 0x630000 [0059.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0059.206] GetProcessHeap () returned 0x630000 [0059.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0059.207] GetProcessHeap () returned 0x630000 [0059.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0059.207] GetProcessHeap () returned 0x630000 [0059.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0059.207] GetProcessHeap () returned 0x630000 [0059.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0059.207] GetProcessHeap () returned 0x630000 [0059.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0059.207] GetProcessHeap () returned 0x630000 [0059.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0059.207] GetProcessHeap () returned 0x630000 [0059.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0059.207] WriteFile (in: hFile=0x230, lpBuffer=0x65a6f8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65a6f8*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0059.213] GetProcessHeap () returned 0x630000 [0059.213] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65a6f8, Size=0x30) returned 0x65a6f8 [0059.213] GetProcessHeap () returned 0x630000 [0059.213] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0059.213] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.213] GetProcessHeap () returned 0x630000 [0059.213] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfde7) returned 0x661980 [0059.213] ReadFile (in: hFile=0x230, lpBuffer=0x661980, nNumberOfBytesToRead=0xfde7, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661980*, lpNumberOfBytesRead=0x243d7e8*=0xfde7, lpOverlapped=0x0) returned 1 [0059.214] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.214] WriteFile (in: hFile=0x230, lpBuffer=0x661980*, nNumberOfBytesToWrite=0xfde7, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661980*, lpNumberOfBytesWritten=0x243d7e4*=0xfde7, lpOverlapped=0x0) returned 1 [0059.216] GetProcessHeap () returned 0x630000 [0059.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661980 | out: hHeap=0x630000) returned 1 [0059.217] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.217] WriteFile (in: hFile=0x230, lpBuffer=0x65a6f8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65a6f8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0059.218] CloseHandle (hObject=0x230) returned 1 [0059.221] GetProcessHeap () returned 0x630000 [0059.221] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651ec0 | out: hHeap=0x630000) returned 1 [0059.221] GetProcessHeap () returned 0x630000 [0059.221] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6555f8 | out: hHeap=0x630000) returned 1 [0059.221] GetProcessHeap () returned 0x630000 [0059.221] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0059.221] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\tMv6GBWCSo.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\tMv6GBWCSo.swf") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\tMv6GBWCSo.swf" [0059.221] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\tMv6GBWCSo.swf", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\tMv6GBWCSo.swf.happythreechoose") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\tMv6GBWCSo.swf.happythreechoose" [0059.221] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\tMv6GBWCSo.swf" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\tmv6gbwcso.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\tMv6GBWCSo.swf.happythreechoose" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\tmv6gbwcso.swf.happythreechoose"), dwFlags=0x1) returned 1 [0059.222] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\tMv6GBWCSo.swf" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M") returned 1 [0059.222] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\") returned="" [0059.222] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\Decryption INFO.html" [0059.222] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\decryption info.html")) returned 0x20 [0059.222] GetProcessHeap () returned 0x630000 [0059.222] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0059.222] FindNextFileW (in: hFindFile=0x65b690, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c90f0c0, ftCreationTime.dwHighDateTime=0x1d5d6a2, ftLastAccessTime.dwLowDateTime=0x64917490, ftLastAccessTime.dwHighDateTime=0x1d5d503, ftLastWriteTime.dwLowDateTime=0x64917490, ftLastWriteTime.dwHighDateTime=0x1d5d503, nFileSizeHigh=0x0, nFileSizeLow=0xfde7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tMv6GBWCSo.swf", cAlternateFileName="TMV6GB~1.SWF")) returned 0 [0059.222] FindClose (in: hFindFile=0x65b690 | out: hFindFile=0x65b690) returned 1 [0059.222] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\" [0059.222] GetProcessHeap () returned 0x630000 [0059.222] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655940 | out: hHeap=0x630000) returned 1 [0059.222] GetProcessHeap () returned 0x630000 [0059.222] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0059.222] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\") returned 52 [0059.222] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\*") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\*" [0059.222] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f027e60, ftCreationTime.dwHighDateTime=0x1d5cbaa, ftLastAccessTime.dwLowDateTime=0xc5f81100, ftLastAccessTime.dwHighDateTime=0x1d5cc4b, ftLastWriteTime.dwLowDateTime=0xc5f81100, ftLastWriteTime.dwHighDateTime=0x1d5cc4b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x65ba90 [0059.223] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0059.223] FindNextFileW (in: hFindFile=0x65ba90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f027e60, ftCreationTime.dwHighDateTime=0x1d5cbaa, ftLastAccessTime.dwLowDateTime=0xc5f81100, ftLastAccessTime.dwHighDateTime=0x1d5cc4b, ftLastWriteTime.dwLowDateTime=0xc5f81100, ftLastWriteTime.dwHighDateTime=0x1d5cc4b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.223] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0059.223] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0059.223] FindNextFileW (in: hFindFile=0x65ba90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5c29950, ftCreationTime.dwHighDateTime=0x1d5d696, ftLastAccessTime.dwLowDateTime=0x79a1f2b0, ftLastAccessTime.dwHighDateTime=0x1d5d279, ftLastWriteTime.dwLowDateTime=0x79a1f2b0, ftLastWriteTime.dwHighDateTime=0x1d5d279, nFileSizeHigh=0x0, nFileSizeLow=0xfc24, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1xJQbwJYk--WCHDN7_A_.mkv", cAlternateFileName="1XJQBW~1.MKV")) returned 1 [0059.223] lstrcmpiW (lpString1="1xJQbwJYk--WCHDN7_A_.mkv", lpString2=".") returned 1 [0059.223] lstrcmpiW (lpString1="1xJQbwJYk--WCHDN7_A_.mkv", lpString2="..") returned 1 [0059.223] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\", lpString2="1xJQbwJYk--WCHDN7_A_.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\1xJQbwJYk--WCHDN7_A_.mkv") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\1xJQbwJYk--WCHDN7_A_.mkv" [0059.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1xJQbwJYk--WCHDN7_A_.mkv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0059.223] GetProcessHeap () returned 0x630000 [0059.223] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x19) returned 0x652000 [0059.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1xJQbwJYk--WCHDN7_A_.mkv", cchWideChar=-1, lpMultiByteStr=0x652000, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1xJQbwJYk--WCHDN7_A_.mkv", lpUsedDefaultChar=0x0) returned 25 [0059.223] lstrlenA (lpString="1xJQbwJYk--WCHDN7_A_.mkv") returned 24 [0059.223] lstrlenA (lpString=".happythreechoose") returned 17 [0059.223] lstrlenA (lpString=".happythreechoose") returned 17 [0059.223] lstrlenA (lpString="1xJQbwJYk--WCHDN7_A_.mkv") returned 24 [0059.223] lstrcmpiA (lpString1="Yk--WCHDN7_A_.mkv", lpString2=".happythreechoose") returned 1 [0059.223] lstrcmpiW (lpString1="1xJQbwJYk--WCHDN7_A_.mkv", lpString2="Decryption INFO.html") returned -1 [0059.223] lstrcmpiW (lpString1="1xJQbwJYk--WCHDN7_A_.mkv", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned -1 [0059.223] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0059.223] lstrcmpiW (lpString1="1xJQbwJYk--WCHDN7_A_.mkv", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0059.223] GetProcessHeap () returned 0x630000 [0059.223] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0059.223] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\1xJQbwJYk--WCHDN7_A_.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\g9kx78tzkibuoa\\1xjqbwjyk--wchdn7_a_.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0059.223] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=64548) returned 1 [0059.223] GetProcessHeap () returned 0x630000 [0059.223] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655b20 [0059.224] GetProcessHeap () returned 0x630000 [0059.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0059.224] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\1xJQbwJYk--WCHDN7_A_.mkv") returned 76 [0059.224] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.224] GetProcessHeap () returned 0x630000 [0059.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0059.224] GetProcessHeap () returned 0x630000 [0059.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x65a730 [0059.224] lstrlenA (lpString="rsa_encrypt") returned 11 [0059.224] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0059.224] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0059.224] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0059.224] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0059.224] GetProcessHeap () returned 0x630000 [0059.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0059.224] lstrlenA (lpString="010001") returned 6 [0059.224] GetProcessHeap () returned 0x630000 [0059.225] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a0c8 [0059.225] GetProcessHeap () returned 0x630000 [0059.225] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.225] GetProcessHeap () returned 0x630000 [0059.225] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e580 [0059.225] GetProcessHeap () returned 0x630000 [0059.225] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.225] GetProcessHeap () returned 0x630000 [0059.225] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dec0 [0059.225] GetProcessHeap () returned 0x630000 [0059.225] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657440 [0059.225] GetProcessHeap () returned 0x630000 [0059.225] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a0e8 [0059.225] GetProcessHeap () returned 0x630000 [0059.225] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0059.225] GetProcessHeap () returned 0x630000 [0059.225] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0e8 | out: hHeap=0x630000) returned 1 [0059.225] GetProcessHeap () returned 0x630000 [0059.225] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0059.225] GetProcessHeap () returned 0x630000 [0059.225] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.225] GetProcessHeap () returned 0x630000 [0059.225] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656ec8 [0059.225] GetProcessHeap () returned 0x630000 [0059.225] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0059.225] GetProcessHeap () returned 0x630000 [0059.225] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0059.225] GetProcessHeap () returned 0x630000 [0059.225] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e610 [0059.225] GetProcessHeap () returned 0x630000 [0059.225] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.225] GetProcessHeap () returned 0x630000 [0059.225] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0059.225] GetProcessHeap () returned 0x630000 [0059.225] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0059.225] GetProcessHeap () returned 0x630000 [0059.225] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0059.225] GetProcessHeap () returned 0x630000 [0059.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0059.226] GetProcessHeap () returned 0x630000 [0059.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0059.226] GetProcessHeap () returned 0x630000 [0059.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0059.226] GetProcessHeap () returned 0x630000 [0059.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0059.226] GetProcessHeap () returned 0x630000 [0059.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0059.226] GetProcessHeap () returned 0x630000 [0059.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ea90 [0059.226] GetProcessHeap () returned 0x630000 [0059.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0059.226] GetProcessHeap () returned 0x630000 [0059.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0059.226] GetProcessHeap () returned 0x630000 [0059.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea90 | out: hHeap=0x630000) returned 1 [0059.226] GetProcessHeap () returned 0x630000 [0059.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0059.226] GetProcessHeap () returned 0x630000 [0059.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0059.226] GetProcessHeap () returned 0x630000 [0059.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0059.226] GetProcessHeap () returned 0x630000 [0059.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0059.226] GetProcessHeap () returned 0x630000 [0059.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0e8 [0059.226] GetProcessHeap () returned 0x630000 [0059.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0e8 | out: hHeap=0x630000) returned 1 [0059.226] GetProcessHeap () returned 0x630000 [0059.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0059.226] GetProcessHeap () returned 0x630000 [0059.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0059.226] GetProcessHeap () returned 0x630000 [0059.226] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0059.226] GetProcessHeap () returned 0x630000 [0059.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0059.226] GetProcessHeap () returned 0x630000 [0059.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.227] GetProcessHeap () returned 0x630000 [0059.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.227] GetProcessHeap () returned 0x630000 [0059.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0059.227] GetProcessHeap () returned 0x630000 [0059.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0059.227] GetProcessHeap () returned 0x630000 [0059.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0059.227] GetProcessHeap () returned 0x630000 [0059.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0059.227] GetProcessHeap () returned 0x630000 [0059.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0059.227] GetProcessHeap () returned 0x630000 [0059.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0059.227] GetProcessHeap () returned 0x630000 [0059.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0059.227] GetProcessHeap () returned 0x630000 [0059.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0059.227] GetProcessHeap () returned 0x630000 [0059.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.227] GetProcessHeap () returned 0x630000 [0059.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.227] GetProcessHeap () returned 0x630000 [0059.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0059.227] GetProcessHeap () returned 0x630000 [0059.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0059.227] GetProcessHeap () returned 0x630000 [0059.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0059.227] GetProcessHeap () returned 0x630000 [0059.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0059.227] GetProcessHeap () returned 0x630000 [0059.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0059.227] GetProcessHeap () returned 0x630000 [0059.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0059.227] GetProcessHeap () returned 0x630000 [0059.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0059.227] GetProcessHeap () returned 0x630000 [0059.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.228] GetProcessHeap () returned 0x630000 [0059.228] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.228] GetProcessHeap () returned 0x630000 [0059.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.228] GetProcessHeap () returned 0x630000 [0059.228] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0059.228] GetProcessHeap () returned 0x630000 [0059.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.228] GetProcessHeap () returned 0x630000 [0059.228] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0059.228] GetProcessHeap () returned 0x630000 [0059.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0059.228] GetProcessHeap () returned 0x630000 [0059.228] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.228] GetProcessHeap () returned 0x630000 [0059.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.228] GetProcessHeap () returned 0x630000 [0059.228] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0059.228] GetProcessHeap () returned 0x630000 [0059.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0059.228] GetProcessHeap () returned 0x630000 [0059.228] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0059.228] GetProcessHeap () returned 0x630000 [0059.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0059.228] GetProcessHeap () returned 0x630000 [0059.228] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.228] GetProcessHeap () returned 0x630000 [0059.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.228] GetProcessHeap () returned 0x630000 [0059.228] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0059.228] GetProcessHeap () returned 0x630000 [0059.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.228] GetProcessHeap () returned 0x630000 [0059.228] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0059.228] GetProcessHeap () returned 0x630000 [0059.228] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0059.228] GetProcessHeap () returned 0x630000 [0059.229] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0059.229] GetProcessHeap () returned 0x630000 [0059.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0059.229] GetProcessHeap () returned 0x630000 [0059.229] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0059.229] GetProcessHeap () returned 0x630000 [0059.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0059.229] GetProcessHeap () returned 0x630000 [0059.229] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.229] GetProcessHeap () returned 0x630000 [0059.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.229] GetProcessHeap () returned 0x630000 [0059.229] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0059.229] GetProcessHeap () returned 0x630000 [0059.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0059.229] GetProcessHeap () returned 0x630000 [0059.229] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0059.229] GetProcessHeap () returned 0x630000 [0059.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0059.229] GetProcessHeap () returned 0x630000 [0059.229] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.229] GetProcessHeap () returned 0x630000 [0059.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.229] GetProcessHeap () returned 0x630000 [0059.229] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0059.229] GetProcessHeap () returned 0x630000 [0059.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0059.229] GetProcessHeap () returned 0x630000 [0059.229] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0059.229] GetProcessHeap () returned 0x630000 [0059.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0059.229] GetProcessHeap () returned 0x630000 [0059.229] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.229] GetProcessHeap () returned 0x630000 [0059.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.229] GetProcessHeap () returned 0x630000 [0059.229] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.229] GetProcessHeap () returned 0x630000 [0059.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.230] GetProcessHeap () returned 0x630000 [0059.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.230] GetProcessHeap () returned 0x630000 [0059.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.230] GetProcessHeap () returned 0x630000 [0059.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0059.230] GetProcessHeap () returned 0x630000 [0059.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0059.230] GetProcessHeap () returned 0x630000 [0059.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.230] GetProcessHeap () returned 0x630000 [0059.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.230] GetProcessHeap () returned 0x630000 [0059.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.230] GetProcessHeap () returned 0x630000 [0059.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.230] GetProcessHeap () returned 0x630000 [0059.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0059.230] GetProcessHeap () returned 0x630000 [0059.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0059.230] GetProcessHeap () returned 0x630000 [0059.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0059.230] GetProcessHeap () returned 0x630000 [0059.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0059.230] GetProcessHeap () returned 0x630000 [0059.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0059.230] GetProcessHeap () returned 0x630000 [0059.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0059.230] GetProcessHeap () returned 0x630000 [0059.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0059.230] GetProcessHeap () returned 0x630000 [0059.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0059.230] GetProcessHeap () returned 0x630000 [0059.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0059.230] GetProcessHeap () returned 0x630000 [0059.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0059.231] GetProcessHeap () returned 0x630000 [0059.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0059.231] GetProcessHeap () returned 0x630000 [0059.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0059.231] GetProcessHeap () returned 0x630000 [0059.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0059.231] GetProcessHeap () returned 0x630000 [0059.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0059.231] GetProcessHeap () returned 0x630000 [0059.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0059.231] GetProcessHeap () returned 0x630000 [0059.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0059.231] GetProcessHeap () returned 0x630000 [0059.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0059.231] WriteFile (in: hFile=0x230, lpBuffer=0x65a730*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65a730*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0059.233] GetProcessHeap () returned 0x630000 [0059.233] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65a730, Size=0x30) returned 0x65a730 [0059.233] GetProcessHeap () returned 0x630000 [0059.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0059.233] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.233] GetProcessHeap () returned 0x630000 [0059.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfc24) returned 0x661980 [0059.236] ReadFile (in: hFile=0x230, lpBuffer=0x661980, nNumberOfBytesToRead=0xfc24, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661980*, lpNumberOfBytesRead=0x243d7e8*=0xfc24, lpOverlapped=0x0) returned 1 [0059.237] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.237] WriteFile (in: hFile=0x230, lpBuffer=0x661980*, nNumberOfBytesToWrite=0xfc24, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661980*, lpNumberOfBytesWritten=0x243d7e4*=0xfc24, lpOverlapped=0x0) returned 1 [0059.239] GetProcessHeap () returned 0x630000 [0059.239] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661980 | out: hHeap=0x630000) returned 1 [0059.240] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.240] WriteFile (in: hFile=0x230, lpBuffer=0x65a730*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65a730*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0059.243] CloseHandle (hObject=0x230) returned 1 [0059.245] GetProcessHeap () returned 0x630000 [0059.245] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0059.246] GetProcessHeap () returned 0x630000 [0059.246] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655b20 | out: hHeap=0x630000) returned 1 [0059.246] GetProcessHeap () returned 0x630000 [0059.246] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0059.246] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\1xJQbwJYk--WCHDN7_A_.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\1xJQbwJYk--WCHDN7_A_.mkv") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\1xJQbwJYk--WCHDN7_A_.mkv" [0059.246] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\1xJQbwJYk--WCHDN7_A_.mkv", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\1xJQbwJYk--WCHDN7_A_.mkv.happythreechoose") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\1xJQbwJYk--WCHDN7_A_.mkv.happythreechoose" [0059.246] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\1xJQbwJYk--WCHDN7_A_.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\g9kx78tzkibuoa\\1xjqbwjyk--wchdn7_a_.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\1xJQbwJYk--WCHDN7_A_.mkv.happythreechoose" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\g9kx78tzkibuoa\\1xjqbwjyk--wchdn7_a_.mkv.happythreechoose"), dwFlags=0x1) returned 1 [0059.246] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\1xJQbwJYk--WCHDN7_A_.mkv" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa") returned 1 [0059.246] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\") returned="" [0059.246] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\Decryption INFO.html" [0059.247] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\g9kx78tzkibuoa\\decryption info.html")) returned 0xffffffff [0059.247] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\g9kx78tzkibuoa\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0059.247] GetProcessHeap () returned 0x630000 [0059.247] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655940 [0059.248] GetProcessHeap () returned 0x630000 [0059.248] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0059.255] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.256] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.256] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.256] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.256] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.256] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.256] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.256] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.256] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.256] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.257] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.257] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.257] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.257] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.257] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.257] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.257] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.257] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.257] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.257] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.257] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.257] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.258] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.258] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.258] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.258] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.258] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.258] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.258] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.258] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.258] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.258] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.258] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.258] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.259] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.259] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.259] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.260] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.260] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.260] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.260] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.260] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.260] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.260] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.260] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.260] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.260] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.261] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.261] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.261] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.261] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.261] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.261] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.261] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.261] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.261] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.261] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.261] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.261] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.262] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.262] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.262] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.262] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.262] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.262] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.262] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.262] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.262] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.262] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.262] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.262] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.262] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.262] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.263] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.263] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.263] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.263] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.263] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.263] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.263] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.263] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.263] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.263] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.263] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.263] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.263] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.264] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.264] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.264] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.264] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.264] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.264] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.264] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.264] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.264] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.264] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.264] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.264] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.264] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.264] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.265] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.265] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.265] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.265] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.265] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.265] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.265] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.265] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.265] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.265] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.265] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.265] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.265] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.265] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.266] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.266] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.266] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.266] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.266] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.266] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.266] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.266] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.266] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.266] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.266] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.266] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.266] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.267] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.267] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.267] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.267] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.267] GetProcessHeap () returned 0x630000 [0059.267] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655940 | out: hHeap=0x630000) returned 1 [0059.267] GetProcessHeap () returned 0x630000 [0059.267] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0059.267] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0059.267] GetProcessHeap () returned 0x630000 [0059.267] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655670 [0059.267] GetProcessHeap () returned 0x630000 [0059.267] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0059.275] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.275] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.275] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.275] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.275] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.276] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.276] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.276] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.276] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.276] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.276] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.276] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.276] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.276] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.276] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.276] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.277] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.277] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.277] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.277] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.277] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.277] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.277] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.277] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.277] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.277] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.278] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.278] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.278] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.278] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.278] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.278] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.278] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.278] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.278] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.278] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.278] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.278] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.278] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.278] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.279] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.279] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.279] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.279] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.279] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.279] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.279] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.279] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.279] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.279] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.279] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.279] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.279] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.280] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.280] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.280] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.280] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.280] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.280] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.280] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.280] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.280] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.280] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.280] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.280] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.280] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.280] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.281] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.281] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.281] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.281] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.281] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.281] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.281] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.281] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.288] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.288] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.288] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.288] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.288] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.288] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.288] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.288] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.288] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.288] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.289] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.289] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.289] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.289] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.289] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.289] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.289] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.289] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.289] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.289] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.289] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.289] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.289] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.289] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.290] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.290] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.290] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.290] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.290] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.290] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.290] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.290] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.290] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.290] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.290] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.290] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.291] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.291] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.291] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.291] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.291] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.291] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.291] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.292] GetProcessHeap () returned 0x630000 [0059.292] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655670 | out: hHeap=0x630000) returned 1 [0059.292] GetProcessHeap () returned 0x630000 [0059.292] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0059.292] CloseHandle (hObject=0x230) returned 1 [0059.292] GetProcessHeap () returned 0x630000 [0059.292] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x652000 | out: hHeap=0x630000) returned 1 [0059.292] FindNextFileW (in: hFindFile=0x65ba90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbff10be0, ftCreationTime.dwHighDateTime=0x1d5d344, ftLastAccessTime.dwLowDateTime=0x1d590350, ftLastAccessTime.dwHighDateTime=0x1d5d5d9, ftLastWriteTime.dwLowDateTime=0x1d590350, ftLastWriteTime.dwHighDateTime=0x1d5d5d9, nFileSizeHigh=0x0, nFileSizeLow=0x137c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="eDhakAkMi35niJgyT.flv", cAlternateFileName="EDHAKA~1.FLV")) returned 1 [0059.292] lstrcmpiW (lpString1="eDhakAkMi35niJgyT.flv", lpString2=".") returned 1 [0059.292] lstrcmpiW (lpString1="eDhakAkMi35niJgyT.flv", lpString2="..") returned 1 [0059.292] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\", lpString2="eDhakAkMi35niJgyT.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\eDhakAkMi35niJgyT.flv") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\eDhakAkMi35niJgyT.flv" [0059.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eDhakAkMi35niJgyT.flv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0059.292] GetProcessHeap () returned 0x630000 [0059.292] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x645d18 [0059.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eDhakAkMi35niJgyT.flv", cchWideChar=-1, lpMultiByteStr=0x645d18, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eDhakAkMi35niJgyT.flv", lpUsedDefaultChar=0x0) returned 22 [0059.292] lstrlenA (lpString="eDhakAkMi35niJgyT.flv") returned 21 [0059.293] lstrlenA (lpString=".happythreechoose") returned 17 [0059.293] lstrlenA (lpString=".happythreechoose") returned 17 [0059.293] lstrlenA (lpString="eDhakAkMi35niJgyT.flv") returned 21 [0059.293] lstrcmpiA (lpString1="kAkMi35niJgyT.flv", lpString2=".happythreechoose") returned 1 [0059.293] lstrcmpiW (lpString1="eDhakAkMi35niJgyT.flv", lpString2="Decryption INFO.html") returned 1 [0059.293] lstrcmpiW (lpString1="eDhakAkMi35niJgyT.flv", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0059.293] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0059.293] lstrcmpiW (lpString1="eDhakAkMi35niJgyT.flv", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0059.293] GetProcessHeap () returned 0x630000 [0059.293] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0059.293] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\eDhakAkMi35niJgyT.flv" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\g9kx78tzkibuoa\\edhakakmi35nijgyt.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0059.293] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=4988) returned 1 [0059.293] GetProcessHeap () returned 0x630000 [0059.293] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6558c8 [0059.293] GetProcessHeap () returned 0x630000 [0059.293] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0059.293] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\eDhakAkMi35niJgyT.flv") returned 73 [0059.293] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.293] GetProcessHeap () returned 0x630000 [0059.293] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0059.293] GetProcessHeap () returned 0x630000 [0059.293] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x384) returned 0x65a768 [0059.293] lstrlenA (lpString="rsa_encrypt") returned 11 [0059.293] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0059.294] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0059.294] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0059.294] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0059.294] GetProcessHeap () returned 0x630000 [0059.294] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0059.294] lstrlenA (lpString="010001") returned 6 [0059.294] GetProcessHeap () returned 0x630000 [0059.294] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a148 [0059.294] GetProcessHeap () returned 0x630000 [0059.294] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.294] GetProcessHeap () returned 0x630000 [0059.294] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e730 [0059.294] GetProcessHeap () returned 0x630000 [0059.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.294] GetProcessHeap () returned 0x630000 [0059.294] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0059.294] GetProcessHeap () returned 0x630000 [0059.294] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x6570f8 [0059.295] GetProcessHeap () returned 0x630000 [0059.295] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a0a8 [0059.295] GetProcessHeap () returned 0x630000 [0059.295] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0059.295] GetProcessHeap () returned 0x630000 [0059.295] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0059.295] GetProcessHeap () returned 0x630000 [0059.295] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0059.295] GetProcessHeap () returned 0x630000 [0059.295] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.295] GetProcessHeap () returned 0x630000 [0059.295] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656db0 [0059.295] GetProcessHeap () returned 0x630000 [0059.295] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.295] GetProcessHeap () returned 0x630000 [0059.295] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0059.295] GetProcessHeap () returned 0x630000 [0059.295] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ec40 [0059.295] GetProcessHeap () returned 0x630000 [0059.295] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.295] GetProcessHeap () returned 0x630000 [0059.295] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0059.295] GetProcessHeap () returned 0x630000 [0059.295] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ec40 | out: hHeap=0x630000) returned 1 [0059.295] GetProcessHeap () returned 0x630000 [0059.295] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0059.295] GetProcessHeap () returned 0x630000 [0059.295] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0059.295] GetProcessHeap () returned 0x630000 [0059.295] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.295] GetProcessHeap () returned 0x630000 [0059.295] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0059.295] GetProcessHeap () returned 0x630000 [0059.295] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0059.295] GetProcessHeap () returned 0x630000 [0059.295] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0059.295] GetProcessHeap () returned 0x630000 [0059.295] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65eb20 [0059.295] GetProcessHeap () returned 0x630000 [0059.296] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0059.296] GetProcessHeap () returned 0x630000 [0059.296] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0059.296] GetProcessHeap () returned 0x630000 [0059.296] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0059.296] GetProcessHeap () returned 0x630000 [0059.296] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0059.296] GetProcessHeap () returned 0x630000 [0059.296] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0059.296] GetProcessHeap () returned 0x630000 [0059.296] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0059.296] GetProcessHeap () returned 0x630000 [0059.296] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.296] GetProcessHeap () returned 0x630000 [0059.296] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0059.296] GetProcessHeap () returned 0x630000 [0059.296] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0059.296] GetProcessHeap () returned 0x630000 [0059.296] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.296] GetProcessHeap () returned 0x630000 [0059.296] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.296] GetProcessHeap () returned 0x630000 [0059.296] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0059.296] GetProcessHeap () returned 0x630000 [0059.296] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0059.296] GetProcessHeap () returned 0x630000 [0059.296] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.296] GetProcessHeap () returned 0x630000 [0059.296] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.296] GetProcessHeap () returned 0x630000 [0059.296] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0059.296] GetProcessHeap () returned 0x630000 [0059.296] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.296] GetProcessHeap () returned 0x630000 [0059.296] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0059.296] GetProcessHeap () returned 0x630000 [0059.296] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0059.297] GetProcessHeap () returned 0x630000 [0059.297] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.297] GetProcessHeap () returned 0x630000 [0059.297] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.297] GetProcessHeap () returned 0x630000 [0059.297] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0059.297] GetProcessHeap () returned 0x630000 [0059.297] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0059.297] GetProcessHeap () returned 0x630000 [0059.297] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.297] GetProcessHeap () returned 0x630000 [0059.297] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.297] GetProcessHeap () returned 0x630000 [0059.297] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0059.297] GetProcessHeap () returned 0x630000 [0059.297] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0059.297] GetProcessHeap () returned 0x630000 [0059.297] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0059.297] GetProcessHeap () returned 0x630000 [0059.297] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0059.297] GetProcessHeap () returned 0x630000 [0059.297] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0059.297] GetProcessHeap () returned 0x630000 [0059.297] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.297] GetProcessHeap () returned 0x630000 [0059.297] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0059.297] GetProcessHeap () returned 0x630000 [0059.297] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0059.297] GetProcessHeap () returned 0x630000 [0059.297] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0059.297] GetProcessHeap () returned 0x630000 [0059.297] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0059.297] GetProcessHeap () returned 0x630000 [0059.297] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0059.297] GetProcessHeap () returned 0x630000 [0059.298] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0059.298] GetProcessHeap () returned 0x630000 [0059.298] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.298] GetProcessHeap () returned 0x630000 [0059.298] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.298] GetProcessHeap () returned 0x630000 [0059.298] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0059.298] GetProcessHeap () returned 0x630000 [0059.298] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0059.298] GetProcessHeap () returned 0x630000 [0059.298] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0059.298] GetProcessHeap () returned 0x630000 [0059.298] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0059.298] GetProcessHeap () returned 0x630000 [0059.298] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0059.298] GetProcessHeap () returned 0x630000 [0059.298] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0059.298] GetProcessHeap () returned 0x630000 [0059.298] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0059.298] GetProcessHeap () returned 0x630000 [0059.298] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0059.298] GetProcessHeap () returned 0x630000 [0059.298] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0059.298] GetProcessHeap () returned 0x630000 [0059.298] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0059.298] GetProcessHeap () returned 0x630000 [0059.298] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.298] GetProcessHeap () returned 0x630000 [0059.298] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.298] GetProcessHeap () returned 0x630000 [0059.298] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0e8 [0059.298] GetProcessHeap () returned 0x630000 [0059.298] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0e8 | out: hHeap=0x630000) returned 1 [0059.298] GetProcessHeap () returned 0x630000 [0059.298] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0059.298] GetProcessHeap () returned 0x630000 [0059.298] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0059.299] GetProcessHeap () returned 0x630000 [0059.299] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0059.299] GetProcessHeap () returned 0x630000 [0059.299] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0059.299] GetProcessHeap () returned 0x630000 [0059.299] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.299] GetProcessHeap () returned 0x630000 [0059.299] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.299] GetProcessHeap () returned 0x630000 [0059.299] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.299] GetProcessHeap () returned 0x630000 [0059.299] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.299] GetProcessHeap () returned 0x630000 [0059.299] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0059.299] GetProcessHeap () returned 0x630000 [0059.299] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0059.299] GetProcessHeap () returned 0x630000 [0059.299] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0059.299] GetProcessHeap () returned 0x630000 [0059.299] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0059.299] GetProcessHeap () returned 0x630000 [0059.299] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.299] GetProcessHeap () returned 0x630000 [0059.299] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.299] GetProcessHeap () returned 0x630000 [0059.299] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0059.299] GetProcessHeap () returned 0x630000 [0059.299] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.299] GetProcessHeap () returned 0x630000 [0059.299] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.299] GetProcessHeap () returned 0x630000 [0059.299] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.299] GetProcessHeap () returned 0x630000 [0059.299] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.299] GetProcessHeap () returned 0x630000 [0059.299] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.299] GetProcessHeap () returned 0x630000 [0059.300] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.300] GetProcessHeap () returned 0x630000 [0059.300] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.300] GetProcessHeap () returned 0x630000 [0059.300] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0059.300] GetProcessHeap () returned 0x630000 [0059.300] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0059.300] GetProcessHeap () returned 0x630000 [0059.300] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.300] GetProcessHeap () returned 0x630000 [0059.300] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.300] GetProcessHeap () returned 0x630000 [0059.300] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0059.300] GetProcessHeap () returned 0x630000 [0059.300] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0059.300] GetProcessHeap () returned 0x630000 [0059.300] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.300] GetProcessHeap () returned 0x630000 [0059.300] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.300] GetProcessHeap () returned 0x630000 [0059.300] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.300] GetProcessHeap () returned 0x630000 [0059.300] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.300] GetProcessHeap () returned 0x630000 [0059.300] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0059.300] GetProcessHeap () returned 0x630000 [0059.300] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0059.300] GetProcessHeap () returned 0x630000 [0059.300] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0059.300] GetProcessHeap () returned 0x630000 [0059.300] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0059.300] GetProcessHeap () returned 0x630000 [0059.300] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0059.300] GetProcessHeap () returned 0x630000 [0059.300] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0059.300] GetProcessHeap () returned 0x630000 [0059.300] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0059.300] GetProcessHeap () returned 0x630000 [0059.301] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0059.301] GetProcessHeap () returned 0x630000 [0059.301] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0059.301] GetProcessHeap () returned 0x630000 [0059.301] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0059.301] GetProcessHeap () returned 0x630000 [0059.301] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0059.301] WriteFile (in: hFile=0x230, lpBuffer=0x65a768*, nNumberOfBytesToWrite=0x384, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65a768*, lpNumberOfBytesWritten=0x243d864*=0x384, lpOverlapped=0x0) returned 1 [0059.303] GetProcessHeap () returned 0x630000 [0059.303] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65a768, Size=0x30) returned 0x65a768 [0059.303] GetProcessHeap () returned 0x630000 [0059.303] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0059.303] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.303] GetProcessHeap () returned 0x630000 [0059.303] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1380) returned 0x661980 [0059.304] ReadFile (in: hFile=0x230, lpBuffer=0x661980, nNumberOfBytesToRead=0x1380, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661980*, lpNumberOfBytesRead=0x243d7e8*=0x1380, lpOverlapped=0x0) returned 1 [0059.304] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.304] WriteFile (in: hFile=0x230, lpBuffer=0x661980*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661980*, lpNumberOfBytesWritten=0x243d7e4*=0x1380, lpOverlapped=0x0) returned 1 [0059.305] GetProcessHeap () returned 0x630000 [0059.305] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661980 | out: hHeap=0x630000) returned 1 [0059.305] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.305] WriteFile (in: hFile=0x230, lpBuffer=0x65a768*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65a768*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0059.306] CloseHandle (hObject=0x230) returned 1 [0059.308] GetProcessHeap () returned 0x630000 [0059.308] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0059.308] GetProcessHeap () returned 0x630000 [0059.308] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6558c8 | out: hHeap=0x630000) returned 1 [0059.308] GetProcessHeap () returned 0x630000 [0059.308] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0059.308] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\eDhakAkMi35niJgyT.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\eDhakAkMi35niJgyT.flv") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\eDhakAkMi35niJgyT.flv" [0059.308] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\eDhakAkMi35niJgyT.flv", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\eDhakAkMi35niJgyT.flv.happythreechoose") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\eDhakAkMi35niJgyT.flv.happythreechoose" [0059.308] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\eDhakAkMi35niJgyT.flv" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\g9kx78tzkibuoa\\edhakakmi35nijgyt.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\eDhakAkMi35niJgyT.flv.happythreechoose" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\g9kx78tzkibuoa\\edhakakmi35nijgyt.flv.happythreechoose"), dwFlags=0x1) returned 1 [0059.308] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\eDhakAkMi35niJgyT.flv" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa") returned 1 [0059.308] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\") returned="" [0059.309] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\Decryption INFO.html" [0059.309] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\g9kx78tzkibuoa\\decryption info.html")) returned 0x20 [0059.309] GetProcessHeap () returned 0x630000 [0059.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645d18 | out: hHeap=0x630000) returned 1 [0059.309] FindNextFileW (in: hFindFile=0x65ba90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a15f650, ftCreationTime.dwHighDateTime=0x1d5d2b7, ftLastAccessTime.dwLowDateTime=0xe66ce920, ftLastAccessTime.dwHighDateTime=0x1d5c9f7, ftLastWriteTime.dwLowDateTime=0xe66ce920, ftLastWriteTime.dwHighDateTime=0x1d5c9f7, nFileSizeHigh=0x0, nFileSizeLow=0x9d22, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MpyGLAi8pyox.avi", cAlternateFileName="MPYGLA~1.AVI")) returned 1 [0059.309] lstrcmpiW (lpString1="MpyGLAi8pyox.avi", lpString2=".") returned 1 [0059.309] lstrcmpiW (lpString1="MpyGLAi8pyox.avi", lpString2="..") returned 1 [0059.309] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\", lpString2="MpyGLAi8pyox.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\MpyGLAi8pyox.avi") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\MpyGLAi8pyox.avi" [0059.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MpyGLAi8pyox.avi", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0059.309] GetProcessHeap () returned 0x630000 [0059.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11) returned 0x645fb8 [0059.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MpyGLAi8pyox.avi", cchWideChar=-1, lpMultiByteStr=0x645fb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MpyGLAi8pyox.avi", lpUsedDefaultChar=0x0) returned 17 [0059.309] lstrlenA (lpString="MpyGLAi8pyox.avi") returned 16 [0059.309] lstrlenA (lpString=".happythreechoose") returned 17 [0059.309] lstrcmpiW (lpString1="MpyGLAi8pyox.avi", lpString2="Decryption INFO.html") returned 1 [0059.309] lstrcmpiW (lpString1="MpyGLAi8pyox.avi", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0059.309] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0059.309] lstrcmpiW (lpString1="MpyGLAi8pyox.avi", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0059.309] GetProcessHeap () returned 0x630000 [0059.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0059.309] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\MpyGLAi8pyox.avi" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\g9kx78tzkibuoa\\mpyglai8pyox.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0059.309] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=40226) returned 1 [0059.309] GetProcessHeap () returned 0x630000 [0059.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6555f8 [0059.309] GetProcessHeap () returned 0x630000 [0059.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0059.309] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\MpyGLAi8pyox.avi") returned 68 [0059.309] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.310] GetProcessHeap () returned 0x630000 [0059.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0059.310] GetProcessHeap () returned 0x630000 [0059.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38e) returned 0x65a7a0 [0059.310] lstrlenA (lpString="rsa_encrypt") returned 11 [0059.310] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0059.310] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0059.310] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0059.310] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0059.310] GetProcessHeap () returned 0x630000 [0059.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0059.310] lstrlenA (lpString="010001") returned 6 [0059.310] GetProcessHeap () returned 0x630000 [0059.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a158 [0059.311] GetProcessHeap () returned 0x630000 [0059.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.311] GetProcessHeap () returned 0x630000 [0059.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e190 [0059.311] GetProcessHeap () returned 0x630000 [0059.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.311] GetProcessHeap () returned 0x630000 [0059.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0059.311] GetProcessHeap () returned 0x630000 [0059.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657210 [0059.311] GetProcessHeap () returned 0x630000 [0059.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a0c8 [0059.311] GetProcessHeap () returned 0x630000 [0059.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0059.311] GetProcessHeap () returned 0x630000 [0059.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0059.311] GetProcessHeap () returned 0x630000 [0059.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0059.311] GetProcessHeap () returned 0x630000 [0059.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.311] GetProcessHeap () returned 0x630000 [0059.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657558 [0059.311] GetProcessHeap () returned 0x630000 [0059.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.311] GetProcessHeap () returned 0x630000 [0059.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0059.311] GetProcessHeap () returned 0x630000 [0059.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0059.311] GetProcessHeap () returned 0x630000 [0059.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.311] GetProcessHeap () returned 0x630000 [0059.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0059.311] GetProcessHeap () returned 0x630000 [0059.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0059.311] GetProcessHeap () returned 0x630000 [0059.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0059.311] GetProcessHeap () returned 0x630000 [0059.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0059.312] GetProcessHeap () returned 0x630000 [0059.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.312] GetProcessHeap () returned 0x630000 [0059.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0059.312] GetProcessHeap () returned 0x630000 [0059.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.312] GetProcessHeap () returned 0x630000 [0059.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.312] GetProcessHeap () returned 0x630000 [0059.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ebb0 [0059.312] GetProcessHeap () returned 0x630000 [0059.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0059.312] GetProcessHeap () returned 0x630000 [0059.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0059.312] GetProcessHeap () returned 0x630000 [0059.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0059.312] GetProcessHeap () returned 0x630000 [0059.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0059.312] GetProcessHeap () returned 0x630000 [0059.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0059.312] GetProcessHeap () returned 0x630000 [0059.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.312] GetProcessHeap () returned 0x630000 [0059.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.312] GetProcessHeap () returned 0x630000 [0059.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0059.312] GetProcessHeap () returned 0x630000 [0059.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0059.312] GetProcessHeap () returned 0x630000 [0059.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0e8 [0059.312] GetProcessHeap () returned 0x630000 [0059.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0e8 | out: hHeap=0x630000) returned 1 [0059.312] GetProcessHeap () returned 0x630000 [0059.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.313] GetProcessHeap () returned 0x630000 [0059.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.313] GetProcessHeap () returned 0x630000 [0059.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.313] GetProcessHeap () returned 0x630000 [0059.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.313] GetProcessHeap () returned 0x630000 [0059.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0059.313] GetProcessHeap () returned 0x630000 [0059.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0059.313] GetProcessHeap () returned 0x630000 [0059.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0059.313] GetProcessHeap () returned 0x630000 [0059.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0059.313] GetProcessHeap () returned 0x630000 [0059.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0059.313] GetProcessHeap () returned 0x630000 [0059.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.313] GetProcessHeap () returned 0x630000 [0059.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.313] GetProcessHeap () returned 0x630000 [0059.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.313] GetProcessHeap () returned 0x630000 [0059.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.313] GetProcessHeap () returned 0x630000 [0059.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.313] GetProcessHeap () returned 0x630000 [0059.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0059.313] GetProcessHeap () returned 0x630000 [0059.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0059.313] GetProcessHeap () returned 0x630000 [0059.314] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0059.314] GetProcessHeap () returned 0x630000 [0059.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0059.314] GetProcessHeap () returned 0x630000 [0059.314] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0059.314] GetProcessHeap () returned 0x630000 [0059.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0059.314] GetProcessHeap () returned 0x630000 [0059.314] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0059.314] GetProcessHeap () returned 0x630000 [0059.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0059.314] GetProcessHeap () returned 0x630000 [0059.314] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0059.314] GetProcessHeap () returned 0x630000 [0059.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0059.314] GetProcessHeap () returned 0x630000 [0059.314] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0059.314] GetProcessHeap () returned 0x630000 [0059.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0059.314] GetProcessHeap () returned 0x630000 [0059.314] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0059.314] GetProcessHeap () returned 0x630000 [0059.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.314] GetProcessHeap () returned 0x630000 [0059.314] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0059.314] GetProcessHeap () returned 0x630000 [0059.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0059.314] GetProcessHeap () returned 0x630000 [0059.314] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0059.314] GetProcessHeap () returned 0x630000 [0059.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0059.314] GetProcessHeap () returned 0x630000 [0059.314] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0059.314] GetProcessHeap () returned 0x630000 [0059.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0059.314] GetProcessHeap () returned 0x630000 [0059.314] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0059.315] GetProcessHeap () returned 0x630000 [0059.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0059.315] GetProcessHeap () returned 0x630000 [0059.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0059.315] GetProcessHeap () returned 0x630000 [0059.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0059.315] GetProcessHeap () returned 0x630000 [0059.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.315] GetProcessHeap () returned 0x630000 [0059.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.315] GetProcessHeap () returned 0x630000 [0059.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0059.315] GetProcessHeap () returned 0x630000 [0059.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0059.315] GetProcessHeap () returned 0x630000 [0059.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0059.315] GetProcessHeap () returned 0x630000 [0059.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0059.315] GetProcessHeap () returned 0x630000 [0059.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0059.315] GetProcessHeap () returned 0x630000 [0059.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0059.315] GetProcessHeap () returned 0x630000 [0059.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0059.315] GetProcessHeap () returned 0x630000 [0059.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0059.315] GetProcessHeap () returned 0x630000 [0059.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0059.315] GetProcessHeap () returned 0x630000 [0059.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0059.315] GetProcessHeap () returned 0x630000 [0059.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0059.315] GetProcessHeap () returned 0x630000 [0059.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0059.315] GetProcessHeap () returned 0x630000 [0059.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0059.315] GetProcessHeap () returned 0x630000 [0059.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0059.316] GetProcessHeap () returned 0x630000 [0059.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.316] GetProcessHeap () returned 0x630000 [0059.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.316] GetProcessHeap () returned 0x630000 [0059.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0059.316] GetProcessHeap () returned 0x630000 [0059.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.316] GetProcessHeap () returned 0x630000 [0059.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0059.316] GetProcessHeap () returned 0x630000 [0059.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0059.316] GetProcessHeap () returned 0x630000 [0059.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0059.316] GetProcessHeap () returned 0x630000 [0059.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0059.316] GetProcessHeap () returned 0x630000 [0059.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0059.316] GetProcessHeap () returned 0x630000 [0059.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0059.316] GetProcessHeap () returned 0x630000 [0059.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0059.316] GetProcessHeap () returned 0x630000 [0059.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0059.316] GetProcessHeap () returned 0x630000 [0059.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.316] GetProcessHeap () returned 0x630000 [0059.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.316] GetProcessHeap () returned 0x630000 [0059.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0059.316] GetProcessHeap () returned 0x630000 [0059.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0059.316] GetProcessHeap () returned 0x630000 [0059.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.316] GetProcessHeap () returned 0x630000 [0059.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.316] GetProcessHeap () returned 0x630000 [0059.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0059.317] GetProcessHeap () returned 0x630000 [0059.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0059.317] GetProcessHeap () returned 0x630000 [0059.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0059.317] GetProcessHeap () returned 0x630000 [0059.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0059.317] GetProcessHeap () returned 0x630000 [0059.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0059.317] GetProcessHeap () returned 0x630000 [0059.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0059.317] GetProcessHeap () returned 0x630000 [0059.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0059.317] GetProcessHeap () returned 0x630000 [0059.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0059.317] GetProcessHeap () returned 0x630000 [0059.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0059.317] GetProcessHeap () returned 0x630000 [0059.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0059.317] GetProcessHeap () returned 0x630000 [0059.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0059.317] GetProcessHeap () returned 0x630000 [0059.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.317] GetProcessHeap () returned 0x630000 [0059.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0059.317] WriteFile (in: hFile=0x230, lpBuffer=0x65a7a0*, nNumberOfBytesToWrite=0x38e, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65a7a0*, lpNumberOfBytesWritten=0x243d864*=0x38e, lpOverlapped=0x0) returned 1 [0059.320] GetProcessHeap () returned 0x630000 [0059.320] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65a7a0, Size=0x30) returned 0x65a7a0 [0059.320] GetProcessHeap () returned 0x630000 [0059.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0059.320] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.320] GetProcessHeap () returned 0x630000 [0059.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9d30) returned 0x661980 [0059.320] ReadFile (in: hFile=0x230, lpBuffer=0x661980, nNumberOfBytesToRead=0x9d30, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661980*, lpNumberOfBytesRead=0x243d7e8*=0x9d30, lpOverlapped=0x0) returned 1 [0059.321] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.321] WriteFile (in: hFile=0x230, lpBuffer=0x661980*, nNumberOfBytesToWrite=0x9d30, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661980*, lpNumberOfBytesWritten=0x243d7e4*=0x9d30, lpOverlapped=0x0) returned 1 [0059.322] GetProcessHeap () returned 0x630000 [0059.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661980 | out: hHeap=0x630000) returned 1 [0059.323] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.323] WriteFile (in: hFile=0x230, lpBuffer=0x65a7a0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65a7a0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0059.324] CloseHandle (hObject=0x230) returned 1 [0059.326] GetProcessHeap () returned 0x630000 [0059.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0059.326] GetProcessHeap () returned 0x630000 [0059.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6555f8 | out: hHeap=0x630000) returned 1 [0059.326] GetProcessHeap () returned 0x630000 [0059.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0059.327] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\MpyGLAi8pyox.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\MpyGLAi8pyox.avi") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\MpyGLAi8pyox.avi" [0059.327] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\MpyGLAi8pyox.avi", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\MpyGLAi8pyox.avi.happythreechoose") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\MpyGLAi8pyox.avi.happythreechoose" [0059.327] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\MpyGLAi8pyox.avi" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\g9kx78tzkibuoa\\mpyglai8pyox.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\MpyGLAi8pyox.avi.happythreechoose" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\g9kx78tzkibuoa\\mpyglai8pyox.avi.happythreechoose"), dwFlags=0x1) returned 1 [0059.327] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\MpyGLAi8pyox.avi" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa") returned 1 [0059.327] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\") returned="" [0059.327] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\Decryption INFO.html" [0059.327] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\g9kx78tzkibuoa\\decryption info.html")) returned 0x20 [0059.328] GetProcessHeap () returned 0x630000 [0059.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645fb8 | out: hHeap=0x630000) returned 1 [0059.328] FindNextFileW (in: hFindFile=0x65ba90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee298450, ftCreationTime.dwHighDateTime=0x1d5d453, ftLastAccessTime.dwLowDateTime=0xf5c0da10, ftLastAccessTime.dwHighDateTime=0x1d5cde1, ftLastWriteTime.dwLowDateTime=0xf5c0da10, ftLastWriteTime.dwHighDateTime=0x1d5cde1, nFileSizeHigh=0x0, nFileSizeLow=0xc9fa, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="QOfYMH2.swf", cAlternateFileName="")) returned 1 [0059.328] lstrcmpiW (lpString1="QOfYMH2.swf", lpString2=".") returned 1 [0059.328] lstrcmpiW (lpString1="QOfYMH2.swf", lpString2="..") returned 1 [0059.328] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\", lpString2="QOfYMH2.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\QOfYMH2.swf") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\QOfYMH2.swf" [0059.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QOfYMH2.swf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.328] GetProcessHeap () returned 0x630000 [0059.328] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0059.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QOfYMH2.swf", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QOfYMH2.swf", lpUsedDefaultChar=0x0) returned 12 [0059.328] lstrlenA (lpString="QOfYMH2.swf") returned 11 [0059.328] lstrlenA (lpString=".happythreechoose") returned 17 [0059.328] lstrcmpiW (lpString1="QOfYMH2.swf", lpString2="Decryption INFO.html") returned 1 [0059.328] lstrcmpiW (lpString1="QOfYMH2.swf", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0059.328] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0059.328] lstrcmpiW (lpString1="QOfYMH2.swf", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0059.328] GetProcessHeap () returned 0x630000 [0059.328] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0059.328] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\QOfYMH2.swf" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\g9kx78tzkibuoa\\qofymh2.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0059.328] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=51706) returned 1 [0059.329] GetProcessHeap () returned 0x630000 [0059.329] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655850 [0059.329] GetProcessHeap () returned 0x630000 [0059.329] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0059.329] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\QOfYMH2.swf") returned 63 [0059.329] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.329] GetProcessHeap () returned 0x630000 [0059.329] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0059.329] GetProcessHeap () returned 0x630000 [0059.329] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x386) returned 0x65a7d8 [0059.329] lstrlenA (lpString="rsa_encrypt") returned 11 [0059.329] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0059.329] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0059.330] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0059.330] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0059.330] GetProcessHeap () returned 0x630000 [0059.330] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0059.330] lstrlenA (lpString="010001") returned 6 [0059.330] GetProcessHeap () returned 0x630000 [0059.330] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a218 [0059.330] GetProcessHeap () returned 0x630000 [0059.330] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.330] GetProcessHeap () returned 0x630000 [0059.330] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e8e0 [0059.330] GetProcessHeap () returned 0x630000 [0059.330] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.330] GetProcessHeap () returned 0x630000 [0059.330] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e580 [0059.330] GetProcessHeap () returned 0x630000 [0059.330] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x6570f8 [0059.330] GetProcessHeap () returned 0x630000 [0059.330] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a178 [0059.330] GetProcessHeap () returned 0x630000 [0059.330] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0059.330] GetProcessHeap () returned 0x630000 [0059.330] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.330] GetProcessHeap () returned 0x630000 [0059.330] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0059.330] GetProcessHeap () returned 0x630000 [0059.330] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.330] GetProcessHeap () returned 0x630000 [0059.330] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657328 [0059.330] GetProcessHeap () returned 0x630000 [0059.330] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0059.330] GetProcessHeap () returned 0x630000 [0059.330] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0059.330] GetProcessHeap () returned 0x630000 [0059.330] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ec40 [0059.331] GetProcessHeap () returned 0x630000 [0059.331] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.331] GetProcessHeap () returned 0x630000 [0059.331] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0059.331] GetProcessHeap () returned 0x630000 [0059.331] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ec40 | out: hHeap=0x630000) returned 1 [0059.331] GetProcessHeap () returned 0x630000 [0059.331] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.331] GetProcessHeap () returned 0x630000 [0059.331] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x661638 [0059.331] GetProcessHeap () returned 0x630000 [0059.331] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.331] GetProcessHeap () returned 0x630000 [0059.331] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.331] GetProcessHeap () returned 0x630000 [0059.331] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0059.331] GetProcessHeap () returned 0x630000 [0059.331] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0059.331] GetProcessHeap () returned 0x630000 [0059.331] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65dec0 [0059.331] GetProcessHeap () returned 0x630000 [0059.331] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661638 | out: hHeap=0x630000) returned 1 [0059.331] GetProcessHeap () returned 0x630000 [0059.331] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0059.331] GetProcessHeap () returned 0x630000 [0059.331] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0059.331] GetProcessHeap () returned 0x630000 [0059.331] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0059.331] GetProcessHeap () returned 0x630000 [0059.331] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0059.331] GetProcessHeap () returned 0x630000 [0059.331] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.331] GetProcessHeap () returned 0x630000 [0059.331] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.331] GetProcessHeap () returned 0x630000 [0059.331] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0059.331] GetProcessHeap () returned 0x630000 [0059.331] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0059.332] GetProcessHeap () returned 0x630000 [0059.332] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.332] GetProcessHeap () returned 0x630000 [0059.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.332] GetProcessHeap () returned 0x630000 [0059.332] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.332] GetProcessHeap () returned 0x630000 [0059.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.332] GetProcessHeap () returned 0x630000 [0059.332] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0059.332] GetProcessHeap () returned 0x630000 [0059.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0059.332] GetProcessHeap () returned 0x630000 [0059.332] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0059.332] GetProcessHeap () returned 0x630000 [0059.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0059.332] GetProcessHeap () returned 0x630000 [0059.332] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0059.332] GetProcessHeap () returned 0x630000 [0059.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0059.332] GetProcessHeap () returned 0x630000 [0059.332] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0059.332] GetProcessHeap () returned 0x630000 [0059.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0059.332] GetProcessHeap () returned 0x630000 [0059.332] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.332] GetProcessHeap () returned 0x630000 [0059.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.332] GetProcessHeap () returned 0x630000 [0059.332] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0059.332] GetProcessHeap () returned 0x630000 [0059.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0059.332] GetProcessHeap () returned 0x630000 [0059.332] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0059.332] GetProcessHeap () returned 0x630000 [0059.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0059.332] GetProcessHeap () returned 0x630000 [0059.333] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0059.333] GetProcessHeap () returned 0x630000 [0059.333] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0059.333] GetProcessHeap () returned 0x630000 [0059.333] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.333] GetProcessHeap () returned 0x630000 [0059.333] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.333] GetProcessHeap () returned 0x630000 [0059.333] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0059.333] GetProcessHeap () returned 0x630000 [0059.333] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0059.333] GetProcessHeap () returned 0x630000 [0059.333] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.333] GetProcessHeap () returned 0x630000 [0059.333] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.333] GetProcessHeap () returned 0x630000 [0059.333] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0059.333] GetProcessHeap () returned 0x630000 [0059.333] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0059.333] GetProcessHeap () returned 0x630000 [0059.333] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0059.333] GetProcessHeap () returned 0x630000 [0059.333] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0059.333] GetProcessHeap () returned 0x630000 [0059.333] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0059.333] GetProcessHeap () returned 0x630000 [0059.333] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0059.333] GetProcessHeap () returned 0x630000 [0059.333] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.333] GetProcessHeap () returned 0x630000 [0059.333] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.333] GetProcessHeap () returned 0x630000 [0059.333] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.333] GetProcessHeap () returned 0x630000 [0059.333] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.333] GetProcessHeap () returned 0x630000 [0059.333] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0059.334] GetProcessHeap () returned 0x630000 [0059.334] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.334] GetProcessHeap () returned 0x630000 [0059.334] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.334] GetProcessHeap () returned 0x630000 [0059.334] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.334] GetProcessHeap () returned 0x630000 [0059.334] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0059.334] GetProcessHeap () returned 0x630000 [0059.334] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0059.334] GetProcessHeap () returned 0x630000 [0059.334] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0059.334] GetProcessHeap () returned 0x630000 [0059.334] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0059.334] GetProcessHeap () returned 0x630000 [0059.334] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0059.334] GetProcessHeap () returned 0x630000 [0059.334] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0059.334] GetProcessHeap () returned 0x630000 [0059.334] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0059.334] GetProcessHeap () returned 0x630000 [0059.334] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0059.334] GetProcessHeap () returned 0x630000 [0059.334] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0059.334] GetProcessHeap () returned 0x630000 [0059.334] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0059.334] GetProcessHeap () returned 0x630000 [0059.334] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0059.334] GetProcessHeap () returned 0x630000 [0059.334] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0059.334] GetProcessHeap () returned 0x630000 [0059.334] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0059.334] GetProcessHeap () returned 0x630000 [0059.334] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0059.334] GetProcessHeap () returned 0x630000 [0059.334] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0059.334] GetProcessHeap () returned 0x630000 [0059.335] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0059.335] GetProcessHeap () returned 0x630000 [0059.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0059.335] GetProcessHeap () returned 0x630000 [0059.335] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0059.335] GetProcessHeap () returned 0x630000 [0059.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0059.335] GetProcessHeap () returned 0x630000 [0059.335] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0059.335] GetProcessHeap () returned 0x630000 [0059.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0059.335] GetProcessHeap () returned 0x630000 [0059.335] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0059.335] GetProcessHeap () returned 0x630000 [0059.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0059.335] GetProcessHeap () returned 0x630000 [0059.335] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0059.335] GetProcessHeap () returned 0x630000 [0059.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.335] GetProcessHeap () returned 0x630000 [0059.335] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.335] GetProcessHeap () returned 0x630000 [0059.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.335] GetProcessHeap () returned 0x630000 [0059.335] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.335] GetProcessHeap () returned 0x630000 [0059.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0059.335] GetProcessHeap () returned 0x630000 [0059.335] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0059.335] GetProcessHeap () returned 0x630000 [0059.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0059.335] GetProcessHeap () returned 0x630000 [0059.335] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0059.335] GetProcessHeap () returned 0x630000 [0059.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0059.335] GetProcessHeap () returned 0x630000 [0059.335] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0059.336] GetProcessHeap () returned 0x630000 [0059.336] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.336] GetProcessHeap () returned 0x630000 [0059.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.336] GetProcessHeap () returned 0x630000 [0059.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0059.336] GetProcessHeap () returned 0x630000 [0059.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0059.336] GetProcessHeap () returned 0x630000 [0059.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0059.336] GetProcessHeap () returned 0x630000 [0059.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0059.336] GetProcessHeap () returned 0x630000 [0059.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0059.336] GetProcessHeap () returned 0x630000 [0059.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0059.336] GetProcessHeap () returned 0x630000 [0059.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0059.336] GetProcessHeap () returned 0x630000 [0059.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0059.336] GetProcessHeap () returned 0x630000 [0059.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0059.336] GetProcessHeap () returned 0x630000 [0059.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.336] GetProcessHeap () returned 0x630000 [0059.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0059.336] WriteFile (in: hFile=0x230, lpBuffer=0x65a7d8*, nNumberOfBytesToWrite=0x386, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65a7d8*, lpNumberOfBytesWritten=0x243d864*=0x386, lpOverlapped=0x0) returned 1 [0059.338] GetProcessHeap () returned 0x630000 [0059.338] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65a7d8, Size=0x30) returned 0x65a7d8 [0059.338] GetProcessHeap () returned 0x630000 [0059.338] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0059.338] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.338] GetProcessHeap () returned 0x630000 [0059.338] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xca00) returned 0x661980 [0059.340] ReadFile (in: hFile=0x230, lpBuffer=0x661980, nNumberOfBytesToRead=0xca00, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661980*, lpNumberOfBytesRead=0x243d7e8*=0xca00, lpOverlapped=0x0) returned 1 [0059.341] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.341] WriteFile (in: hFile=0x230, lpBuffer=0x661980*, nNumberOfBytesToWrite=0xca00, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661980*, lpNumberOfBytesWritten=0x243d7e4*=0xca00, lpOverlapped=0x0) returned 1 [0059.342] GetProcessHeap () returned 0x630000 [0059.342] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661980 | out: hHeap=0x630000) returned 1 [0059.342] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.342] WriteFile (in: hFile=0x230, lpBuffer=0x65a7d8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65a7d8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0059.343] CloseHandle (hObject=0x230) returned 1 [0059.345] GetProcessHeap () returned 0x630000 [0059.345] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0059.346] GetProcessHeap () returned 0x630000 [0059.346] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655850 | out: hHeap=0x630000) returned 1 [0059.346] GetProcessHeap () returned 0x630000 [0059.346] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0059.346] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\QOfYMH2.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\QOfYMH2.swf") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\QOfYMH2.swf" [0059.346] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\QOfYMH2.swf", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\QOfYMH2.swf.happythreechoose") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\QOfYMH2.swf.happythreechoose" [0059.346] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\QOfYMH2.swf" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\g9kx78tzkibuoa\\qofymh2.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\QOfYMH2.swf.happythreechoose" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\g9kx78tzkibuoa\\qofymh2.swf.happythreechoose"), dwFlags=0x1) returned 1 [0059.346] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\QOfYMH2.swf" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa") returned 1 [0059.346] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\") returned="" [0059.346] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\Decryption INFO.html" [0059.346] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\g9kx78tzkibuoa\\decryption info.html")) returned 0x20 [0059.346] GetProcessHeap () returned 0x630000 [0059.347] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0059.347] FindNextFileW (in: hFindFile=0x65ba90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe78bbcf0, ftCreationTime.dwHighDateTime=0x1d5d7a8, ftLastAccessTime.dwLowDateTime=0xb05c9e80, ftLastAccessTime.dwHighDateTime=0x1d5cc44, ftLastWriteTime.dwLowDateTime=0xb05c9e80, ftLastWriteTime.dwHighDateTime=0x1d5cc44, nFileSizeHigh=0x0, nFileSizeLow=0x8240, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="suBKrtlh5UbO.avi", cAlternateFileName="SUBKRT~1.AVI")) returned 1 [0059.347] lstrcmpiW (lpString1="suBKrtlh5UbO.avi", lpString2=".") returned 1 [0059.347] lstrcmpiW (lpString1="suBKrtlh5UbO.avi", lpString2="..") returned 1 [0059.347] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\", lpString2="suBKrtlh5UbO.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\suBKrtlh5UbO.avi") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\suBKrtlh5UbO.avi" [0059.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="suBKrtlh5UbO.avi", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0059.347] GetProcessHeap () returned 0x630000 [0059.347] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11) returned 0x645cd8 [0059.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="suBKrtlh5UbO.avi", cchWideChar=-1, lpMultiByteStr=0x645cd8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="suBKrtlh5UbO.avi", lpUsedDefaultChar=0x0) returned 17 [0059.347] lstrlenA (lpString="suBKrtlh5UbO.avi") returned 16 [0059.347] lstrlenA (lpString=".happythreechoose") returned 17 [0059.347] lstrcmpiW (lpString1="suBKrtlh5UbO.avi", lpString2="Decryption INFO.html") returned 1 [0059.347] lstrcmpiW (lpString1="suBKrtlh5UbO.avi", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0059.347] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0059.347] lstrcmpiW (lpString1="suBKrtlh5UbO.avi", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0059.347] GetProcessHeap () returned 0x630000 [0059.347] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0059.347] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\suBKrtlh5UbO.avi" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\g9kx78tzkibuoa\\subkrtlh5ubo.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0059.347] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=33344) returned 1 [0059.347] GetProcessHeap () returned 0x630000 [0059.347] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6558c8 [0059.347] GetProcessHeap () returned 0x630000 [0059.347] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0059.347] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\suBKrtlh5UbO.avi") returned 68 [0059.347] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.347] GetProcessHeap () returned 0x630000 [0059.347] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0059.348] GetProcessHeap () returned 0x630000 [0059.348] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x65a810 [0059.348] lstrlenA (lpString="rsa_encrypt") returned 11 [0059.349] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0059.350] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0059.350] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0059.350] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0059.350] GetProcessHeap () returned 0x630000 [0059.350] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0059.350] lstrlenA (lpString="010001") returned 6 [0059.350] GetProcessHeap () returned 0x630000 [0059.350] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a1d8 [0059.350] GetProcessHeap () returned 0x630000 [0059.350] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x65ab98 [0059.350] GetProcessHeap () returned 0x630000 [0059.350] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea00 [0059.350] GetProcessHeap () returned 0x630000 [0059.350] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ab98 | out: hHeap=0x630000) returned 1 [0059.350] GetProcessHeap () returned 0x630000 [0059.350] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e970 [0059.350] GetProcessHeap () returned 0x630000 [0059.350] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657328 [0059.350] GetProcessHeap () returned 0x630000 [0059.350] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a128 [0059.350] GetProcessHeap () returned 0x630000 [0059.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0059.351] GetProcessHeap () returned 0x630000 [0059.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0059.351] GetProcessHeap () returned 0x630000 [0059.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0059.351] GetProcessHeap () returned 0x630000 [0059.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x65ab98 [0059.351] GetProcessHeap () returned 0x630000 [0059.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x6570f8 [0059.351] GetProcessHeap () returned 0x630000 [0059.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0059.351] GetProcessHeap () returned 0x630000 [0059.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0059.351] GetProcessHeap () returned 0x630000 [0059.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0059.351] GetProcessHeap () returned 0x630000 [0059.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ab98 | out: hHeap=0x630000) returned 1 [0059.351] GetProcessHeap () returned 0x630000 [0059.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0059.351] GetProcessHeap () returned 0x630000 [0059.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0059.351] GetProcessHeap () returned 0x630000 [0059.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0059.351] GetProcessHeap () returned 0x630000 [0059.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0059.351] GetProcessHeap () returned 0x630000 [0059.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0059.351] GetProcessHeap () returned 0x630000 [0059.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0059.351] GetProcessHeap () returned 0x630000 [0059.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.351] GetProcessHeap () returned 0x630000 [0059.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.351] GetProcessHeap () returned 0x630000 [0059.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ea90 [0059.351] GetProcessHeap () returned 0x630000 [0059.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0059.351] GetProcessHeap () returned 0x630000 [0059.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0059.352] GetProcessHeap () returned 0x630000 [0059.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea90 | out: hHeap=0x630000) returned 1 [0059.352] GetProcessHeap () returned 0x630000 [0059.352] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.352] GetProcessHeap () returned 0x630000 [0059.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.352] GetProcessHeap () returned 0x630000 [0059.352] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0059.352] GetProcessHeap () returned 0x630000 [0059.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.352] GetProcessHeap () returned 0x630000 [0059.352] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.352] GetProcessHeap () returned 0x630000 [0059.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.352] GetProcessHeap () returned 0x630000 [0059.352] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.352] GetProcessHeap () returned 0x630000 [0059.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.352] GetProcessHeap () returned 0x630000 [0059.352] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.352] GetProcessHeap () returned 0x630000 [0059.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.352] GetProcessHeap () returned 0x630000 [0059.352] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0059.352] GetProcessHeap () returned 0x630000 [0059.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0059.352] GetProcessHeap () returned 0x630000 [0059.352] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.352] GetProcessHeap () returned 0x630000 [0059.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.352] GetProcessHeap () returned 0x630000 [0059.352] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0059.352] GetProcessHeap () returned 0x630000 [0059.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0059.352] GetProcessHeap () returned 0x630000 [0059.352] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.352] GetProcessHeap () returned 0x630000 [0059.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.353] GetProcessHeap () returned 0x630000 [0059.353] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.353] GetProcessHeap () returned 0x630000 [0059.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.353] GetProcessHeap () returned 0x630000 [0059.353] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0059.353] GetProcessHeap () returned 0x630000 [0059.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0059.353] GetProcessHeap () returned 0x630000 [0059.353] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0059.353] GetProcessHeap () returned 0x630000 [0059.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.353] GetProcessHeap () returned 0x630000 [0059.353] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0059.353] GetProcessHeap () returned 0x630000 [0059.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0059.353] GetProcessHeap () returned 0x630000 [0059.353] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.353] GetProcessHeap () returned 0x630000 [0059.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.353] GetProcessHeap () returned 0x630000 [0059.353] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0059.353] GetProcessHeap () returned 0x630000 [0059.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0059.353] GetProcessHeap () returned 0x630000 [0059.353] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0059.353] GetProcessHeap () returned 0x630000 [0059.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0059.353] GetProcessHeap () returned 0x630000 [0059.353] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0059.353] GetProcessHeap () returned 0x630000 [0059.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0059.353] GetProcessHeap () returned 0x630000 [0059.353] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0059.353] GetProcessHeap () returned 0x630000 [0059.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.353] GetProcessHeap () returned 0x630000 [0059.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0059.354] GetProcessHeap () returned 0x630000 [0059.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.354] GetProcessHeap () returned 0x630000 [0059.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0059.354] GetProcessHeap () returned 0x630000 [0059.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0059.354] GetProcessHeap () returned 0x630000 [0059.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.354] GetProcessHeap () returned 0x630000 [0059.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.354] GetProcessHeap () returned 0x630000 [0059.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.354] GetProcessHeap () returned 0x630000 [0059.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.354] GetProcessHeap () returned 0x630000 [0059.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0059.354] GetProcessHeap () returned 0x630000 [0059.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0059.354] GetProcessHeap () returned 0x630000 [0059.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0059.354] GetProcessHeap () returned 0x630000 [0059.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0059.354] GetProcessHeap () returned 0x630000 [0059.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.354] GetProcessHeap () returned 0x630000 [0059.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.354] GetProcessHeap () returned 0x630000 [0059.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.354] GetProcessHeap () returned 0x630000 [0059.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.354] GetProcessHeap () returned 0x630000 [0059.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.354] GetProcessHeap () returned 0x630000 [0059.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.354] GetProcessHeap () returned 0x630000 [0059.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0059.355] GetProcessHeap () returned 0x630000 [0059.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.355] GetProcessHeap () returned 0x630000 [0059.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0059.355] GetProcessHeap () returned 0x630000 [0059.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0059.355] GetProcessHeap () returned 0x630000 [0059.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0059.355] GetProcessHeap () returned 0x630000 [0059.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0059.355] GetProcessHeap () returned 0x630000 [0059.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0059.355] GetProcessHeap () returned 0x630000 [0059.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0059.355] GetProcessHeap () returned 0x630000 [0059.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0059.355] GetProcessHeap () returned 0x630000 [0059.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0059.355] GetProcessHeap () returned 0x630000 [0059.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0059.355] GetProcessHeap () returned 0x630000 [0059.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.355] GetProcessHeap () returned 0x630000 [0059.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0059.355] GetProcessHeap () returned 0x630000 [0059.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0059.355] GetProcessHeap () returned 0x630000 [0059.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0059.355] GetProcessHeap () returned 0x630000 [0059.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0059.355] GetProcessHeap () returned 0x630000 [0059.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0059.355] GetProcessHeap () returned 0x630000 [0059.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0059.355] GetProcessHeap () returned 0x630000 [0059.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0059.355] GetProcessHeap () returned 0x630000 [0059.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0059.356] GetProcessHeap () returned 0x630000 [0059.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0059.356] GetProcessHeap () returned 0x630000 [0059.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0059.356] GetProcessHeap () returned 0x630000 [0059.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0059.356] GetProcessHeap () returned 0x630000 [0059.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0059.356] GetProcessHeap () returned 0x630000 [0059.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0059.356] GetProcessHeap () returned 0x630000 [0059.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0059.356] GetProcessHeap () returned 0x630000 [0059.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0059.356] GetProcessHeap () returned 0x630000 [0059.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0059.356] GetProcessHeap () returned 0x630000 [0059.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0059.356] GetProcessHeap () returned 0x630000 [0059.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0059.356] GetProcessHeap () returned 0x630000 [0059.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0059.356] GetProcessHeap () returned 0x630000 [0059.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0059.356] GetProcessHeap () returned 0x630000 [0059.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0059.356] GetProcessHeap () returned 0x630000 [0059.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0059.356] GetProcessHeap () returned 0x630000 [0059.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0059.356] GetProcessHeap () returned 0x630000 [0059.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0059.356] GetProcessHeap () returned 0x630000 [0059.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0059.356] GetProcessHeap () returned 0x630000 [0059.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0059.357] GetProcessHeap () returned 0x630000 [0059.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0059.357] WriteFile (in: hFile=0x230, lpBuffer=0x65a810*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65a810*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0059.360] GetProcessHeap () returned 0x630000 [0059.360] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65a810, Size=0x30) returned 0x65a810 [0059.360] GetProcessHeap () returned 0x630000 [0059.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0059.360] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.360] GetProcessHeap () returned 0x630000 [0059.360] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8240) returned 0x661980 [0059.360] ReadFile (in: hFile=0x230, lpBuffer=0x661980, nNumberOfBytesToRead=0x8240, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661980*, lpNumberOfBytesRead=0x243d7e8*=0x8240, lpOverlapped=0x0) returned 1 [0059.361] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.361] WriteFile (in: hFile=0x230, lpBuffer=0x661980*, nNumberOfBytesToWrite=0x8240, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661980*, lpNumberOfBytesWritten=0x243d7e4*=0x8240, lpOverlapped=0x0) returned 1 [0059.362] GetProcessHeap () returned 0x630000 [0059.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661980 | out: hHeap=0x630000) returned 1 [0059.363] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.363] WriteFile (in: hFile=0x230, lpBuffer=0x65a810*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65a810*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0059.364] CloseHandle (hObject=0x230) returned 1 [0059.366] GetProcessHeap () returned 0x630000 [0059.366] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0059.366] GetProcessHeap () returned 0x630000 [0059.366] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6558c8 | out: hHeap=0x630000) returned 1 [0059.366] GetProcessHeap () returned 0x630000 [0059.366] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0059.366] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\suBKrtlh5UbO.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\suBKrtlh5UbO.avi") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\suBKrtlh5UbO.avi" [0059.366] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\suBKrtlh5UbO.avi", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\suBKrtlh5UbO.avi.happythreechoose") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\suBKrtlh5UbO.avi.happythreechoose" [0059.366] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\suBKrtlh5UbO.avi" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\g9kx78tzkibuoa\\subkrtlh5ubo.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\suBKrtlh5UbO.avi.happythreechoose" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\g9kx78tzkibuoa\\subkrtlh5ubo.avi.happythreechoose"), dwFlags=0x1) returned 1 [0059.367] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\suBKrtlh5UbO.avi" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa") returned 1 [0059.367] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\") returned="" [0059.367] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\Decryption INFO.html" [0059.367] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\g9kx78tzkibuoa\\decryption info.html")) returned 0x20 [0059.367] GetProcessHeap () returned 0x630000 [0059.367] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645cd8 | out: hHeap=0x630000) returned 1 [0059.367] FindNextFileW (in: hFindFile=0x65ba90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a607130, ftCreationTime.dwHighDateTime=0x1d5cd7e, ftLastAccessTime.dwLowDateTime=0x85a8de30, ftLastAccessTime.dwHighDateTime=0x1d5c8ff, ftLastWriteTime.dwLowDateTime=0x85a8de30, ftLastWriteTime.dwHighDateTime=0x1d5c8ff, nFileSizeHigh=0x0, nFileSizeLow=0x145e5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zIi6l7eS.mkv", cAlternateFileName="")) returned 1 [0059.367] lstrcmpiW (lpString1="zIi6l7eS.mkv", lpString2=".") returned 1 [0059.367] lstrcmpiW (lpString1="zIi6l7eS.mkv", lpString2="..") returned 1 [0059.367] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\", lpString2="zIi6l7eS.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\zIi6l7eS.mkv") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\zIi6l7eS.mkv" [0059.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="zIi6l7eS.mkv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0059.367] GetProcessHeap () returned 0x630000 [0059.367] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd) returned 0x64c9f0 [0059.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="zIi6l7eS.mkv", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zIi6l7eS.mkv", lpUsedDefaultChar=0x0) returned 13 [0059.367] lstrlenA (lpString="zIi6l7eS.mkv") returned 12 [0059.367] lstrlenA (lpString=".happythreechoose") returned 17 [0059.367] lstrcmpiW (lpString1="zIi6l7eS.mkv", lpString2="Decryption INFO.html") returned 1 [0059.367] lstrcmpiW (lpString1="zIi6l7eS.mkv", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0059.368] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0059.368] lstrcmpiW (lpString1="zIi6l7eS.mkv", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0059.368] GetProcessHeap () returned 0x630000 [0059.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f10 [0059.368] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\zIi6l7eS.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\g9kx78tzkibuoa\\zii6l7es.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0059.368] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=83429) returned 1 [0059.368] GetProcessHeap () returned 0x630000 [0059.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6555f8 [0059.368] GetProcessHeap () returned 0x630000 [0059.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0059.368] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\zIi6l7eS.mkv") returned 64 [0059.368] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.368] GetProcessHeap () returned 0x630000 [0059.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0059.368] GetProcessHeap () returned 0x630000 [0059.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38b) returned 0x65a848 [0059.368] lstrlenA (lpString="rsa_encrypt") returned 11 [0059.368] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0059.369] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0059.369] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0059.369] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0059.369] GetProcessHeap () returned 0x630000 [0059.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0059.369] lstrlenA (lpString="010001") returned 6 [0059.369] GetProcessHeap () returned 0x630000 [0059.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a128 [0059.369] GetProcessHeap () returned 0x630000 [0059.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.369] GetProcessHeap () returned 0x630000 [0059.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ec40 [0059.369] GetProcessHeap () returned 0x630000 [0059.369] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.369] GetProcessHeap () returned 0x630000 [0059.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e340 [0059.369] GetProcessHeap () returned 0x630000 [0059.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657670 [0059.369] GetProcessHeap () returned 0x630000 [0059.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a1e8 [0059.369] GetProcessHeap () returned 0x630000 [0059.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0059.369] GetProcessHeap () returned 0x630000 [0059.369] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0059.369] GetProcessHeap () returned 0x630000 [0059.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0059.369] GetProcessHeap () returned 0x630000 [0059.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.369] GetProcessHeap () returned 0x630000 [0059.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656c98 [0059.370] GetProcessHeap () returned 0x630000 [0059.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0059.370] GetProcessHeap () returned 0x630000 [0059.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0059.370] GetProcessHeap () returned 0x630000 [0059.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dfe0 [0059.370] GetProcessHeap () returned 0x630000 [0059.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.370] GetProcessHeap () returned 0x630000 [0059.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0059.370] GetProcessHeap () returned 0x630000 [0059.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0059.370] GetProcessHeap () returned 0x630000 [0059.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0059.370] GetProcessHeap () returned 0x630000 [0059.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x661908 [0059.370] GetProcessHeap () returned 0x630000 [0059.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0059.370] GetProcessHeap () returned 0x630000 [0059.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0059.370] GetProcessHeap () returned 0x630000 [0059.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0059.370] GetProcessHeap () returned 0x630000 [0059.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0059.370] GetProcessHeap () returned 0x630000 [0059.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65dda0 [0059.370] GetProcessHeap () returned 0x630000 [0059.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661908 | out: hHeap=0x630000) returned 1 [0059.370] GetProcessHeap () returned 0x630000 [0059.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0059.370] GetProcessHeap () returned 0x630000 [0059.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0059.370] GetProcessHeap () returned 0x630000 [0059.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.370] GetProcessHeap () returned 0x630000 [0059.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.370] GetProcessHeap () returned 0x630000 [0059.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0059.371] GetProcessHeap () returned 0x630000 [0059.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0059.371] GetProcessHeap () returned 0x630000 [0059.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0059.371] GetProcessHeap () returned 0x630000 [0059.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0059.371] GetProcessHeap () returned 0x630000 [0059.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0059.371] GetProcessHeap () returned 0x630000 [0059.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0059.371] GetProcessHeap () returned 0x630000 [0059.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.371] GetProcessHeap () returned 0x630000 [0059.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.371] GetProcessHeap () returned 0x630000 [0059.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0059.371] GetProcessHeap () returned 0x630000 [0059.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0059.371] GetProcessHeap () returned 0x630000 [0059.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.371] GetProcessHeap () returned 0x630000 [0059.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.371] GetProcessHeap () returned 0x630000 [0059.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0059.371] GetProcessHeap () returned 0x630000 [0059.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0059.371] GetProcessHeap () returned 0x630000 [0059.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0059.371] GetProcessHeap () returned 0x630000 [0059.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.371] GetProcessHeap () returned 0x630000 [0059.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0059.371] GetProcessHeap () returned 0x630000 [0059.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0059.371] GetProcessHeap () returned 0x630000 [0059.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0059.371] GetProcessHeap () returned 0x630000 [0059.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0059.372] GetProcessHeap () returned 0x630000 [0059.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.372] GetProcessHeap () returned 0x630000 [0059.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.372] GetProcessHeap () returned 0x630000 [0059.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0059.372] GetProcessHeap () returned 0x630000 [0059.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.372] GetProcessHeap () returned 0x630000 [0059.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0059.372] GetProcessHeap () returned 0x630000 [0059.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.372] GetProcessHeap () returned 0x630000 [0059.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0059.372] GetProcessHeap () returned 0x630000 [0059.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0059.372] GetProcessHeap () returned 0x630000 [0059.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0059.372] GetProcessHeap () returned 0x630000 [0059.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0059.372] GetProcessHeap () returned 0x630000 [0059.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0059.372] GetProcessHeap () returned 0x630000 [0059.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0059.372] GetProcessHeap () returned 0x630000 [0059.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.372] GetProcessHeap () returned 0x630000 [0059.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.372] GetProcessHeap () returned 0x630000 [0059.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0e8 [0059.372] GetProcessHeap () returned 0x630000 [0059.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0e8 | out: hHeap=0x630000) returned 1 [0059.372] GetProcessHeap () returned 0x630000 [0059.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0059.372] GetProcessHeap () returned 0x630000 [0059.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.373] GetProcessHeap () returned 0x630000 [0059.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0059.373] GetProcessHeap () returned 0x630000 [0059.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0059.373] GetProcessHeap () returned 0x630000 [0059.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0059.373] GetProcessHeap () returned 0x630000 [0059.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0059.373] GetProcessHeap () returned 0x630000 [0059.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0059.373] GetProcessHeap () returned 0x630000 [0059.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0059.373] GetProcessHeap () returned 0x630000 [0059.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0059.373] GetProcessHeap () returned 0x630000 [0059.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0059.373] GetProcessHeap () returned 0x630000 [0059.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0059.373] GetProcessHeap () returned 0x630000 [0059.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.373] GetProcessHeap () returned 0x630000 [0059.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0059.373] GetProcessHeap () returned 0x630000 [0059.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0059.373] GetProcessHeap () returned 0x630000 [0059.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0059.373] GetProcessHeap () returned 0x630000 [0059.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0059.373] GetProcessHeap () returned 0x630000 [0059.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0059.373] GetProcessHeap () returned 0x630000 [0059.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0059.373] GetProcessHeap () returned 0x630000 [0059.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0059.373] GetProcessHeap () returned 0x630000 [0059.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0059.373] GetProcessHeap () returned 0x630000 [0059.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0059.374] GetProcessHeap () returned 0x630000 [0059.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0059.374] GetProcessHeap () returned 0x630000 [0059.374] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0059.374] GetProcessHeap () returned 0x630000 [0059.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0059.374] GetProcessHeap () returned 0x630000 [0059.374] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0059.374] GetProcessHeap () returned 0x630000 [0059.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0059.374] GetProcessHeap () returned 0x630000 [0059.374] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0059.374] GetProcessHeap () returned 0x630000 [0059.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0059.374] GetProcessHeap () returned 0x630000 [0059.374] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0e8 [0059.374] GetProcessHeap () returned 0x630000 [0059.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0e8 | out: hHeap=0x630000) returned 1 [0059.374] GetProcessHeap () returned 0x630000 [0059.374] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0059.374] GetProcessHeap () returned 0x630000 [0059.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0059.374] GetProcessHeap () returned 0x630000 [0059.374] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0059.374] GetProcessHeap () returned 0x630000 [0059.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0059.374] GetProcessHeap () returned 0x630000 [0059.374] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.374] GetProcessHeap () returned 0x630000 [0059.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.374] GetProcessHeap () returned 0x630000 [0059.374] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0059.374] GetProcessHeap () returned 0x630000 [0059.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0059.374] GetProcessHeap () returned 0x630000 [0059.374] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0059.374] GetProcessHeap () returned 0x630000 [0059.375] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0059.375] GetProcessHeap () returned 0x630000 [0059.375] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0059.375] GetProcessHeap () returned 0x630000 [0059.375] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0059.375] GetProcessHeap () returned 0x630000 [0059.375] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0059.375] GetProcessHeap () returned 0x630000 [0059.375] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0059.375] GetProcessHeap () returned 0x630000 [0059.375] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0059.375] GetProcessHeap () returned 0x630000 [0059.375] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0059.375] GetProcessHeap () returned 0x630000 [0059.375] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0059.375] GetProcessHeap () returned 0x630000 [0059.375] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0059.375] GetProcessHeap () returned 0x630000 [0059.375] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0059.375] GetProcessHeap () returned 0x630000 [0059.375] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0059.375] GetProcessHeap () returned 0x630000 [0059.376] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0059.376] GetProcessHeap () returned 0x630000 [0059.376] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ec40 | out: hHeap=0x630000) returned 1 [0059.376] GetProcessHeap () returned 0x630000 [0059.376] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0059.376] GetProcessHeap () returned 0x630000 [0059.376] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0059.376] GetProcessHeap () returned 0x630000 [0059.376] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0059.376] WriteFile (in: hFile=0x230, lpBuffer=0x65a848*, nNumberOfBytesToWrite=0x38b, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65a848*, lpNumberOfBytesWritten=0x243d864*=0x38b, lpOverlapped=0x0) returned 1 [0059.379] GetProcessHeap () returned 0x630000 [0059.379] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65a848, Size=0x30) returned 0x65a848 [0059.379] GetProcessHeap () returned 0x630000 [0059.379] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0059.379] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.379] GetProcessHeap () returned 0x630000 [0059.379] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x145f0) returned 0x661980 [0059.381] ReadFile (in: hFile=0x230, lpBuffer=0x661980, nNumberOfBytesToRead=0x145f0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661980*, lpNumberOfBytesRead=0x243d7e8*=0x145f0, lpOverlapped=0x0) returned 1 [0059.382] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.382] WriteFile (in: hFile=0x230, lpBuffer=0x661980*, nNumberOfBytesToWrite=0x145f0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661980*, lpNumberOfBytesWritten=0x243d7e4*=0x145f0, lpOverlapped=0x0) returned 1 [0059.384] GetProcessHeap () returned 0x630000 [0059.384] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661980 | out: hHeap=0x630000) returned 1 [0059.384] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.384] WriteFile (in: hFile=0x230, lpBuffer=0x65a848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65a848*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0059.398] CloseHandle (hObject=0x230) returned 1 [0059.400] GetProcessHeap () returned 0x630000 [0059.400] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f10 | out: hHeap=0x630000) returned 1 [0059.400] GetProcessHeap () returned 0x630000 [0059.400] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6555f8 | out: hHeap=0x630000) returned 1 [0059.400] GetProcessHeap () returned 0x630000 [0059.401] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0059.401] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\zIi6l7eS.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\zIi6l7eS.mkv") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\zIi6l7eS.mkv" [0059.401] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\zIi6l7eS.mkv", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\zIi6l7eS.mkv.happythreechoose") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\zIi6l7eS.mkv.happythreechoose" [0059.401] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\zIi6l7eS.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\g9kx78tzkibuoa\\zii6l7es.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\zIi6l7eS.mkv.happythreechoose" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\g9kx78tzkibuoa\\zii6l7es.mkv.happythreechoose"), dwFlags=0x1) returned 1 [0059.401] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\zIi6l7eS.mkv" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa") returned 1 [0059.401] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\") returned="" [0059.401] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\Decryption INFO.html" [0059.401] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\PQRbVh-tDHt-M\\G9kX78tzKIbuOa\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\videos\\pqrbvh-tdht-m\\g9kx78tzkibuoa\\decryption info.html")) returned 0x20 [0059.401] GetProcessHeap () returned 0x630000 [0059.401] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0059.402] FindNextFileW (in: hFindFile=0x65ba90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a607130, ftCreationTime.dwHighDateTime=0x1d5cd7e, ftLastAccessTime.dwLowDateTime=0x85a8de30, ftLastAccessTime.dwHighDateTime=0x1d5c8ff, ftLastWriteTime.dwLowDateTime=0x85a8de30, ftLastWriteTime.dwHighDateTime=0x1d5c8ff, nFileSizeHigh=0x0, nFileSizeLow=0x145e5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zIi6l7eS.mkv", cAlternateFileName="")) returned 0 [0059.402] FindClose (in: hFindFile=0x65ba90 | out: hFindFile=0x65ba90) returned 1 [0059.402] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\Templates\\" | out: lpString1="C:\\Users\\FD1HVy\\Templates\\") returned="C:\\Users\\FD1HVy\\Templates\\" [0059.402] GetProcessHeap () returned 0x630000 [0059.402] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65bd10 | out: hHeap=0x630000) returned 1 [0059.402] GetProcessHeap () returned 0x630000 [0059.402] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1a8 | out: hHeap=0x630000) returned 1 [0059.402] lstrlenW (lpString="C:\\Users\\FD1HVy\\Templates\\") returned 26 [0059.402] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Templates\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Templates\\*") returned="C:\\Users\\FD1HVy\\Templates\\*" [0059.402] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Templates\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a607130, ftCreationTime.dwHighDateTime=0x1d5cd7e, ftLastAccessTime.dwLowDateTime=0x85a8de30, ftLastAccessTime.dwHighDateTime=0x1d5c8ff, ftLastWriteTime.dwLowDateTime=0x85a8de30, ftLastWriteTime.dwHighDateTime=0x1d5c8ff, nFileSizeHigh=0x0, nFileSizeLow=0x145e5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zIi6l7eS.mkv", cAlternateFileName="")) returned 0xffffffff [0059.402] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\Start Menu\\" | out: lpString1="C:\\Users\\FD1HVy\\Start Menu\\") returned="C:\\Users\\FD1HVy\\Start Menu\\" [0059.402] GetProcessHeap () returned 0x630000 [0059.402] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65bbd0 | out: hHeap=0x630000) returned 1 [0059.402] GetProcessHeap () returned 0x630000 [0059.402] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0059.402] lstrlenW (lpString="C:\\Users\\FD1HVy\\Start Menu\\") returned 27 [0059.402] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Start Menu\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Start Menu\\*") returned="C:\\Users\\FD1HVy\\Start Menu\\*" [0059.402] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Start Menu\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a607130, ftCreationTime.dwHighDateTime=0x1d5cd7e, ftLastAccessTime.dwLowDateTime=0x85a8de30, ftLastAccessTime.dwHighDateTime=0x1d5c8ff, ftLastWriteTime.dwLowDateTime=0x85a8de30, ftLastWriteTime.dwHighDateTime=0x1d5c8ff, nFileSizeHigh=0x0, nFileSizeLow=0x145e5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zIi6l7eS.mkv", cAlternateFileName="")) returned 0xffffffff [0059.402] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\SendTo\\" | out: lpString1="C:\\Users\\FD1HVy\\SendTo\\") returned="C:\\Users\\FD1HVy\\SendTo\\" [0059.402] GetProcessHeap () returned 0x630000 [0059.402] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x652710 | out: hHeap=0x630000) returned 1 [0059.402] GetProcessHeap () returned 0x630000 [0059.402] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a208 | out: hHeap=0x630000) returned 1 [0059.402] lstrlenW (lpString="C:\\Users\\FD1HVy\\SendTo\\") returned 23 [0059.403] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\SendTo\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\SendTo\\*") returned="C:\\Users\\FD1HVy\\SendTo\\*" [0059.403] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\SendTo\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a607130, ftCreationTime.dwHighDateTime=0x1d5cd7e, ftLastAccessTime.dwLowDateTime=0x85a8de30, ftLastAccessTime.dwHighDateTime=0x1d5c8ff, ftLastWriteTime.dwLowDateTime=0x85a8de30, ftLastWriteTime.dwHighDateTime=0x1d5c8ff, nFileSizeHigh=0x0, nFileSizeLow=0x145e5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zIi6l7eS.mkv", cAlternateFileName="")) returned 0xffffffff [0059.403] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\Searches\\" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\") returned="C:\\Users\\FD1HVy\\Searches\\" [0059.403] GetProcessHeap () returned 0x630000 [0059.403] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x648c10 | out: hHeap=0x630000) returned 1 [0059.403] GetProcessHeap () returned 0x630000 [0059.403] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0059.403] lstrlenW (lpString="C:\\Users\\FD1HVy\\Searches\\") returned 25 [0059.403] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Searches\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\*") returned="C:\\Users\\FD1HVy\\Searches\\*" [0059.403] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Searches\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648b50 [0059.403] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0059.403] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.403] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0059.403] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0059.403] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0059.403] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0059.403] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0059.403] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Searches\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\desktop.ini") returned="C:\\Users\\FD1HVy\\Searches\\desktop.ini" [0059.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.403] GetProcessHeap () returned 0x630000 [0059.403] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0059.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0059.403] lstrlenA (lpString="desktop.ini") returned 11 [0059.403] lstrlenA (lpString=".happythreechoose") returned 17 [0059.403] lstrcmpiW (lpString1="desktop.ini", lpString2="Decryption INFO.html") returned 1 [0059.404] lstrcmpiW (lpString1="desktop.ini", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0059.404] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0059.404] lstrcmpiW (lpString1="desktop.ini", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0059.404] GetProcessHeap () returned 0x630000 [0059.404] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0059.404] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Searches\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\searches\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0059.404] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=524) returned 1 [0059.404] GetProcessHeap () returned 0x630000 [0059.404] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655760 [0059.404] GetProcessHeap () returned 0x630000 [0059.404] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0059.404] lstrlenW (lpString="C:\\Users\\FD1HVy\\Searches\\desktop.ini") returned 36 [0059.404] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.404] GetProcessHeap () returned 0x630000 [0059.404] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0059.404] GetProcessHeap () returned 0x630000 [0059.404] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x384) returned 0x65a880 [0059.404] lstrlenA (lpString="rsa_encrypt") returned 11 [0059.404] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0059.405] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0059.405] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0059.405] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0059.405] GetProcessHeap () returned 0x630000 [0059.405] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0059.405] lstrlenA (lpString="010001") returned 6 [0059.405] GetProcessHeap () returned 0x630000 [0059.405] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a168 [0059.405] GetProcessHeap () returned 0x630000 [0059.405] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.405] GetProcessHeap () returned 0x630000 [0059.405] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e580 [0059.405] GetProcessHeap () returned 0x630000 [0059.405] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.405] GetProcessHeap () returned 0x630000 [0059.405] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e730 [0059.405] GetProcessHeap () returned 0x630000 [0059.405] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656ec8 [0059.405] GetProcessHeap () returned 0x630000 [0059.405] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a118 [0059.405] GetProcessHeap () returned 0x630000 [0059.405] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0059.405] GetProcessHeap () returned 0x630000 [0059.405] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0059.405] GetProcessHeap () returned 0x630000 [0059.405] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0059.406] GetProcessHeap () returned 0x630000 [0059.406] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.406] GetProcessHeap () returned 0x630000 [0059.406] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656a68 [0059.406] GetProcessHeap () returned 0x630000 [0059.406] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0059.406] GetProcessHeap () returned 0x630000 [0059.406] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0059.406] GetProcessHeap () returned 0x630000 [0059.406] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e190 [0059.406] GetProcessHeap () returned 0x630000 [0059.406] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.406] GetProcessHeap () returned 0x630000 [0059.406] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0059.406] GetProcessHeap () returned 0x630000 [0059.406] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0059.406] GetProcessHeap () returned 0x630000 [0059.406] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0059.406] GetProcessHeap () returned 0x630000 [0059.406] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x6618c0 [0059.406] GetProcessHeap () returned 0x630000 [0059.406] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0059.406] GetProcessHeap () returned 0x630000 [0059.406] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0059.406] GetProcessHeap () returned 0x630000 [0059.406] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0059.432] GetProcessHeap () returned 0x630000 [0059.432] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0059.432] GetProcessHeap () returned 0x630000 [0059.432] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65eb20 [0059.432] GetProcessHeap () returned 0x630000 [0059.432] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6618c0 | out: hHeap=0x630000) returned 1 [0059.432] GetProcessHeap () returned 0x630000 [0059.432] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0059.432] GetProcessHeap () returned 0x630000 [0059.432] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0059.432] GetProcessHeap () returned 0x630000 [0059.432] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0059.432] GetProcessHeap () returned 0x630000 [0059.432] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0059.432] GetProcessHeap () returned 0x630000 [0059.432] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.432] GetProcessHeap () returned 0x630000 [0059.432] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.432] GetProcessHeap () returned 0x630000 [0059.432] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0059.432] GetProcessHeap () returned 0x630000 [0059.432] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0059.432] GetProcessHeap () returned 0x630000 [0059.432] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0059.432] GetProcessHeap () returned 0x630000 [0059.432] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0059.432] GetProcessHeap () returned 0x630000 [0059.432] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0059.432] GetProcessHeap () returned 0x630000 [0059.432] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0059.432] GetProcessHeap () returned 0x630000 [0059.432] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.432] GetProcessHeap () returned 0x630000 [0059.433] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.433] GetProcessHeap () returned 0x630000 [0059.433] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0059.433] GetProcessHeap () returned 0x630000 [0059.433] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0059.433] GetProcessHeap () returned 0x630000 [0059.433] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0059.433] GetProcessHeap () returned 0x630000 [0059.433] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0059.433] GetProcessHeap () returned 0x630000 [0059.433] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0059.433] GetProcessHeap () returned 0x630000 [0059.433] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0059.433] GetProcessHeap () returned 0x630000 [0059.433] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.433] GetProcessHeap () returned 0x630000 [0059.433] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.433] GetProcessHeap () returned 0x630000 [0059.433] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.433] GetProcessHeap () returned 0x630000 [0059.433] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.433] GetProcessHeap () returned 0x630000 [0059.433] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0059.433] GetProcessHeap () returned 0x630000 [0059.433] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0059.433] GetProcessHeap () returned 0x630000 [0059.433] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0059.433] GetProcessHeap () returned 0x630000 [0059.433] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0059.433] GetProcessHeap () returned 0x630000 [0059.433] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0059.433] GetProcessHeap () returned 0x630000 [0059.433] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0059.433] GetProcessHeap () returned 0x630000 [0059.433] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0059.433] GetProcessHeap () returned 0x630000 [0059.433] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0059.434] GetProcessHeap () returned 0x630000 [0059.434] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0059.434] GetProcessHeap () returned 0x630000 [0059.434] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0059.434] GetProcessHeap () returned 0x630000 [0059.434] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.434] GetProcessHeap () returned 0x630000 [0059.434] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.434] GetProcessHeap () returned 0x630000 [0059.434] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.434] GetProcessHeap () returned 0x630000 [0059.434] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.434] GetProcessHeap () returned 0x630000 [0059.434] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0059.434] GetProcessHeap () returned 0x630000 [0059.434] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0059.434] GetProcessHeap () returned 0x630000 [0059.434] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0059.434] GetProcessHeap () returned 0x630000 [0059.434] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.434] GetProcessHeap () returned 0x630000 [0059.434] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0059.434] GetProcessHeap () returned 0x630000 [0059.434] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0059.434] GetProcessHeap () returned 0x630000 [0059.434] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0059.434] GetProcessHeap () returned 0x630000 [0059.434] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0059.434] GetProcessHeap () returned 0x630000 [0059.434] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0059.434] GetProcessHeap () returned 0x630000 [0059.434] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0059.434] GetProcessHeap () returned 0x630000 [0059.434] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a208 [0059.434] GetProcessHeap () returned 0x630000 [0059.434] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a208 | out: hHeap=0x630000) returned 1 [0059.435] GetProcessHeap () returned 0x630000 [0059.435] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1a8 [0059.435] GetProcessHeap () returned 0x630000 [0059.435] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1a8 | out: hHeap=0x630000) returned 1 [0059.435] GetProcessHeap () returned 0x630000 [0059.435] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0059.435] GetProcessHeap () returned 0x630000 [0059.435] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0059.435] GetProcessHeap () returned 0x630000 [0059.435] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0059.435] GetProcessHeap () returned 0x630000 [0059.435] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0059.435] GetProcessHeap () returned 0x630000 [0059.435] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0059.435] GetProcessHeap () returned 0x630000 [0059.435] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0059.435] GetProcessHeap () returned 0x630000 [0059.435] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.435] GetProcessHeap () returned 0x630000 [0059.435] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.435] GetProcessHeap () returned 0x630000 [0059.435] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0059.435] GetProcessHeap () returned 0x630000 [0059.435] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0059.435] GetProcessHeap () returned 0x630000 [0059.435] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.435] GetProcessHeap () returned 0x630000 [0059.435] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.435] GetProcessHeap () returned 0x630000 [0059.435] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0059.435] GetProcessHeap () returned 0x630000 [0059.435] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.435] GetProcessHeap () returned 0x630000 [0059.435] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0059.435] GetProcessHeap () returned 0x630000 [0059.435] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0059.435] GetProcessHeap () returned 0x630000 [0059.435] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.436] GetProcessHeap () returned 0x630000 [0059.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.436] GetProcessHeap () returned 0x630000 [0059.436] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0059.436] GetProcessHeap () returned 0x630000 [0059.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0059.436] GetProcessHeap () returned 0x630000 [0059.436] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1a8 [0059.436] GetProcessHeap () returned 0x630000 [0059.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1a8 | out: hHeap=0x630000) returned 1 [0059.436] GetProcessHeap () returned 0x630000 [0059.436] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0059.436] GetProcessHeap () returned 0x630000 [0059.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0059.436] GetProcessHeap () returned 0x630000 [0059.436] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0059.436] GetProcessHeap () returned 0x630000 [0059.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0059.436] GetProcessHeap () returned 0x630000 [0059.436] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0059.436] GetProcessHeap () returned 0x630000 [0059.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0059.436] GetProcessHeap () returned 0x630000 [0059.436] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0059.436] GetProcessHeap () returned 0x630000 [0059.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0059.436] GetProcessHeap () returned 0x630000 [0059.436] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0059.436] GetProcessHeap () returned 0x630000 [0059.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0059.436] GetProcessHeap () returned 0x630000 [0059.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0059.436] GetProcessHeap () returned 0x630000 [0059.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0059.436] GetProcessHeap () returned 0x630000 [0059.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0059.436] GetProcessHeap () returned 0x630000 [0059.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0059.436] GetProcessHeap () returned 0x630000 [0059.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0059.437] GetProcessHeap () returned 0x630000 [0059.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0059.437] GetProcessHeap () returned 0x630000 [0059.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0059.437] GetProcessHeap () returned 0x630000 [0059.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0059.437] GetProcessHeap () returned 0x630000 [0059.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0059.437] GetProcessHeap () returned 0x630000 [0059.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.437] GetProcessHeap () returned 0x630000 [0059.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0059.437] WriteFile (in: hFile=0x230, lpBuffer=0x65a880*, nNumberOfBytesToWrite=0x384, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65a880*, lpNumberOfBytesWritten=0x243d864*=0x384, lpOverlapped=0x0) returned 1 [0059.446] GetProcessHeap () returned 0x630000 [0059.446] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x65a880, Size=0x30) returned 0x65a880 [0059.446] GetProcessHeap () returned 0x630000 [0059.446] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0059.446] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.446] GetProcessHeap () returned 0x630000 [0059.446] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x210) returned 0x64cc78 [0059.446] ReadFile (in: hFile=0x230, lpBuffer=0x64cc78, nNumberOfBytesToRead=0x210, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x64cc78*, lpNumberOfBytesRead=0x243d7e8*=0x210, lpOverlapped=0x0) returned 1 [0059.446] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.446] WriteFile (in: hFile=0x230, lpBuffer=0x64cc78*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x64cc78*, lpNumberOfBytesWritten=0x243d7e4*=0x210, lpOverlapped=0x0) returned 1 [0059.447] GetProcessHeap () returned 0x630000 [0059.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0059.447] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.447] WriteFile (in: hFile=0x230, lpBuffer=0x65a880*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x65a880*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0059.448] CloseHandle (hObject=0x230) returned 1 [0059.449] GetProcessHeap () returned 0x630000 [0059.449] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0059.449] GetProcessHeap () returned 0x630000 [0059.449] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655760 | out: hHeap=0x630000) returned 1 [0059.449] GetProcessHeap () returned 0x630000 [0059.449] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0059.449] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Searches\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\desktop.ini") returned="C:\\Users\\FD1HVy\\Searches\\desktop.ini" [0059.449] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Searches\\desktop.ini", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\desktop.ini.happythreechoose") returned="C:\\Users\\FD1HVy\\Searches\\desktop.ini.happythreechoose" [0059.449] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Searches\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\searches\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Searches\\desktop.ini.happythreechoose" (normalized: "c:\\users\\fd1hvy\\searches\\desktop.ini.happythreechoose"), dwFlags=0x1) returned 1 [0059.450] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Searches\\desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\Searches") returned 1 [0059.450] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Searches" | out: pszPath="C:\\Users\\FD1HVy\\Searches\\") returned="" [0059.450] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Searches\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Searches\\Decryption INFO.html" [0059.450] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\searches\\decryption info.html")) returned 0xffffffff [0059.450] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\searches\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0059.450] GetProcessHeap () returned 0x630000 [0059.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655490 [0059.450] GetProcessHeap () returned 0x630000 [0059.451] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0059.457] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.458] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.458] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.459] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.459] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.459] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.459] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.459] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.459] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.459] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.459] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.459] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.459] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.459] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.459] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.459] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.460] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.460] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.460] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.460] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.460] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.460] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.460] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.460] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.460] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.460] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.460] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.460] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.460] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.460] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.461] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.461] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.461] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.461] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.461] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.461] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.461] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.462] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.462] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.462] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.462] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.462] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.462] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.462] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.462] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.462] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.462] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.462] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.462] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.462] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.463] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.463] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.463] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.463] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.463] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.463] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.463] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.463] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.463] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.463] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.463] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.463] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.463] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.463] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.464] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.464] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.464] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.464] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.464] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.464] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.464] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.464] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.464] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.464] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.464] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.464] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.464] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.464] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.464] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.465] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.465] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.465] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.465] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.465] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.465] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.465] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.465] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.465] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.465] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.465] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.465] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.465] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.465] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.466] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.466] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.466] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.466] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.466] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.466] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.466] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.466] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.466] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.466] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.466] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.466] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.466] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.466] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.467] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.467] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.467] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.467] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.467] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.467] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.467] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.467] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.467] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.467] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.467] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.467] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.467] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.467] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.468] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.468] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.468] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.468] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.468] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.468] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.468] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.468] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.468] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.468] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.468] GetProcessHeap () returned 0x630000 [0059.468] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655490 | out: hHeap=0x630000) returned 1 [0059.468] GetProcessHeap () returned 0x630000 [0059.468] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0059.468] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0059.468] GetProcessHeap () returned 0x630000 [0059.468] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6559b8 [0059.468] GetProcessHeap () returned 0x630000 [0059.468] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0059.476] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.476] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.476] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.476] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.476] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.476] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.476] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.477] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.477] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.477] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.477] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.477] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.477] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.477] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.477] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.477] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.477] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.477] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.477] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.477] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.477] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.477] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.478] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.478] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.478] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.478] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.478] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.478] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.478] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.478] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.478] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.478] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.478] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.478] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.478] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.478] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.478] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.479] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.479] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.479] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.479] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.479] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.479] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.479] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.479] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.479] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.479] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.479] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.479] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.479] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.479] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.480] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.480] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.480] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.480] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.480] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.480] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.480] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.480] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.480] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.480] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.480] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.480] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.480] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.480] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.480] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.481] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.481] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.481] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.481] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.481] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.481] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.481] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.481] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.481] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.481] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.481] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.481] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.481] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.482] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.482] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.482] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.482] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.482] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.482] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.482] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.482] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.482] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.482] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.482] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.482] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.482] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.482] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.483] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.483] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.483] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.483] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.483] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.483] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.483] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.489] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.489] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.489] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.490] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.490] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.490] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.490] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.490] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.490] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.490] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.490] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.490] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.490] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.490] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.490] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.490] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.490] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.490] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.491] GetProcessHeap () returned 0x630000 [0059.491] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6559b8 | out: hHeap=0x630000) returned 1 [0059.491] GetProcessHeap () returned 0x630000 [0059.491] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0059.491] CloseHandle (hObject=0x230) returned 1 [0059.492] GetProcessHeap () returned 0x630000 [0059.492] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0059.492] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44269063, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44269063, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x44269063, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0059.492] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2=".") returned 1 [0059.492] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2="..") returned 1 [0059.492] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Searches\\", lpString2="Everywhere.search-ms" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms") returned="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms" [0059.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Everywhere.search-ms", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0059.492] GetProcessHeap () returned 0x630000 [0059.492] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x15) returned 0x645e58 [0059.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Everywhere.search-ms", cchWideChar=-1, lpMultiByteStr=0x645e58, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Everywhere.search-ms", lpUsedDefaultChar=0x0) returned 21 [0059.492] lstrlenA (lpString="Everywhere.search-ms") returned 20 [0059.492] lstrlenA (lpString=".happythreechoose") returned 17 [0059.492] lstrlenA (lpString=".happythreechoose") returned 17 [0059.492] lstrlenA (lpString="Everywhere.search-ms") returned 20 [0059.492] lstrcmpiA (lpString1="rywhere.search-ms", lpString2=".happythreechoose") returned 1 [0059.492] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2="Decryption INFO.html") returned 1 [0059.492] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0059.492] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0059.492] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0059.492] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", dwFileAttributes=0x22) returned 1 [0059.493] GetProcessHeap () returned 0x630000 [0059.493] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0059.493] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\fd1hvy\\searches\\everywhere.search-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0059.493] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=248) returned 1 [0059.493] GetProcessHeap () returned 0x630000 [0059.493] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6558c8 [0059.493] GetProcessHeap () returned 0x630000 [0059.493] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0059.494] lstrlenW (lpString="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms") returned 45 [0059.494] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.494] GetProcessHeap () returned 0x630000 [0059.494] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0059.494] GetProcessHeap () returned 0x630000 [0059.494] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x388) returned 0x661980 [0059.494] lstrlenA (lpString="rsa_encrypt") returned 11 [0059.494] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0059.494] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0059.494] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0059.494] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0059.494] GetProcessHeap () returned 0x630000 [0059.494] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0059.494] lstrlenA (lpString="010001") returned 6 [0059.495] GetProcessHeap () returned 0x630000 [0059.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a238 [0059.495] GetProcessHeap () returned 0x630000 [0059.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.495] GetProcessHeap () returned 0x630000 [0059.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ebb0 [0059.495] GetProcessHeap () returned 0x630000 [0059.495] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.495] GetProcessHeap () returned 0x630000 [0059.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea90 [0059.495] GetProcessHeap () returned 0x630000 [0059.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656a68 [0059.495] GetProcessHeap () returned 0x630000 [0059.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a078 [0059.495] GetProcessHeap () returned 0x630000 [0059.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0059.495] GetProcessHeap () returned 0x630000 [0059.495] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0059.495] GetProcessHeap () returned 0x630000 [0059.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0059.495] GetProcessHeap () returned 0x630000 [0059.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.495] GetProcessHeap () returned 0x630000 [0059.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656950 [0059.495] GetProcessHeap () returned 0x630000 [0059.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0059.495] GetProcessHeap () returned 0x630000 [0059.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0059.495] GetProcessHeap () returned 0x630000 [0059.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ecd0 [0059.495] GetProcessHeap () returned 0x630000 [0059.495] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.495] GetProcessHeap () returned 0x630000 [0059.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0059.495] GetProcessHeap () returned 0x630000 [0059.495] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ecd0 | out: hHeap=0x630000) returned 1 [0059.495] GetProcessHeap () returned 0x630000 [0059.496] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0059.496] GetProcessHeap () returned 0x630000 [0059.496] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0059.496] GetProcessHeap () returned 0x630000 [0059.496] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0059.496] GetProcessHeap () returned 0x630000 [0059.496] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0059.496] GetProcessHeap () returned 0x630000 [0059.496] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0059.496] GetProcessHeap () returned 0x630000 [0059.496] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0059.496] GetProcessHeap () returned 0x630000 [0059.496] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65df50 [0059.496] GetProcessHeap () returned 0x630000 [0059.496] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0059.496] GetProcessHeap () returned 0x630000 [0059.496] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0059.496] GetProcessHeap () returned 0x630000 [0059.496] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0059.496] GetProcessHeap () returned 0x630000 [0059.496] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0059.496] GetProcessHeap () returned 0x630000 [0059.496] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0059.496] GetProcessHeap () returned 0x630000 [0059.496] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0059.496] GetProcessHeap () returned 0x630000 [0059.496] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0059.496] GetProcessHeap () returned 0x630000 [0059.496] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.496] GetProcessHeap () returned 0x630000 [0059.496] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.496] GetProcessHeap () returned 0x630000 [0059.496] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0059.496] GetProcessHeap () returned 0x630000 [0059.496] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0059.496] GetProcessHeap () returned 0x630000 [0059.496] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.496] GetProcessHeap () returned 0x630000 [0059.496] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.497] GetProcessHeap () returned 0x630000 [0059.497] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0059.497] GetProcessHeap () returned 0x630000 [0059.497] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0059.497] GetProcessHeap () returned 0x630000 [0059.497] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.497] GetProcessHeap () returned 0x630000 [0059.497] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.497] GetProcessHeap () returned 0x630000 [0059.497] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.497] GetProcessHeap () returned 0x630000 [0059.497] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.497] GetProcessHeap () returned 0x630000 [0059.497] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0059.497] GetProcessHeap () returned 0x630000 [0059.497] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0059.497] GetProcessHeap () returned 0x630000 [0059.497] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0059.497] GetProcessHeap () returned 0x630000 [0059.497] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0059.497] GetProcessHeap () returned 0x630000 [0059.497] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0059.497] GetProcessHeap () returned 0x630000 [0059.497] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0059.497] GetProcessHeap () returned 0x630000 [0059.497] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0059.497] GetProcessHeap () returned 0x630000 [0059.497] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0059.497] GetProcessHeap () returned 0x630000 [0059.497] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a208 [0059.497] GetProcessHeap () returned 0x630000 [0059.497] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a208 | out: hHeap=0x630000) returned 1 [0059.497] GetProcessHeap () returned 0x630000 [0059.497] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.497] GetProcessHeap () returned 0x630000 [0059.497] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.497] GetProcessHeap () returned 0x630000 [0059.497] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0059.498] GetProcessHeap () returned 0x630000 [0059.498] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0059.498] GetProcessHeap () returned 0x630000 [0059.498] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.498] GetProcessHeap () returned 0x630000 [0059.498] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.498] GetProcessHeap () returned 0x630000 [0059.498] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0059.498] GetProcessHeap () returned 0x630000 [0059.498] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0059.498] GetProcessHeap () returned 0x630000 [0059.498] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.498] GetProcessHeap () returned 0x630000 [0059.498] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.498] GetProcessHeap () returned 0x630000 [0059.498] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0059.498] GetProcessHeap () returned 0x630000 [0059.498] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0059.498] GetProcessHeap () returned 0x630000 [0059.498] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0e8 [0059.498] GetProcessHeap () returned 0x630000 [0059.498] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0e8 | out: hHeap=0x630000) returned 1 [0059.498] GetProcessHeap () returned 0x630000 [0059.498] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.498] GetProcessHeap () returned 0x630000 [0059.498] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.498] GetProcessHeap () returned 0x630000 [0059.498] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.498] GetProcessHeap () returned 0x630000 [0059.498] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.498] GetProcessHeap () returned 0x630000 [0059.498] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0059.498] GetProcessHeap () returned 0x630000 [0059.498] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0059.498] GetProcessHeap () returned 0x630000 [0059.498] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0059.498] GetProcessHeap () returned 0x630000 [0059.499] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0059.499] GetProcessHeap () returned 0x630000 [0059.499] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0059.499] GetProcessHeap () returned 0x630000 [0059.499] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.499] GetProcessHeap () returned 0x630000 [0059.499] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0059.499] GetProcessHeap () returned 0x630000 [0059.499] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.499] GetProcessHeap () returned 0x630000 [0059.499] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.499] GetProcessHeap () returned 0x630000 [0059.499] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.499] GetProcessHeap () returned 0x630000 [0059.499] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0059.499] GetProcessHeap () returned 0x630000 [0059.499] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0059.499] GetProcessHeap () returned 0x630000 [0059.499] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0059.499] GetProcessHeap () returned 0x630000 [0059.499] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0059.499] GetProcessHeap () returned 0x630000 [0059.499] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0059.499] GetProcessHeap () returned 0x630000 [0059.499] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0059.499] GetProcessHeap () returned 0x630000 [0059.499] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0059.499] GetProcessHeap () returned 0x630000 [0059.499] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0059.499] GetProcessHeap () returned 0x630000 [0059.499] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0059.499] GetProcessHeap () returned 0x630000 [0059.499] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0059.499] GetProcessHeap () returned 0x630000 [0059.499] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0059.499] GetProcessHeap () returned 0x630000 [0059.499] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0059.500] GetProcessHeap () returned 0x630000 [0059.500] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0059.500] GetProcessHeap () returned 0x630000 [0059.500] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.500] GetProcessHeap () returned 0x630000 [0059.500] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0059.500] GetProcessHeap () returned 0x630000 [0059.500] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0059.500] GetProcessHeap () returned 0x630000 [0059.500] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0059.500] GetProcessHeap () returned 0x630000 [0059.500] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0059.500] GetProcessHeap () returned 0x630000 [0059.500] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0059.500] GetProcessHeap () returned 0x630000 [0059.500] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0059.501] GetProcessHeap () returned 0x630000 [0059.501] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0059.501] GetProcessHeap () returned 0x630000 [0059.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0059.501] GetProcessHeap () returned 0x630000 [0059.501] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0059.501] GetProcessHeap () returned 0x630000 [0059.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0059.501] GetProcessHeap () returned 0x630000 [0059.501] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.501] GetProcessHeap () returned 0x630000 [0059.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.501] GetProcessHeap () returned 0x630000 [0059.501] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0059.501] GetProcessHeap () returned 0x630000 [0059.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0059.501] GetProcessHeap () returned 0x630000 [0059.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0059.501] GetProcessHeap () returned 0x630000 [0059.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0059.501] GetProcessHeap () returned 0x630000 [0059.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0059.501] GetProcessHeap () returned 0x630000 [0059.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0059.501] GetProcessHeap () returned 0x630000 [0059.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0059.501] GetProcessHeap () returned 0x630000 [0059.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea90 | out: hHeap=0x630000) returned 1 [0059.501] GetProcessHeap () returned 0x630000 [0059.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0059.501] GetProcessHeap () returned 0x630000 [0059.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0059.501] GetProcessHeap () returned 0x630000 [0059.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0059.501] GetProcessHeap () returned 0x630000 [0059.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0059.501] GetProcessHeap () returned 0x630000 [0059.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0059.502] WriteFile (in: hFile=0x230, lpBuffer=0x661980*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661980*, lpNumberOfBytesWritten=0x243d864*=0x388, lpOverlapped=0x0) returned 1 [0059.506] GetProcessHeap () returned 0x630000 [0059.506] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x661980, Size=0x30) returned 0x661980 [0059.506] GetProcessHeap () returned 0x630000 [0059.506] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0059.506] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.506] GetProcessHeap () returned 0x630000 [0059.506] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x100) returned 0x63f900 [0059.506] ReadFile (in: hFile=0x230, lpBuffer=0x63f900, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x63f900*, lpNumberOfBytesRead=0x243d7e8*=0x100, lpOverlapped=0x0) returned 1 [0059.506] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.506] WriteFile (in: hFile=0x230, lpBuffer=0x63f900*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x63f900*, lpNumberOfBytesWritten=0x243d7e4*=0x100, lpOverlapped=0x0) returned 1 [0059.507] GetProcessHeap () returned 0x630000 [0059.507] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63f900 | out: hHeap=0x630000) returned 1 [0059.507] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.507] WriteFile (in: hFile=0x230, lpBuffer=0x661980*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661980*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0059.508] CloseHandle (hObject=0x230) returned 1 [0059.509] GetProcessHeap () returned 0x630000 [0059.509] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0059.509] GetProcessHeap () returned 0x630000 [0059.509] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6558c8 | out: hHeap=0x630000) returned 1 [0059.509] GetProcessHeap () returned 0x630000 [0059.509] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0059.509] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms") returned="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms" [0059.510] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms.happythreechoose") returned="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms.happythreechoose" [0059.510] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\fd1hvy\\searches\\everywhere.search-ms"), lpNewFileName="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms.happythreechoose" (normalized: "c:\\users\\fd1hvy\\searches\\everywhere.search-ms.happythreechoose"), dwFlags=0x1) returned 1 [0059.510] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms" | out: pszPath="C:\\Users\\FD1HVy\\Searches") returned 1 [0059.510] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Searches" | out: pszPath="C:\\Users\\FD1HVy\\Searches\\") returned="" [0059.510] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Searches\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Searches\\Decryption INFO.html" [0059.510] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\searches\\decryption info.html")) returned 0x20 [0059.510] GetProcessHeap () returned 0x630000 [0059.510] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645e58 | out: hHeap=0x630000) returned 1 [0059.510] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44242e24, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44242e24, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x44242e24, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0059.510] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2=".") returned 1 [0059.510] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2="..") returned 1 [0059.510] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Searches\\", lpString2="Indexed Locations.search-ms" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms") returned="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms" [0059.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Indexed Locations.search-ms", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0059.511] GetProcessHeap () returned 0x630000 [0059.511] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c) returned 0x651fd8 [0059.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Indexed Locations.search-ms", cchWideChar=-1, lpMultiByteStr=0x651fd8, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Indexed Locations.search-ms", lpUsedDefaultChar=0x0) returned 28 [0059.511] lstrlenA (lpString="Indexed Locations.search-ms") returned 27 [0059.511] lstrlenA (lpString=".happythreechoose") returned 17 [0059.511] lstrlenA (lpString=".happythreechoose") returned 17 [0059.511] lstrlenA (lpString="Indexed Locations.search-ms") returned 27 [0059.511] lstrcmpiA (lpString1="cations.search-ms", lpString2=".happythreechoose") returned 1 [0059.511] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2="Decryption INFO.html") returned 1 [0059.511] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0059.511] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0059.511] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0059.511] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", dwFileAttributes=0x22) returned 1 [0059.511] GetProcessHeap () returned 0x630000 [0059.511] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0059.511] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\fd1hvy\\searches\\indexed locations.search-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0059.511] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=248) returned 1 [0059.511] GetProcessHeap () returned 0x630000 [0059.511] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655580 [0059.511] GetProcessHeap () returned 0x630000 [0059.511] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0059.511] lstrlenW (lpString="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms") returned 52 [0059.512] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.512] GetProcessHeap () returned 0x630000 [0059.512] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0059.512] GetProcessHeap () returned 0x630000 [0059.512] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x388) returned 0x6619b8 [0059.512] lstrlenA (lpString="rsa_encrypt") returned 11 [0059.512] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0059.512] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0059.512] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0059.512] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0059.512] GetProcessHeap () returned 0x630000 [0059.512] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0059.512] lstrlenA (lpString="010001") returned 6 [0059.512] GetProcessHeap () returned 0x630000 [0059.512] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a1d8 [0059.513] GetProcessHeap () returned 0x630000 [0059.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.513] GetProcessHeap () returned 0x630000 [0059.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e340 [0059.513] GetProcessHeap () returned 0x630000 [0059.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.513] GetProcessHeap () returned 0x630000 [0059.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e2b0 [0059.513] GetProcessHeap () returned 0x630000 [0059.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x6570f8 [0059.513] GetProcessHeap () returned 0x630000 [0059.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a088 [0059.513] GetProcessHeap () returned 0x630000 [0059.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0059.513] GetProcessHeap () returned 0x630000 [0059.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0059.513] GetProcessHeap () returned 0x630000 [0059.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0059.513] GetProcessHeap () returned 0x630000 [0059.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.513] GetProcessHeap () returned 0x630000 [0059.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656c98 [0059.513] GetProcessHeap () returned 0x630000 [0059.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0059.513] GetProcessHeap () returned 0x630000 [0059.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0059.513] GetProcessHeap () returned 0x630000 [0059.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e190 [0059.513] GetProcessHeap () returned 0x630000 [0059.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.513] GetProcessHeap () returned 0x630000 [0059.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0059.513] GetProcessHeap () returned 0x630000 [0059.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0059.513] GetProcessHeap () returned 0x630000 [0059.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0059.513] GetProcessHeap () returned 0x630000 [0059.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0059.513] GetProcessHeap () returned 0x630000 [0059.514] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0059.514] GetProcessHeap () returned 0x630000 [0059.514] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0059.514] GetProcessHeap () returned 0x630000 [0059.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0059.514] GetProcessHeap () returned 0x630000 [0059.514] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.514] GetProcessHeap () returned 0x630000 [0059.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e8e0 [0059.514] GetProcessHeap () returned 0x630000 [0059.514] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0059.514] GetProcessHeap () returned 0x630000 [0059.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0059.514] GetProcessHeap () returned 0x630000 [0059.514] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0059.514] GetProcessHeap () returned 0x630000 [0059.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0059.514] GetProcessHeap () returned 0x630000 [0059.514] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0059.514] GetProcessHeap () returned 0x630000 [0059.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.514] GetProcessHeap () returned 0x630000 [0059.514] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.514] GetProcessHeap () returned 0x630000 [0059.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0059.514] GetProcessHeap () returned 0x630000 [0059.514] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0059.514] GetProcessHeap () returned 0x630000 [0059.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0059.514] GetProcessHeap () returned 0x630000 [0059.514] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0059.514] GetProcessHeap () returned 0x630000 [0059.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.514] GetProcessHeap () returned 0x630000 [0059.514] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.514] GetProcessHeap () returned 0x630000 [0059.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0059.514] GetProcessHeap () returned 0x630000 [0059.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.515] GetProcessHeap () returned 0x630000 [0059.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0059.515] GetProcessHeap () returned 0x630000 [0059.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0059.515] GetProcessHeap () returned 0x630000 [0059.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0059.515] GetProcessHeap () returned 0x630000 [0059.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0059.515] GetProcessHeap () returned 0x630000 [0059.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0059.515] GetProcessHeap () returned 0x630000 [0059.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0059.515] GetProcessHeap () returned 0x630000 [0059.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0059.515] GetProcessHeap () returned 0x630000 [0059.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.515] GetProcessHeap () returned 0x630000 [0059.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0059.515] GetProcessHeap () returned 0x630000 [0059.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0059.515] GetProcessHeap () returned 0x630000 [0059.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0059.515] GetProcessHeap () returned 0x630000 [0059.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0059.515] GetProcessHeap () returned 0x630000 [0059.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0059.515] GetProcessHeap () returned 0x630000 [0059.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0059.515] GetProcessHeap () returned 0x630000 [0059.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0059.515] GetProcessHeap () returned 0x630000 [0059.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0059.515] GetProcessHeap () returned 0x630000 [0059.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0059.515] GetProcessHeap () returned 0x630000 [0059.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0059.516] GetProcessHeap () returned 0x630000 [0059.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0059.516] GetProcessHeap () returned 0x630000 [0059.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0059.516] GetProcessHeap () returned 0x630000 [0059.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0059.516] GetProcessHeap () returned 0x630000 [0059.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0059.516] GetProcessHeap () returned 0x630000 [0059.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1a8 [0059.516] GetProcessHeap () returned 0x630000 [0059.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1a8 | out: hHeap=0x630000) returned 1 [0059.516] GetProcessHeap () returned 0x630000 [0059.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0059.516] GetProcessHeap () returned 0x630000 [0059.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0059.516] GetProcessHeap () returned 0x630000 [0059.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.516] GetProcessHeap () returned 0x630000 [0059.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.516] GetProcessHeap () returned 0x630000 [0059.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.516] GetProcessHeap () returned 0x630000 [0059.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.516] GetProcessHeap () returned 0x630000 [0059.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0059.516] GetProcessHeap () returned 0x630000 [0059.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0059.516] GetProcessHeap () returned 0x630000 [0059.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0059.516] GetProcessHeap () returned 0x630000 [0059.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0059.516] GetProcessHeap () returned 0x630000 [0059.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0059.517] GetProcessHeap () returned 0x630000 [0059.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0059.517] GetProcessHeap () returned 0x630000 [0059.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a208 [0059.517] GetProcessHeap () returned 0x630000 [0059.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a208 | out: hHeap=0x630000) returned 1 [0059.517] GetProcessHeap () returned 0x630000 [0059.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1a8 [0059.517] GetProcessHeap () returned 0x630000 [0059.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1a8 | out: hHeap=0x630000) returned 1 [0059.517] GetProcessHeap () returned 0x630000 [0059.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0059.517] GetProcessHeap () returned 0x630000 [0059.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0059.517] GetProcessHeap () returned 0x630000 [0059.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0059.517] GetProcessHeap () returned 0x630000 [0059.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0059.517] GetProcessHeap () returned 0x630000 [0059.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0059.517] GetProcessHeap () returned 0x630000 [0059.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0059.517] GetProcessHeap () returned 0x630000 [0059.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.517] GetProcessHeap () returned 0x630000 [0059.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.517] GetProcessHeap () returned 0x630000 [0059.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0059.517] GetProcessHeap () returned 0x630000 [0059.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0059.517] GetProcessHeap () returned 0x630000 [0059.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.517] GetProcessHeap () returned 0x630000 [0059.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.517] GetProcessHeap () returned 0x630000 [0059.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0059.517] GetProcessHeap () returned 0x630000 [0059.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0059.518] GetProcessHeap () returned 0x630000 [0059.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0059.518] GetProcessHeap () returned 0x630000 [0059.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0059.518] GetProcessHeap () returned 0x630000 [0059.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0059.518] GetProcessHeap () returned 0x630000 [0059.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.518] GetProcessHeap () returned 0x630000 [0059.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.518] GetProcessHeap () returned 0x630000 [0059.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.518] GetProcessHeap () returned 0x630000 [0059.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.518] GetProcessHeap () returned 0x630000 [0059.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.518] GetProcessHeap () returned 0x630000 [0059.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0059.518] GetProcessHeap () returned 0x630000 [0059.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.518] GetProcessHeap () returned 0x630000 [0059.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.518] GetProcessHeap () returned 0x630000 [0059.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.518] GetProcessHeap () returned 0x630000 [0059.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0059.518] GetProcessHeap () returned 0x630000 [0059.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0059.518] GetProcessHeap () returned 0x630000 [0059.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0059.518] GetProcessHeap () returned 0x630000 [0059.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0059.518] GetProcessHeap () returned 0x630000 [0059.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0059.518] GetProcessHeap () returned 0x630000 [0059.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0059.519] GetProcessHeap () returned 0x630000 [0059.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0059.519] GetProcessHeap () returned 0x630000 [0059.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0059.519] GetProcessHeap () returned 0x630000 [0059.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0059.519] GetProcessHeap () returned 0x630000 [0059.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e2b0 | out: hHeap=0x630000) returned 1 [0059.519] GetProcessHeap () returned 0x630000 [0059.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0059.519] GetProcessHeap () returned 0x630000 [0059.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0059.519] GetProcessHeap () returned 0x630000 [0059.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0059.519] GetProcessHeap () returned 0x630000 [0059.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0059.519] GetProcessHeap () returned 0x630000 [0059.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0059.519] WriteFile (in: hFile=0x230, lpBuffer=0x6619b8*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6619b8*, lpNumberOfBytesWritten=0x243d864*=0x388, lpOverlapped=0x0) returned 1 [0059.523] GetProcessHeap () returned 0x630000 [0059.523] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6619b8, Size=0x30) returned 0x6619b8 [0059.523] GetProcessHeap () returned 0x630000 [0059.523] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0059.523] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.523] GetProcessHeap () returned 0x630000 [0059.523] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x100) returned 0x63f900 [0059.523] ReadFile (in: hFile=0x230, lpBuffer=0x63f900, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x63f900*, lpNumberOfBytesRead=0x243d7e8*=0x100, lpOverlapped=0x0) returned 1 [0059.523] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.523] WriteFile (in: hFile=0x230, lpBuffer=0x63f900*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x63f900*, lpNumberOfBytesWritten=0x243d7e4*=0x100, lpOverlapped=0x0) returned 1 [0059.524] GetProcessHeap () returned 0x630000 [0059.524] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63f900 | out: hHeap=0x630000) returned 1 [0059.524] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.524] WriteFile (in: hFile=0x230, lpBuffer=0x6619b8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6619b8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0059.525] CloseHandle (hObject=0x230) returned 1 [0059.526] GetProcessHeap () returned 0x630000 [0059.526] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0059.526] GetProcessHeap () returned 0x630000 [0059.526] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655580 | out: hHeap=0x630000) returned 1 [0059.526] GetProcessHeap () returned 0x630000 [0059.526] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0059.526] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms") returned="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms" [0059.526] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms.happythreechoose") returned="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms.happythreechoose" [0059.527] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\fd1hvy\\searches\\indexed locations.search-ms"), lpNewFileName="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms.happythreechoose" (normalized: "c:\\users\\fd1hvy\\searches\\indexed locations.search-ms.happythreechoose"), dwFlags=0x1) returned 1 [0059.527] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms" | out: pszPath="C:\\Users\\FD1HVy\\Searches") returned 1 [0059.527] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Searches" | out: pszPath="C:\\Users\\FD1HVy\\Searches\\") returned="" [0059.527] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Searches\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Searches\\Decryption INFO.html" [0059.527] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\searches\\decryption info.html")) returned 0x20 [0059.527] GetProcessHeap () returned 0x630000 [0059.527] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0059.527] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="WINRT-~1.SEA")) returned 1 [0059.527] lstrcmpiW (lpString1="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", lpString2=".") returned 1 [0059.527] lstrcmpiW (lpString1="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", lpString2="..") returned 1 [0059.527] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Searches\\", lpString2="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms") returned="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" [0059.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 75 [0059.527] GetProcessHeap () returned 0x630000 [0059.527] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4b) returned 0x65ee58 [0059.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cchWideChar=-1, lpMultiByteStr=0x65ee58, cbMultiByte=75, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", lpUsedDefaultChar=0x0) returned 75 [0059.527] lstrlenA (lpString="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms") returned 74 [0059.528] lstrlenA (lpString=".happythreechoose") returned 17 [0059.528] lstrlenA (lpString=".happythreechoose") returned 17 [0059.528] lstrlenA (lpString="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms") returned 74 [0059.528] lstrcmpiA (lpString1="earchconnector-ms", lpString2=".happythreechoose") returned 1 [0059.528] lstrcmpiW (lpString1="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", lpString2="Decryption INFO.html") returned 1 [0059.528] lstrcmpiW (lpString1="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0059.528] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0059.528] lstrcmpiW (lpString1="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0059.528] GetProcessHeap () returned 0x630000 [0059.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0059.528] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" (normalized: "c:\\users\\fd1hvy\\searches\\winrt--{s-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0059.529] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=855) returned 1 [0059.529] GetProcessHeap () returned 0x630000 [0059.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6555f8 [0059.529] GetProcessHeap () returned 0x630000 [0059.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0059.529] lstrlenW (lpString="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms") returned 99 [0059.530] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.530] GetProcessHeap () returned 0x630000 [0059.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0059.530] GetProcessHeap () returned 0x630000 [0059.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x389) returned 0x6619f0 [0059.530] lstrlenA (lpString="rsa_encrypt") returned 11 [0059.530] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0059.530] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0059.530] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0059.530] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0059.530] GetProcessHeap () returned 0x630000 [0059.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0059.530] lstrlenA (lpString="010001") returned 6 [0059.530] GetProcessHeap () returned 0x630000 [0059.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a1f8 [0059.531] GetProcessHeap () returned 0x630000 [0059.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.531] GetProcessHeap () returned 0x630000 [0059.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e580 [0059.531] GetProcessHeap () returned 0x630000 [0059.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.531] GetProcessHeap () returned 0x630000 [0059.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e4f0 [0059.531] GetProcessHeap () returned 0x630000 [0059.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656db0 [0059.531] GetProcessHeap () returned 0x630000 [0059.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a128 [0059.531] GetProcessHeap () returned 0x630000 [0059.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0059.531] GetProcessHeap () returned 0x630000 [0059.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0059.531] GetProcessHeap () returned 0x630000 [0059.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0059.531] GetProcessHeap () returned 0x630000 [0059.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.531] GetProcessHeap () returned 0x630000 [0059.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656b80 [0059.531] GetProcessHeap () returned 0x630000 [0059.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.531] GetProcessHeap () returned 0x630000 [0059.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0059.531] GetProcessHeap () returned 0x630000 [0059.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e850 [0059.532] GetProcessHeap () returned 0x630000 [0059.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.532] GetProcessHeap () returned 0x630000 [0059.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0059.532] GetProcessHeap () returned 0x630000 [0059.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0059.532] GetProcessHeap () returned 0x630000 [0059.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0059.532] GetProcessHeap () returned 0x630000 [0059.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0059.532] GetProcessHeap () returned 0x630000 [0059.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.532] GetProcessHeap () returned 0x630000 [0059.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0059.532] GetProcessHeap () returned 0x630000 [0059.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0059.532] GetProcessHeap () returned 0x630000 [0059.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0059.532] GetProcessHeap () returned 0x630000 [0059.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ea00 [0059.532] GetProcessHeap () returned 0x630000 [0059.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0059.532] GetProcessHeap () returned 0x630000 [0059.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0059.532] GetProcessHeap () returned 0x630000 [0059.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0059.532] GetProcessHeap () returned 0x630000 [0059.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0059.532] GetProcessHeap () returned 0x630000 [0059.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0059.532] GetProcessHeap () returned 0x630000 [0059.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0059.532] GetProcessHeap () returned 0x630000 [0059.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0059.532] GetProcessHeap () returned 0x630000 [0059.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0059.532] GetProcessHeap () returned 0x630000 [0059.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.533] GetProcessHeap () returned 0x630000 [0059.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0059.533] GetProcessHeap () returned 0x630000 [0059.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0059.533] GetProcessHeap () returned 0x630000 [0059.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0059.533] GetProcessHeap () returned 0x630000 [0059.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0059.533] GetProcessHeap () returned 0x630000 [0059.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0059.533] GetProcessHeap () returned 0x630000 [0059.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0059.533] GetProcessHeap () returned 0x630000 [0059.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0059.533] GetProcessHeap () returned 0x630000 [0059.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0059.533] GetProcessHeap () returned 0x630000 [0059.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0059.533] GetProcessHeap () returned 0x630000 [0059.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0059.533] GetProcessHeap () returned 0x630000 [0059.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0059.533] GetProcessHeap () returned 0x630000 [0059.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0059.533] GetProcessHeap () returned 0x630000 [0059.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0059.533] GetProcessHeap () returned 0x630000 [0059.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0059.533] GetProcessHeap () returned 0x630000 [0059.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.533] GetProcessHeap () returned 0x630000 [0059.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.533] GetProcessHeap () returned 0x630000 [0059.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.533] GetProcessHeap () returned 0x630000 [0059.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.534] GetProcessHeap () returned 0x630000 [0059.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0059.534] GetProcessHeap () returned 0x630000 [0059.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0059.534] GetProcessHeap () returned 0x630000 [0059.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0059.534] GetProcessHeap () returned 0x630000 [0059.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0059.534] GetProcessHeap () returned 0x630000 [0059.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.534] GetProcessHeap () returned 0x630000 [0059.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.534] GetProcessHeap () returned 0x630000 [0059.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0059.534] GetProcessHeap () returned 0x630000 [0059.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.534] GetProcessHeap () returned 0x630000 [0059.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.534] GetProcessHeap () returned 0x630000 [0059.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.534] GetProcessHeap () returned 0x630000 [0059.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.534] GetProcessHeap () returned 0x630000 [0059.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.534] GetProcessHeap () returned 0x630000 [0059.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.534] GetProcessHeap () returned 0x630000 [0059.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.534] GetProcessHeap () returned 0x630000 [0059.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0059.534] GetProcessHeap () returned 0x630000 [0059.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0059.534] GetProcessHeap () returned 0x630000 [0059.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.534] GetProcessHeap () returned 0x630000 [0059.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.535] GetProcessHeap () returned 0x630000 [0059.535] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0059.535] GetProcessHeap () returned 0x630000 [0059.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0059.535] GetProcessHeap () returned 0x630000 [0059.535] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1a8 [0059.535] GetProcessHeap () returned 0x630000 [0059.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1a8 | out: hHeap=0x630000) returned 1 [0059.535] GetProcessHeap () returned 0x630000 [0059.535] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.535] GetProcessHeap () returned 0x630000 [0059.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.535] GetProcessHeap () returned 0x630000 [0059.535] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0059.535] GetProcessHeap () returned 0x630000 [0059.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0059.535] GetProcessHeap () returned 0x630000 [0059.535] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a208 [0059.535] GetProcessHeap () returned 0x630000 [0059.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a208 | out: hHeap=0x630000) returned 1 [0059.535] GetProcessHeap () returned 0x630000 [0059.535] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0059.535] GetProcessHeap () returned 0x630000 [0059.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0059.535] GetProcessHeap () returned 0x630000 [0059.535] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.535] GetProcessHeap () returned 0x630000 [0059.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.535] GetProcessHeap () returned 0x630000 [0059.535] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0059.535] GetProcessHeap () returned 0x630000 [0059.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0059.535] GetProcessHeap () returned 0x630000 [0059.535] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a208 [0059.535] GetProcessHeap () returned 0x630000 [0059.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a208 | out: hHeap=0x630000) returned 1 [0059.535] GetProcessHeap () returned 0x630000 [0059.535] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0059.536] GetProcessHeap () returned 0x630000 [0059.536] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0059.536] GetProcessHeap () returned 0x630000 [0059.536] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a208 [0059.536] GetProcessHeap () returned 0x630000 [0059.536] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a208 | out: hHeap=0x630000) returned 1 [0059.536] GetProcessHeap () returned 0x630000 [0059.536] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0059.536] GetProcessHeap () returned 0x630000 [0059.536] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.536] GetProcessHeap () returned 0x630000 [0059.536] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0059.536] GetProcessHeap () returned 0x630000 [0059.536] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0059.536] GetProcessHeap () returned 0x630000 [0059.536] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.536] GetProcessHeap () returned 0x630000 [0059.536] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.536] GetProcessHeap () returned 0x630000 [0059.536] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1a8 [0059.536] GetProcessHeap () returned 0x630000 [0059.536] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1a8 | out: hHeap=0x630000) returned 1 [0059.536] GetProcessHeap () returned 0x630000 [0059.536] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0059.536] GetProcessHeap () returned 0x630000 [0059.536] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0059.536] GetProcessHeap () returned 0x630000 [0059.536] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0059.536] GetProcessHeap () returned 0x630000 [0059.536] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0059.536] GetProcessHeap () returned 0x630000 [0059.536] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.536] GetProcessHeap () returned 0x630000 [0059.536] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.536] GetProcessHeap () returned 0x630000 [0059.536] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.536] GetProcessHeap () returned 0x630000 [0059.536] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.536] GetProcessHeap () returned 0x630000 [0059.537] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.537] GetProcessHeap () returned 0x630000 [0059.537] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.537] GetProcessHeap () returned 0x630000 [0059.537] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0059.537] GetProcessHeap () returned 0x630000 [0059.537] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0059.537] GetProcessHeap () returned 0x630000 [0059.537] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0059.537] GetProcessHeap () returned 0x630000 [0059.537] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0059.537] GetProcessHeap () returned 0x630000 [0059.537] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0059.537] GetProcessHeap () returned 0x630000 [0059.537] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0059.537] GetProcessHeap () returned 0x630000 [0059.537] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0059.537] GetProcessHeap () returned 0x630000 [0059.537] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0059.537] GetProcessHeap () returned 0x630000 [0059.537] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0059.537] GetProcessHeap () returned 0x630000 [0059.537] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0059.537] GetProcessHeap () returned 0x630000 [0059.537] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0059.537] WriteFile (in: hFile=0x230, lpBuffer=0x6619f0*, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6619f0*, lpNumberOfBytesWritten=0x243d864*=0x389, lpOverlapped=0x0) returned 1 [0059.562] GetProcessHeap () returned 0x630000 [0059.562] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6619f0, Size=0x30) returned 0x6619f0 [0059.562] GetProcessHeap () returned 0x630000 [0059.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0059.562] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.562] GetProcessHeap () returned 0x630000 [0059.562] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x360) returned 0x6561c0 [0059.562] ReadFile (in: hFile=0x230, lpBuffer=0x6561c0, nNumberOfBytesToRead=0x360, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x6561c0*, lpNumberOfBytesRead=0x243d7e8*=0x360, lpOverlapped=0x0) returned 1 [0059.563] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.563] WriteFile (in: hFile=0x230, lpBuffer=0x6561c0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x6561c0*, lpNumberOfBytesWritten=0x243d7e4*=0x360, lpOverlapped=0x0) returned 1 [0059.564] GetProcessHeap () returned 0x630000 [0059.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6561c0 | out: hHeap=0x630000) returned 1 [0059.564] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.564] WriteFile (in: hFile=0x230, lpBuffer=0x6619f0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6619f0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0059.565] CloseHandle (hObject=0x230) returned 1 [0059.566] GetProcessHeap () returned 0x630000 [0059.566] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0059.566] GetProcessHeap () returned 0x630000 [0059.566] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6555f8 | out: hHeap=0x630000) returned 1 [0059.566] GetProcessHeap () returned 0x630000 [0059.566] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0059.566] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms") returned="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" [0059.566] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.happythreechoose") returned="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.happythreechoose" [0059.567] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" (normalized: "c:\\users\\fd1hvy\\searches\\winrt--{s-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms"), lpNewFileName="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.happythreechoose" (normalized: "c:\\users\\fd1hvy\\searches\\winrt--{s-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.happythreechoose"), dwFlags=0x1) returned 1 [0059.567] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" | out: pszPath="C:\\Users\\FD1HVy\\Searches") returned 1 [0059.567] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Searches" | out: pszPath="C:\\Users\\FD1HVy\\Searches\\") returned="" [0059.567] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Searches\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Searches\\Decryption INFO.html" [0059.567] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\searches\\decryption info.html")) returned 0x20 [0059.567] GetProcessHeap () returned 0x630000 [0059.567] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ee58 | out: hHeap=0x630000) returned 1 [0059.567] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="WINRT-~1.SEA")) returned 0 [0059.567] FindClose (in: hFindFile=0x648b50 | out: hFindFile=0x648b50) returned 1 [0059.567] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\Saved Games\\" | out: lpString1="C:\\Users\\FD1HVy\\Saved Games\\") returned="C:\\Users\\FD1HVy\\Saved Games\\" [0059.567] GetProcessHeap () returned 0x630000 [0059.568] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6424c0 | out: hHeap=0x630000) returned 1 [0059.568] GetProcessHeap () returned 0x630000 [0059.568] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.568] lstrlenW (lpString="C:\\Users\\FD1HVy\\Saved Games\\") returned 28 [0059.568] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Saved Games\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Saved Games\\*") returned="C:\\Users\\FD1HVy\\Saved Games\\*" [0059.568] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Saved Games\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648b50 [0059.568] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0059.568] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.568] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0059.568] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0059.568] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0059.568] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0059.568] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0059.568] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Saved Games\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini") returned="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini" [0059.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.568] GetProcessHeap () returned 0x630000 [0059.568] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0059.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0059.568] lstrlenA (lpString="desktop.ini") returned 11 [0059.568] lstrlenA (lpString=".happythreechoose") returned 17 [0059.568] lstrcmpiW (lpString1="desktop.ini", lpString2="Decryption INFO.html") returned 1 [0059.568] lstrcmpiW (lpString1="desktop.ini", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0059.568] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0059.568] lstrcmpiW (lpString1="desktop.ini", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0059.568] GetProcessHeap () returned 0x630000 [0059.568] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0059.568] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\saved games\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0059.569] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=282) returned 1 [0059.569] GetProcessHeap () returned 0x630000 [0059.569] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655490 [0059.569] GetProcessHeap () returned 0x630000 [0059.569] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0059.569] lstrlenW (lpString="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini") returned 39 [0059.569] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.569] GetProcessHeap () returned 0x630000 [0059.569] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0059.569] GetProcessHeap () returned 0x630000 [0059.569] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x386) returned 0x661a28 [0059.569] lstrlenA (lpString="rsa_encrypt") returned 11 [0059.569] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0059.570] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0059.570] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0059.570] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0059.570] GetProcessHeap () returned 0x630000 [0059.570] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0059.570] lstrlenA (lpString="010001") returned 6 [0059.570] GetProcessHeap () returned 0x630000 [0059.570] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0059.570] GetProcessHeap () returned 0x630000 [0059.570] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.570] GetProcessHeap () returned 0x630000 [0059.570] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e6a0 [0059.570] GetProcessHeap () returned 0x630000 [0059.570] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.570] GetProcessHeap () returned 0x630000 [0059.570] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea90 [0059.570] GetProcessHeap () returned 0x630000 [0059.570] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656fe0 [0059.570] GetProcessHeap () returned 0x630000 [0059.570] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a218 [0059.570] GetProcessHeap () returned 0x630000 [0059.570] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0059.570] GetProcessHeap () returned 0x630000 [0059.570] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.570] GetProcessHeap () returned 0x630000 [0059.570] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0059.570] GetProcessHeap () returned 0x630000 [0059.570] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.570] GetProcessHeap () returned 0x630000 [0059.570] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656950 [0059.570] GetProcessHeap () returned 0x630000 [0059.570] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0059.570] GetProcessHeap () returned 0x630000 [0059.570] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0059.571] GetProcessHeap () returned 0x630000 [0059.571] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e460 [0059.571] GetProcessHeap () returned 0x630000 [0059.571] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.571] GetProcessHeap () returned 0x630000 [0059.571] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0059.571] GetProcessHeap () returned 0x630000 [0059.571] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e460 | out: hHeap=0x630000) returned 1 [0059.571] GetProcessHeap () returned 0x630000 [0059.571] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0059.571] GetProcessHeap () returned 0x630000 [0059.571] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x6617b8 [0059.571] GetProcessHeap () returned 0x630000 [0059.571] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0059.571] GetProcessHeap () returned 0x630000 [0059.571] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0059.571] GetProcessHeap () returned 0x630000 [0059.571] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0059.571] GetProcessHeap () returned 0x630000 [0059.571] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0059.571] GetProcessHeap () returned 0x630000 [0059.571] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65dda0 [0059.571] GetProcessHeap () returned 0x630000 [0059.571] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6617b8 | out: hHeap=0x630000) returned 1 [0059.571] GetProcessHeap () returned 0x630000 [0059.571] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0059.571] GetProcessHeap () returned 0x630000 [0059.571] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0059.571] GetProcessHeap () returned 0x630000 [0059.571] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.571] GetProcessHeap () returned 0x630000 [0059.571] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.571] GetProcessHeap () returned 0x630000 [0059.571] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.571] GetProcessHeap () returned 0x630000 [0059.571] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.571] GetProcessHeap () returned 0x630000 [0059.571] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0059.572] GetProcessHeap () returned 0x630000 [0059.572] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0059.572] GetProcessHeap () returned 0x630000 [0059.572] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0059.572] GetProcessHeap () returned 0x630000 [0059.572] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0059.572] GetProcessHeap () returned 0x630000 [0059.572] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0059.572] GetProcessHeap () returned 0x630000 [0059.572] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0059.572] GetProcessHeap () returned 0x630000 [0059.572] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.572] GetProcessHeap () returned 0x630000 [0059.572] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.572] GetProcessHeap () returned 0x630000 [0059.572] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0059.572] GetProcessHeap () returned 0x630000 [0059.572] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0059.572] GetProcessHeap () returned 0x630000 [0059.572] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0059.572] GetProcessHeap () returned 0x630000 [0059.572] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0059.572] GetProcessHeap () returned 0x630000 [0059.572] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0059.572] GetProcessHeap () returned 0x630000 [0059.572] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0059.572] GetProcessHeap () returned 0x630000 [0059.572] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.572] GetProcessHeap () returned 0x630000 [0059.572] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.572] GetProcessHeap () returned 0x630000 [0059.572] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.572] GetProcessHeap () returned 0x630000 [0059.572] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.572] GetProcessHeap () returned 0x630000 [0059.572] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0059.572] GetProcessHeap () returned 0x630000 [0059.572] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0059.572] GetProcessHeap () returned 0x630000 [0059.573] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0059.573] GetProcessHeap () returned 0x630000 [0059.573] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0059.573] GetProcessHeap () returned 0x630000 [0059.573] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0059.573] GetProcessHeap () returned 0x630000 [0059.573] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0059.573] GetProcessHeap () returned 0x630000 [0059.573] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1a8 [0059.573] GetProcessHeap () returned 0x630000 [0059.573] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1a8 | out: hHeap=0x630000) returned 1 [0059.573] GetProcessHeap () returned 0x630000 [0059.573] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0059.573] GetProcessHeap () returned 0x630000 [0059.573] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0059.573] GetProcessHeap () returned 0x630000 [0059.573] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1a8 [0059.573] GetProcessHeap () returned 0x630000 [0059.573] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1a8 | out: hHeap=0x630000) returned 1 [0059.573] GetProcessHeap () returned 0x630000 [0059.573] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0059.573] GetProcessHeap () returned 0x630000 [0059.573] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0059.573] GetProcessHeap () returned 0x630000 [0059.573] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0059.573] GetProcessHeap () returned 0x630000 [0059.573] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.573] GetProcessHeap () returned 0x630000 [0059.573] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0059.573] GetProcessHeap () returned 0x630000 [0059.573] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0059.573] GetProcessHeap () returned 0x630000 [0059.573] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0059.573] GetProcessHeap () returned 0x630000 [0059.573] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0059.573] GetProcessHeap () returned 0x630000 [0059.573] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.573] GetProcessHeap () returned 0x630000 [0059.574] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.574] GetProcessHeap () returned 0x630000 [0059.574] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a208 [0059.574] GetProcessHeap () returned 0x630000 [0059.574] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a208 | out: hHeap=0x630000) returned 1 [0059.574] GetProcessHeap () returned 0x630000 [0059.574] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0059.574] GetProcessHeap () returned 0x630000 [0059.574] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.574] GetProcessHeap () returned 0x630000 [0059.574] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0059.574] GetProcessHeap () returned 0x630000 [0059.574] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0059.574] GetProcessHeap () returned 0x630000 [0059.574] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0059.574] GetProcessHeap () returned 0x630000 [0059.574] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0059.574] GetProcessHeap () returned 0x630000 [0059.574] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0059.574] GetProcessHeap () returned 0x630000 [0059.574] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0059.574] GetProcessHeap () returned 0x630000 [0059.574] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.574] GetProcessHeap () returned 0x630000 [0059.574] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.574] GetProcessHeap () returned 0x630000 [0059.574] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0e8 [0059.574] GetProcessHeap () returned 0x630000 [0059.574] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0e8 | out: hHeap=0x630000) returned 1 [0059.574] GetProcessHeap () returned 0x630000 [0059.574] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a208 [0059.574] GetProcessHeap () returned 0x630000 [0059.574] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a208 | out: hHeap=0x630000) returned 1 [0059.574] GetProcessHeap () returned 0x630000 [0059.574] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0059.574] GetProcessHeap () returned 0x630000 [0059.574] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0059.575] GetProcessHeap () returned 0x630000 [0059.575] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0059.575] GetProcessHeap () returned 0x630000 [0059.575] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0059.575] GetProcessHeap () returned 0x630000 [0059.575] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0059.575] GetProcessHeap () returned 0x630000 [0059.575] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0059.575] GetProcessHeap () returned 0x630000 [0059.575] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0059.575] GetProcessHeap () returned 0x630000 [0059.575] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0059.575] GetProcessHeap () returned 0x630000 [0059.575] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0059.575] GetProcessHeap () returned 0x630000 [0059.575] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.575] GetProcessHeap () returned 0x630000 [0059.575] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0059.575] GetProcessHeap () returned 0x630000 [0059.575] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0059.575] GetProcessHeap () returned 0x630000 [0059.575] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0059.575] GetProcessHeap () returned 0x630000 [0059.575] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0059.575] GetProcessHeap () returned 0x630000 [0059.575] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0059.575] GetProcessHeap () returned 0x630000 [0059.575] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0059.575] GetProcessHeap () returned 0x630000 [0059.575] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0059.575] GetProcessHeap () returned 0x630000 [0059.575] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0059.575] GetProcessHeap () returned 0x630000 [0059.575] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0059.575] GetProcessHeap () returned 0x630000 [0059.575] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0059.575] GetProcessHeap () returned 0x630000 [0059.575] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0059.576] GetProcessHeap () returned 0x630000 [0059.576] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0059.576] GetProcessHeap () returned 0x630000 [0059.576] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0059.576] GetProcessHeap () returned 0x630000 [0059.576] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0059.576] GetProcessHeap () returned 0x630000 [0059.576] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0059.576] GetProcessHeap () returned 0x630000 [0059.576] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0059.576] GetProcessHeap () returned 0x630000 [0059.576] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0059.576] GetProcessHeap () returned 0x630000 [0059.576] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea90 | out: hHeap=0x630000) returned 1 [0059.576] GetProcessHeap () returned 0x630000 [0059.576] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0059.576] GetProcessHeap () returned 0x630000 [0059.576] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e6a0 | out: hHeap=0x630000) returned 1 [0059.576] GetProcessHeap () returned 0x630000 [0059.576] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0059.576] GetProcessHeap () returned 0x630000 [0059.576] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.576] GetProcessHeap () returned 0x630000 [0059.576] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0059.576] WriteFile (in: hFile=0x230, lpBuffer=0x661a28*, nNumberOfBytesToWrite=0x386, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661a28*, lpNumberOfBytesWritten=0x243d864*=0x386, lpOverlapped=0x0) returned 1 [0059.579] GetProcessHeap () returned 0x630000 [0059.579] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x661a28, Size=0x30) returned 0x661a28 [0059.579] GetProcessHeap () returned 0x630000 [0059.579] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0059.579] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.579] GetProcessHeap () returned 0x630000 [0059.579] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x120) returned 0x63f408 [0059.579] ReadFile (in: hFile=0x230, lpBuffer=0x63f408, nNumberOfBytesToRead=0x120, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x63f408*, lpNumberOfBytesRead=0x243d7e8*=0x120, lpOverlapped=0x0) returned 1 [0059.579] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.579] WriteFile (in: hFile=0x230, lpBuffer=0x63f408*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x63f408*, lpNumberOfBytesWritten=0x243d7e4*=0x120, lpOverlapped=0x0) returned 1 [0059.580] GetProcessHeap () returned 0x630000 [0059.580] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63f408 | out: hHeap=0x630000) returned 1 [0059.580] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.580] WriteFile (in: hFile=0x230, lpBuffer=0x661a28*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661a28*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0059.581] CloseHandle (hObject=0x230) returned 1 [0059.583] GetProcessHeap () returned 0x630000 [0059.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0059.583] GetProcessHeap () returned 0x630000 [0059.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655490 | out: hHeap=0x630000) returned 1 [0059.583] GetProcessHeap () returned 0x630000 [0059.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0059.583] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini") returned="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini" [0059.583] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini.happythreechoose") returned="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini.happythreechoose" [0059.583] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\saved games\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini.happythreechoose" (normalized: "c:\\users\\fd1hvy\\saved games\\desktop.ini.happythreechoose"), dwFlags=0x1) returned 1 [0059.583] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\Saved Games") returned 1 [0059.583] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Saved Games" | out: pszPath="C:\\Users\\FD1HVy\\Saved Games\\") returned="" [0059.583] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Saved Games\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Saved Games\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Saved Games\\Decryption INFO.html" [0059.583] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Saved Games\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\saved games\\decryption info.html")) returned 0xffffffff [0059.583] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Saved Games\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\saved games\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0059.584] GetProcessHeap () returned 0x630000 [0059.584] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655508 [0059.584] GetProcessHeap () returned 0x630000 [0059.584] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0059.591] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.591] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.592] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.592] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.592] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.592] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.592] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.592] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.592] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.592] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.592] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.592] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.592] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.592] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.592] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.593] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.593] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.593] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.593] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.593] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.593] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.593] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.593] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.593] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.593] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.593] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.593] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.593] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.593] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.594] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.594] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.594] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.594] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.594] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.594] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.594] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.594] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.595] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.595] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.595] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.595] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.595] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.595] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.595] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.595] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.595] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.596] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.596] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.596] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.596] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.596] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.596] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.596] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.596] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.596] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.596] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.596] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.596] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.596] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.597] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.597] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.597] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.597] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.597] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.597] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.597] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.597] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.597] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.597] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.597] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.597] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.597] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.597] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.598] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.598] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.598] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.598] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.598] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.598] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.598] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.598] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.598] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.598] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.598] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.598] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.598] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.599] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.599] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.599] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.599] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.599] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.599] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.599] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.599] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.599] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.599] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.599] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.599] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.599] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.599] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.600] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.600] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.600] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.600] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.600] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.600] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.600] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.600] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.600] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.600] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.600] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.600] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.600] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.600] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.601] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.601] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.601] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.601] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.601] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.601] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.601] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.601] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.601] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.601] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.601] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.601] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.601] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.601] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.601] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.602] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.602] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.602] GetProcessHeap () returned 0x630000 [0059.602] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655508 | out: hHeap=0x630000) returned 1 [0059.602] GetProcessHeap () returned 0x630000 [0059.602] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0059.602] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0059.602] GetProcessHeap () returned 0x630000 [0059.602] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655850 [0059.602] GetProcessHeap () returned 0x630000 [0059.602] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0059.609] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.609] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.609] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.609] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.609] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.609] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.609] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.609] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.610] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.610] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.610] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.610] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.610] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.610] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.610] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.610] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.610] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.610] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.610] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.610] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.610] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.611] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.611] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.611] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.611] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.611] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.611] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.611] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.611] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.611] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.611] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.611] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.611] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.611] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.611] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.612] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.612] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.612] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.612] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.612] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.612] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.612] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.612] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.612] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.612] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.612] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.612] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.612] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.612] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.613] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.613] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.613] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.613] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.613] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.613] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.613] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.613] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.613] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.613] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.613] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.613] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.613] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.613] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.613] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.614] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.614] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.614] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.614] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.614] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.614] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.614] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.614] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.614] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.614] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.614] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.614] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.614] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.614] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.615] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.615] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.615] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.615] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.615] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.615] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.615] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.615] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.615] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.615] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.615] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.615] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.615] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.616] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.616] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.616] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.616] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.616] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.616] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.616] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.616] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.616] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.616] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.616] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.616] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.626] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.626] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.626] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.626] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.626] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.627] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.627] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.627] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.627] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.627] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.627] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.627] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.627] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.627] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.627] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.628] GetProcessHeap () returned 0x630000 [0059.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655850 | out: hHeap=0x630000) returned 1 [0059.628] GetProcessHeap () returned 0x630000 [0059.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0059.628] CloseHandle (hObject=0x230) returned 1 [0059.628] GetProcessHeap () returned 0x630000 [0059.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0059.628] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0059.628] FindClose (in: hFindFile=0x648b50 | out: hFindFile=0x648b50) returned 1 [0059.629] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\Recent\\") returned="C:\\Users\\FD1HVy\\Recent\\" [0059.629] GetProcessHeap () returned 0x630000 [0059.629] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x652240 | out: hHeap=0x630000) returned 1 [0059.629] GetProcessHeap () returned 0x630000 [0059.629] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a188 | out: hHeap=0x630000) returned 1 [0059.629] lstrlenW (lpString="C:\\Users\\FD1HVy\\Recent\\") returned 23 [0059.629] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Recent\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Recent\\*") returned="C:\\Users\\FD1HVy\\Recent\\*" [0059.629] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Recent\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0xffffffff [0059.629] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\PrintHood\\" | out: lpString1="C:\\Users\\FD1HVy\\PrintHood\\") returned="C:\\Users\\FD1HVy\\PrintHood\\" [0059.629] GetProcessHeap () returned 0x630000 [0059.629] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x648bd0 | out: hHeap=0x630000) returned 1 [0059.629] GetProcessHeap () returned 0x630000 [0059.629] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.629] lstrlenW (lpString="C:\\Users\\FD1HVy\\PrintHood\\") returned 26 [0059.629] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\PrintHood\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\PrintHood\\*") returned="C:\\Users\\FD1HVy\\PrintHood\\*" [0059.629] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\PrintHood\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0xffffffff [0059.629] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0059.629] GetProcessHeap () returned 0x630000 [0059.629] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x648b10 | out: hHeap=0x630000) returned 1 [0059.629] GetProcessHeap () returned 0x630000 [0059.629] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.629] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\") returned 25 [0059.629] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\*") returned="C:\\Users\\FD1HVy\\Pictures\\*" [0059.630] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3a99ac44, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3a99ac44, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648b10 [0059.630] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0059.630] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3a99ac44, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3a99ac44, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.630] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0059.630] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0059.630] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a4883c0, ftCreationTime.dwHighDateTime=0x1d5c90e, ftLastAccessTime.dwLowDateTime=0x39a38980, ftLastAccessTime.dwHighDateTime=0x1d5c9ff, ftLastWriteTime.dwLowDateTime=0x39a38980, ftLastWriteTime.dwHighDateTime=0x1d5c9ff, nFileSizeHigh=0x0, nFileSizeLow=0x104b6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-9iF5.gif", cAlternateFileName="")) returned 1 [0059.630] lstrcmpiW (lpString1="-9iF5.gif", lpString2=".") returned 1 [0059.630] lstrcmpiW (lpString1="-9iF5.gif", lpString2="..") returned 1 [0059.630] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="-9iF5.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\-9iF5.gif") returned="C:\\Users\\FD1HVy\\Pictures\\-9iF5.gif" [0059.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="-9iF5.gif", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.630] GetProcessHeap () returned 0x630000 [0059.630] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x64ca20 [0059.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="-9iF5.gif", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-9iF5.gif", lpUsedDefaultChar=0x0) returned 10 [0059.630] lstrlenA (lpString="-9iF5.gif") returned 9 [0059.630] lstrlenA (lpString=".happythreechoose") returned 17 [0059.630] lstrcmpiW (lpString1="-9iF5.gif", lpString2="Decryption INFO.html") returned -1 [0059.630] lstrcmpiW (lpString1="-9iF5.gif", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0059.630] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0059.630] lstrcmpiW (lpString1="-9iF5.gif", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0059.630] GetProcessHeap () returned 0x630000 [0059.630] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0059.630] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\-9iF5.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\-9if5.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0059.630] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=66742) returned 1 [0059.630] GetProcessHeap () returned 0x630000 [0059.630] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655a30 [0059.630] GetProcessHeap () returned 0x630000 [0059.631] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0059.631] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\-9iF5.gif") returned 34 [0059.631] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.631] GetProcessHeap () returned 0x630000 [0059.631] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0059.631] GetProcessHeap () returned 0x630000 [0059.631] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38a) returned 0x661a60 [0059.631] lstrlenA (lpString="rsa_encrypt") returned 11 [0059.631] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0059.631] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0059.631] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0059.631] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0059.631] GetProcessHeap () returned 0x630000 [0059.631] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0059.631] lstrlenA (lpString="010001") returned 6 [0059.631] GetProcessHeap () returned 0x630000 [0059.631] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0059.632] GetProcessHeap () returned 0x630000 [0059.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.632] GetProcessHeap () returned 0x630000 [0059.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e7c0 [0059.632] GetProcessHeap () returned 0x630000 [0059.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.632] GetProcessHeap () returned 0x630000 [0059.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e3d0 [0059.632] GetProcessHeap () returned 0x630000 [0059.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657440 [0059.632] GetProcessHeap () returned 0x630000 [0059.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0059.632] GetProcessHeap () returned 0x630000 [0059.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0059.632] GetProcessHeap () returned 0x630000 [0059.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.632] GetProcessHeap () returned 0x630000 [0059.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0059.632] GetProcessHeap () returned 0x630000 [0059.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.632] GetProcessHeap () returned 0x630000 [0059.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657328 [0059.632] GetProcessHeap () returned 0x630000 [0059.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.632] GetProcessHeap () returned 0x630000 [0059.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0059.632] GetProcessHeap () returned 0x630000 [0059.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e460 [0059.632] GetProcessHeap () returned 0x630000 [0059.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.632] GetProcessHeap () returned 0x630000 [0059.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0059.632] GetProcessHeap () returned 0x630000 [0059.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e460 | out: hHeap=0x630000) returned 1 [0059.632] GetProcessHeap () returned 0x630000 [0059.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.632] GetProcessHeap () returned 0x630000 [0059.633] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x661968 [0059.633] GetProcessHeap () returned 0x630000 [0059.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.633] GetProcessHeap () returned 0x630000 [0059.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.633] GetProcessHeap () returned 0x630000 [0059.633] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.633] GetProcessHeap () returned 0x630000 [0059.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.633] GetProcessHeap () returned 0x630000 [0059.633] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65dfe0 [0059.633] GetProcessHeap () returned 0x630000 [0059.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661968 | out: hHeap=0x630000) returned 1 [0059.633] GetProcessHeap () returned 0x630000 [0059.633] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0059.633] GetProcessHeap () returned 0x630000 [0059.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0059.633] GetProcessHeap () returned 0x630000 [0059.633] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.633] GetProcessHeap () returned 0x630000 [0059.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.633] GetProcessHeap () returned 0x630000 [0059.633] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.633] GetProcessHeap () returned 0x630000 [0059.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.633] GetProcessHeap () returned 0x630000 [0059.633] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.633] GetProcessHeap () returned 0x630000 [0059.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.633] GetProcessHeap () returned 0x630000 [0059.633] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.633] GetProcessHeap () returned 0x630000 [0059.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.633] GetProcessHeap () returned 0x630000 [0059.633] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.633] GetProcessHeap () returned 0x630000 [0059.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.634] GetProcessHeap () returned 0x630000 [0059.634] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.634] GetProcessHeap () returned 0x630000 [0059.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.634] GetProcessHeap () returned 0x630000 [0059.634] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.634] GetProcessHeap () returned 0x630000 [0059.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.634] GetProcessHeap () returned 0x630000 [0059.634] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.634] GetProcessHeap () returned 0x630000 [0059.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.634] GetProcessHeap () returned 0x630000 [0059.634] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.634] GetProcessHeap () returned 0x630000 [0059.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.634] GetProcessHeap () returned 0x630000 [0059.634] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.634] GetProcessHeap () returned 0x630000 [0059.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.634] GetProcessHeap () returned 0x630000 [0059.634] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.634] GetProcessHeap () returned 0x630000 [0059.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.634] GetProcessHeap () returned 0x630000 [0059.634] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.634] GetProcessHeap () returned 0x630000 [0059.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.634] GetProcessHeap () returned 0x630000 [0059.634] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.634] GetProcessHeap () returned 0x630000 [0059.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.634] GetProcessHeap () returned 0x630000 [0059.634] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.634] GetProcessHeap () returned 0x630000 [0059.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.635] GetProcessHeap () returned 0x630000 [0059.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.635] GetProcessHeap () returned 0x630000 [0059.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.635] GetProcessHeap () returned 0x630000 [0059.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.635] GetProcessHeap () returned 0x630000 [0059.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.635] GetProcessHeap () returned 0x630000 [0059.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.635] GetProcessHeap () returned 0x630000 [0059.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.635] GetProcessHeap () returned 0x630000 [0059.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.635] GetProcessHeap () returned 0x630000 [0059.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.635] GetProcessHeap () returned 0x630000 [0059.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.635] GetProcessHeap () returned 0x630000 [0059.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.635] GetProcessHeap () returned 0x630000 [0059.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.635] GetProcessHeap () returned 0x630000 [0059.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.635] GetProcessHeap () returned 0x630000 [0059.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.635] GetProcessHeap () returned 0x630000 [0059.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.635] GetProcessHeap () returned 0x630000 [0059.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.635] GetProcessHeap () returned 0x630000 [0059.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.635] GetProcessHeap () returned 0x630000 [0059.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.635] GetProcessHeap () returned 0x630000 [0059.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.635] GetProcessHeap () returned 0x630000 [0059.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.636] GetProcessHeap () returned 0x630000 [0059.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.636] GetProcessHeap () returned 0x630000 [0059.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.636] GetProcessHeap () returned 0x630000 [0059.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.636] GetProcessHeap () returned 0x630000 [0059.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.636] GetProcessHeap () returned 0x630000 [0059.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.636] GetProcessHeap () returned 0x630000 [0059.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.636] GetProcessHeap () returned 0x630000 [0059.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.636] GetProcessHeap () returned 0x630000 [0059.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.636] GetProcessHeap () returned 0x630000 [0059.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.636] GetProcessHeap () returned 0x630000 [0059.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.636] GetProcessHeap () returned 0x630000 [0059.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.636] GetProcessHeap () returned 0x630000 [0059.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.636] GetProcessHeap () returned 0x630000 [0059.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.636] GetProcessHeap () returned 0x630000 [0059.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.636] GetProcessHeap () returned 0x630000 [0059.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.636] GetProcessHeap () returned 0x630000 [0059.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.636] GetProcessHeap () returned 0x630000 [0059.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.636] GetProcessHeap () returned 0x630000 [0059.637] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.637] GetProcessHeap () returned 0x630000 [0059.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.637] GetProcessHeap () returned 0x630000 [0059.637] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.637] GetProcessHeap () returned 0x630000 [0059.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.637] GetProcessHeap () returned 0x630000 [0059.637] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.637] GetProcessHeap () returned 0x630000 [0059.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.637] GetProcessHeap () returned 0x630000 [0059.637] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.637] GetProcessHeap () returned 0x630000 [0059.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.637] GetProcessHeap () returned 0x630000 [0059.637] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.637] GetProcessHeap () returned 0x630000 [0059.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.637] GetProcessHeap () returned 0x630000 [0059.637] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.637] GetProcessHeap () returned 0x630000 [0059.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.637] GetProcessHeap () returned 0x630000 [0059.637] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.637] GetProcessHeap () returned 0x630000 [0059.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.637] GetProcessHeap () returned 0x630000 [0059.637] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.637] GetProcessHeap () returned 0x630000 [0059.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.637] GetProcessHeap () returned 0x630000 [0059.637] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.637] GetProcessHeap () returned 0x630000 [0059.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.637] GetProcessHeap () returned 0x630000 [0059.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0059.638] GetProcessHeap () returned 0x630000 [0059.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0059.638] GetProcessHeap () returned 0x630000 [0059.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0059.638] GetProcessHeap () returned 0x630000 [0059.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0059.638] GetProcessHeap () returned 0x630000 [0059.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0059.638] GetProcessHeap () returned 0x630000 [0059.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0059.638] GetProcessHeap () returned 0x630000 [0059.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0059.638] GetProcessHeap () returned 0x630000 [0059.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e7c0 | out: hHeap=0x630000) returned 1 [0059.638] GetProcessHeap () returned 0x630000 [0059.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0059.638] GetProcessHeap () returned 0x630000 [0059.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.638] GetProcessHeap () returned 0x630000 [0059.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0059.638] WriteFile (in: hFile=0x230, lpBuffer=0x661a60*, nNumberOfBytesToWrite=0x38a, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661a60*, lpNumberOfBytesWritten=0x243d864*=0x38a, lpOverlapped=0x0) returned 1 [0059.670] GetProcessHeap () returned 0x630000 [0059.670] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x661a60, Size=0x30) returned 0x661a60 [0059.670] GetProcessHeap () returned 0x630000 [0059.670] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0059.670] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.670] GetProcessHeap () returned 0x630000 [0059.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x104c0) returned 0x661a98 [0059.670] ReadFile (in: hFile=0x230, lpBuffer=0x661a98, nNumberOfBytesToRead=0x104c0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661a98*, lpNumberOfBytesRead=0x243d7e8*=0x104c0, lpOverlapped=0x0) returned 1 [0059.671] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.671] WriteFile (in: hFile=0x230, lpBuffer=0x661a98*, nNumberOfBytesToWrite=0x104c0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661a98*, lpNumberOfBytesWritten=0x243d7e4*=0x104c0, lpOverlapped=0x0) returned 1 [0059.672] GetProcessHeap () returned 0x630000 [0059.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661a98 | out: hHeap=0x630000) returned 1 [0059.672] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.673] WriteFile (in: hFile=0x230, lpBuffer=0x661a60*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661a60*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0059.673] CloseHandle (hObject=0x230) returned 1 [0059.676] GetProcessHeap () returned 0x630000 [0059.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0059.676] GetProcessHeap () returned 0x630000 [0059.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655a30 | out: hHeap=0x630000) returned 1 [0059.676] GetProcessHeap () returned 0x630000 [0059.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0059.676] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\-9iF5.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\-9iF5.gif") returned="C:\\Users\\FD1HVy\\Pictures\\-9iF5.gif" [0059.676] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\-9iF5.gif", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\-9iF5.gif.happythreechoose") returned="C:\\Users\\FD1HVy\\Pictures\\-9iF5.gif.happythreechoose" [0059.676] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\-9iF5.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\-9if5.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\-9iF5.gif.happythreechoose" (normalized: "c:\\users\\fd1hvy\\pictures\\-9if5.gif.happythreechoose"), dwFlags=0x1) returned 1 [0059.677] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\-9iF5.gif" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0059.677] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0059.677] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" [0059.677] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\pictures\\decryption info.html")) returned 0xffffffff [0059.677] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\pictures\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0059.678] GetProcessHeap () returned 0x630000 [0059.678] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6559b8 [0059.678] GetProcessHeap () returned 0x630000 [0059.678] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0059.685] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.686] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.686] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.687] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.687] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.687] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.687] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.687] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.687] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.687] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.688] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.688] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.688] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.688] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.688] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.688] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.688] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.688] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.688] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.688] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.688] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.688] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.689] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.689] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.689] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.689] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.689] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.689] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.689] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.689] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.689] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.689] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.689] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.689] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.689] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.690] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.690] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.690] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.690] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.690] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.690] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.691] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.691] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.691] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.691] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.691] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.691] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.691] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.691] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.691] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.691] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.691] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.691] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.691] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.691] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.691] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.692] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.692] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.692] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.692] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.692] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.692] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.692] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.692] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.692] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.692] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.692] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.692] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.692] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.692] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.693] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.693] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.693] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.693] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.693] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.693] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.693] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.693] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.693] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.693] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.693] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.693] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.693] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.693] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.693] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.694] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.694] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.694] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.694] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.694] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.694] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.694] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.694] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.694] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.694] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.694] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.694] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.694] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.695] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.695] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.695] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.695] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.695] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.695] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.695] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.695] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.695] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.695] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.695] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.695] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.695] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.695] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.695] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.696] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.696] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.696] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.696] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.696] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.696] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.696] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.696] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.696] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.696] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.696] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.696] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.696] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.696] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.696] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.697] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.697] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.697] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.697] GetProcessHeap () returned 0x630000 [0059.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6559b8 | out: hHeap=0x630000) returned 1 [0059.697] GetProcessHeap () returned 0x630000 [0059.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0059.697] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0059.697] GetProcessHeap () returned 0x630000 [0059.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655a30 [0059.697] GetProcessHeap () returned 0x630000 [0059.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0059.704] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.704] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.704] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.704] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.704] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.704] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.704] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.705] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.705] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.705] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.705] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.705] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.705] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.705] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.705] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.705] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.705] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.705] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.705] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.705] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.705] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.706] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.706] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.706] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.706] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.706] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.706] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.706] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.706] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.706] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.706] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.706] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.706] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.706] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.706] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.706] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.707] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.707] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.707] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.707] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.707] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.707] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.707] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.707] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.707] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.707] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.707] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.707] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.707] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.707] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.708] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.708] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.708] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.708] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.708] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.708] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.708] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.708] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.708] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.708] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.708] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.708] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.708] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.709] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.709] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.709] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.709] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.709] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.709] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.709] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.709] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.709] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.709] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.709] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.709] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.709] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.709] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.709] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.710] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.710] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.710] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.710] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.710] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.710] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.710] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.710] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.710] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.710] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.710] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.710] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.711] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.711] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.711] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.711] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.711] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.711] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.711] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.711] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.711] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.711] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.711] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.711] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.711] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.711] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.712] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.712] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.712] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.712] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.712] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.712] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.712] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.712] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.712] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.712] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.712] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.712] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.712] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.712] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0059.713] GetProcessHeap () returned 0x630000 [0059.713] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655a30 | out: hHeap=0x630000) returned 1 [0059.713] GetProcessHeap () returned 0x630000 [0059.713] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0059.713] CloseHandle (hObject=0x230) returned 1 [0059.714] GetProcessHeap () returned 0x630000 [0059.714] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0059.714] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbcd19d0, ftCreationTime.dwHighDateTime=0x1d5d394, ftLastAccessTime.dwLowDateTime=0xe2c3ba80, ftLastAccessTime.dwHighDateTime=0x1d5ce19, ftLastWriteTime.dwLowDateTime=0xe2c3ba80, ftLastWriteTime.dwHighDateTime=0x1d5ce19, nFileSizeHigh=0x0, nFileSizeLow=0x1975, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-dlFOBhT.png", cAlternateFileName="")) returned 1 [0059.714] lstrcmpiW (lpString1="-dlFOBhT.png", lpString2=".") returned 1 [0059.714] lstrcmpiW (lpString1="-dlFOBhT.png", lpString2="..") returned 1 [0059.714] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="-dlFOBhT.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\-dlFOBhT.png") returned="C:\\Users\\FD1HVy\\Pictures\\-dlFOBhT.png" [0059.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="-dlFOBhT.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0059.714] GetProcessHeap () returned 0x630000 [0059.714] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd) returned 0x64c9f0 [0059.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="-dlFOBhT.png", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-dlFOBhT.png", lpUsedDefaultChar=0x0) returned 13 [0059.714] lstrlenA (lpString="-dlFOBhT.png") returned 12 [0059.714] lstrlenA (lpString=".happythreechoose") returned 17 [0059.714] lstrcmpiW (lpString1="-dlFOBhT.png", lpString2="Decryption INFO.html") returned 1 [0059.714] lstrcmpiW (lpString1="-dlFOBhT.png", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0059.714] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0059.714] lstrcmpiW (lpString1="-dlFOBhT.png", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0059.714] GetProcessHeap () returned 0x630000 [0059.714] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0059.714] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\-dlFOBhT.png" (normalized: "c:\\users\\fd1hvy\\pictures\\-dlfobht.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0059.714] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=6517) returned 1 [0059.714] GetProcessHeap () returned 0x630000 [0059.714] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655aa8 [0059.714] GetProcessHeap () returned 0x630000 [0059.714] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0059.714] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\-dlFOBhT.png") returned 37 [0059.714] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.715] GetProcessHeap () returned 0x630000 [0059.715] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0059.715] GetProcessHeap () returned 0x630000 [0059.715] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38b) returned 0x661a98 [0059.715] lstrlenA (lpString="rsa_encrypt") returned 11 [0059.715] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0059.715] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0059.715] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0059.715] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0059.715] GetProcessHeap () returned 0x630000 [0059.715] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0059.715] lstrlenA (lpString="010001") returned 6 [0059.715] GetProcessHeap () returned 0x630000 [0059.715] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0059.716] GetProcessHeap () returned 0x630000 [0059.716] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.716] GetProcessHeap () returned 0x630000 [0059.716] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e4f0 [0059.716] GetProcessHeap () returned 0x630000 [0059.716] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.716] GetProcessHeap () returned 0x630000 [0059.716] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e6a0 [0059.716] GetProcessHeap () returned 0x630000 [0059.716] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x6570f8 [0059.716] GetProcessHeap () returned 0x630000 [0059.716] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0059.716] GetProcessHeap () returned 0x630000 [0059.716] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0059.716] GetProcessHeap () returned 0x630000 [0059.716] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.716] GetProcessHeap () returned 0x630000 [0059.716] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0059.716] GetProcessHeap () returned 0x630000 [0059.716] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.716] GetProcessHeap () returned 0x630000 [0059.716] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657328 [0059.716] GetProcessHeap () returned 0x630000 [0059.716] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.716] GetProcessHeap () returned 0x630000 [0059.716] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0059.716] GetProcessHeap () returned 0x630000 [0059.716] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ebb0 [0059.716] GetProcessHeap () returned 0x630000 [0059.716] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.716] GetProcessHeap () returned 0x630000 [0059.716] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0059.716] GetProcessHeap () returned 0x630000 [0059.716] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0059.716] GetProcessHeap () returned 0x630000 [0059.716] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.716] GetProcessHeap () returned 0x630000 [0059.716] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x6618a8 [0059.717] GetProcessHeap () returned 0x630000 [0059.717] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.717] GetProcessHeap () returned 0x630000 [0059.717] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.717] GetProcessHeap () returned 0x630000 [0059.717] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.717] GetProcessHeap () returned 0x630000 [0059.717] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.717] GetProcessHeap () returned 0x630000 [0059.717] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e610 [0059.717] GetProcessHeap () returned 0x630000 [0059.717] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6618a8 | out: hHeap=0x630000) returned 1 [0059.717] GetProcessHeap () returned 0x630000 [0059.717] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0059.717] GetProcessHeap () returned 0x630000 [0059.717] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0059.717] GetProcessHeap () returned 0x630000 [0059.717] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.717] GetProcessHeap () returned 0x630000 [0059.717] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.717] GetProcessHeap () returned 0x630000 [0059.717] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.717] GetProcessHeap () returned 0x630000 [0059.717] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.717] GetProcessHeap () returned 0x630000 [0059.717] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.717] GetProcessHeap () returned 0x630000 [0059.717] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.717] GetProcessHeap () returned 0x630000 [0059.717] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.717] GetProcessHeap () returned 0x630000 [0059.717] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.717] GetProcessHeap () returned 0x630000 [0059.717] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.717] GetProcessHeap () returned 0x630000 [0059.717] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.717] GetProcessHeap () returned 0x630000 [0059.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.718] GetProcessHeap () returned 0x630000 [0059.718] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.718] GetProcessHeap () returned 0x630000 [0059.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.718] GetProcessHeap () returned 0x630000 [0059.718] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.718] GetProcessHeap () returned 0x630000 [0059.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.718] GetProcessHeap () returned 0x630000 [0059.718] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.718] GetProcessHeap () returned 0x630000 [0059.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.718] GetProcessHeap () returned 0x630000 [0059.718] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.718] GetProcessHeap () returned 0x630000 [0059.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.718] GetProcessHeap () returned 0x630000 [0059.718] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.718] GetProcessHeap () returned 0x630000 [0059.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.718] GetProcessHeap () returned 0x630000 [0059.718] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.718] GetProcessHeap () returned 0x630000 [0059.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.718] GetProcessHeap () returned 0x630000 [0059.718] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.718] GetProcessHeap () returned 0x630000 [0059.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.718] GetProcessHeap () returned 0x630000 [0059.718] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.718] GetProcessHeap () returned 0x630000 [0059.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.718] GetProcessHeap () returned 0x630000 [0059.718] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.719] GetProcessHeap () returned 0x630000 [0059.719] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.719] GetProcessHeap () returned 0x630000 [0059.719] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.727] GetProcessHeap () returned 0x630000 [0059.727] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.727] GetProcessHeap () returned 0x630000 [0059.727] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.727] GetProcessHeap () returned 0x630000 [0059.727] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.728] GetProcessHeap () returned 0x630000 [0059.728] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.728] GetProcessHeap () returned 0x630000 [0059.728] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.728] GetProcessHeap () returned 0x630000 [0059.728] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.728] GetProcessHeap () returned 0x630000 [0059.728] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.728] GetProcessHeap () returned 0x630000 [0059.728] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.728] GetProcessHeap () returned 0x630000 [0059.728] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.728] GetProcessHeap () returned 0x630000 [0059.728] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.728] GetProcessHeap () returned 0x630000 [0059.728] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.728] GetProcessHeap () returned 0x630000 [0059.728] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.728] GetProcessHeap () returned 0x630000 [0059.728] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.728] GetProcessHeap () returned 0x630000 [0059.728] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.728] GetProcessHeap () returned 0x630000 [0059.728] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.728] GetProcessHeap () returned 0x630000 [0059.728] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.728] GetProcessHeap () returned 0x630000 [0059.728] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.728] GetProcessHeap () returned 0x630000 [0059.728] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.728] GetProcessHeap () returned 0x630000 [0059.728] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.728] GetProcessHeap () returned 0x630000 [0059.728] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.728] GetProcessHeap () returned 0x630000 [0059.728] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.729] GetProcessHeap () returned 0x630000 [0059.729] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.729] GetProcessHeap () returned 0x630000 [0059.729] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.729] GetProcessHeap () returned 0x630000 [0059.729] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.729] GetProcessHeap () returned 0x630000 [0059.729] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.729] GetProcessHeap () returned 0x630000 [0059.729] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.729] GetProcessHeap () returned 0x630000 [0059.729] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.729] GetProcessHeap () returned 0x630000 [0059.729] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.729] GetProcessHeap () returned 0x630000 [0059.729] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.729] GetProcessHeap () returned 0x630000 [0059.729] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.729] GetProcessHeap () returned 0x630000 [0059.729] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.729] GetProcessHeap () returned 0x630000 [0059.729] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.729] GetProcessHeap () returned 0x630000 [0059.729] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.729] GetProcessHeap () returned 0x630000 [0059.729] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.729] GetProcessHeap () returned 0x630000 [0059.729] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.729] GetProcessHeap () returned 0x630000 [0059.729] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.729] GetProcessHeap () returned 0x630000 [0059.729] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.729] GetProcessHeap () returned 0x630000 [0059.729] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.729] GetProcessHeap () returned 0x630000 [0059.729] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.729] GetProcessHeap () returned 0x630000 [0059.729] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.730] GetProcessHeap () returned 0x630000 [0059.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.730] GetProcessHeap () returned 0x630000 [0059.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.730] GetProcessHeap () returned 0x630000 [0059.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.730] GetProcessHeap () returned 0x630000 [0059.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.730] GetProcessHeap () returned 0x630000 [0059.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.730] GetProcessHeap () returned 0x630000 [0059.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.730] GetProcessHeap () returned 0x630000 [0059.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.730] GetProcessHeap () returned 0x630000 [0059.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.730] GetProcessHeap () returned 0x630000 [0059.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.730] GetProcessHeap () returned 0x630000 [0059.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.730] GetProcessHeap () returned 0x630000 [0059.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.730] GetProcessHeap () returned 0x630000 [0059.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.730] GetProcessHeap () returned 0x630000 [0059.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0059.730] GetProcessHeap () returned 0x630000 [0059.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0059.730] GetProcessHeap () returned 0x630000 [0059.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0059.730] GetProcessHeap () returned 0x630000 [0059.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0059.730] GetProcessHeap () returned 0x630000 [0059.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0059.730] GetProcessHeap () returned 0x630000 [0059.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e6a0 | out: hHeap=0x630000) returned 1 [0059.731] GetProcessHeap () returned 0x630000 [0059.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0059.731] GetProcessHeap () returned 0x630000 [0059.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0059.731] GetProcessHeap () returned 0x630000 [0059.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0059.731] GetProcessHeap () returned 0x630000 [0059.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.731] GetProcessHeap () returned 0x630000 [0059.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0059.731] WriteFile (in: hFile=0x230, lpBuffer=0x661a98*, nNumberOfBytesToWrite=0x38b, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661a98*, lpNumberOfBytesWritten=0x243d864*=0x38b, lpOverlapped=0x0) returned 1 [0059.733] GetProcessHeap () returned 0x630000 [0059.733] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x661a98, Size=0x30) returned 0x661a98 [0059.733] GetProcessHeap () returned 0x630000 [0059.733] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0059.733] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.733] GetProcessHeap () returned 0x630000 [0059.733] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1980) returned 0x661ad0 [0059.733] ReadFile (in: hFile=0x230, lpBuffer=0x661ad0, nNumberOfBytesToRead=0x1980, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661ad0*, lpNumberOfBytesRead=0x243d7e8*=0x1980, lpOverlapped=0x0) returned 1 [0059.733] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.733] WriteFile (in: hFile=0x230, lpBuffer=0x661ad0*, nNumberOfBytesToWrite=0x1980, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661ad0*, lpNumberOfBytesWritten=0x243d7e4*=0x1980, lpOverlapped=0x0) returned 1 [0059.734] GetProcessHeap () returned 0x630000 [0059.734] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661ad0 | out: hHeap=0x630000) returned 1 [0059.734] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.734] WriteFile (in: hFile=0x230, lpBuffer=0x661a98*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661a98*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0059.735] CloseHandle (hObject=0x230) returned 1 [0059.737] GetProcessHeap () returned 0x630000 [0059.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0059.737] GetProcessHeap () returned 0x630000 [0059.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655aa8 | out: hHeap=0x630000) returned 1 [0059.737] GetProcessHeap () returned 0x630000 [0059.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0059.737] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\-dlFOBhT.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\-dlFOBhT.png") returned="C:\\Users\\FD1HVy\\Pictures\\-dlFOBhT.png" [0059.737] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\-dlFOBhT.png", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\-dlFOBhT.png.happythreechoose") returned="C:\\Users\\FD1HVy\\Pictures\\-dlFOBhT.png.happythreechoose" [0059.737] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\-dlFOBhT.png" (normalized: "c:\\users\\fd1hvy\\pictures\\-dlfobht.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\-dlFOBhT.png.happythreechoose" (normalized: "c:\\users\\fd1hvy\\pictures\\-dlfobht.png.happythreechoose"), dwFlags=0x1) returned 1 [0059.737] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\-dlFOBhT.png" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0059.737] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0059.738] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" [0059.738] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\pictures\\decryption info.html")) returned 0x20 [0059.738] GetProcessHeap () returned 0x630000 [0059.738] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0059.738] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39601dc0, ftCreationTime.dwHighDateTime=0x1d5d509, ftLastAccessTime.dwLowDateTime=0x666cb0a0, ftLastAccessTime.dwHighDateTime=0x1d5ced6, ftLastWriteTime.dwLowDateTime=0x666cb0a0, ftLastWriteTime.dwHighDateTime=0x1d5ced6, nFileSizeHigh=0x0, nFileSizeLow=0x9a66, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4Fd4V.bmp", cAlternateFileName="")) returned 1 [0059.738] lstrcmpiW (lpString1="4Fd4V.bmp", lpString2=".") returned 1 [0059.738] lstrcmpiW (lpString1="4Fd4V.bmp", lpString2="..") returned 1 [0059.738] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="4Fd4V.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\4Fd4V.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\4Fd4V.bmp" [0059.738] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4Fd4V.bmp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0059.738] GetProcessHeap () returned 0x630000 [0059.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x64c9f0 [0059.738] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4Fd4V.bmp", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4Fd4V.bmp", lpUsedDefaultChar=0x0) returned 10 [0059.738] lstrlenA (lpString="4Fd4V.bmp") returned 9 [0059.738] lstrlenA (lpString=".happythreechoose") returned 17 [0059.738] lstrcmpiW (lpString1="4Fd4V.bmp", lpString2="Decryption INFO.html") returned -1 [0059.738] lstrcmpiW (lpString1="4Fd4V.bmp", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned -1 [0059.738] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0059.738] lstrcmpiW (lpString1="4Fd4V.bmp", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0059.738] GetProcessHeap () returned 0x630000 [0059.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0059.738] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4Fd4V.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\4fd4v.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0059.738] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=39526) returned 1 [0059.738] GetProcessHeap () returned 0x630000 [0059.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6555f8 [0059.738] GetProcessHeap () returned 0x630000 [0059.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0059.739] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\4Fd4V.bmp") returned 34 [0059.739] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.739] GetProcessHeap () returned 0x630000 [0059.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0059.739] GetProcessHeap () returned 0x630000 [0059.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38a) returned 0x661ad0 [0059.739] lstrlenA (lpString="rsa_encrypt") returned 11 [0059.739] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0059.739] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0059.739] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0059.739] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0059.739] GetProcessHeap () returned 0x630000 [0059.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0059.739] lstrlenA (lpString="010001") returned 6 [0059.740] GetProcessHeap () returned 0x630000 [0059.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0059.740] GetProcessHeap () returned 0x630000 [0059.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.740] GetProcessHeap () returned 0x630000 [0059.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e4f0 [0059.740] GetProcessHeap () returned 0x630000 [0059.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.740] GetProcessHeap () returned 0x630000 [0059.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e580 [0059.740] GetProcessHeap () returned 0x630000 [0059.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656ec8 [0059.740] GetProcessHeap () returned 0x630000 [0059.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0059.740] GetProcessHeap () returned 0x630000 [0059.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0059.740] GetProcessHeap () returned 0x630000 [0059.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.740] GetProcessHeap () returned 0x630000 [0059.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0059.740] GetProcessHeap () returned 0x630000 [0059.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.740] GetProcessHeap () returned 0x630000 [0059.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x6570f8 [0059.740] GetProcessHeap () returned 0x630000 [0059.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0059.740] GetProcessHeap () returned 0x630000 [0059.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0059.740] GetProcessHeap () returned 0x630000 [0059.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65df50 [0059.740] GetProcessHeap () returned 0x630000 [0059.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.740] GetProcessHeap () returned 0x630000 [0059.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0059.740] GetProcessHeap () returned 0x630000 [0059.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0059.740] GetProcessHeap () returned 0x630000 [0059.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.741] GetProcessHeap () returned 0x630000 [0059.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x6615f0 [0059.741] GetProcessHeap () returned 0x630000 [0059.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.741] GetProcessHeap () returned 0x630000 [0059.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.741] GetProcessHeap () returned 0x630000 [0059.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0059.741] GetProcessHeap () returned 0x630000 [0059.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.741] GetProcessHeap () returned 0x630000 [0059.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ec40 [0059.741] GetProcessHeap () returned 0x630000 [0059.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6615f0 | out: hHeap=0x630000) returned 1 [0059.741] GetProcessHeap () returned 0x630000 [0059.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0059.741] GetProcessHeap () returned 0x630000 [0059.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ec40 | out: hHeap=0x630000) returned 1 [0059.741] GetProcessHeap () returned 0x630000 [0059.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0059.741] GetProcessHeap () returned 0x630000 [0059.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.741] GetProcessHeap () returned 0x630000 [0059.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0059.741] GetProcessHeap () returned 0x630000 [0059.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.741] GetProcessHeap () returned 0x630000 [0059.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0059.741] GetProcessHeap () returned 0x630000 [0059.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.741] GetProcessHeap () returned 0x630000 [0059.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0059.741] GetProcessHeap () returned 0x630000 [0059.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.741] GetProcessHeap () returned 0x630000 [0059.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0059.742] GetProcessHeap () returned 0x630000 [0059.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.742] GetProcessHeap () returned 0x630000 [0059.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0059.742] GetProcessHeap () returned 0x630000 [0059.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.742] GetProcessHeap () returned 0x630000 [0059.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0059.742] GetProcessHeap () returned 0x630000 [0059.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.742] GetProcessHeap () returned 0x630000 [0059.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0059.742] GetProcessHeap () returned 0x630000 [0059.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.742] GetProcessHeap () returned 0x630000 [0059.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0059.742] GetProcessHeap () returned 0x630000 [0059.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.742] GetProcessHeap () returned 0x630000 [0059.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0059.742] GetProcessHeap () returned 0x630000 [0059.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.742] GetProcessHeap () returned 0x630000 [0059.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0059.742] GetProcessHeap () returned 0x630000 [0059.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.742] GetProcessHeap () returned 0x630000 [0059.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0059.742] GetProcessHeap () returned 0x630000 [0059.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.742] GetProcessHeap () returned 0x630000 [0059.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0059.742] GetProcessHeap () returned 0x630000 [0059.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.742] GetProcessHeap () returned 0x630000 [0059.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0059.743] GetProcessHeap () returned 0x630000 [0059.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.743] GetProcessHeap () returned 0x630000 [0059.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0059.743] GetProcessHeap () returned 0x630000 [0059.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.743] GetProcessHeap () returned 0x630000 [0059.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.743] GetProcessHeap () returned 0x630000 [0059.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.743] GetProcessHeap () returned 0x630000 [0059.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0059.743] GetProcessHeap () returned 0x630000 [0059.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.743] GetProcessHeap () returned 0x630000 [0059.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0059.743] GetProcessHeap () returned 0x630000 [0059.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.743] GetProcessHeap () returned 0x630000 [0059.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.743] GetProcessHeap () returned 0x630000 [0059.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.743] GetProcessHeap () returned 0x630000 [0059.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0059.743] GetProcessHeap () returned 0x630000 [0059.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.743] GetProcessHeap () returned 0x630000 [0059.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0059.743] GetProcessHeap () returned 0x630000 [0059.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.743] GetProcessHeap () returned 0x630000 [0059.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0059.743] GetProcessHeap () returned 0x630000 [0059.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.743] GetProcessHeap () returned 0x630000 [0059.744] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0059.744] GetProcessHeap () returned 0x630000 [0059.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.744] GetProcessHeap () returned 0x630000 [0059.744] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0059.744] GetProcessHeap () returned 0x630000 [0059.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.744] GetProcessHeap () returned 0x630000 [0059.744] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0059.744] GetProcessHeap () returned 0x630000 [0059.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.744] GetProcessHeap () returned 0x630000 [0059.744] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0059.744] GetProcessHeap () returned 0x630000 [0059.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.744] GetProcessHeap () returned 0x630000 [0059.744] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0059.744] GetProcessHeap () returned 0x630000 [0059.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.744] GetProcessHeap () returned 0x630000 [0059.744] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0059.744] GetProcessHeap () returned 0x630000 [0059.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.744] GetProcessHeap () returned 0x630000 [0059.744] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0059.744] GetProcessHeap () returned 0x630000 [0059.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.744] GetProcessHeap () returned 0x630000 [0059.744] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0059.744] GetProcessHeap () returned 0x630000 [0059.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.744] GetProcessHeap () returned 0x630000 [0059.744] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0059.744] GetProcessHeap () returned 0x630000 [0059.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.744] GetProcessHeap () returned 0x630000 [0059.744] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0059.745] GetProcessHeap () returned 0x630000 [0059.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.745] GetProcessHeap () returned 0x630000 [0059.745] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0059.745] GetProcessHeap () returned 0x630000 [0059.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.745] GetProcessHeap () returned 0x630000 [0059.745] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0059.745] GetProcessHeap () returned 0x630000 [0059.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.745] GetProcessHeap () returned 0x630000 [0059.745] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0059.745] GetProcessHeap () returned 0x630000 [0059.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.745] GetProcessHeap () returned 0x630000 [0059.745] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0059.745] GetProcessHeap () returned 0x630000 [0059.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.745] GetProcessHeap () returned 0x630000 [0059.745] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0059.745] GetProcessHeap () returned 0x630000 [0059.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.745] GetProcessHeap () returned 0x630000 [0059.745] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0059.745] GetProcessHeap () returned 0x630000 [0059.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.745] GetProcessHeap () returned 0x630000 [0059.745] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0059.745] GetProcessHeap () returned 0x630000 [0059.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.745] GetProcessHeap () returned 0x630000 [0059.745] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0059.745] GetProcessHeap () returned 0x630000 [0059.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.745] GetProcessHeap () returned 0x630000 [0059.745] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0059.745] GetProcessHeap () returned 0x630000 [0059.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.746] GetProcessHeap () returned 0x630000 [0059.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0059.746] GetProcessHeap () returned 0x630000 [0059.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0059.746] GetProcessHeap () returned 0x630000 [0059.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0059.746] GetProcessHeap () returned 0x630000 [0059.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0059.746] GetProcessHeap () returned 0x630000 [0059.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0059.746] GetProcessHeap () returned 0x630000 [0059.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0059.746] GetProcessHeap () returned 0x630000 [0059.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0059.746] GetProcessHeap () returned 0x630000 [0059.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0059.746] GetProcessHeap () returned 0x630000 [0059.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0059.746] GetProcessHeap () returned 0x630000 [0059.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.746] GetProcessHeap () returned 0x630000 [0059.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0059.746] WriteFile (in: hFile=0x230, lpBuffer=0x661ad0*, nNumberOfBytesToWrite=0x38a, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661ad0*, lpNumberOfBytesWritten=0x243d864*=0x38a, lpOverlapped=0x0) returned 1 [0059.748] GetProcessHeap () returned 0x630000 [0059.748] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x661ad0, Size=0x30) returned 0x661ad0 [0059.748] GetProcessHeap () returned 0x630000 [0059.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0059.748] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.748] GetProcessHeap () returned 0x630000 [0059.748] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9a70) returned 0x661b08 [0059.748] ReadFile (in: hFile=0x230, lpBuffer=0x661b08, nNumberOfBytesToRead=0x9a70, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661b08*, lpNumberOfBytesRead=0x243d7e8*=0x9a70, lpOverlapped=0x0) returned 1 [0059.748] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.748] WriteFile (in: hFile=0x230, lpBuffer=0x661b08*, nNumberOfBytesToWrite=0x9a70, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661b08*, lpNumberOfBytesWritten=0x243d7e4*=0x9a70, lpOverlapped=0x0) returned 1 [0059.750] GetProcessHeap () returned 0x630000 [0059.750] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661b08 | out: hHeap=0x630000) returned 1 [0059.750] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.750] WriteFile (in: hFile=0x230, lpBuffer=0x661ad0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661ad0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0059.751] CloseHandle (hObject=0x230) returned 1 [0059.753] GetProcessHeap () returned 0x630000 [0059.753] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0059.753] GetProcessHeap () returned 0x630000 [0059.753] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6555f8 | out: hHeap=0x630000) returned 1 [0059.753] GetProcessHeap () returned 0x630000 [0059.753] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0059.753] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\4Fd4V.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\4Fd4V.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\4Fd4V.bmp" [0059.753] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\4Fd4V.bmp", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\4Fd4V.bmp.happythreechoose") returned="C:\\Users\\FD1HVy\\Pictures\\4Fd4V.bmp.happythreechoose" [0059.753] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\4Fd4V.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\4fd4v.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\4Fd4V.bmp.happythreechoose" (normalized: "c:\\users\\fd1hvy\\pictures\\4fd4v.bmp.happythreechoose"), dwFlags=0x1) returned 1 [0059.754] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\4Fd4V.bmp" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0059.754] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0059.754] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" [0059.754] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\pictures\\decryption info.html")) returned 0x20 [0059.754] GetProcessHeap () returned 0x630000 [0059.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0059.754] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb96c3370, ftCreationTime.dwHighDateTime=0x1d5d1a6, ftLastAccessTime.dwLowDateTime=0x68a7db40, ftLastAccessTime.dwHighDateTime=0x1d5d734, ftLastWriteTime.dwLowDateTime=0x68a7db40, ftLastWriteTime.dwHighDateTime=0x1d5d734, nFileSizeHigh=0x0, nFileSizeLow=0x23b4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="6a4Mw1x qK6sP.gif", cAlternateFileName="6A4MW1~1.GIF")) returned 1 [0059.754] lstrcmpiW (lpString1="6a4Mw1x qK6sP.gif", lpString2=".") returned 1 [0059.754] lstrcmpiW (lpString1="6a4Mw1x qK6sP.gif", lpString2="..") returned 1 [0059.754] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="6a4Mw1x qK6sP.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\6a4Mw1x qK6sP.gif") returned="C:\\Users\\FD1HVy\\Pictures\\6a4Mw1x qK6sP.gif" [0059.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="6a4Mw1x qK6sP.gif", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0059.754] GetProcessHeap () returned 0x630000 [0059.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x645e58 [0059.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="6a4Mw1x qK6sP.gif", cchWideChar=-1, lpMultiByteStr=0x645e58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6a4Mw1x qK6sP.gif", lpUsedDefaultChar=0x0) returned 18 [0059.755] lstrlenA (lpString="6a4Mw1x qK6sP.gif") returned 17 [0059.755] lstrlenA (lpString=".happythreechoose") returned 17 [0059.755] lstrlenA (lpString=".happythreechoose") returned 17 [0059.755] lstrlenA (lpString="6a4Mw1x qK6sP.gif") returned 17 [0059.755] lstrcmpiA (lpString1="6a4Mw1x qK6sP.gif", lpString2=".happythreechoose") returned 1 [0059.755] lstrcmpiW (lpString1="6a4Mw1x qK6sP.gif", lpString2="Decryption INFO.html") returned -1 [0059.755] lstrcmpiW (lpString1="6a4Mw1x qK6sP.gif", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0059.755] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0059.755] lstrcmpiW (lpString1="6a4Mw1x qK6sP.gif", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0059.755] GetProcessHeap () returned 0x630000 [0059.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0059.755] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\6a4Mw1x qK6sP.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\6a4mw1x qk6sp.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0059.755] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=9140) returned 1 [0059.755] GetProcessHeap () returned 0x630000 [0059.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6556e8 [0059.755] GetProcessHeap () returned 0x630000 [0059.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0059.755] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\6a4Mw1x qK6sP.gif") returned 42 [0059.755] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.755] GetProcessHeap () returned 0x630000 [0059.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0059.755] GetProcessHeap () returned 0x630000 [0059.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x661b08 [0059.755] lstrlenA (lpString="rsa_encrypt") returned 11 [0059.755] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0059.756] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0059.756] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0059.756] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0059.756] GetProcessHeap () returned 0x630000 [0059.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0059.756] lstrlenA (lpString="010001") returned 6 [0059.756] GetProcessHeap () returned 0x630000 [0059.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0059.756] GetProcessHeap () returned 0x630000 [0059.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.756] GetProcessHeap () returned 0x630000 [0059.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e340 [0059.756] GetProcessHeap () returned 0x630000 [0059.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.756] GetProcessHeap () returned 0x630000 [0059.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65eb20 [0059.756] GetProcessHeap () returned 0x630000 [0059.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657328 [0059.756] GetProcessHeap () returned 0x630000 [0059.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0059.757] GetProcessHeap () returned 0x630000 [0059.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0059.757] GetProcessHeap () returned 0x630000 [0059.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.757] GetProcessHeap () returned 0x630000 [0059.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0059.757] GetProcessHeap () returned 0x630000 [0059.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.757] GetProcessHeap () returned 0x630000 [0059.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656db0 [0059.757] GetProcessHeap () returned 0x630000 [0059.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.757] GetProcessHeap () returned 0x630000 [0059.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0059.757] GetProcessHeap () returned 0x630000 [0059.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ebb0 [0059.757] GetProcessHeap () returned 0x630000 [0059.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.757] GetProcessHeap () returned 0x630000 [0059.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0059.757] GetProcessHeap () returned 0x630000 [0059.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0059.757] GetProcessHeap () returned 0x630000 [0059.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.757] GetProcessHeap () returned 0x630000 [0059.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0059.757] GetProcessHeap () returned 0x630000 [0059.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.757] GetProcessHeap () returned 0x630000 [0059.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.757] GetProcessHeap () returned 0x630000 [0059.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.757] GetProcessHeap () returned 0x630000 [0059.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.757] GetProcessHeap () returned 0x630000 [0059.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e3d0 [0059.757] GetProcessHeap () returned 0x630000 [0059.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0059.757] GetProcessHeap () returned 0x630000 [0059.758] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0059.758] GetProcessHeap () returned 0x630000 [0059.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0059.758] GetProcessHeap () returned 0x630000 [0059.758] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.758] GetProcessHeap () returned 0x630000 [0059.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.758] GetProcessHeap () returned 0x630000 [0059.758] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.758] GetProcessHeap () returned 0x630000 [0059.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.758] GetProcessHeap () returned 0x630000 [0059.758] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.758] GetProcessHeap () returned 0x630000 [0059.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.758] GetProcessHeap () returned 0x630000 [0059.758] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.758] GetProcessHeap () returned 0x630000 [0059.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.758] GetProcessHeap () returned 0x630000 [0059.758] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.758] GetProcessHeap () returned 0x630000 [0059.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.758] GetProcessHeap () returned 0x630000 [0059.758] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.758] GetProcessHeap () returned 0x630000 [0059.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.758] GetProcessHeap () returned 0x630000 [0059.758] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.758] GetProcessHeap () returned 0x630000 [0059.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.758] GetProcessHeap () returned 0x630000 [0059.758] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.758] GetProcessHeap () returned 0x630000 [0059.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.759] GetProcessHeap () returned 0x630000 [0059.759] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.759] GetProcessHeap () returned 0x630000 [0059.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.759] GetProcessHeap () returned 0x630000 [0059.759] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.759] GetProcessHeap () returned 0x630000 [0059.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.759] GetProcessHeap () returned 0x630000 [0059.759] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.759] GetProcessHeap () returned 0x630000 [0059.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.759] GetProcessHeap () returned 0x630000 [0059.759] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.759] GetProcessHeap () returned 0x630000 [0059.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.759] GetProcessHeap () returned 0x630000 [0059.759] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.759] GetProcessHeap () returned 0x630000 [0059.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.759] GetProcessHeap () returned 0x630000 [0059.759] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.759] GetProcessHeap () returned 0x630000 [0059.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.759] GetProcessHeap () returned 0x630000 [0059.759] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.759] GetProcessHeap () returned 0x630000 [0059.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.759] GetProcessHeap () returned 0x630000 [0059.759] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.759] GetProcessHeap () returned 0x630000 [0059.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.759] GetProcessHeap () returned 0x630000 [0059.759] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.759] GetProcessHeap () returned 0x630000 [0059.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.760] GetProcessHeap () returned 0x630000 [0059.760] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.760] GetProcessHeap () returned 0x630000 [0059.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.760] GetProcessHeap () returned 0x630000 [0059.760] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.760] GetProcessHeap () returned 0x630000 [0059.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.760] GetProcessHeap () returned 0x630000 [0059.760] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.760] GetProcessHeap () returned 0x630000 [0059.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.760] GetProcessHeap () returned 0x630000 [0059.760] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.760] GetProcessHeap () returned 0x630000 [0059.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.760] GetProcessHeap () returned 0x630000 [0059.760] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.760] GetProcessHeap () returned 0x630000 [0059.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.760] GetProcessHeap () returned 0x630000 [0059.760] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.760] GetProcessHeap () returned 0x630000 [0059.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.760] GetProcessHeap () returned 0x630000 [0059.760] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.760] GetProcessHeap () returned 0x630000 [0059.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.760] GetProcessHeap () returned 0x630000 [0059.760] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.760] GetProcessHeap () returned 0x630000 [0059.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.760] GetProcessHeap () returned 0x630000 [0059.760] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.760] GetProcessHeap () returned 0x630000 [0059.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.761] GetProcessHeap () returned 0x630000 [0059.761] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.761] GetProcessHeap () returned 0x630000 [0059.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.761] GetProcessHeap () returned 0x630000 [0059.761] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.761] GetProcessHeap () returned 0x630000 [0059.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.761] GetProcessHeap () returned 0x630000 [0059.761] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.761] GetProcessHeap () returned 0x630000 [0059.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.761] GetProcessHeap () returned 0x630000 [0059.761] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.761] GetProcessHeap () returned 0x630000 [0059.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.761] GetProcessHeap () returned 0x630000 [0059.761] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.761] GetProcessHeap () returned 0x630000 [0059.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.761] GetProcessHeap () returned 0x630000 [0059.761] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.761] GetProcessHeap () returned 0x630000 [0059.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.761] GetProcessHeap () returned 0x630000 [0059.761] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.761] GetProcessHeap () returned 0x630000 [0059.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.761] GetProcessHeap () returned 0x630000 [0059.761] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.761] GetProcessHeap () returned 0x630000 [0059.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.761] GetProcessHeap () returned 0x630000 [0059.761] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.761] GetProcessHeap () returned 0x630000 [0059.762] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.762] GetProcessHeap () returned 0x630000 [0059.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.762] GetProcessHeap () returned 0x630000 [0059.762] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.762] GetProcessHeap () returned 0x630000 [0059.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.762] GetProcessHeap () returned 0x630000 [0059.762] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.762] GetProcessHeap () returned 0x630000 [0059.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.762] GetProcessHeap () returned 0x630000 [0059.762] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.762] GetProcessHeap () returned 0x630000 [0059.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.762] GetProcessHeap () returned 0x630000 [0059.762] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.762] GetProcessHeap () returned 0x630000 [0059.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.762] GetProcessHeap () returned 0x630000 [0059.762] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.762] GetProcessHeap () returned 0x630000 [0059.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.762] GetProcessHeap () returned 0x630000 [0059.762] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.762] GetProcessHeap () returned 0x630000 [0059.762] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0059.762] GetProcessHeap () returned 0x630000 [0059.762] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0059.762] GetProcessHeap () returned 0x630000 [0059.762] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0059.762] GetProcessHeap () returned 0x630000 [0059.762] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0059.762] GetProcessHeap () returned 0x630000 [0059.762] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0059.763] GetProcessHeap () returned 0x630000 [0059.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0059.763] GetProcessHeap () returned 0x630000 [0059.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0059.763] GetProcessHeap () returned 0x630000 [0059.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0059.763] GetProcessHeap () returned 0x630000 [0059.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0059.763] GetProcessHeap () returned 0x630000 [0059.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.763] GetProcessHeap () returned 0x630000 [0059.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0059.763] WriteFile (in: hFile=0x230, lpBuffer=0x661b08*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661b08*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0059.764] GetProcessHeap () returned 0x630000 [0059.764] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x661b08, Size=0x30) returned 0x661b08 [0059.764] GetProcessHeap () returned 0x630000 [0059.764] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0059.765] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.765] GetProcessHeap () returned 0x630000 [0059.765] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x23b4) returned 0x661b40 [0059.765] ReadFile (in: hFile=0x230, lpBuffer=0x661b40, nNumberOfBytesToRead=0x23b4, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661b40*, lpNumberOfBytesRead=0x243d7e8*=0x23b4, lpOverlapped=0x0) returned 1 [0059.765] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.765] WriteFile (in: hFile=0x230, lpBuffer=0x661b40*, nNumberOfBytesToWrite=0x23b4, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661b40*, lpNumberOfBytesWritten=0x243d7e4*=0x23b4, lpOverlapped=0x0) returned 1 [0059.766] GetProcessHeap () returned 0x630000 [0059.766] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661b40 | out: hHeap=0x630000) returned 1 [0059.766] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.766] WriteFile (in: hFile=0x230, lpBuffer=0x661b08*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661b08*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0059.767] CloseHandle (hObject=0x230) returned 1 [0059.768] GetProcessHeap () returned 0x630000 [0059.768] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0059.768] GetProcessHeap () returned 0x630000 [0059.768] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6556e8 | out: hHeap=0x630000) returned 1 [0059.768] GetProcessHeap () returned 0x630000 [0059.768] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0059.769] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\6a4Mw1x qK6sP.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\6a4Mw1x qK6sP.gif") returned="C:\\Users\\FD1HVy\\Pictures\\6a4Mw1x qK6sP.gif" [0059.769] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\6a4Mw1x qK6sP.gif", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\6a4Mw1x qK6sP.gif.happythreechoose") returned="C:\\Users\\FD1HVy\\Pictures\\6a4Mw1x qK6sP.gif.happythreechoose" [0059.769] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\6a4Mw1x qK6sP.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\6a4mw1x qk6sp.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\6a4Mw1x qK6sP.gif.happythreechoose" (normalized: "c:\\users\\fd1hvy\\pictures\\6a4mw1x qk6sp.gif.happythreechoose"), dwFlags=0x1) returned 1 [0059.769] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\6a4Mw1x qK6sP.gif" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0059.769] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0059.769] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" [0059.769] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\pictures\\decryption info.html")) returned 0x20 [0059.769] GetProcessHeap () returned 0x630000 [0059.769] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645e58 | out: hHeap=0x630000) returned 1 [0059.769] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93f461a0, ftCreationTime.dwHighDateTime=0x1d5ccae, ftLastAccessTime.dwLowDateTime=0x6ed8e620, ftLastAccessTime.dwHighDateTime=0x1d5d4e7, ftLastWriteTime.dwLowDateTime=0x6ed8e620, ftLastWriteTime.dwHighDateTime=0x1d5d4e7, nFileSizeHigh=0x0, nFileSizeLow=0x1773b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BbIsK7S2s3miGzaMngA.png", cAlternateFileName="BBISK7~1.PNG")) returned 1 [0059.769] lstrcmpiW (lpString1="BbIsK7S2s3miGzaMngA.png", lpString2=".") returned 1 [0059.769] lstrcmpiW (lpString1="BbIsK7S2s3miGzaMngA.png", lpString2="..") returned 1 [0059.769] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="BbIsK7S2s3miGzaMngA.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\BbIsK7S2s3miGzaMngA.png") returned="C:\\Users\\FD1HVy\\Pictures\\BbIsK7S2s3miGzaMngA.png" [0059.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BbIsK7S2s3miGzaMngA.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0059.770] GetProcessHeap () returned 0x630000 [0059.770] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18) returned 0x645e78 [0059.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BbIsK7S2s3miGzaMngA.png", cchWideChar=-1, lpMultiByteStr=0x645e78, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BbIsK7S2s3miGzaMngA.png", lpUsedDefaultChar=0x0) returned 24 [0059.770] lstrlenA (lpString="BbIsK7S2s3miGzaMngA.png") returned 23 [0059.770] lstrlenA (lpString=".happythreechoose") returned 17 [0059.770] lstrlenA (lpString=".happythreechoose") returned 17 [0059.770] lstrlenA (lpString="BbIsK7S2s3miGzaMngA.png") returned 23 [0059.770] lstrcmpiA (lpString1="S2s3miGzaMngA.png", lpString2=".happythreechoose") returned 1 [0059.770] lstrcmpiW (lpString1="BbIsK7S2s3miGzaMngA.png", lpString2="Decryption INFO.html") returned -1 [0059.770] lstrcmpiW (lpString1="BbIsK7S2s3miGzaMngA.png", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0059.770] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0059.770] lstrcmpiW (lpString1="BbIsK7S2s3miGzaMngA.png", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0059.770] GetProcessHeap () returned 0x630000 [0059.770] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0059.770] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\BbIsK7S2s3miGzaMngA.png" (normalized: "c:\\users\\fd1hvy\\pictures\\bbisk7s2s3migzamnga.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0059.770] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=96059) returned 1 [0059.770] GetProcessHeap () returned 0x630000 [0059.770] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655418 [0059.770] GetProcessHeap () returned 0x630000 [0059.770] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0059.770] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\BbIsK7S2s3miGzaMngA.png") returned 48 [0059.770] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.770] GetProcessHeap () returned 0x630000 [0059.770] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0059.770] GetProcessHeap () returned 0x630000 [0059.770] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x661b40 [0059.770] lstrlenA (lpString="rsa_encrypt") returned 11 [0059.771] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0059.771] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0059.771] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0059.771] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0059.771] GetProcessHeap () returned 0x630000 [0059.771] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0059.771] lstrlenA (lpString="010001") returned 6 [0059.771] GetProcessHeap () returned 0x630000 [0059.771] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0059.771] GetProcessHeap () returned 0x630000 [0059.771] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.771] GetProcessHeap () returned 0x630000 [0059.771] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e730 [0059.771] GetProcessHeap () returned 0x630000 [0059.771] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.771] GetProcessHeap () returned 0x630000 [0059.771] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dec0 [0059.772] GetProcessHeap () returned 0x630000 [0059.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657328 [0059.772] GetProcessHeap () returned 0x630000 [0059.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0059.772] GetProcessHeap () returned 0x630000 [0059.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0059.772] GetProcessHeap () returned 0x630000 [0059.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.772] GetProcessHeap () returned 0x630000 [0059.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0059.772] GetProcessHeap () returned 0x630000 [0059.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.772] GetProcessHeap () returned 0x630000 [0059.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657440 [0059.772] GetProcessHeap () returned 0x630000 [0059.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.772] GetProcessHeap () returned 0x630000 [0059.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0059.772] GetProcessHeap () returned 0x630000 [0059.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ebb0 [0059.772] GetProcessHeap () returned 0x630000 [0059.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.772] GetProcessHeap () returned 0x630000 [0059.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0059.772] GetProcessHeap () returned 0x630000 [0059.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0059.772] GetProcessHeap () returned 0x630000 [0059.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.772] GetProcessHeap () returned 0x630000 [0059.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0059.772] GetProcessHeap () returned 0x630000 [0059.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.772] GetProcessHeap () returned 0x630000 [0059.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.772] GetProcessHeap () returned 0x630000 [0059.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.772] GetProcessHeap () returned 0x630000 [0059.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.772] GetProcessHeap () returned 0x630000 [0059.773] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ecd0 [0059.773] GetProcessHeap () returned 0x630000 [0059.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0059.773] GetProcessHeap () returned 0x630000 [0059.773] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0059.773] GetProcessHeap () returned 0x630000 [0059.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ecd0 | out: hHeap=0x630000) returned 1 [0059.773] GetProcessHeap () returned 0x630000 [0059.773] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.773] GetProcessHeap () returned 0x630000 [0059.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.773] GetProcessHeap () returned 0x630000 [0059.773] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.773] GetProcessHeap () returned 0x630000 [0059.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.773] GetProcessHeap () returned 0x630000 [0059.773] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.773] GetProcessHeap () returned 0x630000 [0059.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.773] GetProcessHeap () returned 0x630000 [0059.773] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.773] GetProcessHeap () returned 0x630000 [0059.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.773] GetProcessHeap () returned 0x630000 [0059.773] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.773] GetProcessHeap () returned 0x630000 [0059.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.773] GetProcessHeap () returned 0x630000 [0059.773] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.773] GetProcessHeap () returned 0x630000 [0059.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.773] GetProcessHeap () returned 0x630000 [0059.773] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.773] GetProcessHeap () returned 0x630000 [0059.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.773] GetProcessHeap () returned 0x630000 [0059.773] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.774] GetProcessHeap () returned 0x630000 [0059.774] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.774] GetProcessHeap () returned 0x630000 [0059.774] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.774] GetProcessHeap () returned 0x630000 [0059.774] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.774] GetProcessHeap () returned 0x630000 [0059.774] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.774] GetProcessHeap () returned 0x630000 [0059.774] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.774] GetProcessHeap () returned 0x630000 [0059.774] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.774] GetProcessHeap () returned 0x630000 [0059.774] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.774] GetProcessHeap () returned 0x630000 [0059.774] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.774] GetProcessHeap () returned 0x630000 [0059.774] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.774] GetProcessHeap () returned 0x630000 [0059.774] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.774] GetProcessHeap () returned 0x630000 [0059.774] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.774] GetProcessHeap () returned 0x630000 [0059.774] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.774] GetProcessHeap () returned 0x630000 [0059.774] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.774] GetProcessHeap () returned 0x630000 [0059.774] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.774] GetProcessHeap () returned 0x630000 [0059.774] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.774] GetProcessHeap () returned 0x630000 [0059.774] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.774] GetProcessHeap () returned 0x630000 [0059.774] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.774] GetProcessHeap () returned 0x630000 [0059.775] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.775] GetProcessHeap () returned 0x630000 [0059.775] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.775] GetProcessHeap () returned 0x630000 [0059.775] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.775] GetProcessHeap () returned 0x630000 [0059.775] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.775] GetProcessHeap () returned 0x630000 [0059.775] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.775] GetProcessHeap () returned 0x630000 [0059.775] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.775] GetProcessHeap () returned 0x630000 [0059.775] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.775] GetProcessHeap () returned 0x630000 [0059.775] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.775] GetProcessHeap () returned 0x630000 [0059.775] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.775] GetProcessHeap () returned 0x630000 [0059.775] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.775] GetProcessHeap () returned 0x630000 [0059.775] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.775] GetProcessHeap () returned 0x630000 [0059.775] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.775] GetProcessHeap () returned 0x630000 [0059.775] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.775] GetProcessHeap () returned 0x630000 [0059.775] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.775] GetProcessHeap () returned 0x630000 [0059.775] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.775] GetProcessHeap () returned 0x630000 [0059.775] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.775] GetProcessHeap () returned 0x630000 [0059.775] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.775] GetProcessHeap () returned 0x630000 [0059.775] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.775] GetProcessHeap () returned 0x630000 [0059.775] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.776] GetProcessHeap () returned 0x630000 [0059.776] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.776] GetProcessHeap () returned 0x630000 [0059.776] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.776] GetProcessHeap () returned 0x630000 [0059.776] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.776] GetProcessHeap () returned 0x630000 [0059.776] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.776] GetProcessHeap () returned 0x630000 [0059.776] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.776] GetProcessHeap () returned 0x630000 [0059.776] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.776] GetProcessHeap () returned 0x630000 [0059.776] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.776] GetProcessHeap () returned 0x630000 [0059.776] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.776] GetProcessHeap () returned 0x630000 [0059.776] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.776] GetProcessHeap () returned 0x630000 [0059.776] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.776] GetProcessHeap () returned 0x630000 [0059.776] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.776] GetProcessHeap () returned 0x630000 [0059.776] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.776] GetProcessHeap () returned 0x630000 [0059.776] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.776] GetProcessHeap () returned 0x630000 [0059.776] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.776] GetProcessHeap () returned 0x630000 [0059.776] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.776] GetProcessHeap () returned 0x630000 [0059.776] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.776] GetProcessHeap () returned 0x630000 [0059.776] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.776] GetProcessHeap () returned 0x630000 [0059.776] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.777] GetProcessHeap () returned 0x630000 [0059.777] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.777] GetProcessHeap () returned 0x630000 [0059.777] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.777] GetProcessHeap () returned 0x630000 [0059.777] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.777] GetProcessHeap () returned 0x630000 [0059.777] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.777] GetProcessHeap () returned 0x630000 [0059.777] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.777] GetProcessHeap () returned 0x630000 [0059.777] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.777] GetProcessHeap () returned 0x630000 [0059.777] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.777] GetProcessHeap () returned 0x630000 [0059.777] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.777] GetProcessHeap () returned 0x630000 [0059.777] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.777] GetProcessHeap () returned 0x630000 [0059.777] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0059.777] GetProcessHeap () returned 0x630000 [0059.777] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0059.777] GetProcessHeap () returned 0x630000 [0059.777] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.777] GetProcessHeap () returned 0x630000 [0059.777] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.777] GetProcessHeap () returned 0x630000 [0059.777] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0059.777] GetProcessHeap () returned 0x630000 [0059.777] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0059.777] GetProcessHeap () returned 0x630000 [0059.777] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0059.777] GetProcessHeap () returned 0x630000 [0059.777] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0059.777] GetProcessHeap () returned 0x630000 [0059.777] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0059.778] GetProcessHeap () returned 0x630000 [0059.778] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0059.778] GetProcessHeap () returned 0x630000 [0059.778] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0059.778] GetProcessHeap () returned 0x630000 [0059.778] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0059.778] GetProcessHeap () returned 0x630000 [0059.778] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0059.778] GetProcessHeap () returned 0x630000 [0059.778] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.778] GetProcessHeap () returned 0x630000 [0059.778] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0059.778] WriteFile (in: hFile=0x230, lpBuffer=0x661b40*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661b40*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0059.780] GetProcessHeap () returned 0x630000 [0059.780] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x661b40, Size=0x30) returned 0x661b40 [0059.780] GetProcessHeap () returned 0x630000 [0059.780] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0059.780] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.780] GetProcessHeap () returned 0x630000 [0059.780] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1773b) returned 0x661b78 [0059.781] ReadFile (in: hFile=0x230, lpBuffer=0x661b78, nNumberOfBytesToRead=0x1773b, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661b78*, lpNumberOfBytesRead=0x243d7e8*=0x1773b, lpOverlapped=0x0) returned 1 [0059.782] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.782] WriteFile (in: hFile=0x230, lpBuffer=0x661b78*, nNumberOfBytesToWrite=0x1773b, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661b78*, lpNumberOfBytesWritten=0x243d7e4*=0x1773b, lpOverlapped=0x0) returned 1 [0059.784] GetProcessHeap () returned 0x630000 [0059.784] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661b78 | out: hHeap=0x630000) returned 1 [0059.784] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.784] WriteFile (in: hFile=0x230, lpBuffer=0x661b40*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661b40*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0059.785] CloseHandle (hObject=0x230) returned 1 [0059.788] GetProcessHeap () returned 0x630000 [0059.788] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0059.788] GetProcessHeap () returned 0x630000 [0059.788] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655418 | out: hHeap=0x630000) returned 1 [0059.788] GetProcessHeap () returned 0x630000 [0059.788] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0059.788] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\BbIsK7S2s3miGzaMngA.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\BbIsK7S2s3miGzaMngA.png") returned="C:\\Users\\FD1HVy\\Pictures\\BbIsK7S2s3miGzaMngA.png" [0059.788] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\BbIsK7S2s3miGzaMngA.png", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\BbIsK7S2s3miGzaMngA.png.happythreechoose") returned="C:\\Users\\FD1HVy\\Pictures\\BbIsK7S2s3miGzaMngA.png.happythreechoose" [0059.788] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\BbIsK7S2s3miGzaMngA.png" (normalized: "c:\\users\\fd1hvy\\pictures\\bbisk7s2s3migzamnga.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\BbIsK7S2s3miGzaMngA.png.happythreechoose" (normalized: "c:\\users\\fd1hvy\\pictures\\bbisk7s2s3migzamnga.png.happythreechoose"), dwFlags=0x1) returned 1 [0059.789] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\BbIsK7S2s3miGzaMngA.png" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0059.789] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0059.789] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" [0059.789] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\pictures\\decryption info.html")) returned 0x20 [0059.789] GetProcessHeap () returned 0x630000 [0059.789] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645e78 | out: hHeap=0x630000) returned 1 [0059.789] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Camera Roll", cAlternateFileName="CAMERA~1")) returned 1 [0059.789] lstrcmpiW (lpString1="Camera Roll", lpString2=".") returned 1 [0059.789] lstrcmpiW (lpString1="Camera Roll", lpString2="..") returned 1 [0059.789] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="Camera Roll" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Camera Roll") returned="C:\\Users\\FD1HVy\\Pictures\\Camera Roll" [0059.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Camera Roll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.789] GetProcessHeap () returned 0x630000 [0059.789] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0059.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Camera Roll", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Camera Roll", lpUsedDefaultChar=0x0) returned 12 [0059.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0059.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0059.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0059.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0059.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0059.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0059.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0059.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0059.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0059.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0059.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0059.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0059.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0059.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0059.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0059.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0059.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0059.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0059.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0059.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0059.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0059.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0059.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0059.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0059.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0059.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0059.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0059.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0059.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0059.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0059.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0059.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0059.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0059.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0059.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0059.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0059.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0059.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0059.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0059.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0059.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0059.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0059.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0059.790] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\") returned="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\" [0059.790] GetProcessHeap () returned 0x630000 [0059.790] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a3b8 [0059.790] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\") returned 37 [0059.790] GetProcessHeap () returned 0x630000 [0059.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4c) returned 0x65f068 [0059.791] lstrcpyW (in: lpString1=0x65f068, lpString2="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\") returned="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\" [0059.791] GetProcessHeap () returned 0x630000 [0059.791] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0059.791] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44053085, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44053085, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0059.791] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0059.791] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0059.791] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\desktop.ini") returned="C:\\Users\\FD1HVy\\Pictures\\desktop.ini" [0059.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0059.791] GetProcessHeap () returned 0x630000 [0059.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0059.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0059.791] lstrlenA (lpString="desktop.ini") returned 11 [0059.791] lstrlenA (lpString=".happythreechoose") returned 17 [0059.791] lstrcmpiW (lpString1="desktop.ini", lpString2="Decryption INFO.html") returned 1 [0059.791] lstrcmpiW (lpString1="desktop.ini", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0059.791] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0059.791] lstrcmpiW (lpString1="desktop.ini", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0059.791] GetProcessHeap () returned 0x630000 [0059.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0059.791] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0059.791] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=504) returned 1 [0059.791] GetProcessHeap () returned 0x630000 [0059.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6556e8 [0059.791] GetProcessHeap () returned 0x630000 [0059.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0059.791] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\desktop.ini") returned 36 [0059.791] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.791] GetProcessHeap () returned 0x630000 [0059.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0059.792] GetProcessHeap () returned 0x630000 [0059.792] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x388) returned 0x661b78 [0059.792] lstrlenA (lpString="rsa_encrypt") returned 11 [0059.792] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0059.792] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0059.792] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0059.792] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0059.792] GetProcessHeap () returned 0x630000 [0059.792] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0059.792] lstrlenA (lpString="010001") returned 6 [0059.792] GetProcessHeap () returned 0x630000 [0059.792] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0059.792] GetProcessHeap () returned 0x630000 [0059.792] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.792] GetProcessHeap () returned 0x630000 [0059.793] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e6a0 [0059.793] GetProcessHeap () returned 0x630000 [0059.793] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.793] GetProcessHeap () returned 0x630000 [0059.793] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0059.793] GetProcessHeap () returned 0x630000 [0059.793] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656a68 [0059.793] GetProcessHeap () returned 0x630000 [0059.793] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0059.793] GetProcessHeap () returned 0x630000 [0059.793] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0059.793] GetProcessHeap () returned 0x630000 [0059.793] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.793] GetProcessHeap () returned 0x630000 [0059.793] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0059.793] GetProcessHeap () returned 0x630000 [0059.793] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.793] GetProcessHeap () returned 0x630000 [0059.793] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657328 [0059.793] GetProcessHeap () returned 0x630000 [0059.793] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.793] GetProcessHeap () returned 0x630000 [0059.793] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0059.793] GetProcessHeap () returned 0x630000 [0059.793] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0059.793] GetProcessHeap () returned 0x630000 [0059.793] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.793] GetProcessHeap () returned 0x630000 [0059.793] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0059.793] GetProcessHeap () returned 0x630000 [0059.793] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0059.793] GetProcessHeap () returned 0x630000 [0059.793] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0059.793] GetProcessHeap () returned 0x630000 [0059.793] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x661680 [0059.793] GetProcessHeap () returned 0x630000 [0059.793] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.793] GetProcessHeap () returned 0x630000 [0059.793] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0059.794] GetProcessHeap () returned 0x630000 [0059.794] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0e8 [0059.794] GetProcessHeap () returned 0x630000 [0059.794] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0e8 | out: hHeap=0x630000) returned 1 [0059.794] GetProcessHeap () returned 0x630000 [0059.794] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e100 [0059.794] GetProcessHeap () returned 0x630000 [0059.794] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661680 | out: hHeap=0x630000) returned 1 [0059.794] GetProcessHeap () returned 0x630000 [0059.794] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0059.794] GetProcessHeap () returned 0x630000 [0059.794] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0059.794] GetProcessHeap () returned 0x630000 [0059.794] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0059.794] GetProcessHeap () returned 0x630000 [0059.794] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0059.794] GetProcessHeap () returned 0x630000 [0059.794] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0059.794] GetProcessHeap () returned 0x630000 [0059.794] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.794] GetProcessHeap () returned 0x630000 [0059.794] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0059.794] GetProcessHeap () returned 0x630000 [0059.794] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0059.794] GetProcessHeap () returned 0x630000 [0059.794] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a188 [0059.794] GetProcessHeap () returned 0x630000 [0059.794] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a188 | out: hHeap=0x630000) returned 1 [0059.794] GetProcessHeap () returned 0x630000 [0059.794] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0059.794] GetProcessHeap () returned 0x630000 [0059.794] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0059.794] GetProcessHeap () returned 0x630000 [0059.794] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0059.794] GetProcessHeap () returned 0x630000 [0059.794] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0059.795] GetProcessHeap () returned 0x630000 [0059.795] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0059.795] GetProcessHeap () returned 0x630000 [0059.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0059.795] GetProcessHeap () returned 0x630000 [0059.795] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0059.795] GetProcessHeap () returned 0x630000 [0059.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0059.795] GetProcessHeap () returned 0x630000 [0059.795] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a208 [0059.795] GetProcessHeap () returned 0x630000 [0059.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a208 | out: hHeap=0x630000) returned 1 [0059.795] GetProcessHeap () returned 0x630000 [0059.795] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.795] GetProcessHeap () returned 0x630000 [0059.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.795] GetProcessHeap () returned 0x630000 [0059.795] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0059.795] GetProcessHeap () returned 0x630000 [0059.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0059.795] GetProcessHeap () returned 0x630000 [0059.795] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0059.795] GetProcessHeap () returned 0x630000 [0059.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.795] GetProcessHeap () returned 0x630000 [0059.795] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a188 [0059.795] GetProcessHeap () returned 0x630000 [0059.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a188 | out: hHeap=0x630000) returned 1 [0059.795] GetProcessHeap () returned 0x630000 [0059.795] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0059.795] GetProcessHeap () returned 0x630000 [0059.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0059.795] GetProcessHeap () returned 0x630000 [0059.795] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0059.795] GetProcessHeap () returned 0x630000 [0059.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0059.796] GetProcessHeap () returned 0x630000 [0059.796] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0059.796] GetProcessHeap () returned 0x630000 [0059.796] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0059.796] GetProcessHeap () returned 0x630000 [0059.796] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a208 [0059.796] GetProcessHeap () returned 0x630000 [0059.796] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a208 | out: hHeap=0x630000) returned 1 [0059.796] GetProcessHeap () returned 0x630000 [0059.796] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0059.796] GetProcessHeap () returned 0x630000 [0059.796] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.796] GetProcessHeap () returned 0x630000 [0059.796] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0059.796] GetProcessHeap () returned 0x630000 [0059.796] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0059.796] GetProcessHeap () returned 0x630000 [0059.796] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.796] GetProcessHeap () returned 0x630000 [0059.796] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.796] GetProcessHeap () returned 0x630000 [0059.796] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0059.796] GetProcessHeap () returned 0x630000 [0059.796] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0059.796] GetProcessHeap () returned 0x630000 [0059.796] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0059.796] GetProcessHeap () returned 0x630000 [0059.796] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0059.796] GetProcessHeap () returned 0x630000 [0059.796] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0059.796] GetProcessHeap () returned 0x630000 [0059.796] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0059.796] GetProcessHeap () returned 0x630000 [0059.796] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.796] GetProcessHeap () returned 0x630000 [0059.797] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.797] GetProcessHeap () returned 0x630000 [0059.797] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0059.797] GetProcessHeap () returned 0x630000 [0059.797] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0059.797] GetProcessHeap () returned 0x630000 [0059.797] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0059.797] GetProcessHeap () returned 0x630000 [0059.797] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0059.797] GetProcessHeap () returned 0x630000 [0059.797] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0059.797] GetProcessHeap () returned 0x630000 [0059.797] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0059.797] GetProcessHeap () returned 0x630000 [0059.797] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a188 [0059.797] GetProcessHeap () returned 0x630000 [0059.797] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a188 | out: hHeap=0x630000) returned 1 [0059.797] GetProcessHeap () returned 0x630000 [0059.797] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.797] GetProcessHeap () returned 0x630000 [0059.797] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.797] GetProcessHeap () returned 0x630000 [0059.797] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0059.797] GetProcessHeap () returned 0x630000 [0059.797] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0059.797] GetProcessHeap () returned 0x630000 [0059.797] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0059.797] GetProcessHeap () returned 0x630000 [0059.797] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0059.797] GetProcessHeap () returned 0x630000 [0059.797] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0059.797] GetProcessHeap () returned 0x630000 [0059.797] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0059.797] GetProcessHeap () returned 0x630000 [0059.798] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0059.798] GetProcessHeap () returned 0x630000 [0059.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0059.798] GetProcessHeap () returned 0x630000 [0059.798] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0059.798] GetProcessHeap () returned 0x630000 [0059.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0059.798] GetProcessHeap () returned 0x630000 [0059.798] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.798] GetProcessHeap () returned 0x630000 [0059.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.798] GetProcessHeap () returned 0x630000 [0059.798] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.798] GetProcessHeap () returned 0x630000 [0059.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.798] GetProcessHeap () returned 0x630000 [0059.798] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0059.798] GetProcessHeap () returned 0x630000 [0059.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0059.798] GetProcessHeap () returned 0x630000 [0059.798] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0059.798] GetProcessHeap () returned 0x630000 [0059.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.798] GetProcessHeap () returned 0x630000 [0059.798] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0059.798] GetProcessHeap () returned 0x630000 [0059.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0059.798] GetProcessHeap () returned 0x630000 [0059.798] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0059.798] GetProcessHeap () returned 0x630000 [0059.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0059.798] GetProcessHeap () returned 0x630000 [0059.798] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0059.798] GetProcessHeap () returned 0x630000 [0059.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0059.798] GetProcessHeap () returned 0x630000 [0059.799] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0059.799] GetProcessHeap () returned 0x630000 [0059.799] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0059.799] GetProcessHeap () returned 0x630000 [0059.799] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0059.799] GetProcessHeap () returned 0x630000 [0059.799] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0059.799] GetProcessHeap () returned 0x630000 [0059.799] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0059.799] GetProcessHeap () returned 0x630000 [0059.799] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0059.799] GetProcessHeap () returned 0x630000 [0059.799] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0059.799] GetProcessHeap () returned 0x630000 [0059.799] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e6a0 | out: hHeap=0x630000) returned 1 [0059.799] GetProcessHeap () returned 0x630000 [0059.799] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0059.799] GetProcessHeap () returned 0x630000 [0059.799] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.799] GetProcessHeap () returned 0x630000 [0059.799] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0059.799] WriteFile (in: hFile=0x230, lpBuffer=0x661b78*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661b78*, lpNumberOfBytesWritten=0x243d864*=0x388, lpOverlapped=0x0) returned 1 [0059.802] GetProcessHeap () returned 0x630000 [0059.802] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x661b78, Size=0x30) returned 0x661b78 [0059.802] GetProcessHeap () returned 0x630000 [0059.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0059.802] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.802] GetProcessHeap () returned 0x630000 [0059.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0059.802] ReadFile (in: hFile=0x230, lpBuffer=0x64cc78, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x64cc78*, lpNumberOfBytesRead=0x243d7e8*=0x200, lpOverlapped=0x0) returned 1 [0059.802] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.802] WriteFile (in: hFile=0x230, lpBuffer=0x64cc78*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x64cc78*, lpNumberOfBytesWritten=0x243d7e4*=0x200, lpOverlapped=0x0) returned 1 [0059.803] GetProcessHeap () returned 0x630000 [0059.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0059.803] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.803] WriteFile (in: hFile=0x230, lpBuffer=0x661b78*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661b78*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0059.804] CloseHandle (hObject=0x230) returned 1 [0059.805] GetProcessHeap () returned 0x630000 [0059.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0059.805] GetProcessHeap () returned 0x630000 [0059.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6556e8 | out: hHeap=0x630000) returned 1 [0059.805] GetProcessHeap () returned 0x630000 [0059.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0059.805] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\desktop.ini") returned="C:\\Users\\FD1HVy\\Pictures\\desktop.ini" [0059.805] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\desktop.ini", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\desktop.ini.happythreechoose") returned="C:\\Users\\FD1HVy\\Pictures\\desktop.ini.happythreechoose" [0059.805] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\desktop.ini.happythreechoose" (normalized: "c:\\users\\fd1hvy\\pictures\\desktop.ini.happythreechoose"), dwFlags=0x1) returned 1 [0059.806] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0059.806] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0059.806] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" [0059.806] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\pictures\\decryption info.html")) returned 0x20 [0059.806] GetProcessHeap () returned 0x630000 [0059.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0059.806] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16d58e80, ftCreationTime.dwHighDateTime=0x1d5cbf8, ftLastAccessTime.dwLowDateTime=0x587246d0, ftLastAccessTime.dwHighDateTime=0x1d5c9dc, ftLastWriteTime.dwLowDateTime=0x587246d0, ftLastWriteTime.dwHighDateTime=0x1d5c9dc, nFileSizeHigh=0x0, nFileSizeLow=0x10e7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dQXUa DLCVau.jpg", cAlternateFileName="DQXUAD~1.JPG")) returned 1 [0059.806] lstrcmpiW (lpString1="dQXUa DLCVau.jpg", lpString2=".") returned 1 [0059.806] lstrcmpiW (lpString1="dQXUa DLCVau.jpg", lpString2="..") returned 1 [0059.806] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="dQXUa DLCVau.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\dQXUa DLCVau.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\dQXUa DLCVau.jpg" [0059.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dQXUa DLCVau.jpg", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0059.806] GetProcessHeap () returned 0x630000 [0059.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11) returned 0x645e58 [0059.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dQXUa DLCVau.jpg", cchWideChar=-1, lpMultiByteStr=0x645e58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dQXUa DLCVau.jpg", lpUsedDefaultChar=0x0) returned 17 [0059.806] lstrlenA (lpString="dQXUa DLCVau.jpg") returned 16 [0059.806] lstrlenA (lpString=".happythreechoose") returned 17 [0059.806] lstrcmpiW (lpString1="dQXUa DLCVau.jpg", lpString2="Decryption INFO.html") returned 1 [0059.806] lstrcmpiW (lpString1="dQXUa DLCVau.jpg", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0059.806] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0059.807] lstrcmpiW (lpString1="dQXUa DLCVau.jpg", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0059.807] GetProcessHeap () returned 0x630000 [0059.807] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0059.807] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dQXUa DLCVau.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\dqxua dlcvau.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0059.807] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=4327) returned 1 [0059.807] GetProcessHeap () returned 0x630000 [0059.807] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6555f8 [0059.807] GetProcessHeap () returned 0x630000 [0059.807] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0059.807] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\dQXUa DLCVau.jpg") returned 41 [0059.807] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.807] GetProcessHeap () returned 0x630000 [0059.807] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0059.807] GetProcessHeap () returned 0x630000 [0059.807] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x389) returned 0x661bb0 [0059.807] lstrlenA (lpString="rsa_encrypt") returned 11 [0059.807] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0059.808] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0059.808] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0059.808] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0059.808] GetProcessHeap () returned 0x630000 [0059.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0059.808] lstrlenA (lpString="010001") returned 6 [0059.808] GetProcessHeap () returned 0x630000 [0059.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0059.808] GetProcessHeap () returned 0x630000 [0059.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.808] GetProcessHeap () returned 0x630000 [0059.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dfe0 [0059.808] GetProcessHeap () returned 0x630000 [0059.808] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.808] GetProcessHeap () returned 0x630000 [0059.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e850 [0059.808] GetProcessHeap () returned 0x630000 [0059.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657210 [0059.808] GetProcessHeap () returned 0x630000 [0059.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0059.808] GetProcessHeap () returned 0x630000 [0059.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0059.808] GetProcessHeap () returned 0x630000 [0059.808] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.808] GetProcessHeap () returned 0x630000 [0059.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0059.808] GetProcessHeap () returned 0x630000 [0059.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.808] GetProcessHeap () returned 0x630000 [0059.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656db0 [0059.809] GetProcessHeap () returned 0x630000 [0059.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.809] GetProcessHeap () returned 0x630000 [0059.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0059.809] GetProcessHeap () returned 0x630000 [0059.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0059.809] GetProcessHeap () returned 0x630000 [0059.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.809] GetProcessHeap () returned 0x630000 [0059.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0059.809] GetProcessHeap () returned 0x630000 [0059.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0059.809] GetProcessHeap () returned 0x630000 [0059.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0059.809] GetProcessHeap () returned 0x630000 [0059.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0059.809] GetProcessHeap () returned 0x630000 [0059.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.809] GetProcessHeap () returned 0x630000 [0059.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.809] GetProcessHeap () returned 0x630000 [0059.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.809] GetProcessHeap () returned 0x630000 [0059.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.809] GetProcessHeap () returned 0x630000 [0059.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e8e0 [0059.809] GetProcessHeap () returned 0x630000 [0059.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0059.809] GetProcessHeap () returned 0x630000 [0059.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0059.809] GetProcessHeap () returned 0x630000 [0059.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0059.809] GetProcessHeap () returned 0x630000 [0059.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0059.809] GetProcessHeap () returned 0x630000 [0059.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0059.809] GetProcessHeap () returned 0x630000 [0059.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.809] GetProcessHeap () returned 0x630000 [0059.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.810] GetProcessHeap () returned 0x630000 [0059.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.810] GetProcessHeap () returned 0x630000 [0059.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.810] GetProcessHeap () returned 0x630000 [0059.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.810] GetProcessHeap () returned 0x630000 [0059.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.810] GetProcessHeap () returned 0x630000 [0059.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0059.810] GetProcessHeap () returned 0x630000 [0059.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.810] GetProcessHeap () returned 0x630000 [0059.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0059.810] GetProcessHeap () returned 0x630000 [0059.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0059.810] GetProcessHeap () returned 0x630000 [0059.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0059.810] GetProcessHeap () returned 0x630000 [0059.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0059.810] GetProcessHeap () returned 0x630000 [0059.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0059.810] GetProcessHeap () returned 0x630000 [0059.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0059.810] GetProcessHeap () returned 0x630000 [0059.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0059.810] GetProcessHeap () returned 0x630000 [0059.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0059.810] GetProcessHeap () returned 0x630000 [0059.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0059.810] GetProcessHeap () returned 0x630000 [0059.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.810] GetProcessHeap () returned 0x630000 [0059.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0059.810] GetProcessHeap () returned 0x630000 [0059.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0059.811] GetProcessHeap () returned 0x630000 [0059.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0059.811] GetProcessHeap () returned 0x630000 [0059.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0059.811] GetProcessHeap () returned 0x630000 [0059.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0059.811] GetProcessHeap () returned 0x630000 [0059.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0059.811] GetProcessHeap () returned 0x630000 [0059.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.811] GetProcessHeap () returned 0x630000 [0059.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.811] GetProcessHeap () returned 0x630000 [0059.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0059.811] GetProcessHeap () returned 0x630000 [0059.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0059.811] GetProcessHeap () returned 0x630000 [0059.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.811] GetProcessHeap () returned 0x630000 [0059.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.811] GetProcessHeap () returned 0x630000 [0059.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.811] GetProcessHeap () returned 0x630000 [0059.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.811] GetProcessHeap () returned 0x630000 [0059.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0059.811] GetProcessHeap () returned 0x630000 [0059.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0059.811] GetProcessHeap () returned 0x630000 [0059.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.811] GetProcessHeap () returned 0x630000 [0059.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.811] GetProcessHeap () returned 0x630000 [0059.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.811] GetProcessHeap () returned 0x630000 [0059.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.812] GetProcessHeap () returned 0x630000 [0059.812] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0059.812] GetProcessHeap () returned 0x630000 [0059.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0059.812] GetProcessHeap () returned 0x630000 [0059.812] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.812] GetProcessHeap () returned 0x630000 [0059.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.812] GetProcessHeap () returned 0x630000 [0059.812] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0059.812] GetProcessHeap () returned 0x630000 [0059.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0059.812] GetProcessHeap () returned 0x630000 [0059.812] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0059.812] GetProcessHeap () returned 0x630000 [0059.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0059.812] GetProcessHeap () returned 0x630000 [0059.812] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0059.812] GetProcessHeap () returned 0x630000 [0059.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.812] GetProcessHeap () returned 0x630000 [0059.812] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0059.812] GetProcessHeap () returned 0x630000 [0059.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0059.812] GetProcessHeap () returned 0x630000 [0059.812] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0059.812] GetProcessHeap () returned 0x630000 [0059.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0059.812] GetProcessHeap () returned 0x630000 [0059.812] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.812] GetProcessHeap () returned 0x630000 [0059.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.813] GetProcessHeap () returned 0x630000 [0059.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0059.813] GetProcessHeap () returned 0x630000 [0059.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0059.813] GetProcessHeap () returned 0x630000 [0059.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.813] GetProcessHeap () returned 0x630000 [0059.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.813] GetProcessHeap () returned 0x630000 [0059.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0059.813] GetProcessHeap () returned 0x630000 [0059.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0059.813] GetProcessHeap () returned 0x630000 [0059.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.813] GetProcessHeap () returned 0x630000 [0059.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.813] GetProcessHeap () returned 0x630000 [0059.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.813] GetProcessHeap () returned 0x630000 [0059.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.813] GetProcessHeap () returned 0x630000 [0059.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0059.813] GetProcessHeap () returned 0x630000 [0059.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0059.813] GetProcessHeap () returned 0x630000 [0059.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0059.813] GetProcessHeap () returned 0x630000 [0059.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0059.813] GetProcessHeap () returned 0x630000 [0059.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0059.813] GetProcessHeap () returned 0x630000 [0059.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0059.814] GetProcessHeap () returned 0x630000 [0059.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0059.814] GetProcessHeap () returned 0x630000 [0059.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0059.814] GetProcessHeap () returned 0x630000 [0059.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a208 [0059.814] GetProcessHeap () returned 0x630000 [0059.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a208 | out: hHeap=0x630000) returned 1 [0059.814] GetProcessHeap () returned 0x630000 [0059.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.814] GetProcessHeap () returned 0x630000 [0059.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.814] GetProcessHeap () returned 0x630000 [0059.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0059.814] GetProcessHeap () returned 0x630000 [0059.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0059.814] GetProcessHeap () returned 0x630000 [0059.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a188 [0059.814] GetProcessHeap () returned 0x630000 [0059.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a188 | out: hHeap=0x630000) returned 1 [0059.814] GetProcessHeap () returned 0x630000 [0059.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0059.814] GetProcessHeap () returned 0x630000 [0059.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0059.814] GetProcessHeap () returned 0x630000 [0059.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0059.814] GetProcessHeap () returned 0x630000 [0059.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0059.814] GetProcessHeap () returned 0x630000 [0059.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0059.814] GetProcessHeap () returned 0x630000 [0059.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0059.814] GetProcessHeap () returned 0x630000 [0059.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0059.814] GetProcessHeap () returned 0x630000 [0059.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0059.814] GetProcessHeap () returned 0x630000 [0059.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0059.815] GetProcessHeap () returned 0x630000 [0059.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.815] GetProcessHeap () returned 0x630000 [0059.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0059.815] WriteFile (in: hFile=0x230, lpBuffer=0x661bb0*, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661bb0*, lpNumberOfBytesWritten=0x243d864*=0x389, lpOverlapped=0x0) returned 1 [0059.818] GetProcessHeap () returned 0x630000 [0059.818] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x661bb0, Size=0x30) returned 0x661bb0 [0059.818] GetProcessHeap () returned 0x630000 [0059.818] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0059.818] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.818] GetProcessHeap () returned 0x630000 [0059.818] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10f0) returned 0x65b620 [0059.818] ReadFile (in: hFile=0x230, lpBuffer=0x65b620, nNumberOfBytesToRead=0x10f0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65b620*, lpNumberOfBytesRead=0x243d7e8*=0x10f0, lpOverlapped=0x0) returned 1 [0059.818] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.818] WriteFile (in: hFile=0x230, lpBuffer=0x65b620*, nNumberOfBytesToWrite=0x10f0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65b620*, lpNumberOfBytesWritten=0x243d7e4*=0x10f0, lpOverlapped=0x0) returned 1 [0059.819] GetProcessHeap () returned 0x630000 [0059.819] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65b620 | out: hHeap=0x630000) returned 1 [0059.819] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.820] WriteFile (in: hFile=0x230, lpBuffer=0x661bb0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661bb0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0059.820] CloseHandle (hObject=0x230) returned 1 [0059.822] GetProcessHeap () returned 0x630000 [0059.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0059.822] GetProcessHeap () returned 0x630000 [0059.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6555f8 | out: hHeap=0x630000) returned 1 [0059.822] GetProcessHeap () returned 0x630000 [0059.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0059.822] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\dQXUa DLCVau.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\dQXUa DLCVau.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\dQXUa DLCVau.jpg" [0059.822] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\dQXUa DLCVau.jpg", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\dQXUa DLCVau.jpg.happythreechoose") returned="C:\\Users\\FD1HVy\\Pictures\\dQXUa DLCVau.jpg.happythreechoose" [0059.822] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\dQXUa DLCVau.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\dqxua dlcvau.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\dQXUa DLCVau.jpg.happythreechoose" (normalized: "c:\\users\\fd1hvy\\pictures\\dqxua dlcvau.jpg.happythreechoose"), dwFlags=0x1) returned 1 [0059.822] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\dQXUa DLCVau.jpg" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0059.822] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0059.822] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" [0059.823] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\pictures\\decryption info.html")) returned 0x20 [0059.823] GetProcessHeap () returned 0x630000 [0059.823] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645e58 | out: hHeap=0x630000) returned 1 [0059.823] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9f985c0, ftCreationTime.dwHighDateTime=0x1d5c79b, ftLastAccessTime.dwLowDateTime=0xdf1ecfd0, ftLastAccessTime.dwHighDateTime=0x1d5cd94, ftLastWriteTime.dwLowDateTime=0xdf1ecfd0, ftLastWriteTime.dwHighDateTime=0x1d5cd94, nFileSizeHigh=0x0, nFileSizeLow=0x15dbe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dtoOLa0zbl.bmp", cAlternateFileName="DTOOLA~1.BMP")) returned 1 [0059.823] lstrcmpiW (lpString1="dtoOLa0zbl.bmp", lpString2=".") returned 1 [0059.823] lstrcmpiW (lpString1="dtoOLa0zbl.bmp", lpString2="..") returned 1 [0059.823] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="dtoOLa0zbl.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\dtoOLa0zbl.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\dtoOLa0zbl.bmp" [0059.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dtoOLa0zbl.bmp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0059.823] GetProcessHeap () returned 0x630000 [0059.823] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0059.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dtoOLa0zbl.bmp", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dtoOLa0zbl.bmp", lpUsedDefaultChar=0x0) returned 15 [0059.823] lstrlenA (lpString="dtoOLa0zbl.bmp") returned 14 [0059.823] lstrlenA (lpString=".happythreechoose") returned 17 [0059.823] lstrcmpiW (lpString1="dtoOLa0zbl.bmp", lpString2="Decryption INFO.html") returned 1 [0059.823] lstrcmpiW (lpString1="dtoOLa0zbl.bmp", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0059.823] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0059.823] lstrcmpiW (lpString1="dtoOLa0zbl.bmp", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0059.823] GetProcessHeap () returned 0x630000 [0059.823] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f10 [0059.823] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dtoOLa0zbl.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\dtoola0zbl.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0059.823] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=89534) returned 1 [0059.823] GetProcessHeap () returned 0x630000 [0059.823] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655850 [0059.823] GetProcessHeap () returned 0x630000 [0059.823] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0059.823] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\dtoOLa0zbl.bmp") returned 39 [0059.823] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.824] GetProcessHeap () returned 0x630000 [0059.824] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0059.824] GetProcessHeap () returned 0x630000 [0059.824] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x382) returned 0x654110 [0059.824] lstrlenA (lpString="rsa_encrypt") returned 11 [0059.824] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0059.824] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0059.824] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0059.824] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0059.824] GetProcessHeap () returned 0x630000 [0059.824] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0059.824] lstrlenA (lpString="010001") returned 6 [0059.824] GetProcessHeap () returned 0x630000 [0059.824] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0059.824] GetProcessHeap () returned 0x630000 [0059.824] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.824] GetProcessHeap () returned 0x630000 [0059.825] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e3d0 [0059.825] GetProcessHeap () returned 0x630000 [0059.825] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.825] GetProcessHeap () returned 0x630000 [0059.825] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e100 [0059.825] GetProcessHeap () returned 0x630000 [0059.825] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x6570f8 [0059.825] GetProcessHeap () returned 0x630000 [0059.825] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0059.825] GetProcessHeap () returned 0x630000 [0059.825] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0059.825] GetProcessHeap () returned 0x630000 [0059.825] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.825] GetProcessHeap () returned 0x630000 [0059.825] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0059.825] GetProcessHeap () returned 0x630000 [0059.825] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.825] GetProcessHeap () returned 0x630000 [0059.825] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657328 [0059.825] GetProcessHeap () returned 0x630000 [0059.825] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.825] GetProcessHeap () returned 0x630000 [0059.825] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0059.825] GetProcessHeap () returned 0x630000 [0059.825] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e2b0 [0059.825] GetProcessHeap () returned 0x630000 [0059.825] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.825] GetProcessHeap () returned 0x630000 [0059.825] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0059.825] GetProcessHeap () returned 0x630000 [0059.825] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e2b0 | out: hHeap=0x630000) returned 1 [0059.825] GetProcessHeap () returned 0x630000 [0059.825] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0059.825] GetProcessHeap () returned 0x630000 [0059.825] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x661608 [0059.825] GetProcessHeap () returned 0x630000 [0059.825] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.825] GetProcessHeap () returned 0x630000 [0059.825] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0059.826] GetProcessHeap () returned 0x630000 [0059.826] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0059.826] GetProcessHeap () returned 0x630000 [0059.826] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0059.826] GetProcessHeap () returned 0x630000 [0059.826] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e070 [0059.826] GetProcessHeap () returned 0x630000 [0059.826] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661608 | out: hHeap=0x630000) returned 1 [0059.826] GetProcessHeap () returned 0x630000 [0059.826] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0059.826] GetProcessHeap () returned 0x630000 [0059.826] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0059.826] GetProcessHeap () returned 0x630000 [0059.826] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0059.826] GetProcessHeap () returned 0x630000 [0059.826] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0059.826] GetProcessHeap () returned 0x630000 [0059.826] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0059.826] GetProcessHeap () returned 0x630000 [0059.826] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0059.826] GetProcessHeap () returned 0x630000 [0059.826] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0059.826] GetProcessHeap () returned 0x630000 [0059.826] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0059.826] GetProcessHeap () returned 0x630000 [0059.826] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0059.826] GetProcessHeap () returned 0x630000 [0059.826] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0059.826] GetProcessHeap () returned 0x630000 [0059.826] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0059.826] GetProcessHeap () returned 0x630000 [0059.826] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0059.826] GetProcessHeap () returned 0x630000 [0059.826] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0059.826] GetProcessHeap () returned 0x630000 [0059.826] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0059.826] GetProcessHeap () returned 0x630000 [0059.826] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0059.827] GetProcessHeap () returned 0x630000 [0059.827] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0059.827] GetProcessHeap () returned 0x630000 [0059.827] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0059.827] GetProcessHeap () returned 0x630000 [0059.827] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0059.827] GetProcessHeap () returned 0x630000 [0059.827] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0059.827] GetProcessHeap () returned 0x630000 [0059.827] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0059.827] GetProcessHeap () returned 0x630000 [0059.827] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0059.827] GetProcessHeap () returned 0x630000 [0059.827] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0059.827] GetProcessHeap () returned 0x630000 [0059.827] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0059.827] GetProcessHeap () returned 0x630000 [0059.827] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0059.827] GetProcessHeap () returned 0x630000 [0059.827] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0059.827] GetProcessHeap () returned 0x630000 [0059.827] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0059.827] GetProcessHeap () returned 0x630000 [0059.827] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.827] GetProcessHeap () returned 0x630000 [0059.827] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.827] GetProcessHeap () returned 0x630000 [0059.827] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0059.827] GetProcessHeap () returned 0x630000 [0059.827] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0059.827] GetProcessHeap () returned 0x630000 [0059.827] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0059.827] GetProcessHeap () returned 0x630000 [0059.827] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0059.827] GetProcessHeap () returned 0x630000 [0059.827] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0059.827] GetProcessHeap () returned 0x630000 [0059.828] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0059.828] GetProcessHeap () returned 0x630000 [0059.828] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0059.828] GetProcessHeap () returned 0x630000 [0059.828] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0059.828] GetProcessHeap () returned 0x630000 [0059.828] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0059.828] GetProcessHeap () returned 0x630000 [0059.828] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0059.828] GetProcessHeap () returned 0x630000 [0059.828] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0059.828] GetProcessHeap () returned 0x630000 [0059.828] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.828] GetProcessHeap () returned 0x630000 [0059.828] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.828] GetProcessHeap () returned 0x630000 [0059.828] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.828] GetProcessHeap () returned 0x630000 [0059.828] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0059.828] GetProcessHeap () returned 0x630000 [0059.829] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.829] GetProcessHeap () returned 0x630000 [0059.829] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0059.829] GetProcessHeap () returned 0x630000 [0059.829] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0059.829] GetProcessHeap () returned 0x630000 [0059.829] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.829] GetProcessHeap () returned 0x630000 [0059.829] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.829] GetProcessHeap () returned 0x630000 [0059.829] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0059.829] GetProcessHeap () returned 0x630000 [0059.829] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0059.829] GetProcessHeap () returned 0x630000 [0059.829] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0059.829] GetProcessHeap () returned 0x630000 [0059.829] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0059.829] GetProcessHeap () returned 0x630000 [0059.829] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.829] GetProcessHeap () returned 0x630000 [0059.829] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.829] GetProcessHeap () returned 0x630000 [0059.829] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0059.829] GetProcessHeap () returned 0x630000 [0059.829] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.829] GetProcessHeap () returned 0x630000 [0059.829] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0059.829] GetProcessHeap () returned 0x630000 [0059.830] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0059.830] GetProcessHeap () returned 0x630000 [0059.830] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0059.830] GetProcessHeap () returned 0x630000 [0059.830] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0059.830] GetProcessHeap () returned 0x630000 [0059.830] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0059.830] GetProcessHeap () returned 0x630000 [0059.830] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0059.830] GetProcessHeap () returned 0x630000 [0059.830] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0059.830] GetProcessHeap () returned 0x630000 [0059.830] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.830] GetProcessHeap () returned 0x630000 [0059.830] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0059.830] GetProcessHeap () returned 0x630000 [0059.830] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0059.830] GetProcessHeap () returned 0x630000 [0059.830] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0059.830] GetProcessHeap () returned 0x630000 [0059.830] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0059.830] GetProcessHeap () returned 0x630000 [0059.830] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0059.830] GetProcessHeap () returned 0x630000 [0059.830] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0059.830] GetProcessHeap () returned 0x630000 [0059.830] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0059.830] GetProcessHeap () returned 0x630000 [0059.830] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0059.830] GetProcessHeap () returned 0x630000 [0059.830] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0059.830] GetProcessHeap () returned 0x630000 [0059.830] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0059.830] GetProcessHeap () returned 0x630000 [0059.830] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0059.830] GetProcessHeap () returned 0x630000 [0059.830] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0059.830] GetProcessHeap () returned 0x630000 [0059.831] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0059.831] GetProcessHeap () returned 0x630000 [0059.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0059.831] GetProcessHeap () returned 0x630000 [0059.831] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1a8 [0059.831] GetProcessHeap () returned 0x630000 [0059.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1a8 | out: hHeap=0x630000) returned 1 [0059.831] GetProcessHeap () returned 0x630000 [0059.831] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0059.831] GetProcessHeap () returned 0x630000 [0059.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0059.831] GetProcessHeap () returned 0x630000 [0059.831] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.831] GetProcessHeap () returned 0x630000 [0059.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.831] GetProcessHeap () returned 0x630000 [0059.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0059.831] GetProcessHeap () returned 0x630000 [0059.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0059.831] GetProcessHeap () returned 0x630000 [0059.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0059.831] GetProcessHeap () returned 0x630000 [0059.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0059.831] GetProcessHeap () returned 0x630000 [0059.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0059.831] GetProcessHeap () returned 0x630000 [0059.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0059.831] GetProcessHeap () returned 0x630000 [0059.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0059.831] GetProcessHeap () returned 0x630000 [0059.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0059.831] GetProcessHeap () returned 0x630000 [0059.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0059.831] GetProcessHeap () returned 0x630000 [0059.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.831] GetProcessHeap () returned 0x630000 [0059.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0059.832] WriteFile (in: hFile=0x230, lpBuffer=0x654110*, nNumberOfBytesToWrite=0x382, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654110*, lpNumberOfBytesWritten=0x243d864*=0x382, lpOverlapped=0x0) returned 1 [0059.834] GetProcessHeap () returned 0x630000 [0059.834] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x654110, Size=0x30) returned 0x654110 [0059.834] GetProcessHeap () returned 0x630000 [0059.834] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0059.834] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.834] GetProcessHeap () returned 0x630000 [0059.834] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x15dc0) returned 0x661be8 [0059.834] ReadFile (in: hFile=0x230, lpBuffer=0x661be8, nNumberOfBytesToRead=0x15dc0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661be8*, lpNumberOfBytesRead=0x243d7e8*=0x15dc0, lpOverlapped=0x0) returned 1 [0059.835] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.835] WriteFile (in: hFile=0x230, lpBuffer=0x661be8*, nNumberOfBytesToWrite=0x15dc0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661be8*, lpNumberOfBytesWritten=0x243d7e4*=0x15dc0, lpOverlapped=0x0) returned 1 [0059.837] GetProcessHeap () returned 0x630000 [0059.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661be8 | out: hHeap=0x630000) returned 1 [0059.837] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.837] WriteFile (in: hFile=0x230, lpBuffer=0x654110*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654110*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0059.838] CloseHandle (hObject=0x230) returned 1 [0059.841] GetProcessHeap () returned 0x630000 [0059.841] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f10 | out: hHeap=0x630000) returned 1 [0059.841] GetProcessHeap () returned 0x630000 [0059.841] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655850 | out: hHeap=0x630000) returned 1 [0059.841] GetProcessHeap () returned 0x630000 [0059.841] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0059.841] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\dtoOLa0zbl.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\dtoOLa0zbl.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\dtoOLa0zbl.bmp" [0059.841] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\dtoOLa0zbl.bmp", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\dtoOLa0zbl.bmp.happythreechoose") returned="C:\\Users\\FD1HVy\\Pictures\\dtoOLa0zbl.bmp.happythreechoose" [0059.841] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\dtoOLa0zbl.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\dtoola0zbl.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\dtoOLa0zbl.bmp.happythreechoose" (normalized: "c:\\users\\fd1hvy\\pictures\\dtoola0zbl.bmp.happythreechoose"), dwFlags=0x1) returned 1 [0059.842] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\dtoOLa0zbl.bmp" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0059.842] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0059.842] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" [0059.842] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\pictures\\decryption info.html")) returned 0x20 [0059.842] GetProcessHeap () returned 0x630000 [0059.842] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0059.842] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27082130, ftCreationTime.dwHighDateTime=0x1d5d046, ftLastAccessTime.dwLowDateTime=0x42bd78e0, ftLastAccessTime.dwHighDateTime=0x1d5cd57, ftLastWriteTime.dwLowDateTime=0x42bd78e0, ftLastWriteTime.dwHighDateTime=0x1d5cd57, nFileSizeHigh=0x0, nFileSizeLow=0xb8c3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="D_TcKlywXm9.png", cAlternateFileName="D_TCKL~1.PNG")) returned 1 [0059.842] lstrcmpiW (lpString1="D_TcKlywXm9.png", lpString2=".") returned 1 [0059.842] lstrcmpiW (lpString1="D_TcKlywXm9.png", lpString2="..") returned 1 [0059.842] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="D_TcKlywXm9.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\D_TcKlywXm9.png") returned="C:\\Users\\FD1HVy\\Pictures\\D_TcKlywXm9.png" [0059.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D_TcKlywXm9.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0059.842] GetProcessHeap () returned 0x630000 [0059.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x64c9f0 [0059.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D_TcKlywXm9.png", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="D_TcKlywXm9.png", lpUsedDefaultChar=0x0) returned 16 [0059.842] lstrlenA (lpString="D_TcKlywXm9.png") returned 15 [0059.842] lstrlenA (lpString=".happythreechoose") returned 17 [0059.842] lstrcmpiW (lpString1="D_TcKlywXm9.png", lpString2="Decryption INFO.html") returned -1 [0059.842] lstrcmpiW (lpString1="D_TcKlywXm9.png", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0059.842] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0059.842] lstrcmpiW (lpString1="D_TcKlywXm9.png", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0059.842] GetProcessHeap () returned 0x630000 [0059.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0059.842] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\D_TcKlywXm9.png" (normalized: "c:\\users\\fd1hvy\\pictures\\d_tcklywxm9.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0059.843] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=47299) returned 1 [0059.843] GetProcessHeap () returned 0x630000 [0059.843] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655940 [0059.843] GetProcessHeap () returned 0x630000 [0059.843] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0059.843] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\D_TcKlywXm9.png") returned 40 [0059.843] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.843] GetProcessHeap () returned 0x630000 [0059.843] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0059.843] GetProcessHeap () returned 0x630000 [0059.843] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x654148 [0059.843] lstrlenA (lpString="rsa_encrypt") returned 11 [0059.843] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0059.843] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0059.844] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0059.844] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0059.844] GetProcessHeap () returned 0x630000 [0059.844] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0059.844] lstrlenA (lpString="010001") returned 6 [0059.844] GetProcessHeap () returned 0x630000 [0059.844] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0059.844] GetProcessHeap () returned 0x630000 [0059.844] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.844] GetProcessHeap () returned 0x630000 [0059.844] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e7c0 [0059.844] GetProcessHeap () returned 0x630000 [0059.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.844] GetProcessHeap () returned 0x630000 [0059.844] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0059.844] GetProcessHeap () returned 0x630000 [0059.844] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657788 [0059.844] GetProcessHeap () returned 0x630000 [0059.844] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0059.844] GetProcessHeap () returned 0x630000 [0059.844] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0059.844] GetProcessHeap () returned 0x630000 [0059.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.844] GetProcessHeap () returned 0x630000 [0059.844] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0059.844] GetProcessHeap () returned 0x630000 [0059.845] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.845] GetProcessHeap () returned 0x630000 [0059.845] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x6570f8 [0059.845] GetProcessHeap () returned 0x630000 [0059.845] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.845] GetProcessHeap () returned 0x630000 [0059.845] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0059.845] GetProcessHeap () returned 0x630000 [0059.845] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dec0 [0059.845] GetProcessHeap () returned 0x630000 [0059.845] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.845] GetProcessHeap () returned 0x630000 [0059.845] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0059.845] GetProcessHeap () returned 0x630000 [0059.845] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0059.845] GetProcessHeap () returned 0x630000 [0059.845] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.845] GetProcessHeap () returned 0x630000 [0059.845] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x6618f0 [0059.845] GetProcessHeap () returned 0x630000 [0059.845] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.845] GetProcessHeap () returned 0x630000 [0059.845] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.845] GetProcessHeap () returned 0x630000 [0059.845] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0059.845] GetProcessHeap () returned 0x630000 [0059.845] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0059.845] GetProcessHeap () returned 0x630000 [0059.845] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e610 [0059.845] GetProcessHeap () returned 0x630000 [0059.845] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6618f0 | out: hHeap=0x630000) returned 1 [0059.845] GetProcessHeap () returned 0x630000 [0059.845] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0059.845] GetProcessHeap () returned 0x630000 [0059.845] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0059.845] GetProcessHeap () returned 0x630000 [0059.845] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0059.845] GetProcessHeap () returned 0x630000 [0059.845] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0059.846] GetProcessHeap () returned 0x630000 [0059.846] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0059.846] GetProcessHeap () returned 0x630000 [0059.846] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0059.846] GetProcessHeap () returned 0x630000 [0059.846] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0059.846] GetProcessHeap () returned 0x630000 [0059.846] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0059.846] GetProcessHeap () returned 0x630000 [0059.846] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0059.846] GetProcessHeap () returned 0x630000 [0059.846] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0059.846] GetProcessHeap () returned 0x630000 [0059.846] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0059.846] GetProcessHeap () returned 0x630000 [0059.846] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0059.846] GetProcessHeap () returned 0x630000 [0059.846] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.846] GetProcessHeap () returned 0x630000 [0059.846] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.846] GetProcessHeap () returned 0x630000 [0059.846] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0059.846] GetProcessHeap () returned 0x630000 [0059.846] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0059.846] GetProcessHeap () returned 0x630000 [0059.846] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.846] GetProcessHeap () returned 0x630000 [0059.846] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.846] GetProcessHeap () returned 0x630000 [0059.846] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0059.846] GetProcessHeap () returned 0x630000 [0059.846] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.846] GetProcessHeap () returned 0x630000 [0059.846] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0059.846] GetProcessHeap () returned 0x630000 [0059.846] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0059.846] GetProcessHeap () returned 0x630000 [0059.846] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.847] GetProcessHeap () returned 0x630000 [0059.847] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.847] GetProcessHeap () returned 0x630000 [0059.847] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0059.847] GetProcessHeap () returned 0x630000 [0059.847] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0059.847] GetProcessHeap () returned 0x630000 [0059.847] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1a8 [0059.847] GetProcessHeap () returned 0x630000 [0059.847] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1a8 | out: hHeap=0x630000) returned 1 [0059.847] GetProcessHeap () returned 0x630000 [0059.847] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0059.847] GetProcessHeap () returned 0x630000 [0059.847] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0059.847] GetProcessHeap () returned 0x630000 [0059.847] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0059.847] GetProcessHeap () returned 0x630000 [0059.847] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0059.847] GetProcessHeap () returned 0x630000 [0059.847] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0059.847] GetProcessHeap () returned 0x630000 [0059.847] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0059.847] GetProcessHeap () returned 0x630000 [0059.847] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0059.847] GetProcessHeap () returned 0x630000 [0059.847] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0059.847] GetProcessHeap () returned 0x630000 [0059.847] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0059.847] GetProcessHeap () returned 0x630000 [0059.847] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0059.847] GetProcessHeap () returned 0x630000 [0059.847] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0059.847] GetProcessHeap () returned 0x630000 [0059.847] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0059.847] GetProcessHeap () returned 0x630000 [0059.847] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0059.847] GetProcessHeap () returned 0x630000 [0059.848] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0059.848] GetProcessHeap () returned 0x630000 [0059.848] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0059.848] GetProcessHeap () returned 0x630000 [0059.848] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0059.848] GetProcessHeap () returned 0x630000 [0059.848] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0059.848] GetProcessHeap () returned 0x630000 [0059.848] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.848] GetProcessHeap () returned 0x630000 [0059.848] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0059.848] GetProcessHeap () returned 0x630000 [0059.848] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0059.848] GetProcessHeap () returned 0x630000 [0059.848] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0059.848] GetProcessHeap () returned 0x630000 [0059.848] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0059.848] GetProcessHeap () returned 0x630000 [0059.848] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0059.848] GetProcessHeap () returned 0x630000 [0059.848] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0059.848] GetProcessHeap () returned 0x630000 [0059.848] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0059.848] GetProcessHeap () returned 0x630000 [0059.848] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0059.848] GetProcessHeap () returned 0x630000 [0059.848] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0059.848] GetProcessHeap () returned 0x630000 [0059.848] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0059.848] GetProcessHeap () returned 0x630000 [0059.848] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0059.848] GetProcessHeap () returned 0x630000 [0059.848] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0059.848] GetProcessHeap () returned 0x630000 [0059.848] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0059.848] GetProcessHeap () returned 0x630000 [0059.848] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0059.848] GetProcessHeap () returned 0x630000 [0059.849] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.849] GetProcessHeap () returned 0x630000 [0059.849] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.849] GetProcessHeap () returned 0x630000 [0059.849] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a188 [0059.849] GetProcessHeap () returned 0x630000 [0059.849] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a188 | out: hHeap=0x630000) returned 1 [0059.849] GetProcessHeap () returned 0x630000 [0059.849] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0059.849] GetProcessHeap () returned 0x630000 [0059.849] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0059.849] GetProcessHeap () returned 0x630000 [0059.849] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0059.849] GetProcessHeap () returned 0x630000 [0059.849] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0059.849] GetProcessHeap () returned 0x630000 [0059.849] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.849] GetProcessHeap () returned 0x630000 [0059.849] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.849] GetProcessHeap () returned 0x630000 [0059.849] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0059.849] GetProcessHeap () returned 0x630000 [0059.849] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.849] GetProcessHeap () returned 0x630000 [0059.849] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.849] GetProcessHeap () returned 0x630000 [0059.849] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.849] GetProcessHeap () returned 0x630000 [0059.849] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.849] GetProcessHeap () returned 0x630000 [0059.849] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.849] GetProcessHeap () returned 0x630000 [0059.849] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.849] GetProcessHeap () returned 0x630000 [0059.849] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.849] GetProcessHeap () returned 0x630000 [0059.849] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0059.849] GetProcessHeap () returned 0x630000 [0059.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0059.850] GetProcessHeap () returned 0x630000 [0059.850] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.850] GetProcessHeap () returned 0x630000 [0059.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.850] GetProcessHeap () returned 0x630000 [0059.850] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0059.850] GetProcessHeap () returned 0x630000 [0059.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0059.850] GetProcessHeap () returned 0x630000 [0059.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0059.850] GetProcessHeap () returned 0x630000 [0059.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0059.850] GetProcessHeap () returned 0x630000 [0059.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0059.850] GetProcessHeap () returned 0x630000 [0059.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0059.850] GetProcessHeap () returned 0x630000 [0059.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0059.850] GetProcessHeap () returned 0x630000 [0059.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0059.850] GetProcessHeap () returned 0x630000 [0059.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0059.850] GetProcessHeap () returned 0x630000 [0059.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e7c0 | out: hHeap=0x630000) returned 1 [0059.850] GetProcessHeap () returned 0x630000 [0059.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0059.850] GetProcessHeap () returned 0x630000 [0059.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.850] GetProcessHeap () returned 0x630000 [0059.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0059.850] WriteFile (in: hFile=0x230, lpBuffer=0x654148*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654148*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0059.852] GetProcessHeap () returned 0x630000 [0059.852] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x654148, Size=0x30) returned 0x654148 [0059.852] GetProcessHeap () returned 0x630000 [0059.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0059.852] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.852] GetProcessHeap () returned 0x630000 [0059.852] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb8c3) returned 0x661be8 [0059.853] ReadFile (in: hFile=0x230, lpBuffer=0x661be8, nNumberOfBytesToRead=0xb8c3, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661be8*, lpNumberOfBytesRead=0x243d7e8*=0xb8c3, lpOverlapped=0x0) returned 1 [0059.853] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.853] WriteFile (in: hFile=0x230, lpBuffer=0x661be8*, nNumberOfBytesToWrite=0xb8c3, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661be8*, lpNumberOfBytesWritten=0x243d7e4*=0xb8c3, lpOverlapped=0x0) returned 1 [0059.855] GetProcessHeap () returned 0x630000 [0059.855] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661be8 | out: hHeap=0x630000) returned 1 [0059.856] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.856] WriteFile (in: hFile=0x230, lpBuffer=0x654148*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654148*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0059.857] CloseHandle (hObject=0x230) returned 1 [0059.860] GetProcessHeap () returned 0x630000 [0059.860] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0059.860] GetProcessHeap () returned 0x630000 [0059.860] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655940 | out: hHeap=0x630000) returned 1 [0059.860] GetProcessHeap () returned 0x630000 [0059.860] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0059.860] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\D_TcKlywXm9.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\D_TcKlywXm9.png") returned="C:\\Users\\FD1HVy\\Pictures\\D_TcKlywXm9.png" [0059.860] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\D_TcKlywXm9.png", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\D_TcKlywXm9.png.happythreechoose") returned="C:\\Users\\FD1HVy\\Pictures\\D_TcKlywXm9.png.happythreechoose" [0059.860] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\D_TcKlywXm9.png" (normalized: "c:\\users\\fd1hvy\\pictures\\d_tcklywxm9.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\D_TcKlywXm9.png.happythreechoose" (normalized: "c:\\users\\fd1hvy\\pictures\\d_tcklywxm9.png.happythreechoose"), dwFlags=0x1) returned 1 [0059.860] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\D_TcKlywXm9.png" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0059.861] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0059.861] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" [0059.861] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\pictures\\decryption info.html")) returned 0x20 [0059.861] GetProcessHeap () returned 0x630000 [0059.861] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0059.861] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9a5ea90, ftCreationTime.dwHighDateTime=0x1d5c94e, ftLastAccessTime.dwLowDateTime=0xf54ff400, ftLastAccessTime.dwHighDateTime=0x1d5d2bc, ftLastWriteTime.dwLowDateTime=0xf54ff400, ftLastWriteTime.dwHighDateTime=0x1d5d2bc, nFileSizeHigh=0x0, nFileSizeLow=0x10403, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="g-2mYacKrynw43.jpg", cAlternateFileName="G-2MYA~1.JPG")) returned 1 [0059.861] lstrcmpiW (lpString1="g-2mYacKrynw43.jpg", lpString2=".") returned 1 [0059.861] lstrcmpiW (lpString1="g-2mYacKrynw43.jpg", lpString2="..") returned 1 [0059.861] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="g-2mYacKrynw43.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\g-2mYacKrynw43.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\g-2mYacKrynw43.jpg" [0059.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="g-2mYacKrynw43.jpg", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0059.861] GetProcessHeap () returned 0x630000 [0059.861] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x13) returned 0x645c58 [0059.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="g-2mYacKrynw43.jpg", cchWideChar=-1, lpMultiByteStr=0x645c58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="g-2mYacKrynw43.jpg", lpUsedDefaultChar=0x0) returned 19 [0059.861] lstrlenA (lpString="g-2mYacKrynw43.jpg") returned 18 [0059.861] lstrlenA (lpString=".happythreechoose") returned 17 [0059.861] lstrlenA (lpString=".happythreechoose") returned 17 [0059.861] lstrlenA (lpString="g-2mYacKrynw43.jpg") returned 18 [0059.861] lstrcmpiA (lpString1="-2mYacKrynw43.jpg", lpString2=".happythreechoose") returned 1 [0059.861] lstrcmpiW (lpString1="g-2mYacKrynw43.jpg", lpString2="Decryption INFO.html") returned 1 [0059.861] lstrcmpiW (lpString1="g-2mYacKrynw43.jpg", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0059.861] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0059.861] lstrcmpiW (lpString1="g-2mYacKrynw43.jpg", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0059.861] GetProcessHeap () returned 0x630000 [0059.861] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0059.861] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\g-2mYacKrynw43.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\g-2myackrynw43.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0059.861] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=66563) returned 1 [0059.861] GetProcessHeap () returned 0x630000 [0059.861] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655b20 [0059.862] GetProcessHeap () returned 0x630000 [0059.862] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0059.862] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\g-2mYacKrynw43.jpg") returned 43 [0059.862] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.862] GetProcessHeap () returned 0x630000 [0059.862] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0059.862] GetProcessHeap () returned 0x630000 [0059.862] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38d) returned 0x654180 [0059.862] lstrlenA (lpString="rsa_encrypt") returned 11 [0059.862] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0059.862] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0059.862] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0059.862] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0059.862] GetProcessHeap () returned 0x630000 [0059.862] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0059.863] lstrlenA (lpString="010001") returned 6 [0059.863] GetProcessHeap () returned 0x630000 [0059.863] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0059.863] GetProcessHeap () returned 0x630000 [0059.863] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.863] GetProcessHeap () returned 0x630000 [0059.863] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e610 [0059.863] GetProcessHeap () returned 0x630000 [0059.863] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.863] GetProcessHeap () returned 0x630000 [0059.863] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e190 [0059.863] GetProcessHeap () returned 0x630000 [0059.863] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656950 [0059.863] GetProcessHeap () returned 0x630000 [0059.863] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0059.863] GetProcessHeap () returned 0x630000 [0059.863] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0059.863] GetProcessHeap () returned 0x630000 [0059.863] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.863] GetProcessHeap () returned 0x630000 [0059.863] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0059.863] GetProcessHeap () returned 0x630000 [0059.863] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.863] GetProcessHeap () returned 0x630000 [0059.863] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656a68 [0059.863] GetProcessHeap () returned 0x630000 [0059.863] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.863] GetProcessHeap () returned 0x630000 [0059.863] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0059.863] GetProcessHeap () returned 0x630000 [0059.863] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e460 [0059.863] GetProcessHeap () returned 0x630000 [0059.863] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.863] GetProcessHeap () returned 0x630000 [0059.863] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0059.863] GetProcessHeap () returned 0x630000 [0059.863] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e460 | out: hHeap=0x630000) returned 1 [0059.864] GetProcessHeap () returned 0x630000 [0059.864] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0059.864] GetProcessHeap () returned 0x630000 [0059.864] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0059.864] GetProcessHeap () returned 0x630000 [0059.864] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.864] GetProcessHeap () returned 0x630000 [0059.864] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0059.864] GetProcessHeap () returned 0x630000 [0059.864] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a208 [0059.864] GetProcessHeap () returned 0x630000 [0059.864] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a208 | out: hHeap=0x630000) returned 1 [0059.864] GetProcessHeap () returned 0x630000 [0059.864] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e8e0 [0059.864] GetProcessHeap () returned 0x630000 [0059.864] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0059.864] GetProcessHeap () returned 0x630000 [0059.864] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0059.864] GetProcessHeap () returned 0x630000 [0059.864] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0059.864] GetProcessHeap () returned 0x630000 [0059.864] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a188 [0059.864] GetProcessHeap () returned 0x630000 [0059.864] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a188 | out: hHeap=0x630000) returned 1 [0059.864] GetProcessHeap () returned 0x630000 [0059.864] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0059.864] GetProcessHeap () returned 0x630000 [0059.864] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0059.864] GetProcessHeap () returned 0x630000 [0059.864] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.864] GetProcessHeap () returned 0x630000 [0059.864] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.864] GetProcessHeap () returned 0x630000 [0059.864] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0059.864] GetProcessHeap () returned 0x630000 [0059.864] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0059.864] GetProcessHeap () returned 0x630000 [0059.864] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0e8 [0059.865] GetProcessHeap () returned 0x630000 [0059.865] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0e8 | out: hHeap=0x630000) returned 1 [0059.865] GetProcessHeap () returned 0x630000 [0059.865] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.865] GetProcessHeap () returned 0x630000 [0059.865] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.865] GetProcessHeap () returned 0x630000 [0059.865] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.865] GetProcessHeap () returned 0x630000 [0059.865] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.865] GetProcessHeap () returned 0x630000 [0059.865] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0059.865] GetProcessHeap () returned 0x630000 [0059.865] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0059.865] GetProcessHeap () returned 0x630000 [0059.865] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0059.865] GetProcessHeap () returned 0x630000 [0059.865] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0059.865] GetProcessHeap () returned 0x630000 [0059.865] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0059.865] GetProcessHeap () returned 0x630000 [0059.865] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.865] GetProcessHeap () returned 0x630000 [0059.865] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0059.865] GetProcessHeap () returned 0x630000 [0059.865] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.865] GetProcessHeap () returned 0x630000 [0059.865] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a188 [0059.865] GetProcessHeap () returned 0x630000 [0059.865] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a188 | out: hHeap=0x630000) returned 1 [0059.865] GetProcessHeap () returned 0x630000 [0059.865] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0059.865] GetProcessHeap () returned 0x630000 [0059.865] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0059.865] GetProcessHeap () returned 0x630000 [0059.865] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0059.865] GetProcessHeap () returned 0x630000 [0059.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0059.866] GetProcessHeap () returned 0x630000 [0059.866] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0059.866] GetProcessHeap () returned 0x630000 [0059.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0059.866] GetProcessHeap () returned 0x630000 [0059.866] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0059.866] GetProcessHeap () returned 0x630000 [0059.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0059.866] GetProcessHeap () returned 0x630000 [0059.866] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0059.866] GetProcessHeap () returned 0x630000 [0059.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0059.866] GetProcessHeap () returned 0x630000 [0059.866] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0059.866] GetProcessHeap () returned 0x630000 [0059.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0059.866] GetProcessHeap () returned 0x630000 [0059.866] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0059.866] GetProcessHeap () returned 0x630000 [0059.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.866] GetProcessHeap () returned 0x630000 [0059.866] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0059.866] GetProcessHeap () returned 0x630000 [0059.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0059.866] GetProcessHeap () returned 0x630000 [0059.866] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1a8 [0059.866] GetProcessHeap () returned 0x630000 [0059.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1a8 | out: hHeap=0x630000) returned 1 [0059.866] GetProcessHeap () returned 0x630000 [0059.866] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0059.866] GetProcessHeap () returned 0x630000 [0059.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0059.866] GetProcessHeap () returned 0x630000 [0059.866] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0059.866] GetProcessHeap () returned 0x630000 [0059.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0059.867] GetProcessHeap () returned 0x630000 [0059.867] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0059.867] GetProcessHeap () returned 0x630000 [0059.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0059.867] GetProcessHeap () returned 0x630000 [0059.867] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.867] GetProcessHeap () returned 0x630000 [0059.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.867] GetProcessHeap () returned 0x630000 [0059.867] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.867] GetProcessHeap () returned 0x630000 [0059.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.867] GetProcessHeap () returned 0x630000 [0059.867] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0059.867] GetProcessHeap () returned 0x630000 [0059.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0059.867] GetProcessHeap () returned 0x630000 [0059.867] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0059.867] GetProcessHeap () returned 0x630000 [0059.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0059.867] GetProcessHeap () returned 0x630000 [0059.867] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0059.867] GetProcessHeap () returned 0x630000 [0059.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0059.867] GetProcessHeap () returned 0x630000 [0059.867] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.867] GetProcessHeap () returned 0x630000 [0059.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.867] GetProcessHeap () returned 0x630000 [0059.867] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0059.867] GetProcessHeap () returned 0x630000 [0059.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0059.867] GetProcessHeap () returned 0x630000 [0059.867] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0059.867] GetProcessHeap () returned 0x630000 [0059.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0059.867] GetProcessHeap () returned 0x630000 [0059.867] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0059.867] GetProcessHeap () returned 0x630000 [0059.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0059.868] GetProcessHeap () returned 0x630000 [0059.868] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.868] GetProcessHeap () returned 0x630000 [0059.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.868] GetProcessHeap () returned 0x630000 [0059.868] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.868] GetProcessHeap () returned 0x630000 [0059.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.868] GetProcessHeap () returned 0x630000 [0059.868] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0059.868] GetProcessHeap () returned 0x630000 [0059.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0059.868] GetProcessHeap () returned 0x630000 [0059.868] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0059.868] GetProcessHeap () returned 0x630000 [0059.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0059.868] GetProcessHeap () returned 0x630000 [0059.868] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a188 [0059.868] GetProcessHeap () returned 0x630000 [0059.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a188 | out: hHeap=0x630000) returned 1 [0059.868] GetProcessHeap () returned 0x630000 [0059.868] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.868] GetProcessHeap () returned 0x630000 [0059.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.868] GetProcessHeap () returned 0x630000 [0059.868] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1a8 [0059.868] GetProcessHeap () returned 0x630000 [0059.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1a8 | out: hHeap=0x630000) returned 1 [0059.868] GetProcessHeap () returned 0x630000 [0059.868] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0059.868] GetProcessHeap () returned 0x630000 [0059.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0059.868] GetProcessHeap () returned 0x630000 [0059.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0059.868] GetProcessHeap () returned 0x630000 [0059.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0059.868] GetProcessHeap () returned 0x630000 [0059.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0059.869] GetProcessHeap () returned 0x630000 [0059.869] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0059.869] GetProcessHeap () returned 0x630000 [0059.869] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0059.869] GetProcessHeap () returned 0x630000 [0059.869] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0059.869] GetProcessHeap () returned 0x630000 [0059.869] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0059.869] GetProcessHeap () returned 0x630000 [0059.869] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0059.869] GetProcessHeap () returned 0x630000 [0059.869] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0059.869] GetProcessHeap () returned 0x630000 [0059.869] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.869] GetProcessHeap () returned 0x630000 [0059.869] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0059.869] WriteFile (in: hFile=0x230, lpBuffer=0x654180*, nNumberOfBytesToWrite=0x38d, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654180*, lpNumberOfBytesWritten=0x243d864*=0x38d, lpOverlapped=0x0) returned 1 [0059.871] GetProcessHeap () returned 0x630000 [0059.871] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x654180, Size=0x30) returned 0x654180 [0059.871] GetProcessHeap () returned 0x630000 [0059.871] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0059.871] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.871] GetProcessHeap () returned 0x630000 [0059.871] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10410) returned 0x661be8 [0059.873] ReadFile (in: hFile=0x230, lpBuffer=0x661be8, nNumberOfBytesToRead=0x10410, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661be8*, lpNumberOfBytesRead=0x243d7e8*=0x10410, lpOverlapped=0x0) returned 1 [0059.874] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.874] WriteFile (in: hFile=0x230, lpBuffer=0x661be8*, nNumberOfBytesToWrite=0x10410, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661be8*, lpNumberOfBytesWritten=0x243d7e4*=0x10410, lpOverlapped=0x0) returned 1 [0059.877] GetProcessHeap () returned 0x630000 [0059.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661be8 | out: hHeap=0x630000) returned 1 [0059.877] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.877] WriteFile (in: hFile=0x230, lpBuffer=0x654180*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654180*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0059.891] CloseHandle (hObject=0x230) returned 1 [0059.893] GetProcessHeap () returned 0x630000 [0059.893] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0059.893] GetProcessHeap () returned 0x630000 [0059.893] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655b20 | out: hHeap=0x630000) returned 1 [0059.893] GetProcessHeap () returned 0x630000 [0059.893] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0059.893] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\g-2mYacKrynw43.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\g-2mYacKrynw43.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\g-2mYacKrynw43.jpg" [0059.894] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\g-2mYacKrynw43.jpg", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\g-2mYacKrynw43.jpg.happythreechoose") returned="C:\\Users\\FD1HVy\\Pictures\\g-2mYacKrynw43.jpg.happythreechoose" [0059.894] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\g-2mYacKrynw43.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\g-2myackrynw43.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\g-2mYacKrynw43.jpg.happythreechoose" (normalized: "c:\\users\\fd1hvy\\pictures\\g-2myackrynw43.jpg.happythreechoose"), dwFlags=0x1) returned 1 [0059.894] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\g-2mYacKrynw43.jpg" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0059.894] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0059.894] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" [0059.894] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\pictures\\decryption info.html")) returned 0x20 [0059.894] GetProcessHeap () returned 0x630000 [0059.894] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645c58 | out: hHeap=0x630000) returned 1 [0059.894] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a3f3c50, ftCreationTime.dwHighDateTime=0x1d5cd2a, ftLastAccessTime.dwLowDateTime=0x400fd9b0, ftLastAccessTime.dwHighDateTime=0x1d5cb15, ftLastWriteTime.dwLowDateTime=0x400fd9b0, ftLastWriteTime.dwHighDateTime=0x1d5cb15, nFileSizeHigh=0x0, nFileSizeLow=0x16a31, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ggL8qjzKkKvv34z2Ow j.jpg", cAlternateFileName="GGL8QJ~1.JPG")) returned 1 [0059.894] lstrcmpiW (lpString1="ggL8qjzKkKvv34z2Ow j.jpg", lpString2=".") returned 1 [0059.894] lstrcmpiW (lpString1="ggL8qjzKkKvv34z2Ow j.jpg", lpString2="..") returned 1 [0059.895] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="ggL8qjzKkKvv34z2Ow j.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\ggL8qjzKkKvv34z2Ow j.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\ggL8qjzKkKvv34z2Ow j.jpg" [0059.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ggL8qjzKkKvv34z2Ow j.jpg", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0059.895] GetProcessHeap () returned 0x630000 [0059.895] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x19) returned 0x651ec0 [0059.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ggL8qjzKkKvv34z2Ow j.jpg", cchWideChar=-1, lpMultiByteStr=0x651ec0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ggL8qjzKkKvv34z2Ow j.jpg", lpUsedDefaultChar=0x0) returned 25 [0059.895] lstrlenA (lpString="ggL8qjzKkKvv34z2Ow j.jpg") returned 24 [0059.895] lstrlenA (lpString=".happythreechoose") returned 17 [0059.895] lstrlenA (lpString=".happythreechoose") returned 17 [0059.895] lstrlenA (lpString="ggL8qjzKkKvv34z2Ow j.jpg") returned 24 [0059.895] lstrcmpiA (lpString1="KkKvv34z2Ow j.jpg", lpString2=".happythreechoose") returned 1 [0059.895] lstrcmpiW (lpString1="ggL8qjzKkKvv34z2Ow j.jpg", lpString2="Decryption INFO.html") returned 1 [0059.895] lstrcmpiW (lpString1="ggL8qjzKkKvv34z2Ow j.jpg", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0059.895] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0059.895] lstrcmpiW (lpString1="ggL8qjzKkKvv34z2Ow j.jpg", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0059.895] GetProcessHeap () returned 0x630000 [0059.895] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0059.895] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ggL8qjzKkKvv34z2Ow j.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ggl8qjzkkkvv34z2ow j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0059.895] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=92721) returned 1 [0059.895] GetProcessHeap () returned 0x630000 [0059.895] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6557d8 [0059.895] GetProcessHeap () returned 0x630000 [0059.895] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0059.895] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\ggL8qjzKkKvv34z2Ow j.jpg") returned 49 [0059.895] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.895] GetProcessHeap () returned 0x630000 [0059.895] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0059.895] GetProcessHeap () returned 0x630000 [0059.895] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x6541b8 [0059.896] lstrlenA (lpString="rsa_encrypt") returned 11 [0059.896] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0059.896] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0059.896] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0059.896] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0059.896] GetProcessHeap () returned 0x630000 [0059.896] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0059.896] lstrlenA (lpString="010001") returned 6 [0059.896] GetProcessHeap () returned 0x630000 [0059.896] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0059.896] GetProcessHeap () returned 0x630000 [0059.896] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.896] GetProcessHeap () returned 0x630000 [0059.896] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e580 [0059.896] GetProcessHeap () returned 0x630000 [0059.896] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.897] GetProcessHeap () returned 0x630000 [0059.897] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e730 [0059.897] GetProcessHeap () returned 0x630000 [0059.897] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656fe0 [0059.897] GetProcessHeap () returned 0x630000 [0059.897] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0059.897] GetProcessHeap () returned 0x630000 [0059.897] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0059.897] GetProcessHeap () returned 0x630000 [0059.897] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.897] GetProcessHeap () returned 0x630000 [0059.897] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0059.897] GetProcessHeap () returned 0x630000 [0059.897] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.897] GetProcessHeap () returned 0x630000 [0059.897] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656b80 [0059.897] GetProcessHeap () returned 0x630000 [0059.897] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.897] GetProcessHeap () returned 0x630000 [0059.897] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0059.897] GetProcessHeap () returned 0x630000 [0059.897] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ebb0 [0059.897] GetProcessHeap () returned 0x630000 [0059.897] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.897] GetProcessHeap () returned 0x630000 [0059.897] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0059.897] GetProcessHeap () returned 0x630000 [0059.897] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0059.897] GetProcessHeap () returned 0x630000 [0059.897] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0059.897] GetProcessHeap () returned 0x630000 [0059.897] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0059.897] GetProcessHeap () returned 0x630000 [0059.897] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.897] GetProcessHeap () returned 0x630000 [0059.897] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0059.897] GetProcessHeap () returned 0x630000 [0059.897] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0059.897] GetProcessHeap () returned 0x630000 [0059.898] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0059.898] GetProcessHeap () returned 0x630000 [0059.898] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65dec0 [0059.898] GetProcessHeap () returned 0x630000 [0059.898] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0059.898] GetProcessHeap () returned 0x630000 [0059.898] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0059.898] GetProcessHeap () returned 0x630000 [0059.898] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0059.898] GetProcessHeap () returned 0x630000 [0059.898] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0059.898] GetProcessHeap () returned 0x630000 [0059.898] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0059.898] GetProcessHeap () returned 0x630000 [0059.898] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1a8 [0059.898] GetProcessHeap () returned 0x630000 [0059.898] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1a8 | out: hHeap=0x630000) returned 1 [0059.898] GetProcessHeap () returned 0x630000 [0059.898] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0059.898] GetProcessHeap () returned 0x630000 [0059.898] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0059.898] GetProcessHeap () returned 0x630000 [0059.898] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.898] GetProcessHeap () returned 0x630000 [0059.898] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.898] GetProcessHeap () returned 0x630000 [0059.898] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.898] GetProcessHeap () returned 0x630000 [0059.898] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.898] GetProcessHeap () returned 0x630000 [0059.898] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0059.898] GetProcessHeap () returned 0x630000 [0059.898] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0059.898] GetProcessHeap () returned 0x630000 [0059.898] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0059.898] GetProcessHeap () returned 0x630000 [0059.898] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0059.898] GetProcessHeap () returned 0x630000 [0059.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0059.899] GetProcessHeap () returned 0x630000 [0059.899] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0059.899] GetProcessHeap () returned 0x630000 [0059.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a208 [0059.899] GetProcessHeap () returned 0x630000 [0059.899] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a208 | out: hHeap=0x630000) returned 1 [0059.899] GetProcessHeap () returned 0x630000 [0059.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1a8 [0059.899] GetProcessHeap () returned 0x630000 [0059.899] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1a8 | out: hHeap=0x630000) returned 1 [0059.899] GetProcessHeap () returned 0x630000 [0059.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0059.899] GetProcessHeap () returned 0x630000 [0059.899] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0059.899] GetProcessHeap () returned 0x630000 [0059.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0059.899] GetProcessHeap () returned 0x630000 [0059.899] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0059.899] GetProcessHeap () returned 0x630000 [0059.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0059.899] GetProcessHeap () returned 0x630000 [0059.899] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0059.899] GetProcessHeap () returned 0x630000 [0059.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a188 [0059.899] GetProcessHeap () returned 0x630000 [0059.899] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a188 | out: hHeap=0x630000) returned 1 [0059.899] GetProcessHeap () returned 0x630000 [0059.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0059.899] GetProcessHeap () returned 0x630000 [0059.899] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0059.899] GetProcessHeap () returned 0x630000 [0059.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a188 [0059.899] GetProcessHeap () returned 0x630000 [0059.899] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a188 | out: hHeap=0x630000) returned 1 [0059.899] GetProcessHeap () returned 0x630000 [0059.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0059.899] GetProcessHeap () returned 0x630000 [0059.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0059.900] GetProcessHeap () returned 0x630000 [0059.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.900] GetProcessHeap () returned 0x630000 [0059.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.900] GetProcessHeap () returned 0x630000 [0059.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0e8 [0059.900] GetProcessHeap () returned 0x630000 [0059.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0e8 | out: hHeap=0x630000) returned 1 [0059.900] GetProcessHeap () returned 0x630000 [0059.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0059.900] GetProcessHeap () returned 0x630000 [0059.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0059.900] GetProcessHeap () returned 0x630000 [0059.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0059.900] GetProcessHeap () returned 0x630000 [0059.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.900] GetProcessHeap () returned 0x630000 [0059.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0059.900] GetProcessHeap () returned 0x630000 [0059.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0059.900] GetProcessHeap () returned 0x630000 [0059.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0059.900] GetProcessHeap () returned 0x630000 [0059.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.900] GetProcessHeap () returned 0x630000 [0059.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0059.900] GetProcessHeap () returned 0x630000 [0059.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0059.900] GetProcessHeap () returned 0x630000 [0059.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a188 [0059.900] GetProcessHeap () returned 0x630000 [0059.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a188 | out: hHeap=0x630000) returned 1 [0059.900] GetProcessHeap () returned 0x630000 [0059.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0059.900] GetProcessHeap () returned 0x630000 [0059.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0059.901] GetProcessHeap () returned 0x630000 [0059.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0059.901] GetProcessHeap () returned 0x630000 [0059.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0059.901] GetProcessHeap () returned 0x630000 [0059.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0059.901] GetProcessHeap () returned 0x630000 [0059.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0059.901] GetProcessHeap () returned 0x630000 [0059.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0059.901] GetProcessHeap () returned 0x630000 [0059.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0059.901] GetProcessHeap () returned 0x630000 [0059.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a208 [0059.901] GetProcessHeap () returned 0x630000 [0059.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a208 | out: hHeap=0x630000) returned 1 [0059.901] GetProcessHeap () returned 0x630000 [0059.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.901] GetProcessHeap () returned 0x630000 [0059.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.901] GetProcessHeap () returned 0x630000 [0059.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0059.901] GetProcessHeap () returned 0x630000 [0059.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0059.901] GetProcessHeap () returned 0x630000 [0059.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0059.901] GetProcessHeap () returned 0x630000 [0059.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.901] GetProcessHeap () returned 0x630000 [0059.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a188 [0059.901] GetProcessHeap () returned 0x630000 [0059.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a188 | out: hHeap=0x630000) returned 1 [0059.901] GetProcessHeap () returned 0x630000 [0059.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0059.901] GetProcessHeap () returned 0x630000 [0059.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0059.901] GetProcessHeap () returned 0x630000 [0059.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0059.902] GetProcessHeap () returned 0x630000 [0059.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0059.902] GetProcessHeap () returned 0x630000 [0059.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0059.902] GetProcessHeap () returned 0x630000 [0059.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0059.902] GetProcessHeap () returned 0x630000 [0059.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a208 [0059.902] GetProcessHeap () returned 0x630000 [0059.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a208 | out: hHeap=0x630000) returned 1 [0059.902] GetProcessHeap () returned 0x630000 [0059.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0059.902] GetProcessHeap () returned 0x630000 [0059.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.902] GetProcessHeap () returned 0x630000 [0059.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0059.902] GetProcessHeap () returned 0x630000 [0059.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0059.902] GetProcessHeap () returned 0x630000 [0059.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.902] GetProcessHeap () returned 0x630000 [0059.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.902] GetProcessHeap () returned 0x630000 [0059.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0059.902] GetProcessHeap () returned 0x630000 [0059.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0059.902] GetProcessHeap () returned 0x630000 [0059.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0059.902] GetProcessHeap () returned 0x630000 [0059.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0059.902] GetProcessHeap () returned 0x630000 [0059.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0059.902] GetProcessHeap () returned 0x630000 [0059.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0059.902] GetProcessHeap () returned 0x630000 [0059.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0059.903] GetProcessHeap () returned 0x630000 [0059.903] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0059.903] GetProcessHeap () returned 0x630000 [0059.903] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0059.903] GetProcessHeap () returned 0x630000 [0059.903] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.903] GetProcessHeap () returned 0x630000 [0059.903] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0059.903] WriteFile (in: hFile=0x230, lpBuffer=0x6541b8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6541b8*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0059.905] GetProcessHeap () returned 0x630000 [0059.905] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6541b8, Size=0x30) returned 0x6541b8 [0059.905] GetProcessHeap () returned 0x630000 [0059.905] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0059.905] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.905] GetProcessHeap () returned 0x630000 [0059.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16a31) returned 0x661be8 [0059.906] ReadFile (in: hFile=0x230, lpBuffer=0x661be8, nNumberOfBytesToRead=0x16a31, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661be8*, lpNumberOfBytesRead=0x243d7e8*=0x16a31, lpOverlapped=0x0) returned 1 [0059.907] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.907] WriteFile (in: hFile=0x230, lpBuffer=0x661be8*, nNumberOfBytesToWrite=0x16a31, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661be8*, lpNumberOfBytesWritten=0x243d7e4*=0x16a31, lpOverlapped=0x0) returned 1 [0059.909] GetProcessHeap () returned 0x630000 [0059.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661be8 | out: hHeap=0x630000) returned 1 [0059.910] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.910] WriteFile (in: hFile=0x230, lpBuffer=0x6541b8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6541b8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0059.911] CloseHandle (hObject=0x230) returned 1 [0059.914] GetProcessHeap () returned 0x630000 [0059.914] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0059.914] GetProcessHeap () returned 0x630000 [0059.914] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6557d8 | out: hHeap=0x630000) returned 1 [0059.914] GetProcessHeap () returned 0x630000 [0059.914] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0059.914] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\ggL8qjzKkKvv34z2Ow j.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\ggL8qjzKkKvv34z2Ow j.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\ggL8qjzKkKvv34z2Ow j.jpg" [0059.914] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\ggL8qjzKkKvv34z2Ow j.jpg", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\ggL8qjzKkKvv34z2Ow j.jpg.happythreechoose") returned="C:\\Users\\FD1HVy\\Pictures\\ggL8qjzKkKvv34z2Ow j.jpg.happythreechoose" [0059.914] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\ggL8qjzKkKvv34z2Ow j.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ggl8qjzkkkvv34z2ow j.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\ggL8qjzKkKvv34z2Ow j.jpg.happythreechoose" (normalized: "c:\\users\\fd1hvy\\pictures\\ggl8qjzkkkvv34z2ow j.jpg.happythreechoose"), dwFlags=0x1) returned 1 [0059.915] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\ggL8qjzKkKvv34z2Ow j.jpg" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0059.915] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0059.915] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" [0059.915] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\pictures\\decryption info.html")) returned 0x20 [0059.915] GetProcessHeap () returned 0x630000 [0059.915] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651ec0 | out: hHeap=0x630000) returned 1 [0059.915] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43e10730, ftCreationTime.dwHighDateTime=0x1d5ccdc, ftLastAccessTime.dwLowDateTime=0x62baa7f0, ftLastAccessTime.dwHighDateTime=0x1d5ce90, ftLastWriteTime.dwLowDateTime=0x62baa7f0, ftLastWriteTime.dwHighDateTime=0x1d5ce90, nFileSizeHigh=0x0, nFileSizeLow=0x15c5c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="izseTU9WJ4k9Fj.bmp", cAlternateFileName="IZSETU~1.BMP")) returned 1 [0059.915] lstrcmpiW (lpString1="izseTU9WJ4k9Fj.bmp", lpString2=".") returned 1 [0059.915] lstrcmpiW (lpString1="izseTU9WJ4k9Fj.bmp", lpString2="..") returned 1 [0059.915] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="izseTU9WJ4k9Fj.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\izseTU9WJ4k9Fj.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\izseTU9WJ4k9Fj.bmp" [0059.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="izseTU9WJ4k9Fj.bmp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0059.915] GetProcessHeap () returned 0x630000 [0059.915] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x13) returned 0x645ed8 [0059.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="izseTU9WJ4k9Fj.bmp", cchWideChar=-1, lpMultiByteStr=0x645ed8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="izseTU9WJ4k9Fj.bmp", lpUsedDefaultChar=0x0) returned 19 [0059.915] lstrlenA (lpString="izseTU9WJ4k9Fj.bmp") returned 18 [0059.915] lstrlenA (lpString=".happythreechoose") returned 17 [0059.916] lstrlenA (lpString=".happythreechoose") returned 17 [0059.916] lstrlenA (lpString="izseTU9WJ4k9Fj.bmp") returned 18 [0059.916] lstrcmpiA (lpString1="zseTU9WJ4k9Fj.bmp", lpString2=".happythreechoose") returned 1 [0059.916] lstrcmpiW (lpString1="izseTU9WJ4k9Fj.bmp", lpString2="Decryption INFO.html") returned 1 [0059.916] lstrcmpiW (lpString1="izseTU9WJ4k9Fj.bmp", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0059.916] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0059.916] lstrcmpiW (lpString1="izseTU9WJ4k9Fj.bmp", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0059.916] GetProcessHeap () returned 0x630000 [0059.916] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0059.916] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\izseTU9WJ4k9Fj.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\izsetu9wj4k9fj.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0059.916] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=89180) returned 1 [0059.916] GetProcessHeap () returned 0x630000 [0059.916] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655b20 [0059.916] GetProcessHeap () returned 0x630000 [0059.916] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0059.916] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\izseTU9WJ4k9Fj.bmp") returned 43 [0059.916] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.916] GetProcessHeap () returned 0x630000 [0059.916] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0059.916] GetProcessHeap () returned 0x630000 [0059.916] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x384) returned 0x6541f0 [0059.916] lstrlenA (lpString="rsa_encrypt") returned 11 [0059.916] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0059.917] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0059.917] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0059.917] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0059.917] GetProcessHeap () returned 0x630000 [0059.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0059.917] lstrlenA (lpString="010001") returned 6 [0059.917] GetProcessHeap () returned 0x630000 [0059.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0059.917] GetProcessHeap () returned 0x630000 [0059.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.917] GetProcessHeap () returned 0x630000 [0059.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea00 [0059.917] GetProcessHeap () returned 0x630000 [0059.917] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.917] GetProcessHeap () returned 0x630000 [0059.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e2b0 [0059.917] GetProcessHeap () returned 0x630000 [0059.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657788 [0059.917] GetProcessHeap () returned 0x630000 [0059.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0059.917] GetProcessHeap () returned 0x630000 [0059.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0059.917] GetProcessHeap () returned 0x630000 [0059.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.918] GetProcessHeap () returned 0x630000 [0059.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0059.918] GetProcessHeap () returned 0x630000 [0059.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.918] GetProcessHeap () returned 0x630000 [0059.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657558 [0059.918] GetProcessHeap () returned 0x630000 [0059.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.918] GetProcessHeap () returned 0x630000 [0059.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0059.918] GetProcessHeap () returned 0x630000 [0059.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65df50 [0059.918] GetProcessHeap () returned 0x630000 [0059.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.918] GetProcessHeap () returned 0x630000 [0059.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0059.918] GetProcessHeap () returned 0x630000 [0059.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0059.918] GetProcessHeap () returned 0x630000 [0059.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a188 [0059.918] GetProcessHeap () returned 0x630000 [0059.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0059.918] GetProcessHeap () returned 0x630000 [0059.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.918] GetProcessHeap () returned 0x630000 [0059.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a188 | out: hHeap=0x630000) returned 1 [0059.918] GetProcessHeap () returned 0x630000 [0059.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0059.918] GetProcessHeap () returned 0x630000 [0059.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0059.918] GetProcessHeap () returned 0x630000 [0059.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e8e0 [0059.918] GetProcessHeap () returned 0x630000 [0059.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0059.918] GetProcessHeap () returned 0x630000 [0059.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0059.918] GetProcessHeap () returned 0x630000 [0059.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0059.919] GetProcessHeap () returned 0x630000 [0059.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.919] GetProcessHeap () returned 0x630000 [0059.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.919] GetProcessHeap () returned 0x630000 [0059.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.919] GetProcessHeap () returned 0x630000 [0059.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.919] GetProcessHeap () returned 0x630000 [0059.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.919] GetProcessHeap () returned 0x630000 [0059.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.919] GetProcessHeap () returned 0x630000 [0059.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0059.919] GetProcessHeap () returned 0x630000 [0059.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0059.919] GetProcessHeap () returned 0x630000 [0059.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.919] GetProcessHeap () returned 0x630000 [0059.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.919] GetProcessHeap () returned 0x630000 [0059.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0059.919] GetProcessHeap () returned 0x630000 [0059.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0059.919] GetProcessHeap () returned 0x630000 [0059.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1a8 [0059.919] GetProcessHeap () returned 0x630000 [0059.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1a8 | out: hHeap=0x630000) returned 1 [0059.919] GetProcessHeap () returned 0x630000 [0059.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.919] GetProcessHeap () returned 0x630000 [0059.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.919] GetProcessHeap () returned 0x630000 [0059.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0059.919] GetProcessHeap () returned 0x630000 [0059.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0059.919] GetProcessHeap () returned 0x630000 [0059.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a208 [0059.920] GetProcessHeap () returned 0x630000 [0059.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a208 | out: hHeap=0x630000) returned 1 [0059.920] GetProcessHeap () returned 0x630000 [0059.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0059.920] GetProcessHeap () returned 0x630000 [0059.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0059.920] GetProcessHeap () returned 0x630000 [0059.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.920] GetProcessHeap () returned 0x630000 [0059.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.920] GetProcessHeap () returned 0x630000 [0059.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0059.920] GetProcessHeap () returned 0x630000 [0059.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0059.920] GetProcessHeap () returned 0x630000 [0059.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0059.920] GetProcessHeap () returned 0x630000 [0059.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0059.920] GetProcessHeap () returned 0x630000 [0059.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0059.920] GetProcessHeap () returned 0x630000 [0059.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0059.920] GetProcessHeap () returned 0x630000 [0059.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a208 [0059.920] GetProcessHeap () returned 0x630000 [0059.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a208 | out: hHeap=0x630000) returned 1 [0059.920] GetProcessHeap () returned 0x630000 [0059.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0059.920] GetProcessHeap () returned 0x630000 [0059.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.920] GetProcessHeap () returned 0x630000 [0059.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0059.920] GetProcessHeap () returned 0x630000 [0059.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0059.920] GetProcessHeap () returned 0x630000 [0059.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.921] GetProcessHeap () returned 0x630000 [0059.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.921] GetProcessHeap () returned 0x630000 [0059.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1a8 [0059.921] GetProcessHeap () returned 0x630000 [0059.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1a8 | out: hHeap=0x630000) returned 1 [0059.921] GetProcessHeap () returned 0x630000 [0059.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0059.921] GetProcessHeap () returned 0x630000 [0059.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0059.921] GetProcessHeap () returned 0x630000 [0059.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0059.921] GetProcessHeap () returned 0x630000 [0059.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0059.921] GetProcessHeap () returned 0x630000 [0059.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.921] GetProcessHeap () returned 0x630000 [0059.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.921] GetProcessHeap () returned 0x630000 [0059.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.921] GetProcessHeap () returned 0x630000 [0059.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.921] GetProcessHeap () returned 0x630000 [0059.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.921] GetProcessHeap () returned 0x630000 [0059.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.921] GetProcessHeap () returned 0x630000 [0059.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0059.921] GetProcessHeap () returned 0x630000 [0059.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.921] GetProcessHeap () returned 0x630000 [0059.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0059.921] GetProcessHeap () returned 0x630000 [0059.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0059.921] GetProcessHeap () returned 0x630000 [0059.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0059.921] GetProcessHeap () returned 0x630000 [0059.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0059.921] GetProcessHeap () returned 0x630000 [0059.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0059.922] GetProcessHeap () returned 0x630000 [0059.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0059.922] GetProcessHeap () returned 0x630000 [0059.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0059.922] GetProcessHeap () returned 0x630000 [0059.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0059.922] GetProcessHeap () returned 0x630000 [0059.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0059.922] GetProcessHeap () returned 0x630000 [0059.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.922] GetProcessHeap () returned 0x630000 [0059.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0059.922] GetProcessHeap () returned 0x630000 [0059.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0059.923] GetProcessHeap () returned 0x630000 [0059.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0059.923] GetProcessHeap () returned 0x630000 [0059.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0059.923] GetProcessHeap () returned 0x630000 [0059.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0059.923] GetProcessHeap () returned 0x630000 [0059.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0059.923] GetProcessHeap () returned 0x630000 [0059.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0059.923] GetProcessHeap () returned 0x630000 [0059.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0059.923] GetProcessHeap () returned 0x630000 [0059.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0059.923] GetProcessHeap () returned 0x630000 [0059.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0059.923] GetProcessHeap () returned 0x630000 [0059.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.923] GetProcessHeap () returned 0x630000 [0059.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.923] GetProcessHeap () returned 0x630000 [0059.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.923] GetProcessHeap () returned 0x630000 [0059.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.923] GetProcessHeap () returned 0x630000 [0059.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0059.923] GetProcessHeap () returned 0x630000 [0059.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0059.923] GetProcessHeap () returned 0x630000 [0059.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.923] GetProcessHeap () returned 0x630000 [0059.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.924] GetProcessHeap () returned 0x630000 [0059.924] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0059.924] GetProcessHeap () returned 0x630000 [0059.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0059.924] GetProcessHeap () returned 0x630000 [0059.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0059.924] GetProcessHeap () returned 0x630000 [0059.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0059.924] GetProcessHeap () returned 0x630000 [0059.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0059.924] GetProcessHeap () returned 0x630000 [0059.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0059.924] GetProcessHeap () returned 0x630000 [0059.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0059.924] GetProcessHeap () returned 0x630000 [0059.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e2b0 | out: hHeap=0x630000) returned 1 [0059.924] GetProcessHeap () returned 0x630000 [0059.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0059.924] GetProcessHeap () returned 0x630000 [0059.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0059.924] GetProcessHeap () returned 0x630000 [0059.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0059.924] GetProcessHeap () returned 0x630000 [0059.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.924] GetProcessHeap () returned 0x630000 [0059.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0059.924] WriteFile (in: hFile=0x230, lpBuffer=0x6541f0*, nNumberOfBytesToWrite=0x384, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6541f0*, lpNumberOfBytesWritten=0x243d864*=0x384, lpOverlapped=0x0) returned 1 [0059.926] GetProcessHeap () returned 0x630000 [0059.926] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6541f0, Size=0x30) returned 0x6541f0 [0059.926] GetProcessHeap () returned 0x630000 [0059.926] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0059.926] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.926] GetProcessHeap () returned 0x630000 [0059.926] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x15c60) returned 0x661be8 [0059.929] ReadFile (in: hFile=0x230, lpBuffer=0x661be8, nNumberOfBytesToRead=0x15c60, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661be8*, lpNumberOfBytesRead=0x243d7e8*=0x15c60, lpOverlapped=0x0) returned 1 [0059.930] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.930] WriteFile (in: hFile=0x230, lpBuffer=0x661be8*, nNumberOfBytesToWrite=0x15c60, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661be8*, lpNumberOfBytesWritten=0x243d7e4*=0x15c60, lpOverlapped=0x0) returned 1 [0059.932] GetProcessHeap () returned 0x630000 [0059.932] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661be8 | out: hHeap=0x630000) returned 1 [0059.932] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.932] WriteFile (in: hFile=0x230, lpBuffer=0x6541f0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6541f0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0059.936] CloseHandle (hObject=0x230) returned 1 [0059.939] GetProcessHeap () returned 0x630000 [0059.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0059.939] GetProcessHeap () returned 0x630000 [0059.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655b20 | out: hHeap=0x630000) returned 1 [0059.939] GetProcessHeap () returned 0x630000 [0059.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0059.939] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\izseTU9WJ4k9Fj.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\izseTU9WJ4k9Fj.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\izseTU9WJ4k9Fj.bmp" [0059.939] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\izseTU9WJ4k9Fj.bmp", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\izseTU9WJ4k9Fj.bmp.happythreechoose") returned="C:\\Users\\FD1HVy\\Pictures\\izseTU9WJ4k9Fj.bmp.happythreechoose" [0059.939] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\izseTU9WJ4k9Fj.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\izsetu9wj4k9fj.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\izseTU9WJ4k9Fj.bmp.happythreechoose" (normalized: "c:\\users\\fd1hvy\\pictures\\izsetu9wj4k9fj.bmp.happythreechoose"), dwFlags=0x1) returned 1 [0059.941] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\izseTU9WJ4k9Fj.bmp" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0059.941] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0059.941] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" [0059.941] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\pictures\\decryption info.html")) returned 0x20 [0059.941] GetProcessHeap () returned 0x630000 [0059.941] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645ed8 | out: hHeap=0x630000) returned 1 [0059.941] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa823a50, ftCreationTime.dwHighDateTime=0x1d5c79a, ftLastAccessTime.dwLowDateTime=0x5f398790, ftLastAccessTime.dwHighDateTime=0x1d5cc0b, ftLastWriteTime.dwLowDateTime=0x5f398790, ftLastWriteTime.dwHighDateTime=0x1d5cc0b, nFileSizeHigh=0x0, nFileSizeLow=0x28a4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="kloRG2tolBYZLd.png", cAlternateFileName="KLORG2~1.PNG")) returned 1 [0059.941] lstrcmpiW (lpString1="kloRG2tolBYZLd.png", lpString2=".") returned 1 [0059.941] lstrcmpiW (lpString1="kloRG2tolBYZLd.png", lpString2="..") returned 1 [0059.942] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="kloRG2tolBYZLd.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\kloRG2tolBYZLd.png") returned="C:\\Users\\FD1HVy\\Pictures\\kloRG2tolBYZLd.png" [0059.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kloRG2tolBYZLd.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0059.942] GetProcessHeap () returned 0x630000 [0059.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x13) returned 0x645cd8 [0059.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kloRG2tolBYZLd.png", cchWideChar=-1, lpMultiByteStr=0x645cd8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kloRG2tolBYZLd.png", lpUsedDefaultChar=0x0) returned 19 [0059.942] lstrlenA (lpString="kloRG2tolBYZLd.png") returned 18 [0059.942] lstrlenA (lpString=".happythreechoose") returned 17 [0059.942] lstrlenA (lpString=".happythreechoose") returned 17 [0059.942] lstrlenA (lpString="kloRG2tolBYZLd.png") returned 18 [0059.942] lstrcmpiA (lpString1="loRG2tolBYZLd.png", lpString2=".happythreechoose") returned 1 [0059.942] lstrcmpiW (lpString1="kloRG2tolBYZLd.png", lpString2="Decryption INFO.html") returned 1 [0059.942] lstrcmpiW (lpString1="kloRG2tolBYZLd.png", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0059.942] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0059.942] lstrcmpiW (lpString1="kloRG2tolBYZLd.png", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0059.942] GetProcessHeap () returned 0x630000 [0059.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0059.942] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\kloRG2tolBYZLd.png" (normalized: "c:\\users\\fd1hvy\\pictures\\klorg2tolbyzld.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0059.942] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=10404) returned 1 [0059.942] GetProcessHeap () returned 0x630000 [0059.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6555f8 [0059.942] GetProcessHeap () returned 0x630000 [0059.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0059.942] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\kloRG2tolBYZLd.png") returned 43 [0059.942] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0059.942] GetProcessHeap () returned 0x630000 [0059.943] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0059.943] GetProcessHeap () returned 0x630000 [0059.943] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x654228 [0059.943] lstrlenA (lpString="rsa_encrypt") returned 11 [0059.943] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0059.943] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0059.943] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0059.943] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0059.943] GetProcessHeap () returned 0x630000 [0059.943] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0059.943] lstrlenA (lpString="010001") returned 6 [0059.943] GetProcessHeap () returned 0x630000 [0059.943] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0059.944] GetProcessHeap () returned 0x630000 [0059.944] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.944] GetProcessHeap () returned 0x630000 [0059.944] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e850 [0059.944] GetProcessHeap () returned 0x630000 [0059.944] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.944] GetProcessHeap () returned 0x630000 [0059.944] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e4f0 [0059.944] GetProcessHeap () returned 0x630000 [0059.944] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656950 [0059.944] GetProcessHeap () returned 0x630000 [0059.944] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0059.944] GetProcessHeap () returned 0x630000 [0059.944] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0059.944] GetProcessHeap () returned 0x630000 [0059.944] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.945] GetProcessHeap () returned 0x630000 [0059.945] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0059.945] GetProcessHeap () returned 0x630000 [0059.945] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0059.945] GetProcessHeap () returned 0x630000 [0059.945] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657670 [0059.945] GetProcessHeap () returned 0x630000 [0059.945] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0059.945] GetProcessHeap () returned 0x630000 [0059.945] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0059.946] GetProcessHeap () returned 0x630000 [0059.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e6a0 [0059.946] GetProcessHeap () returned 0x630000 [0059.946] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0059.946] GetProcessHeap () returned 0x630000 [0059.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0059.946] GetProcessHeap () returned 0x630000 [0059.946] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e6a0 | out: hHeap=0x630000) returned 1 [0059.946] GetProcessHeap () returned 0x630000 [0059.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0059.946] GetProcessHeap () returned 0x630000 [0059.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0059.946] GetProcessHeap () returned 0x630000 [0059.946] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0059.946] GetProcessHeap () returned 0x630000 [0059.946] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0059.946] GetProcessHeap () returned 0x630000 [0059.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.946] GetProcessHeap () returned 0x630000 [0059.946] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.946] GetProcessHeap () returned 0x630000 [0059.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e7c0 [0059.946] GetProcessHeap () returned 0x630000 [0059.946] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0059.946] GetProcessHeap () returned 0x630000 [0059.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0059.946] GetProcessHeap () returned 0x630000 [0059.946] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e7c0 | out: hHeap=0x630000) returned 1 [0059.946] GetProcessHeap () returned 0x630000 [0059.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0059.946] GetProcessHeap () returned 0x630000 [0059.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0059.947] GetProcessHeap () returned 0x630000 [0059.947] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a188 [0059.947] GetProcessHeap () returned 0x630000 [0059.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a188 | out: hHeap=0x630000) returned 1 [0059.947] GetProcessHeap () returned 0x630000 [0059.947] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0059.947] GetProcessHeap () returned 0x630000 [0059.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0059.947] GetProcessHeap () returned 0x630000 [0059.947] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1a8 [0059.948] GetProcessHeap () returned 0x630000 [0059.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1a8 | out: hHeap=0x630000) returned 1 [0059.948] GetProcessHeap () returned 0x630000 [0059.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0059.948] GetProcessHeap () returned 0x630000 [0059.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0059.948] GetProcessHeap () returned 0x630000 [0059.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0059.948] GetProcessHeap () returned 0x630000 [0059.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0059.948] GetProcessHeap () returned 0x630000 [0059.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0059.948] GetProcessHeap () returned 0x630000 [0059.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0059.948] GetProcessHeap () returned 0x630000 [0059.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0059.948] GetProcessHeap () returned 0x630000 [0059.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0059.948] GetProcessHeap () returned 0x630000 [0059.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0059.948] GetProcessHeap () returned 0x630000 [0059.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0059.948] GetProcessHeap () returned 0x630000 [0059.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.948] GetProcessHeap () returned 0x630000 [0059.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.948] GetProcessHeap () returned 0x630000 [0059.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a208 [0059.948] GetProcessHeap () returned 0x630000 [0059.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a208 | out: hHeap=0x630000) returned 1 [0059.949] GetProcessHeap () returned 0x630000 [0059.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0059.949] GetProcessHeap () returned 0x630000 [0059.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.949] GetProcessHeap () returned 0x630000 [0059.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0059.949] GetProcessHeap () returned 0x630000 [0059.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0059.949] GetProcessHeap () returned 0x630000 [0059.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0059.949] GetProcessHeap () returned 0x630000 [0059.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0059.949] GetProcessHeap () returned 0x630000 [0059.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0059.949] GetProcessHeap () returned 0x630000 [0059.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0059.949] GetProcessHeap () returned 0x630000 [0059.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0059.949] GetProcessHeap () returned 0x630000 [0059.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0059.949] GetProcessHeap () returned 0x630000 [0059.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0059.949] GetProcessHeap () returned 0x630000 [0059.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0059.949] GetProcessHeap () returned 0x630000 [0059.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0059.949] GetProcessHeap () returned 0x630000 [0059.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0059.949] GetProcessHeap () returned 0x630000 [0059.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0059.949] GetProcessHeap () returned 0x630000 [0059.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0059.949] GetProcessHeap () returned 0x630000 [0059.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0059.949] GetProcessHeap () returned 0x630000 [0059.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0059.949] GetProcessHeap () returned 0x630000 [0059.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0059.950] GetProcessHeap () returned 0x630000 [0059.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0059.951] GetProcessHeap () returned 0x630000 [0059.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0059.951] GetProcessHeap () returned 0x630000 [0059.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0059.951] GetProcessHeap () returned 0x630000 [0059.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0059.951] GetProcessHeap () returned 0x630000 [0059.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0059.951] GetProcessHeap () returned 0x630000 [0059.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0059.951] GetProcessHeap () returned 0x630000 [0059.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0059.951] GetProcessHeap () returned 0x630000 [0059.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0059.951] GetProcessHeap () returned 0x630000 [0059.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0059.951] GetProcessHeap () returned 0x630000 [0059.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0059.951] GetProcessHeap () returned 0x630000 [0059.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0059.951] GetProcessHeap () returned 0x630000 [0059.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0059.951] GetProcessHeap () returned 0x630000 [0059.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0059.951] GetProcessHeap () returned 0x630000 [0059.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0059.951] GetProcessHeap () returned 0x630000 [0059.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0059.951] GetProcessHeap () returned 0x630000 [0059.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0059.952] GetProcessHeap () returned 0x630000 [0059.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0059.952] GetProcessHeap () returned 0x630000 [0059.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0059.952] GetProcessHeap () returned 0x630000 [0059.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0059.952] GetProcessHeap () returned 0x630000 [0059.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0059.952] GetProcessHeap () returned 0x630000 [0059.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0059.952] GetProcessHeap () returned 0x630000 [0059.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0059.952] GetProcessHeap () returned 0x630000 [0059.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0059.952] GetProcessHeap () returned 0x630000 [0059.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0059.952] GetProcessHeap () returned 0x630000 [0059.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0059.952] GetProcessHeap () returned 0x630000 [0059.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0059.952] GetProcessHeap () returned 0x630000 [0059.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0059.952] GetProcessHeap () returned 0x630000 [0059.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0059.952] GetProcessHeap () returned 0x630000 [0059.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0059.952] GetProcessHeap () returned 0x630000 [0059.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0059.952] GetProcessHeap () returned 0x630000 [0059.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0059.952] GetProcessHeap () returned 0x630000 [0059.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0059.952] GetProcessHeap () returned 0x630000 [0059.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0059.952] GetProcessHeap () returned 0x630000 [0059.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0059.952] GetProcessHeap () returned 0x630000 [0059.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0059.953] GetProcessHeap () returned 0x630000 [0059.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0059.953] GetProcessHeap () returned 0x630000 [0059.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0059.953] GetProcessHeap () returned 0x630000 [0059.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0059.957] GetProcessHeap () returned 0x630000 [0059.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0059.957] GetProcessHeap () returned 0x630000 [0059.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0059.957] GetProcessHeap () returned 0x630000 [0059.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0059.957] GetProcessHeap () returned 0x630000 [0059.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0059.957] GetProcessHeap () returned 0x630000 [0059.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0059.960] GetProcessHeap () returned 0x630000 [0059.960] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0059.960] GetProcessHeap () returned 0x630000 [0059.961] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0059.961] GetProcessHeap () returned 0x630000 [0059.961] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0059.961] GetProcessHeap () returned 0x630000 [0059.961] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0059.961] GetProcessHeap () returned 0x630000 [0059.961] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0059.961] GetProcessHeap () returned 0x630000 [0059.961] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0059.961] GetProcessHeap () returned 0x630000 [0059.961] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0059.961] GetProcessHeap () returned 0x630000 [0059.961] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0059.961] GetProcessHeap () returned 0x630000 [0059.961] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0059.961] WriteFile (in: hFile=0x230, lpBuffer=0x654228*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654228*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0059.994] GetProcessHeap () returned 0x630000 [0059.994] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x654228, Size=0x30) returned 0x654228 [0059.994] GetProcessHeap () returned 0x630000 [0059.994] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0059.994] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.995] GetProcessHeap () returned 0x630000 [0059.995] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x28a4) returned 0x661be8 [0059.995] ReadFile (in: hFile=0x230, lpBuffer=0x661be8, nNumberOfBytesToRead=0x28a4, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661be8*, lpNumberOfBytesRead=0x243d7e8*=0x28a4, lpOverlapped=0x0) returned 1 [0059.995] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0059.995] WriteFile (in: hFile=0x230, lpBuffer=0x661be8*, nNumberOfBytesToWrite=0x28a4, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661be8*, lpNumberOfBytesWritten=0x243d7e4*=0x28a4, lpOverlapped=0x0) returned 1 [0060.015] GetProcessHeap () returned 0x630000 [0060.015] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661be8 | out: hHeap=0x630000) returned 1 [0060.016] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0060.016] WriteFile (in: hFile=0x230, lpBuffer=0x654228*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654228*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0060.048] CloseHandle (hObject=0x230) returned 1 [0060.050] GetProcessHeap () returned 0x630000 [0060.050] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0060.050] GetProcessHeap () returned 0x630000 [0060.050] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6555f8 | out: hHeap=0x630000) returned 1 [0060.050] GetProcessHeap () returned 0x630000 [0060.050] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0060.050] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\kloRG2tolBYZLd.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\kloRG2tolBYZLd.png") returned="C:\\Users\\FD1HVy\\Pictures\\kloRG2tolBYZLd.png" [0060.050] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\kloRG2tolBYZLd.png", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\kloRG2tolBYZLd.png.happythreechoose") returned="C:\\Users\\FD1HVy\\Pictures\\kloRG2tolBYZLd.png.happythreechoose" [0060.050] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\kloRG2tolBYZLd.png" (normalized: "c:\\users\\fd1hvy\\pictures\\klorg2tolbyzld.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\kloRG2tolBYZLd.png.happythreechoose" (normalized: "c:\\users\\fd1hvy\\pictures\\klorg2tolbyzld.png.happythreechoose"), dwFlags=0x1) returned 1 [0060.051] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\kloRG2tolBYZLd.png" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0060.051] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0060.051] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" [0060.051] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\pictures\\decryption info.html")) returned 0x20 [0060.051] GetProcessHeap () returned 0x630000 [0060.051] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645cd8 | out: hHeap=0x630000) returned 1 [0060.051] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6722d760, ftCreationTime.dwHighDateTime=0x1d5d50f, ftLastAccessTime.dwLowDateTime=0xca78d080, ftLastAccessTime.dwHighDateTime=0x1d5d7b7, ftLastWriteTime.dwLowDateTime=0xca78d080, ftLastWriteTime.dwHighDateTime=0x1d5d7b7, nFileSizeHigh=0x0, nFileSizeLow=0x4a8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Ljd9GMm.jpg", cAlternateFileName="")) returned 1 [0060.051] lstrcmpiW (lpString1="Ljd9GMm.jpg", lpString2=".") returned 1 [0060.051] lstrcmpiW (lpString1="Ljd9GMm.jpg", lpString2="..") returned 1 [0060.051] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="Ljd9GMm.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Ljd9GMm.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\Ljd9GMm.jpg" [0060.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Ljd9GMm.jpg", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0060.051] GetProcessHeap () returned 0x630000 [0060.051] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0060.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Ljd9GMm.jpg", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Ljd9GMm.jpg", lpUsedDefaultChar=0x0) returned 12 [0060.051] lstrlenA (lpString="Ljd9GMm.jpg") returned 11 [0060.051] lstrlenA (lpString=".happythreechoose") returned 17 [0060.051] lstrcmpiW (lpString1="Ljd9GMm.jpg", lpString2="Decryption INFO.html") returned 1 [0060.052] lstrcmpiW (lpString1="Ljd9GMm.jpg", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0060.052] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0060.052] lstrcmpiW (lpString1="Ljd9GMm.jpg", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0060.052] GetProcessHeap () returned 0x630000 [0060.052] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0060.052] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Ljd9GMm.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ljd9gmm.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0060.052] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=1192) returned 1 [0060.052] GetProcessHeap () returned 0x630000 [0060.052] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655850 [0060.052] GetProcessHeap () returned 0x630000 [0060.052] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0060.052] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\Ljd9GMm.jpg") returned 36 [0060.052] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0060.052] GetProcessHeap () returned 0x630000 [0060.052] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0060.052] GetProcessHeap () returned 0x630000 [0060.052] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x388) returned 0x654260 [0060.052] lstrlenA (lpString="rsa_encrypt") returned 11 [0060.052] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0060.053] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0060.053] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0060.053] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0060.053] GetProcessHeap () returned 0x630000 [0060.053] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0060.053] lstrlenA (lpString="010001") returned 6 [0060.053] GetProcessHeap () returned 0x630000 [0060.053] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0060.053] GetProcessHeap () returned 0x630000 [0060.053] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0060.053] GetProcessHeap () returned 0x630000 [0060.053] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ebb0 [0060.053] GetProcessHeap () returned 0x630000 [0060.053] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0060.053] GetProcessHeap () returned 0x630000 [0060.053] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e580 [0060.053] GetProcessHeap () returned 0x630000 [0060.053] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x6570f8 [0060.053] GetProcessHeap () returned 0x630000 [0060.053] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0060.053] GetProcessHeap () returned 0x630000 [0060.053] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0060.053] GetProcessHeap () returned 0x630000 [0060.053] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0060.053] GetProcessHeap () returned 0x630000 [0060.053] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0060.053] GetProcessHeap () returned 0x630000 [0060.053] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0060.053] GetProcessHeap () returned 0x630000 [0060.053] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656ec8 [0060.054] GetProcessHeap () returned 0x630000 [0060.054] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0060.054] GetProcessHeap () returned 0x630000 [0060.054] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0060.054] GetProcessHeap () returned 0x630000 [0060.054] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65eb20 [0060.054] GetProcessHeap () returned 0x630000 [0060.054] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0060.054] GetProcessHeap () returned 0x630000 [0060.054] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0060.054] GetProcessHeap () returned 0x630000 [0060.054] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0060.054] GetProcessHeap () returned 0x630000 [0060.054] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0060.054] GetProcessHeap () returned 0x630000 [0060.054] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x661710 [0060.054] GetProcessHeap () returned 0x630000 [0060.054] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0060.054] GetProcessHeap () returned 0x630000 [0060.054] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0060.054] GetProcessHeap () returned 0x630000 [0060.054] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0060.054] GetProcessHeap () returned 0x630000 [0060.054] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0060.054] GetProcessHeap () returned 0x630000 [0060.054] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e100 [0060.054] GetProcessHeap () returned 0x630000 [0060.054] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661710 | out: hHeap=0x630000) returned 1 [0060.054] GetProcessHeap () returned 0x630000 [0060.054] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0060.054] GetProcessHeap () returned 0x630000 [0060.054] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0060.059] GetProcessHeap () returned 0x630000 [0060.059] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0060.059] GetProcessHeap () returned 0x630000 [0060.059] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0060.059] GetProcessHeap () returned 0x630000 [0060.059] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0060.059] GetProcessHeap () returned 0x630000 [0060.059] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0060.059] GetProcessHeap () returned 0x630000 [0060.059] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0060.059] GetProcessHeap () returned 0x630000 [0060.059] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0060.059] GetProcessHeap () returned 0x630000 [0060.059] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0060.059] GetProcessHeap () returned 0x630000 [0060.059] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0060.059] GetProcessHeap () returned 0x630000 [0060.059] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0060.059] GetProcessHeap () returned 0x630000 [0060.060] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0060.060] GetProcessHeap () returned 0x630000 [0060.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0060.060] GetProcessHeap () returned 0x630000 [0060.060] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0060.060] GetProcessHeap () returned 0x630000 [0060.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0060.060] GetProcessHeap () returned 0x630000 [0060.060] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0060.060] GetProcessHeap () returned 0x630000 [0060.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0060.060] GetProcessHeap () returned 0x630000 [0060.060] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0060.060] GetProcessHeap () returned 0x630000 [0060.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0060.060] GetProcessHeap () returned 0x630000 [0060.060] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0060.060] GetProcessHeap () returned 0x630000 [0060.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0060.060] GetProcessHeap () returned 0x630000 [0060.060] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0060.060] GetProcessHeap () returned 0x630000 [0060.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a188 [0060.060] GetProcessHeap () returned 0x630000 [0060.060] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a188 | out: hHeap=0x630000) returned 1 [0060.060] GetProcessHeap () returned 0x630000 [0060.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0060.060] GetProcessHeap () returned 0x630000 [0060.060] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0060.060] GetProcessHeap () returned 0x630000 [0060.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0060.060] GetProcessHeap () returned 0x630000 [0060.060] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0060.060] GetProcessHeap () returned 0x630000 [0060.060] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0060.060] GetProcessHeap () returned 0x630000 [0060.060] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0060.060] GetProcessHeap () returned 0x630000 [0060.061] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0060.061] GetProcessHeap () returned 0x630000 [0060.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0060.061] GetProcessHeap () returned 0x630000 [0060.061] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0060.061] GetProcessHeap () returned 0x630000 [0060.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0060.061] GetProcessHeap () returned 0x630000 [0060.061] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0060.061] GetProcessHeap () returned 0x630000 [0060.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0060.061] GetProcessHeap () returned 0x630000 [0060.061] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0060.061] GetProcessHeap () returned 0x630000 [0060.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0060.061] GetProcessHeap () returned 0x630000 [0060.061] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0060.061] GetProcessHeap () returned 0x630000 [0060.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0060.061] GetProcessHeap () returned 0x630000 [0060.061] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0e8 [0060.061] GetProcessHeap () returned 0x630000 [0060.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0e8 | out: hHeap=0x630000) returned 1 [0060.061] GetProcessHeap () returned 0x630000 [0060.061] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0060.061] GetProcessHeap () returned 0x630000 [0060.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0060.061] GetProcessHeap () returned 0x630000 [0060.061] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0060.061] GetProcessHeap () returned 0x630000 [0060.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0060.061] GetProcessHeap () returned 0x630000 [0060.061] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0060.061] GetProcessHeap () returned 0x630000 [0060.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0060.061] GetProcessHeap () returned 0x630000 [0060.061] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0060.061] GetProcessHeap () returned 0x630000 [0060.061] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0060.062] GetProcessHeap () returned 0x630000 [0060.062] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0060.062] GetProcessHeap () returned 0x630000 [0060.062] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0060.062] GetProcessHeap () returned 0x630000 [0060.062] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0060.062] GetProcessHeap () returned 0x630000 [0060.062] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0060.062] GetProcessHeap () returned 0x630000 [0060.062] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0060.062] GetProcessHeap () returned 0x630000 [0060.062] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0060.062] GetProcessHeap () returned 0x630000 [0060.062] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0060.062] GetProcessHeap () returned 0x630000 [0060.062] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0060.062] GetProcessHeap () returned 0x630000 [0060.062] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0060.062] GetProcessHeap () returned 0x630000 [0060.062] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0060.062] GetProcessHeap () returned 0x630000 [0060.062] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0060.062] GetProcessHeap () returned 0x630000 [0060.062] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0060.062] GetProcessHeap () returned 0x630000 [0060.062] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0060.062] GetProcessHeap () returned 0x630000 [0060.062] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0060.062] GetProcessHeap () returned 0x630000 [0060.062] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0060.062] GetProcessHeap () returned 0x630000 [0060.062] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0060.062] GetProcessHeap () returned 0x630000 [0060.062] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0060.062] GetProcessHeap () returned 0x630000 [0060.062] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0060.062] GetProcessHeap () returned 0x630000 [0060.062] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0060.063] GetProcessHeap () returned 0x630000 [0060.063] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0060.063] GetProcessHeap () returned 0x630000 [0060.063] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0060.063] GetProcessHeap () returned 0x630000 [0060.063] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0060.063] GetProcessHeap () returned 0x630000 [0060.063] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0060.063] GetProcessHeap () returned 0x630000 [0060.063] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0060.063] GetProcessHeap () returned 0x630000 [0060.063] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1a8 [0060.063] GetProcessHeap () returned 0x630000 [0060.063] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1a8 | out: hHeap=0x630000) returned 1 [0060.063] GetProcessHeap () returned 0x630000 [0060.063] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0060.063] GetProcessHeap () returned 0x630000 [0060.063] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0060.063] GetProcessHeap () returned 0x630000 [0060.063] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0060.063] GetProcessHeap () returned 0x630000 [0060.063] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0060.063] GetProcessHeap () returned 0x630000 [0060.063] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0060.063] GetProcessHeap () returned 0x630000 [0060.063] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0060.063] GetProcessHeap () returned 0x630000 [0060.063] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0060.063] GetProcessHeap () returned 0x630000 [0060.063] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0060.063] GetProcessHeap () returned 0x630000 [0060.063] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0060.063] GetProcessHeap () returned 0x630000 [0060.063] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0060.063] GetProcessHeap () returned 0x630000 [0060.063] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0060.063] GetProcessHeap () returned 0x630000 [0060.064] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0060.064] GetProcessHeap () returned 0x630000 [0060.064] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0060.064] GetProcessHeap () returned 0x630000 [0060.064] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0060.064] GetProcessHeap () returned 0x630000 [0060.064] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0060.064] GetProcessHeap () returned 0x630000 [0060.064] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0060.064] GetProcessHeap () returned 0x630000 [0060.064] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0060.064] GetProcessHeap () returned 0x630000 [0060.064] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.064] GetProcessHeap () returned 0x630000 [0060.064] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0060.064] WriteFile (in: hFile=0x230, lpBuffer=0x654260*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654260*, lpNumberOfBytesWritten=0x243d864*=0x388, lpOverlapped=0x0) returned 1 [0060.066] GetProcessHeap () returned 0x630000 [0060.066] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x654260, Size=0x30) returned 0x654260 [0060.066] GetProcessHeap () returned 0x630000 [0060.066] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0060.066] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0060.066] GetProcessHeap () returned 0x630000 [0060.066] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4b0) returned 0x654298 [0060.066] ReadFile (in: hFile=0x230, lpBuffer=0x654298, nNumberOfBytesToRead=0x4b0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x654298*, lpNumberOfBytesRead=0x243d7e8*=0x4b0, lpOverlapped=0x0) returned 1 [0060.067] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0060.067] WriteFile (in: hFile=0x230, lpBuffer=0x654298*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x654298*, lpNumberOfBytesWritten=0x243d7e4*=0x4b0, lpOverlapped=0x0) returned 1 [0060.068] GetProcessHeap () returned 0x630000 [0060.068] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x654298 | out: hHeap=0x630000) returned 1 [0060.068] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0060.068] WriteFile (in: hFile=0x230, lpBuffer=0x654260*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654260*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0060.069] CloseHandle (hObject=0x230) returned 1 [0060.071] GetProcessHeap () returned 0x630000 [0060.071] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0060.071] GetProcessHeap () returned 0x630000 [0060.071] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655850 | out: hHeap=0x630000) returned 1 [0060.071] GetProcessHeap () returned 0x630000 [0060.071] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0060.071] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\Ljd9GMm.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Ljd9GMm.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\Ljd9GMm.jpg" [0060.071] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\Ljd9GMm.jpg", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Ljd9GMm.jpg.happythreechoose") returned="C:\\Users\\FD1HVy\\Pictures\\Ljd9GMm.jpg.happythreechoose" [0060.071] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\Ljd9GMm.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\ljd9gmm.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\Ljd9GMm.jpg.happythreechoose" (normalized: "c:\\users\\fd1hvy\\pictures\\ljd9gmm.jpg.happythreechoose"), dwFlags=0x1) returned 1 [0060.071] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\Ljd9GMm.jpg" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0060.071] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0060.072] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" [0060.072] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\pictures\\decryption info.html")) returned 0x20 [0060.072] GetProcessHeap () returned 0x630000 [0060.072] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0060.072] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6df1bf20, ftCreationTime.dwHighDateTime=0x1d5c9de, ftLastAccessTime.dwLowDateTime=0xef81740, ftLastAccessTime.dwHighDateTime=0x1d5d608, ftLastWriteTime.dwLowDateTime=0xef81740, ftLastWriteTime.dwHighDateTime=0x1d5d608, nFileSizeHigh=0x0, nFileSizeLow=0x6af0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mpw4A8-k5g.gif", cAlternateFileName="MPW4A8~1.GIF")) returned 1 [0060.072] lstrcmpiW (lpString1="Mpw4A8-k5g.gif", lpString2=".") returned 1 [0060.072] lstrcmpiW (lpString1="Mpw4A8-k5g.gif", lpString2="..") returned 1 [0060.072] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="Mpw4A8-k5g.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Mpw4A8-k5g.gif") returned="C:\\Users\\FD1HVy\\Pictures\\Mpw4A8-k5g.gif" [0060.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Mpw4A8-k5g.gif", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0060.072] GetProcessHeap () returned 0x630000 [0060.072] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0060.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Mpw4A8-k5g.gif", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mpw4A8-k5g.gif", lpUsedDefaultChar=0x0) returned 15 [0060.072] lstrlenA (lpString="Mpw4A8-k5g.gif") returned 14 [0060.072] lstrlenA (lpString=".happythreechoose") returned 17 [0060.072] lstrcmpiW (lpString1="Mpw4A8-k5g.gif", lpString2="Decryption INFO.html") returned 1 [0060.072] lstrcmpiW (lpString1="Mpw4A8-k5g.gif", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0060.072] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0060.072] lstrcmpiW (lpString1="Mpw4A8-k5g.gif", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0060.072] GetProcessHeap () returned 0x630000 [0060.072] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0060.072] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Mpw4A8-k5g.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\mpw4a8-k5g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0060.072] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=27376) returned 1 [0060.072] GetProcessHeap () returned 0x630000 [0060.072] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6558c8 [0060.072] GetProcessHeap () returned 0x630000 [0060.072] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0060.072] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\Mpw4A8-k5g.gif") returned 39 [0060.072] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0060.073] GetProcessHeap () returned 0x630000 [0060.073] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0060.073] GetProcessHeap () returned 0x630000 [0060.073] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x654298 [0060.073] lstrlenA (lpString="rsa_encrypt") returned 11 [0060.073] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0060.073] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0060.073] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0060.073] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0060.073] GetProcessHeap () returned 0x630000 [0060.073] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0060.073] lstrlenA (lpString="010001") returned 6 [0060.073] GetProcessHeap () returned 0x630000 [0060.073] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0060.074] GetProcessHeap () returned 0x630000 [0060.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0060.074] GetProcessHeap () returned 0x630000 [0060.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e610 [0060.074] GetProcessHeap () returned 0x630000 [0060.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0060.074] GetProcessHeap () returned 0x630000 [0060.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0060.074] GetProcessHeap () returned 0x630000 [0060.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656fe0 [0060.074] GetProcessHeap () returned 0x630000 [0060.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0060.074] GetProcessHeap () returned 0x630000 [0060.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0060.074] GetProcessHeap () returned 0x630000 [0060.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0060.074] GetProcessHeap () returned 0x630000 [0060.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0060.074] GetProcessHeap () returned 0x630000 [0060.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0060.074] GetProcessHeap () returned 0x630000 [0060.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657558 [0060.074] GetProcessHeap () returned 0x630000 [0060.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0060.074] GetProcessHeap () returned 0x630000 [0060.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0060.074] GetProcessHeap () returned 0x630000 [0060.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e850 [0060.074] GetProcessHeap () returned 0x630000 [0060.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0060.074] GetProcessHeap () returned 0x630000 [0060.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0060.074] GetProcessHeap () returned 0x630000 [0060.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0060.074] GetProcessHeap () returned 0x630000 [0060.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0060.074] GetProcessHeap () returned 0x630000 [0060.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x661638 [0060.074] GetProcessHeap () returned 0x630000 [0060.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0060.075] GetProcessHeap () returned 0x630000 [0060.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0060.075] GetProcessHeap () returned 0x630000 [0060.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0060.075] GetProcessHeap () returned 0x630000 [0060.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0060.075] GetProcessHeap () returned 0x630000 [0060.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e460 [0060.075] GetProcessHeap () returned 0x630000 [0060.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661638 | out: hHeap=0x630000) returned 1 [0060.075] GetProcessHeap () returned 0x630000 [0060.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0060.075] GetProcessHeap () returned 0x630000 [0060.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e460 | out: hHeap=0x630000) returned 1 [0060.075] GetProcessHeap () returned 0x630000 [0060.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0060.075] GetProcessHeap () returned 0x630000 [0060.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0060.075] GetProcessHeap () returned 0x630000 [0060.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0060.075] GetProcessHeap () returned 0x630000 [0060.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0060.075] GetProcessHeap () returned 0x630000 [0060.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0060.075] GetProcessHeap () returned 0x630000 [0060.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0060.075] GetProcessHeap () returned 0x630000 [0060.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0060.075] GetProcessHeap () returned 0x630000 [0060.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0060.075] GetProcessHeap () returned 0x630000 [0060.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0060.075] GetProcessHeap () returned 0x630000 [0060.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0060.075] GetProcessHeap () returned 0x630000 [0060.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0060.075] GetProcessHeap () returned 0x630000 [0060.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0060.076] GetProcessHeap () returned 0x630000 [0060.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0060.076] GetProcessHeap () returned 0x630000 [0060.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0060.076] GetProcessHeap () returned 0x630000 [0060.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0060.076] GetProcessHeap () returned 0x630000 [0060.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0060.076] GetProcessHeap () returned 0x630000 [0060.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0060.076] GetProcessHeap () returned 0x630000 [0060.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0060.076] GetProcessHeap () returned 0x630000 [0060.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0060.076] GetProcessHeap () returned 0x630000 [0060.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0060.076] GetProcessHeap () returned 0x630000 [0060.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0060.076] GetProcessHeap () returned 0x630000 [0060.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0060.076] GetProcessHeap () returned 0x630000 [0060.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0060.076] GetProcessHeap () returned 0x630000 [0060.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0060.076] GetProcessHeap () returned 0x630000 [0060.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0060.076] GetProcessHeap () returned 0x630000 [0060.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0060.076] GetProcessHeap () returned 0x630000 [0060.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0060.076] GetProcessHeap () returned 0x630000 [0060.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0060.076] GetProcessHeap () returned 0x630000 [0060.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0060.076] GetProcessHeap () returned 0x630000 [0060.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0060.076] GetProcessHeap () returned 0x630000 [0060.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a208 [0060.077] GetProcessHeap () returned 0x630000 [0060.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a208 | out: hHeap=0x630000) returned 1 [0060.077] GetProcessHeap () returned 0x630000 [0060.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0060.077] GetProcessHeap () returned 0x630000 [0060.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0060.077] GetProcessHeap () returned 0x630000 [0060.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0060.077] GetProcessHeap () returned 0x630000 [0060.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0060.077] GetProcessHeap () returned 0x630000 [0060.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a188 [0060.077] GetProcessHeap () returned 0x630000 [0060.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a188 | out: hHeap=0x630000) returned 1 [0060.077] GetProcessHeap () returned 0x630000 [0060.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0060.077] GetProcessHeap () returned 0x630000 [0060.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0060.077] GetProcessHeap () returned 0x630000 [0060.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0060.077] GetProcessHeap () returned 0x630000 [0060.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0060.077] GetProcessHeap () returned 0x630000 [0060.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0060.077] GetProcessHeap () returned 0x630000 [0060.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0060.077] GetProcessHeap () returned 0x630000 [0060.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0e8 [0060.077] GetProcessHeap () returned 0x630000 [0060.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0e8 | out: hHeap=0x630000) returned 1 [0060.077] GetProcessHeap () returned 0x630000 [0060.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0060.077] GetProcessHeap () returned 0x630000 [0060.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0060.077] GetProcessHeap () returned 0x630000 [0060.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0060.077] GetProcessHeap () returned 0x630000 [0060.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0060.078] GetProcessHeap () returned 0x630000 [0060.078] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0060.078] GetProcessHeap () returned 0x630000 [0060.078] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0060.078] GetProcessHeap () returned 0x630000 [0060.078] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0060.078] GetProcessHeap () returned 0x630000 [0060.078] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0060.078] GetProcessHeap () returned 0x630000 [0060.078] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0060.078] GetProcessHeap () returned 0x630000 [0060.078] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0060.078] GetProcessHeap () returned 0x630000 [0060.078] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0060.078] GetProcessHeap () returned 0x630000 [0060.078] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0060.078] GetProcessHeap () returned 0x630000 [0060.078] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a188 [0060.078] GetProcessHeap () returned 0x630000 [0060.078] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a188 | out: hHeap=0x630000) returned 1 [0060.078] GetProcessHeap () returned 0x630000 [0060.078] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0060.078] GetProcessHeap () returned 0x630000 [0060.078] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0060.078] GetProcessHeap () returned 0x630000 [0060.078] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0060.078] GetProcessHeap () returned 0x630000 [0060.078] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0060.078] GetProcessHeap () returned 0x630000 [0060.078] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0060.078] GetProcessHeap () returned 0x630000 [0060.078] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0060.078] GetProcessHeap () returned 0x630000 [0060.078] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0060.078] GetProcessHeap () returned 0x630000 [0060.078] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0060.078] GetProcessHeap () returned 0x630000 [0060.078] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0060.079] GetProcessHeap () returned 0x630000 [0060.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0060.079] GetProcessHeap () returned 0x630000 [0060.079] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0060.079] GetProcessHeap () returned 0x630000 [0060.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0060.079] GetProcessHeap () returned 0x630000 [0060.079] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0060.079] GetProcessHeap () returned 0x630000 [0060.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0060.079] GetProcessHeap () returned 0x630000 [0060.079] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0060.079] GetProcessHeap () returned 0x630000 [0060.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0060.079] GetProcessHeap () returned 0x630000 [0060.079] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1a8 [0060.079] GetProcessHeap () returned 0x630000 [0060.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1a8 | out: hHeap=0x630000) returned 1 [0060.079] GetProcessHeap () returned 0x630000 [0060.079] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0060.079] GetProcessHeap () returned 0x630000 [0060.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0060.079] GetProcessHeap () returned 0x630000 [0060.079] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0060.079] GetProcessHeap () returned 0x630000 [0060.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0060.079] GetProcessHeap () returned 0x630000 [0060.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0060.079] GetProcessHeap () returned 0x630000 [0060.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0060.079] GetProcessHeap () returned 0x630000 [0060.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0060.079] GetProcessHeap () returned 0x630000 [0060.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0060.079] GetProcessHeap () returned 0x630000 [0060.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0060.080] GetProcessHeap () returned 0x630000 [0060.080] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0060.080] GetProcessHeap () returned 0x630000 [0060.080] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0060.080] GetProcessHeap () returned 0x630000 [0060.080] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0060.080] GetProcessHeap () returned 0x630000 [0060.080] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0060.080] GetProcessHeap () returned 0x630000 [0060.080] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.080] GetProcessHeap () returned 0x630000 [0060.080] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0060.080] WriteFile (in: hFile=0x230, lpBuffer=0x654298*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654298*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0060.084] GetProcessHeap () returned 0x630000 [0060.084] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x654298, Size=0x30) returned 0x654298 [0060.084] GetProcessHeap () returned 0x630000 [0060.084] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0060.084] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0060.084] GetProcessHeap () returned 0x630000 [0060.084] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6af0) returned 0x661be8 [0060.090] ReadFile (in: hFile=0x230, lpBuffer=0x661be8, nNumberOfBytesToRead=0x6af0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661be8*, lpNumberOfBytesRead=0x243d7e8*=0x6af0, lpOverlapped=0x0) returned 1 [0060.090] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0060.090] WriteFile (in: hFile=0x230, lpBuffer=0x661be8*, nNumberOfBytesToWrite=0x6af0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661be8*, lpNumberOfBytesWritten=0x243d7e4*=0x6af0, lpOverlapped=0x0) returned 1 [0060.091] GetProcessHeap () returned 0x630000 [0060.091] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661be8 | out: hHeap=0x630000) returned 1 [0060.091] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0060.091] WriteFile (in: hFile=0x230, lpBuffer=0x654298*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654298*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0060.092] CloseHandle (hObject=0x230) returned 1 [0060.094] GetProcessHeap () returned 0x630000 [0060.094] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0060.094] GetProcessHeap () returned 0x630000 [0060.094] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6558c8 | out: hHeap=0x630000) returned 1 [0060.094] GetProcessHeap () returned 0x630000 [0060.094] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0060.094] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\Mpw4A8-k5g.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Mpw4A8-k5g.gif") returned="C:\\Users\\FD1HVy\\Pictures\\Mpw4A8-k5g.gif" [0060.094] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\Mpw4A8-k5g.gif", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Mpw4A8-k5g.gif.happythreechoose") returned="C:\\Users\\FD1HVy\\Pictures\\Mpw4A8-k5g.gif.happythreechoose" [0060.094] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\Mpw4A8-k5g.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\mpw4a8-k5g.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\Mpw4A8-k5g.gif.happythreechoose" (normalized: "c:\\users\\fd1hvy\\pictures\\mpw4a8-k5g.gif.happythreechoose"), dwFlags=0x1) returned 1 [0060.095] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\Mpw4A8-k5g.gif" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0060.095] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0060.095] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" [0060.095] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\pictures\\decryption info.html")) returned 0x20 [0060.095] GetProcessHeap () returned 0x630000 [0060.095] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0060.095] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x528fbb90, ftCreationTime.dwHighDateTime=0x1d5d3f4, ftLastAccessTime.dwLowDateTime=0x156a4d90, ftLastAccessTime.dwHighDateTime=0x1d5cf4c, ftLastWriteTime.dwLowDateTime=0x156a4d90, ftLastWriteTime.dwHighDateTime=0x1d5cf4c, nFileSizeHigh=0x0, nFileSizeLow=0xd279, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MZtSVVFTr.jpg", cAlternateFileName="MZTSVV~1.JPG")) returned 1 [0060.095] lstrcmpiW (lpString1="MZtSVVFTr.jpg", lpString2=".") returned 1 [0060.095] lstrcmpiW (lpString1="MZtSVVFTr.jpg", lpString2="..") returned 1 [0060.095] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="MZtSVVFTr.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\MZtSVVFTr.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\MZtSVVFTr.jpg" [0060.095] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MZtSVVFTr.jpg", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0060.095] GetProcessHeap () returned 0x630000 [0060.095] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x64c9f0 [0060.095] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MZtSVVFTr.jpg", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZtSVVFTr.jpg", lpUsedDefaultChar=0x0) returned 14 [0060.095] lstrlenA (lpString="MZtSVVFTr.jpg") returned 13 [0060.095] lstrlenA (lpString=".happythreechoose") returned 17 [0060.095] lstrcmpiW (lpString1="MZtSVVFTr.jpg", lpString2="Decryption INFO.html") returned 1 [0060.095] lstrcmpiW (lpString1="MZtSVVFTr.jpg", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0060.095] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0060.095] lstrcmpiW (lpString1="MZtSVVFTr.jpg", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0060.095] GetProcessHeap () returned 0x630000 [0060.095] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0060.096] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\MZtSVVFTr.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\mztsvvftr.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0060.096] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=53881) returned 1 [0060.096] GetProcessHeap () returned 0x630000 [0060.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655850 [0060.096] GetProcessHeap () returned 0x630000 [0060.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0060.096] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\MZtSVVFTr.jpg") returned 38 [0060.096] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0060.096] GetProcessHeap () returned 0x630000 [0060.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0060.096] GetProcessHeap () returned 0x630000 [0060.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x387) returned 0x6542d0 [0060.096] lstrlenA (lpString="rsa_encrypt") returned 11 [0060.096] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0060.097] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0060.097] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0060.097] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0060.097] GetProcessHeap () returned 0x630000 [0060.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0060.097] lstrlenA (lpString="010001") returned 6 [0060.097] GetProcessHeap () returned 0x630000 [0060.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0060.097] GetProcessHeap () returned 0x630000 [0060.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0060.097] GetProcessHeap () returned 0x630000 [0060.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e460 [0060.097] GetProcessHeap () returned 0x630000 [0060.097] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0060.097] GetProcessHeap () returned 0x630000 [0060.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea00 [0060.097] GetProcessHeap () returned 0x630000 [0060.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656ec8 [0060.097] GetProcessHeap () returned 0x630000 [0060.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0060.097] GetProcessHeap () returned 0x630000 [0060.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0060.097] GetProcessHeap () returned 0x630000 [0060.097] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0060.097] GetProcessHeap () returned 0x630000 [0060.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0060.097] GetProcessHeap () returned 0x630000 [0060.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0060.097] GetProcessHeap () returned 0x630000 [0060.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656b80 [0060.097] GetProcessHeap () returned 0x630000 [0060.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0060.097] GetProcessHeap () returned 0x630000 [0060.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0060.098] GetProcessHeap () returned 0x630000 [0060.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e610 [0060.098] GetProcessHeap () returned 0x630000 [0060.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0060.098] GetProcessHeap () returned 0x630000 [0060.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0060.098] GetProcessHeap () returned 0x630000 [0060.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0060.098] GetProcessHeap () returned 0x630000 [0060.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0060.098] GetProcessHeap () returned 0x630000 [0060.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x661938 [0060.098] GetProcessHeap () returned 0x630000 [0060.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0060.098] GetProcessHeap () returned 0x630000 [0060.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0060.098] GetProcessHeap () returned 0x630000 [0060.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0060.098] GetProcessHeap () returned 0x630000 [0060.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0060.098] GetProcessHeap () returned 0x630000 [0060.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e8e0 [0060.098] GetProcessHeap () returned 0x630000 [0060.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661938 | out: hHeap=0x630000) returned 1 [0060.098] GetProcessHeap () returned 0x630000 [0060.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0060.098] GetProcessHeap () returned 0x630000 [0060.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0060.098] GetProcessHeap () returned 0x630000 [0060.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0060.098] GetProcessHeap () returned 0x630000 [0060.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0060.098] GetProcessHeap () returned 0x630000 [0060.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0060.098] GetProcessHeap () returned 0x630000 [0060.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0060.098] GetProcessHeap () returned 0x630000 [0060.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0060.099] GetProcessHeap () returned 0x630000 [0060.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0060.099] GetProcessHeap () returned 0x630000 [0060.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0060.099] GetProcessHeap () returned 0x630000 [0060.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0060.099] GetProcessHeap () returned 0x630000 [0060.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0060.099] GetProcessHeap () returned 0x630000 [0060.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0060.099] GetProcessHeap () returned 0x630000 [0060.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0060.099] GetProcessHeap () returned 0x630000 [0060.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0060.099] GetProcessHeap () returned 0x630000 [0060.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0060.099] GetProcessHeap () returned 0x630000 [0060.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0060.099] GetProcessHeap () returned 0x630000 [0060.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0060.099] GetProcessHeap () returned 0x630000 [0060.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0060.099] GetProcessHeap () returned 0x630000 [0060.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0060.099] GetProcessHeap () returned 0x630000 [0060.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0060.099] GetProcessHeap () returned 0x630000 [0060.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0060.099] GetProcessHeap () returned 0x630000 [0060.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0060.099] GetProcessHeap () returned 0x630000 [0060.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0060.099] GetProcessHeap () returned 0x630000 [0060.099] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0060.099] GetProcessHeap () returned 0x630000 [0060.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0060.099] GetProcessHeap () returned 0x630000 [0060.100] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0060.100] GetProcessHeap () returned 0x630000 [0060.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0060.100] GetProcessHeap () returned 0x630000 [0060.100] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0060.100] GetProcessHeap () returned 0x630000 [0060.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0060.100] GetProcessHeap () returned 0x630000 [0060.100] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0060.100] GetProcessHeap () returned 0x630000 [0060.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0060.100] GetProcessHeap () returned 0x630000 [0060.100] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0060.100] GetProcessHeap () returned 0x630000 [0060.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0060.100] GetProcessHeap () returned 0x630000 [0060.100] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0060.100] GetProcessHeap () returned 0x630000 [0060.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0060.100] GetProcessHeap () returned 0x630000 [0060.100] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0060.100] GetProcessHeap () returned 0x630000 [0060.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1a8 [0060.100] GetProcessHeap () returned 0x630000 [0060.100] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1a8 | out: hHeap=0x630000) returned 1 [0060.100] GetProcessHeap () returned 0x630000 [0060.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0060.100] GetProcessHeap () returned 0x630000 [0060.100] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0060.100] GetProcessHeap () returned 0x630000 [0060.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0060.100] GetProcessHeap () returned 0x630000 [0060.100] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0060.100] GetProcessHeap () returned 0x630000 [0060.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0060.100] GetProcessHeap () returned 0x630000 [0060.100] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0060.101] GetProcessHeap () returned 0x630000 [0060.101] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0060.101] GetProcessHeap () returned 0x630000 [0060.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0060.101] GetProcessHeap () returned 0x630000 [0060.101] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0060.101] GetProcessHeap () returned 0x630000 [0060.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0060.101] GetProcessHeap () returned 0x630000 [0060.101] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0060.101] GetProcessHeap () returned 0x630000 [0060.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0060.101] GetProcessHeap () returned 0x630000 [0060.101] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a208 [0060.101] GetProcessHeap () returned 0x630000 [0060.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a208 | out: hHeap=0x630000) returned 1 [0060.101] GetProcessHeap () returned 0x630000 [0060.101] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1a8 [0060.101] GetProcessHeap () returned 0x630000 [0060.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1a8 | out: hHeap=0x630000) returned 1 [0060.101] GetProcessHeap () returned 0x630000 [0060.101] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0060.101] GetProcessHeap () returned 0x630000 [0060.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0060.101] GetProcessHeap () returned 0x630000 [0060.101] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0060.101] GetProcessHeap () returned 0x630000 [0060.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0060.103] GetProcessHeap () returned 0x630000 [0060.103] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0060.103] GetProcessHeap () returned 0x630000 [0060.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0060.103] GetProcessHeap () returned 0x630000 [0060.103] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a188 [0060.103] GetProcessHeap () returned 0x630000 [0060.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a188 | out: hHeap=0x630000) returned 1 [0060.103] GetProcessHeap () returned 0x630000 [0060.103] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0060.103] GetProcessHeap () returned 0x630000 [0060.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0060.103] GetProcessHeap () returned 0x630000 [0060.103] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a188 [0060.103] GetProcessHeap () returned 0x630000 [0060.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a188 | out: hHeap=0x630000) returned 1 [0060.103] GetProcessHeap () returned 0x630000 [0060.103] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0060.104] GetProcessHeap () returned 0x630000 [0060.104] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0060.104] GetProcessHeap () returned 0x630000 [0060.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0060.104] GetProcessHeap () returned 0x630000 [0060.104] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0060.104] GetProcessHeap () returned 0x630000 [0060.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0e8 [0060.104] GetProcessHeap () returned 0x630000 [0060.104] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0e8 | out: hHeap=0x630000) returned 1 [0060.104] GetProcessHeap () returned 0x630000 [0060.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0060.104] GetProcessHeap () returned 0x630000 [0060.104] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0060.104] GetProcessHeap () returned 0x630000 [0060.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0060.104] GetProcessHeap () returned 0x630000 [0060.104] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0060.104] GetProcessHeap () returned 0x630000 [0060.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0060.104] GetProcessHeap () returned 0x630000 [0060.104] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0060.104] GetProcessHeap () returned 0x630000 [0060.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0060.104] GetProcessHeap () returned 0x630000 [0060.104] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0060.104] GetProcessHeap () returned 0x630000 [0060.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0060.104] GetProcessHeap () returned 0x630000 [0060.104] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0060.104] GetProcessHeap () returned 0x630000 [0060.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a188 [0060.104] GetProcessHeap () returned 0x630000 [0060.104] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a188 | out: hHeap=0x630000) returned 1 [0060.104] GetProcessHeap () returned 0x630000 [0060.104] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0060.104] GetProcessHeap () returned 0x630000 [0060.104] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0060.104] GetProcessHeap () returned 0x630000 [0060.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0060.105] GetProcessHeap () returned 0x630000 [0060.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0060.105] GetProcessHeap () returned 0x630000 [0060.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0060.105] GetProcessHeap () returned 0x630000 [0060.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0060.105] GetProcessHeap () returned 0x630000 [0060.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0060.105] GetProcessHeap () returned 0x630000 [0060.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e460 | out: hHeap=0x630000) returned 1 [0060.105] GetProcessHeap () returned 0x630000 [0060.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0060.105] GetProcessHeap () returned 0x630000 [0060.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.105] GetProcessHeap () returned 0x630000 [0060.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0060.105] WriteFile (in: hFile=0x230, lpBuffer=0x6542d0*, nNumberOfBytesToWrite=0x387, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6542d0*, lpNumberOfBytesWritten=0x243d864*=0x387, lpOverlapped=0x0) returned 1 [0060.107] GetProcessHeap () returned 0x630000 [0060.107] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6542d0, Size=0x30) returned 0x6542d0 [0060.107] GetProcessHeap () returned 0x630000 [0060.107] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0060.107] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0060.108] GetProcessHeap () returned 0x630000 [0060.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd280) returned 0x661be8 [0060.108] ReadFile (in: hFile=0x230, lpBuffer=0x661be8, nNumberOfBytesToRead=0xd280, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661be8*, lpNumberOfBytesRead=0x243d7e8*=0xd280, lpOverlapped=0x0) returned 1 [0060.109] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0060.109] WriteFile (in: hFile=0x230, lpBuffer=0x661be8*, nNumberOfBytesToWrite=0xd280, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661be8*, lpNumberOfBytesWritten=0x243d7e4*=0xd280, lpOverlapped=0x0) returned 1 [0060.118] GetProcessHeap () returned 0x630000 [0060.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661be8 | out: hHeap=0x630000) returned 1 [0060.119] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0060.119] WriteFile (in: hFile=0x230, lpBuffer=0x6542d0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6542d0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0060.128] CloseHandle (hObject=0x230) returned 1 [0060.131] GetProcessHeap () returned 0x630000 [0060.131] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0060.131] GetProcessHeap () returned 0x630000 [0060.131] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655850 | out: hHeap=0x630000) returned 1 [0060.131] GetProcessHeap () returned 0x630000 [0060.131] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0060.131] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\MZtSVVFTr.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\MZtSVVFTr.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\MZtSVVFTr.jpg" [0060.131] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\MZtSVVFTr.jpg", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\MZtSVVFTr.jpg.happythreechoose") returned="C:\\Users\\FD1HVy\\Pictures\\MZtSVVFTr.jpg.happythreechoose" [0060.131] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\MZtSVVFTr.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\mztsvvftr.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\MZtSVVFTr.jpg.happythreechoose" (normalized: "c:\\users\\fd1hvy\\pictures\\mztsvvftr.jpg.happythreechoose"), dwFlags=0x1) returned 1 [0060.132] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\MZtSVVFTr.jpg" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0060.132] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0060.132] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" [0060.132] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\pictures\\decryption info.html")) returned 0x20 [0060.132] GetProcessHeap () returned 0x630000 [0060.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0060.132] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7c6e1c0, ftCreationTime.dwHighDateTime=0x1d5cc92, ftLastAccessTime.dwLowDateTime=0x447bfc70, ftLastAccessTime.dwHighDateTime=0x1d5d323, ftLastWriteTime.dwLowDateTime=0x447bfc70, ftLastWriteTime.dwHighDateTime=0x1d5d323, nFileSizeHigh=0x0, nFileSizeLow=0x3ea7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nrBuoeH8u5mK.png", cAlternateFileName="NRBUOE~1.PNG")) returned 1 [0060.132] lstrcmpiW (lpString1="nrBuoeH8u5mK.png", lpString2=".") returned 1 [0060.132] lstrcmpiW (lpString1="nrBuoeH8u5mK.png", lpString2="..") returned 1 [0060.132] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="nrBuoeH8u5mK.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\nrBuoeH8u5mK.png") returned="C:\\Users\\FD1HVy\\Pictures\\nrBuoeH8u5mK.png" [0060.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nrBuoeH8u5mK.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0060.132] GetProcessHeap () returned 0x630000 [0060.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11) returned 0x645cd8 [0060.132] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nrBuoeH8u5mK.png", cchWideChar=-1, lpMultiByteStr=0x645cd8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nrBuoeH8u5mK.png", lpUsedDefaultChar=0x0) returned 17 [0060.132] lstrlenA (lpString="nrBuoeH8u5mK.png") returned 16 [0060.132] lstrlenA (lpString=".happythreechoose") returned 17 [0060.132] lstrcmpiW (lpString1="nrBuoeH8u5mK.png", lpString2="Decryption INFO.html") returned 1 [0060.132] lstrcmpiW (lpString1="nrBuoeH8u5mK.png", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0060.132] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0060.132] lstrcmpiW (lpString1="nrBuoeH8u5mK.png", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0060.132] GetProcessHeap () returned 0x630000 [0060.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0060.132] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\nrBuoeH8u5mK.png" (normalized: "c:\\users\\fd1hvy\\pictures\\nrbuoeh8u5mk.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0060.132] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=16039) returned 1 [0060.132] GetProcessHeap () returned 0x630000 [0060.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655940 [0060.132] GetProcessHeap () returned 0x630000 [0060.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0060.133] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\nrBuoeH8u5mK.png") returned 41 [0060.133] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0060.133] GetProcessHeap () returned 0x630000 [0060.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0060.133] GetProcessHeap () returned 0x630000 [0060.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x654308 [0060.133] lstrlenA (lpString="rsa_encrypt") returned 11 [0060.133] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0060.134] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0060.134] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0060.134] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0060.134] GetProcessHeap () returned 0x630000 [0060.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0060.134] lstrlenA (lpString="010001") returned 6 [0060.134] GetProcessHeap () returned 0x630000 [0060.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0060.134] GetProcessHeap () returned 0x630000 [0060.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0060.134] GetProcessHeap () returned 0x630000 [0060.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e580 [0060.134] GetProcessHeap () returned 0x630000 [0060.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0060.134] GetProcessHeap () returned 0x630000 [0060.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e4f0 [0060.134] GetProcessHeap () returned 0x630000 [0060.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656db0 [0060.134] GetProcessHeap () returned 0x630000 [0060.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0060.134] GetProcessHeap () returned 0x630000 [0060.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0060.134] GetProcessHeap () returned 0x630000 [0060.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.134] GetProcessHeap () returned 0x630000 [0060.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0060.134] GetProcessHeap () returned 0x630000 [0060.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0060.135] GetProcessHeap () returned 0x630000 [0060.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656b80 [0060.135] GetProcessHeap () returned 0x630000 [0060.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.135] GetProcessHeap () returned 0x630000 [0060.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0060.135] GetProcessHeap () returned 0x630000 [0060.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e850 [0060.135] GetProcessHeap () returned 0x630000 [0060.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0060.135] GetProcessHeap () returned 0x630000 [0060.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0060.135] GetProcessHeap () returned 0x630000 [0060.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0060.135] GetProcessHeap () returned 0x630000 [0060.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0060.135] GetProcessHeap () returned 0x630000 [0060.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0060.135] GetProcessHeap () returned 0x630000 [0060.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.135] GetProcessHeap () returned 0x630000 [0060.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0060.135] GetProcessHeap () returned 0x630000 [0060.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0060.135] GetProcessHeap () returned 0x630000 [0060.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0060.135] GetProcessHeap () returned 0x630000 [0060.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ea00 [0060.135] GetProcessHeap () returned 0x630000 [0060.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0060.135] GetProcessHeap () returned 0x630000 [0060.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0060.135] GetProcessHeap () returned 0x630000 [0060.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0060.135] GetProcessHeap () returned 0x630000 [0060.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0060.135] GetProcessHeap () returned 0x630000 [0060.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0060.135] GetProcessHeap () returned 0x630000 [0060.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0060.136] GetProcessHeap () returned 0x630000 [0060.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0060.136] GetProcessHeap () returned 0x630000 [0060.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0060.136] GetProcessHeap () returned 0x630000 [0060.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0060.136] GetProcessHeap () returned 0x630000 [0060.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0060.136] GetProcessHeap () returned 0x630000 [0060.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0060.136] GetProcessHeap () returned 0x630000 [0060.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0060.136] GetProcessHeap () returned 0x630000 [0060.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0060.136] GetProcessHeap () returned 0x630000 [0060.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0060.136] GetProcessHeap () returned 0x630000 [0060.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0060.136] GetProcessHeap () returned 0x630000 [0060.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0060.136] GetProcessHeap () returned 0x630000 [0060.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0060.136] GetProcessHeap () returned 0x630000 [0060.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0060.136] GetProcessHeap () returned 0x630000 [0060.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0060.136] GetProcessHeap () returned 0x630000 [0060.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0060.136] GetProcessHeap () returned 0x630000 [0060.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0060.136] GetProcessHeap () returned 0x630000 [0060.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0060.136] GetProcessHeap () returned 0x630000 [0060.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0060.136] GetProcessHeap () returned 0x630000 [0060.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0060.136] GetProcessHeap () returned 0x630000 [0060.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0060.137] GetProcessHeap () returned 0x630000 [0060.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a188 [0060.137] GetProcessHeap () returned 0x630000 [0060.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a188 | out: hHeap=0x630000) returned 1 [0060.137] GetProcessHeap () returned 0x630000 [0060.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0060.137] GetProcessHeap () returned 0x630000 [0060.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0060.137] GetProcessHeap () returned 0x630000 [0060.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0060.137] GetProcessHeap () returned 0x630000 [0060.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0060.137] GetProcessHeap () returned 0x630000 [0060.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0060.137] GetProcessHeap () returned 0x630000 [0060.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0060.137] GetProcessHeap () returned 0x630000 [0060.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0060.137] GetProcessHeap () returned 0x630000 [0060.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0060.137] GetProcessHeap () returned 0x630000 [0060.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0060.137] GetProcessHeap () returned 0x630000 [0060.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0060.137] GetProcessHeap () returned 0x630000 [0060.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0060.137] GetProcessHeap () returned 0x630000 [0060.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0060.137] GetProcessHeap () returned 0x630000 [0060.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0060.137] GetProcessHeap () returned 0x630000 [0060.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0060.137] GetProcessHeap () returned 0x630000 [0060.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0060.137] GetProcessHeap () returned 0x630000 [0060.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0060.137] GetProcessHeap () returned 0x630000 [0060.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0060.138] GetProcessHeap () returned 0x630000 [0060.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0060.138] GetProcessHeap () returned 0x630000 [0060.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0060.138] GetProcessHeap () returned 0x630000 [0060.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0060.138] GetProcessHeap () returned 0x630000 [0060.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1a8 [0060.138] GetProcessHeap () returned 0x630000 [0060.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1a8 | out: hHeap=0x630000) returned 1 [0060.138] GetProcessHeap () returned 0x630000 [0060.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0060.138] GetProcessHeap () returned 0x630000 [0060.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0060.138] GetProcessHeap () returned 0x630000 [0060.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0060.138] GetProcessHeap () returned 0x630000 [0060.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0060.138] GetProcessHeap () returned 0x630000 [0060.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a208 [0060.138] GetProcessHeap () returned 0x630000 [0060.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a208 | out: hHeap=0x630000) returned 1 [0060.138] GetProcessHeap () returned 0x630000 [0060.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0060.138] GetProcessHeap () returned 0x630000 [0060.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0060.138] GetProcessHeap () returned 0x630000 [0060.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0060.138] GetProcessHeap () returned 0x630000 [0060.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0060.138] GetProcessHeap () returned 0x630000 [0060.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0060.138] GetProcessHeap () returned 0x630000 [0060.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0060.138] GetProcessHeap () returned 0x630000 [0060.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0060.139] GetProcessHeap () returned 0x630000 [0060.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0060.139] GetProcessHeap () returned 0x630000 [0060.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0060.139] GetProcessHeap () returned 0x630000 [0060.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0060.139] GetProcessHeap () returned 0x630000 [0060.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a208 [0060.139] GetProcessHeap () returned 0x630000 [0060.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a208 | out: hHeap=0x630000) returned 1 [0060.139] GetProcessHeap () returned 0x630000 [0060.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0060.139] GetProcessHeap () returned 0x630000 [0060.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0060.139] GetProcessHeap () returned 0x630000 [0060.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0060.139] GetProcessHeap () returned 0x630000 [0060.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0060.139] GetProcessHeap () returned 0x630000 [0060.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0060.139] GetProcessHeap () returned 0x630000 [0060.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0060.139] GetProcessHeap () returned 0x630000 [0060.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1a8 [0060.139] GetProcessHeap () returned 0x630000 [0060.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1a8 | out: hHeap=0x630000) returned 1 [0060.139] GetProcessHeap () returned 0x630000 [0060.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0060.139] GetProcessHeap () returned 0x630000 [0060.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0060.139] GetProcessHeap () returned 0x630000 [0060.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0060.139] GetProcessHeap () returned 0x630000 [0060.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0060.139] GetProcessHeap () returned 0x630000 [0060.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0060.139] GetProcessHeap () returned 0x630000 [0060.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0060.140] GetProcessHeap () returned 0x630000 [0060.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0060.140] GetProcessHeap () returned 0x630000 [0060.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0060.140] GetProcessHeap () returned 0x630000 [0060.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0060.140] GetProcessHeap () returned 0x630000 [0060.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0060.140] GetProcessHeap () returned 0x630000 [0060.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0060.140] GetProcessHeap () returned 0x630000 [0060.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0060.140] GetProcessHeap () returned 0x630000 [0060.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0060.140] GetProcessHeap () returned 0x630000 [0060.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0060.140] GetProcessHeap () returned 0x630000 [0060.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0060.140] GetProcessHeap () returned 0x630000 [0060.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0060.140] GetProcessHeap () returned 0x630000 [0060.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0060.140] GetProcessHeap () returned 0x630000 [0060.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0060.140] GetProcessHeap () returned 0x630000 [0060.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0060.140] GetProcessHeap () returned 0x630000 [0060.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0060.140] GetProcessHeap () returned 0x630000 [0060.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0060.140] WriteFile (in: hFile=0x230, lpBuffer=0x654308*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654308*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0060.142] GetProcessHeap () returned 0x630000 [0060.143] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x654308, Size=0x30) returned 0x654308 [0060.143] GetProcessHeap () returned 0x630000 [0060.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0060.143] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0060.143] GetProcessHeap () returned 0x630000 [0060.143] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3ea7) returned 0x661be8 [0060.144] ReadFile (in: hFile=0x230, lpBuffer=0x661be8, nNumberOfBytesToRead=0x3ea7, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661be8*, lpNumberOfBytesRead=0x243d7e8*=0x3ea7, lpOverlapped=0x0) returned 1 [0060.144] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0060.144] WriteFile (in: hFile=0x230, lpBuffer=0x661be8*, nNumberOfBytesToWrite=0x3ea7, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661be8*, lpNumberOfBytesWritten=0x243d7e4*=0x3ea7, lpOverlapped=0x0) returned 1 [0060.146] GetProcessHeap () returned 0x630000 [0060.146] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661be8 | out: hHeap=0x630000) returned 1 [0060.147] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0060.147] WriteFile (in: hFile=0x230, lpBuffer=0x654308*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654308*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0060.148] CloseHandle (hObject=0x230) returned 1 [0060.149] GetProcessHeap () returned 0x630000 [0060.150] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0060.150] GetProcessHeap () returned 0x630000 [0060.150] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655940 | out: hHeap=0x630000) returned 1 [0060.150] GetProcessHeap () returned 0x630000 [0060.150] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0060.150] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\nrBuoeH8u5mK.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\nrBuoeH8u5mK.png") returned="C:\\Users\\FD1HVy\\Pictures\\nrBuoeH8u5mK.png" [0060.150] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\nrBuoeH8u5mK.png", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\nrBuoeH8u5mK.png.happythreechoose") returned="C:\\Users\\FD1HVy\\Pictures\\nrBuoeH8u5mK.png.happythreechoose" [0060.150] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\nrBuoeH8u5mK.png" (normalized: "c:\\users\\fd1hvy\\pictures\\nrbuoeh8u5mk.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\nrBuoeH8u5mK.png.happythreechoose" (normalized: "c:\\users\\fd1hvy\\pictures\\nrbuoeh8u5mk.png.happythreechoose"), dwFlags=0x1) returned 1 [0060.150] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\nrBuoeH8u5mK.png" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0060.150] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0060.150] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" [0060.150] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\pictures\\decryption info.html")) returned 0x20 [0060.150] GetProcessHeap () returned 0x630000 [0060.151] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645cd8 | out: hHeap=0x630000) returned 1 [0060.151] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d402490, ftCreationTime.dwHighDateTime=0x1d5cef6, ftLastAccessTime.dwLowDateTime=0x8cf80550, ftLastAccessTime.dwHighDateTime=0x1d5d47e, ftLastWriteTime.dwLowDateTime=0x8cf80550, ftLastWriteTime.dwHighDateTime=0x1d5d47e, nFileSizeHigh=0x0, nFileSizeLow=0x184db, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pbq-KTW-Acj ll.bmp", cAlternateFileName="PBQ-KT~1.BMP")) returned 1 [0060.151] lstrcmpiW (lpString1="Pbq-KTW-Acj ll.bmp", lpString2=".") returned 1 [0060.151] lstrcmpiW (lpString1="Pbq-KTW-Acj ll.bmp", lpString2="..") returned 1 [0060.151] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="Pbq-KTW-Acj ll.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Pbq-KTW-Acj ll.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\Pbq-KTW-Acj ll.bmp" [0060.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Pbq-KTW-Acj ll.bmp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0060.151] GetProcessHeap () returned 0x630000 [0060.151] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x13) returned 0x645e58 [0060.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Pbq-KTW-Acj ll.bmp", cchWideChar=-1, lpMultiByteStr=0x645e58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pbq-KTW-Acj ll.bmp", lpUsedDefaultChar=0x0) returned 19 [0060.151] lstrlenA (lpString="Pbq-KTW-Acj ll.bmp") returned 18 [0060.151] lstrlenA (lpString=".happythreechoose") returned 17 [0060.151] lstrlenA (lpString=".happythreechoose") returned 17 [0060.151] lstrlenA (lpString="Pbq-KTW-Acj ll.bmp") returned 18 [0060.151] lstrcmpiA (lpString1="bq-KTW-Acj ll.bmp", lpString2=".happythreechoose") returned 1 [0060.151] lstrcmpiW (lpString1="Pbq-KTW-Acj ll.bmp", lpString2="Decryption INFO.html") returned 1 [0060.151] lstrcmpiW (lpString1="Pbq-KTW-Acj ll.bmp", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0060.151] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0060.151] lstrcmpiW (lpString1="Pbq-KTW-Acj ll.bmp", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0060.151] GetProcessHeap () returned 0x630000 [0060.151] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0060.151] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Pbq-KTW-Acj ll.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\pbq-ktw-acj ll.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0060.151] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=99547) returned 1 [0060.151] GetProcessHeap () returned 0x630000 [0060.151] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655b20 [0060.151] GetProcessHeap () returned 0x630000 [0060.151] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0060.151] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\Pbq-KTW-Acj ll.bmp") returned 43 [0060.151] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0060.152] GetProcessHeap () returned 0x630000 [0060.152] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0060.152] GetProcessHeap () returned 0x630000 [0060.152] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x385) returned 0x654340 [0060.152] lstrlenA (lpString="rsa_encrypt") returned 11 [0060.152] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0060.152] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0060.152] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0060.152] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0060.152] GetProcessHeap () returned 0x630000 [0060.152] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0060.152] lstrlenA (lpString="010001") returned 6 [0060.152] GetProcessHeap () returned 0x630000 [0060.152] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0060.152] GetProcessHeap () returned 0x630000 [0060.152] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0060.152] GetProcessHeap () returned 0x630000 [0060.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e340 [0060.153] GetProcessHeap () returned 0x630000 [0060.153] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0060.153] GetProcessHeap () returned 0x630000 [0060.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0060.153] GetProcessHeap () returned 0x630000 [0060.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657210 [0060.153] GetProcessHeap () returned 0x630000 [0060.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0060.153] GetProcessHeap () returned 0x630000 [0060.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0060.153] GetProcessHeap () returned 0x630000 [0060.153] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0060.153] GetProcessHeap () returned 0x630000 [0060.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0060.153] GetProcessHeap () returned 0x630000 [0060.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0060.153] GetProcessHeap () returned 0x630000 [0060.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657670 [0060.153] GetProcessHeap () returned 0x630000 [0060.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0060.153] GetProcessHeap () returned 0x630000 [0060.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0060.153] GetProcessHeap () returned 0x630000 [0060.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0060.153] GetProcessHeap () returned 0x630000 [0060.153] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0060.153] GetProcessHeap () returned 0x630000 [0060.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0060.153] GetProcessHeap () returned 0x630000 [0060.153] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0060.153] GetProcessHeap () returned 0x630000 [0060.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0060.153] GetProcessHeap () returned 0x630000 [0060.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0060.153] GetProcessHeap () returned 0x630000 [0060.153] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0060.153] GetProcessHeap () returned 0x630000 [0060.154] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0060.154] GetProcessHeap () returned 0x630000 [0060.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0060.154] GetProcessHeap () returned 0x630000 [0060.154] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0060.154] GetProcessHeap () returned 0x630000 [0060.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e3d0 [0060.154] GetProcessHeap () returned 0x630000 [0060.154] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0060.154] GetProcessHeap () returned 0x630000 [0060.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0060.154] GetProcessHeap () returned 0x630000 [0060.154] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0060.154] GetProcessHeap () returned 0x630000 [0060.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0060.154] GetProcessHeap () returned 0x630000 [0060.154] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0060.154] GetProcessHeap () returned 0x630000 [0060.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1a8 [0060.154] GetProcessHeap () returned 0x630000 [0060.154] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1a8 | out: hHeap=0x630000) returned 1 [0060.154] GetProcessHeap () returned 0x630000 [0060.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0060.154] GetProcessHeap () returned 0x630000 [0060.154] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0060.154] GetProcessHeap () returned 0x630000 [0060.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0060.154] GetProcessHeap () returned 0x630000 [0060.154] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0060.154] GetProcessHeap () returned 0x630000 [0060.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0060.154] GetProcessHeap () returned 0x630000 [0060.154] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0060.154] GetProcessHeap () returned 0x630000 [0060.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0060.154] GetProcessHeap () returned 0x630000 [0060.154] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0060.155] GetProcessHeap () returned 0x630000 [0060.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0060.155] GetProcessHeap () returned 0x630000 [0060.155] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0060.155] GetProcessHeap () returned 0x630000 [0060.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0060.155] GetProcessHeap () returned 0x630000 [0060.155] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0060.155] GetProcessHeap () returned 0x630000 [0060.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0060.155] GetProcessHeap () returned 0x630000 [0060.155] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0060.155] GetProcessHeap () returned 0x630000 [0060.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0060.155] GetProcessHeap () returned 0x630000 [0060.155] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0060.155] GetProcessHeap () returned 0x630000 [0060.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0060.155] GetProcessHeap () returned 0x630000 [0060.155] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0060.155] GetProcessHeap () returned 0x630000 [0060.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0060.155] GetProcessHeap () returned 0x630000 [0060.155] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0060.155] GetProcessHeap () returned 0x630000 [0060.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0060.155] GetProcessHeap () returned 0x630000 [0060.155] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0060.155] GetProcessHeap () returned 0x630000 [0060.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0060.155] GetProcessHeap () returned 0x630000 [0060.155] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0060.155] GetProcessHeap () returned 0x630000 [0060.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0060.156] GetProcessHeap () returned 0x630000 [0060.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0060.156] GetProcessHeap () returned 0x630000 [0060.156] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0060.156] GetProcessHeap () returned 0x630000 [0060.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0060.156] GetProcessHeap () returned 0x630000 [0060.156] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0060.156] GetProcessHeap () returned 0x630000 [0060.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0060.156] GetProcessHeap () returned 0x630000 [0060.156] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0060.156] GetProcessHeap () returned 0x630000 [0060.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0060.156] GetProcessHeap () returned 0x630000 [0060.156] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a188 [0060.156] GetProcessHeap () returned 0x630000 [0060.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a188 | out: hHeap=0x630000) returned 1 [0060.156] GetProcessHeap () returned 0x630000 [0060.156] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0060.156] GetProcessHeap () returned 0x630000 [0060.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0060.156] GetProcessHeap () returned 0x630000 [0060.156] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1a8 [0060.156] GetProcessHeap () returned 0x630000 [0060.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1a8 | out: hHeap=0x630000) returned 1 [0060.156] GetProcessHeap () returned 0x630000 [0060.156] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0060.156] GetProcessHeap () returned 0x630000 [0060.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0060.156] GetProcessHeap () returned 0x630000 [0060.156] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0060.156] GetProcessHeap () returned 0x630000 [0060.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0060.156] GetProcessHeap () returned 0x630000 [0060.156] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0060.156] GetProcessHeap () returned 0x630000 [0060.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0060.157] GetProcessHeap () returned 0x630000 [0060.157] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0060.157] GetProcessHeap () returned 0x630000 [0060.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0060.157] GetProcessHeap () returned 0x630000 [0060.157] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0060.157] GetProcessHeap () returned 0x630000 [0060.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0060.157] GetProcessHeap () returned 0x630000 [0060.157] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0060.157] GetProcessHeap () returned 0x630000 [0060.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0060.157] GetProcessHeap () returned 0x630000 [0060.157] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a208 [0060.157] GetProcessHeap () returned 0x630000 [0060.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a208 | out: hHeap=0x630000) returned 1 [0060.157] GetProcessHeap () returned 0x630000 [0060.157] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0060.157] GetProcessHeap () returned 0x630000 [0060.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0060.157] GetProcessHeap () returned 0x630000 [0060.157] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0060.157] GetProcessHeap () returned 0x630000 [0060.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0060.157] GetProcessHeap () returned 0x630000 [0060.157] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0060.157] GetProcessHeap () returned 0x630000 [0060.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0060.157] GetProcessHeap () returned 0x630000 [0060.157] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0060.157] GetProcessHeap () returned 0x630000 [0060.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0060.157] GetProcessHeap () returned 0x630000 [0060.157] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0060.157] GetProcessHeap () returned 0x630000 [0060.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0060.157] GetProcessHeap () returned 0x630000 [0060.157] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0060.157] GetProcessHeap () returned 0x630000 [0060.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0060.158] GetProcessHeap () returned 0x630000 [0060.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0060.158] GetProcessHeap () returned 0x630000 [0060.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0060.158] GetProcessHeap () returned 0x630000 [0060.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0060.158] GetProcessHeap () returned 0x630000 [0060.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0060.158] GetProcessHeap () returned 0x630000 [0060.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0060.158] GetProcessHeap () returned 0x630000 [0060.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0060.158] GetProcessHeap () returned 0x630000 [0060.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0060.158] GetProcessHeap () returned 0x630000 [0060.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0060.158] GetProcessHeap () returned 0x630000 [0060.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0060.158] GetProcessHeap () returned 0x630000 [0060.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0060.158] GetProcessHeap () returned 0x630000 [0060.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0060.158] GetProcessHeap () returned 0x630000 [0060.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0060.158] GetProcessHeap () returned 0x630000 [0060.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0060.158] GetProcessHeap () returned 0x630000 [0060.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0060.158] GetProcessHeap () returned 0x630000 [0060.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0060.158] GetProcessHeap () returned 0x630000 [0060.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0060.158] GetProcessHeap () returned 0x630000 [0060.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0060.158] GetProcessHeap () returned 0x630000 [0060.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0060.158] GetProcessHeap () returned 0x630000 [0060.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0060.159] GetProcessHeap () returned 0x630000 [0060.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0060.159] GetProcessHeap () returned 0x630000 [0060.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0060.159] GetProcessHeap () returned 0x630000 [0060.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0060.159] GetProcessHeap () returned 0x630000 [0060.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0060.159] GetProcessHeap () returned 0x630000 [0060.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.159] GetProcessHeap () returned 0x630000 [0060.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0060.159] WriteFile (in: hFile=0x230, lpBuffer=0x654340*, nNumberOfBytesToWrite=0x385, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654340*, lpNumberOfBytesWritten=0x243d864*=0x385, lpOverlapped=0x0) returned 1 [0060.160] GetProcessHeap () returned 0x630000 [0060.160] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x654340, Size=0x30) returned 0x654340 [0060.160] GetProcessHeap () returned 0x630000 [0060.160] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0060.160] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0060.161] GetProcessHeap () returned 0x630000 [0060.161] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x184e0) returned 0x661be8 [0060.162] ReadFile (in: hFile=0x230, lpBuffer=0x661be8, nNumberOfBytesToRead=0x184e0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661be8*, lpNumberOfBytesRead=0x243d7e8*=0x184e0, lpOverlapped=0x0) returned 1 [0060.163] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0060.163] WriteFile (in: hFile=0x230, lpBuffer=0x661be8*, nNumberOfBytesToWrite=0x184e0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661be8*, lpNumberOfBytesWritten=0x243d7e4*=0x184e0, lpOverlapped=0x0) returned 1 [0060.164] GetProcessHeap () returned 0x630000 [0060.164] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661be8 | out: hHeap=0x630000) returned 1 [0060.165] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0060.165] WriteFile (in: hFile=0x230, lpBuffer=0x654340*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654340*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0060.165] CloseHandle (hObject=0x230) returned 1 [0060.168] GetProcessHeap () returned 0x630000 [0060.168] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0060.168] GetProcessHeap () returned 0x630000 [0060.168] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655b20 | out: hHeap=0x630000) returned 1 [0060.169] GetProcessHeap () returned 0x630000 [0060.169] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0060.169] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\Pbq-KTW-Acj ll.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Pbq-KTW-Acj ll.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\Pbq-KTW-Acj ll.bmp" [0060.169] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\Pbq-KTW-Acj ll.bmp", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Pbq-KTW-Acj ll.bmp.happythreechoose") returned="C:\\Users\\FD1HVy\\Pictures\\Pbq-KTW-Acj ll.bmp.happythreechoose" [0060.169] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\Pbq-KTW-Acj ll.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\pbq-ktw-acj ll.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\Pbq-KTW-Acj ll.bmp.happythreechoose" (normalized: "c:\\users\\fd1hvy\\pictures\\pbq-ktw-acj ll.bmp.happythreechoose"), dwFlags=0x1) returned 1 [0060.169] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\Pbq-KTW-Acj ll.bmp" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0060.169] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0060.169] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" [0060.169] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\pictures\\decryption info.html")) returned 0x20 [0060.169] GetProcessHeap () returned 0x630000 [0060.169] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645e58 | out: hHeap=0x630000) returned 1 [0060.169] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2b1e50, ftCreationTime.dwHighDateTime=0x1d5cf39, ftLastAccessTime.dwLowDateTime=0x5d224180, ftLastAccessTime.dwHighDateTime=0x1d5d5e9, ftLastWriteTime.dwLowDateTime=0x5d224180, ftLastWriteTime.dwHighDateTime=0x1d5d5e9, nFileSizeHigh=0x0, nFileSizeLow=0xbcf4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pst61_TXtEoabFYis7G.png", cAlternateFileName="PST61_~1.PNG")) returned 1 [0060.170] lstrcmpiW (lpString1="pst61_TXtEoabFYis7G.png", lpString2=".") returned 1 [0060.170] lstrcmpiW (lpString1="pst61_TXtEoabFYis7G.png", lpString2="..") returned 1 [0060.170] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="pst61_TXtEoabFYis7G.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\pst61_TXtEoabFYis7G.png") returned="C:\\Users\\FD1HVy\\Pictures\\pst61_TXtEoabFYis7G.png" [0060.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pst61_TXtEoabFYis7G.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0060.170] GetProcessHeap () returned 0x630000 [0060.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18) returned 0x645e58 [0060.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pst61_TXtEoabFYis7G.png", cchWideChar=-1, lpMultiByteStr=0x645e58, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pst61_TXtEoabFYis7G.png", lpUsedDefaultChar=0x0) returned 24 [0060.170] lstrlenA (lpString="pst61_TXtEoabFYis7G.png") returned 23 [0060.170] lstrlenA (lpString=".happythreechoose") returned 17 [0060.170] lstrlenA (lpString=".happythreechoose") returned 17 [0060.170] lstrlenA (lpString="pst61_TXtEoabFYis7G.png") returned 23 [0060.170] lstrcmpiA (lpString1="TXtEoabFYis7G.png", lpString2=".happythreechoose") returned 1 [0060.170] lstrcmpiW (lpString1="pst61_TXtEoabFYis7G.png", lpString2="Decryption INFO.html") returned 1 [0060.170] lstrcmpiW (lpString1="pst61_TXtEoabFYis7G.png", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0060.170] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0060.170] lstrcmpiW (lpString1="pst61_TXtEoabFYis7G.png", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0060.170] GetProcessHeap () returned 0x630000 [0060.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0060.170] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\pst61_TXtEoabFYis7G.png" (normalized: "c:\\users\\fd1hvy\\pictures\\pst61_txteoabfyis7g.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0060.170] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=48372) returned 1 [0060.170] GetProcessHeap () returned 0x630000 [0060.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655a30 [0060.170] GetProcessHeap () returned 0x630000 [0060.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0060.170] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\pst61_TXtEoabFYis7G.png") returned 48 [0060.170] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0060.170] GetProcessHeap () returned 0x630000 [0060.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0060.171] GetProcessHeap () returned 0x630000 [0060.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x654378 [0060.171] lstrlenA (lpString="rsa_encrypt") returned 11 [0060.171] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0060.171] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0060.171] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0060.171] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0060.171] GetProcessHeap () returned 0x630000 [0060.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0060.171] lstrlenA (lpString="010001") returned 6 [0060.171] GetProcessHeap () returned 0x630000 [0060.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0060.171] GetProcessHeap () returned 0x630000 [0060.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0060.171] GetProcessHeap () returned 0x630000 [0060.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65df50 [0060.171] GetProcessHeap () returned 0x630000 [0060.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0060.172] GetProcessHeap () returned 0x630000 [0060.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0060.172] GetProcessHeap () returned 0x630000 [0060.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656ec8 [0060.172] GetProcessHeap () returned 0x630000 [0060.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0060.172] GetProcessHeap () returned 0x630000 [0060.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0060.172] GetProcessHeap () returned 0x630000 [0060.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0060.172] GetProcessHeap () returned 0x630000 [0060.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0060.172] GetProcessHeap () returned 0x630000 [0060.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0060.172] GetProcessHeap () returned 0x630000 [0060.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656c98 [0060.172] GetProcessHeap () returned 0x630000 [0060.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0060.172] GetProcessHeap () returned 0x630000 [0060.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0060.172] GetProcessHeap () returned 0x630000 [0060.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0060.172] GetProcessHeap () returned 0x630000 [0060.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0060.172] GetProcessHeap () returned 0x630000 [0060.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0060.172] GetProcessHeap () returned 0x630000 [0060.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0060.172] GetProcessHeap () returned 0x630000 [0060.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0060.172] GetProcessHeap () returned 0x630000 [0060.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0060.172] GetProcessHeap () returned 0x630000 [0060.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0060.172] GetProcessHeap () returned 0x630000 [0060.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0060.172] GetProcessHeap () returned 0x630000 [0060.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0e8 [0060.172] GetProcessHeap () returned 0x630000 [0060.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0e8 | out: hHeap=0x630000) returned 1 [0060.173] GetProcessHeap () returned 0x630000 [0060.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e190 [0060.173] GetProcessHeap () returned 0x630000 [0060.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0060.173] GetProcessHeap () returned 0x630000 [0060.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0060.173] GetProcessHeap () returned 0x630000 [0060.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0060.173] GetProcessHeap () returned 0x630000 [0060.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0060.173] GetProcessHeap () returned 0x630000 [0060.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0060.173] GetProcessHeap () returned 0x630000 [0060.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0060.173] GetProcessHeap () returned 0x630000 [0060.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0060.173] GetProcessHeap () returned 0x630000 [0060.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0060.173] GetProcessHeap () returned 0x630000 [0060.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0060.173] GetProcessHeap () returned 0x630000 [0060.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a188 [0060.173] GetProcessHeap () returned 0x630000 [0060.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a188 | out: hHeap=0x630000) returned 1 [0060.173] GetProcessHeap () returned 0x630000 [0060.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0060.173] GetProcessHeap () returned 0x630000 [0060.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0060.173] GetProcessHeap () returned 0x630000 [0060.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0060.173] GetProcessHeap () returned 0x630000 [0060.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0060.173] GetProcessHeap () returned 0x630000 [0060.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0060.173] GetProcessHeap () returned 0x630000 [0060.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0060.173] GetProcessHeap () returned 0x630000 [0060.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0060.174] GetProcessHeap () returned 0x630000 [0060.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0060.174] GetProcessHeap () returned 0x630000 [0060.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a208 [0060.174] GetProcessHeap () returned 0x630000 [0060.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a208 | out: hHeap=0x630000) returned 1 [0060.174] GetProcessHeap () returned 0x630000 [0060.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0060.174] GetProcessHeap () returned 0x630000 [0060.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0060.174] GetProcessHeap () returned 0x630000 [0060.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0060.174] GetProcessHeap () returned 0x630000 [0060.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0060.174] GetProcessHeap () returned 0x630000 [0060.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0060.174] GetProcessHeap () returned 0x630000 [0060.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0060.174] GetProcessHeap () returned 0x630000 [0060.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0060.174] GetProcessHeap () returned 0x630000 [0060.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0060.174] GetProcessHeap () returned 0x630000 [0060.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0060.174] GetProcessHeap () returned 0x630000 [0060.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0060.174] GetProcessHeap () returned 0x630000 [0060.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0060.174] GetProcessHeap () returned 0x630000 [0060.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0060.174] GetProcessHeap () returned 0x630000 [0060.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0060.174] GetProcessHeap () returned 0x630000 [0060.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0060.174] GetProcessHeap () returned 0x630000 [0060.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0060.174] GetProcessHeap () returned 0x630000 [0060.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0060.175] GetProcessHeap () returned 0x630000 [0060.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0060.175] GetProcessHeap () returned 0x630000 [0060.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0060.175] GetProcessHeap () returned 0x630000 [0060.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0060.175] GetProcessHeap () returned 0x630000 [0060.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0060.175] GetProcessHeap () returned 0x630000 [0060.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0060.175] GetProcessHeap () returned 0x630000 [0060.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0060.175] GetProcessHeap () returned 0x630000 [0060.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0060.175] GetProcessHeap () returned 0x630000 [0060.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0060.175] GetProcessHeap () returned 0x630000 [0060.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0060.175] GetProcessHeap () returned 0x630000 [0060.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0060.175] GetProcessHeap () returned 0x630000 [0060.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0060.175] GetProcessHeap () returned 0x630000 [0060.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0060.175] GetProcessHeap () returned 0x630000 [0060.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0060.175] GetProcessHeap () returned 0x630000 [0060.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0060.175] GetProcessHeap () returned 0x630000 [0060.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0060.175] GetProcessHeap () returned 0x630000 [0060.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0060.175] GetProcessHeap () returned 0x630000 [0060.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0060.175] GetProcessHeap () returned 0x630000 [0060.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0060.176] GetProcessHeap () returned 0x630000 [0060.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0060.176] GetProcessHeap () returned 0x630000 [0060.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0060.176] GetProcessHeap () returned 0x630000 [0060.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a188 [0060.176] GetProcessHeap () returned 0x630000 [0060.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a188 | out: hHeap=0x630000) returned 1 [0060.176] GetProcessHeap () returned 0x630000 [0060.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0060.176] GetProcessHeap () returned 0x630000 [0060.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0060.176] GetProcessHeap () returned 0x630000 [0060.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0060.176] GetProcessHeap () returned 0x630000 [0060.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0060.176] GetProcessHeap () returned 0x630000 [0060.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0060.176] GetProcessHeap () returned 0x630000 [0060.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0060.176] GetProcessHeap () returned 0x630000 [0060.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0060.176] GetProcessHeap () returned 0x630000 [0060.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0060.176] GetProcessHeap () returned 0x630000 [0060.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0060.176] GetProcessHeap () returned 0x630000 [0060.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0060.176] GetProcessHeap () returned 0x630000 [0060.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0060.176] GetProcessHeap () returned 0x630000 [0060.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0060.176] GetProcessHeap () returned 0x630000 [0060.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0060.176] GetProcessHeap () returned 0x630000 [0060.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0060.176] GetProcessHeap () returned 0x630000 [0060.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0060.177] GetProcessHeap () returned 0x630000 [0060.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0060.177] GetProcessHeap () returned 0x630000 [0060.177] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0e8 [0060.177] GetProcessHeap () returned 0x630000 [0060.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0e8 | out: hHeap=0x630000) returned 1 [0060.177] GetProcessHeap () returned 0x630000 [0060.177] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0060.177] GetProcessHeap () returned 0x630000 [0060.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0060.177] GetProcessHeap () returned 0x630000 [0060.177] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0060.177] GetProcessHeap () returned 0x630000 [0060.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0060.177] GetProcessHeap () returned 0x630000 [0060.177] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0060.177] GetProcessHeap () returned 0x630000 [0060.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0060.177] GetProcessHeap () returned 0x630000 [0060.177] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0060.177] GetProcessHeap () returned 0x630000 [0060.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0060.177] GetProcessHeap () returned 0x630000 [0060.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0060.177] GetProcessHeap () returned 0x630000 [0060.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0060.177] GetProcessHeap () returned 0x630000 [0060.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0060.177] GetProcessHeap () returned 0x630000 [0060.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0060.177] GetProcessHeap () returned 0x630000 [0060.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0060.177] GetProcessHeap () returned 0x630000 [0060.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0060.177] GetProcessHeap () returned 0x630000 [0060.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0060.177] GetProcessHeap () returned 0x630000 [0060.178] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0060.178] GetProcessHeap () returned 0x630000 [0060.178] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0060.178] GetProcessHeap () returned 0x630000 [0060.178] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.178] GetProcessHeap () returned 0x630000 [0060.178] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0060.178] WriteFile (in: hFile=0x230, lpBuffer=0x654378*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654378*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0060.181] GetProcessHeap () returned 0x630000 [0060.181] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x654378, Size=0x30) returned 0x654378 [0060.181] GetProcessHeap () returned 0x630000 [0060.181] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0060.181] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0060.181] GetProcessHeap () returned 0x630000 [0060.181] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xbcf4) returned 0x661be8 [0060.181] ReadFile (in: hFile=0x230, lpBuffer=0x661be8, nNumberOfBytesToRead=0xbcf4, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661be8*, lpNumberOfBytesRead=0x243d7e8*=0xbcf4, lpOverlapped=0x0) returned 1 [0060.181] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0060.181] WriteFile (in: hFile=0x230, lpBuffer=0x661be8*, nNumberOfBytesToWrite=0xbcf4, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661be8*, lpNumberOfBytesWritten=0x243d7e4*=0xbcf4, lpOverlapped=0x0) returned 1 [0060.183] GetProcessHeap () returned 0x630000 [0060.183] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661be8 | out: hHeap=0x630000) returned 1 [0060.185] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0060.185] WriteFile (in: hFile=0x230, lpBuffer=0x654378*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654378*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0060.186] CloseHandle (hObject=0x230) returned 1 [0060.188] GetProcessHeap () returned 0x630000 [0060.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0060.188] GetProcessHeap () returned 0x630000 [0060.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655a30 | out: hHeap=0x630000) returned 1 [0060.188] GetProcessHeap () returned 0x630000 [0060.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0060.188] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\pst61_TXtEoabFYis7G.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\pst61_TXtEoabFYis7G.png") returned="C:\\Users\\FD1HVy\\Pictures\\pst61_TXtEoabFYis7G.png" [0060.188] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\pst61_TXtEoabFYis7G.png", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\pst61_TXtEoabFYis7G.png.happythreechoose") returned="C:\\Users\\FD1HVy\\Pictures\\pst61_TXtEoabFYis7G.png.happythreechoose" [0060.188] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\pst61_TXtEoabFYis7G.png" (normalized: "c:\\users\\fd1hvy\\pictures\\pst61_txteoabfyis7g.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\pst61_TXtEoabFYis7G.png.happythreechoose" (normalized: "c:\\users\\fd1hvy\\pictures\\pst61_txteoabfyis7g.png.happythreechoose"), dwFlags=0x1) returned 1 [0060.188] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\pst61_TXtEoabFYis7G.png" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0060.188] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0060.188] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" [0060.188] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\pictures\\decryption info.html")) returned 0x20 [0060.189] GetProcessHeap () returned 0x630000 [0060.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645e58 | out: hHeap=0x630000) returned 1 [0060.189] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ba3c660, ftCreationTime.dwHighDateTime=0x1d5ce92, ftLastAccessTime.dwLowDateTime=0x36ceabf0, ftLastAccessTime.dwHighDateTime=0x1d5d813, ftLastWriteTime.dwLowDateTime=0x36ceabf0, ftLastWriteTime.dwHighDateTime=0x1d5d813, nFileSizeHigh=0x0, nFileSizeLow=0x9e19, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PzTs VJ8hcM.jpg", cAlternateFileName="PZTSVJ~1.JPG")) returned 1 [0060.189] lstrcmpiW (lpString1="PzTs VJ8hcM.jpg", lpString2=".") returned 1 [0060.189] lstrcmpiW (lpString1="PzTs VJ8hcM.jpg", lpString2="..") returned 1 [0060.189] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="PzTs VJ8hcM.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\PzTs VJ8hcM.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\PzTs VJ8hcM.jpg" [0060.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PzTs VJ8hcM.jpg", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0060.189] GetProcessHeap () returned 0x630000 [0060.189] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x64c9f0 [0060.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PzTs VJ8hcM.jpg", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PzTs VJ8hcM.jpg", lpUsedDefaultChar=0x0) returned 16 [0060.189] lstrlenA (lpString="PzTs VJ8hcM.jpg") returned 15 [0060.189] lstrlenA (lpString=".happythreechoose") returned 17 [0060.189] lstrcmpiW (lpString1="PzTs VJ8hcM.jpg", lpString2="Decryption INFO.html") returned 1 [0060.189] lstrcmpiW (lpString1="PzTs VJ8hcM.jpg", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0060.189] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0060.189] lstrcmpiW (lpString1="PzTs VJ8hcM.jpg", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0060.189] GetProcessHeap () returned 0x630000 [0060.189] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0060.189] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\PzTs VJ8hcM.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\pzts vj8hcm.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0060.189] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=40473) returned 1 [0060.189] GetProcessHeap () returned 0x630000 [0060.189] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6555f8 [0060.189] GetProcessHeap () returned 0x630000 [0060.189] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0060.189] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\PzTs VJ8hcM.jpg") returned 40 [0060.189] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0060.189] GetProcessHeap () returned 0x630000 [0060.189] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0060.190] GetProcessHeap () returned 0x630000 [0060.190] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x387) returned 0x6543b0 [0060.190] lstrlenA (lpString="rsa_encrypt") returned 11 [0060.190] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0060.190] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0060.190] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0060.190] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0060.190] GetProcessHeap () returned 0x630000 [0060.190] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0060.190] lstrlenA (lpString="010001") returned 6 [0060.190] GetProcessHeap () returned 0x630000 [0060.190] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0060.190] GetProcessHeap () returned 0x630000 [0060.190] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0060.190] GetProcessHeap () returned 0x630000 [0060.190] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dfe0 [0060.191] GetProcessHeap () returned 0x630000 [0060.191] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0060.191] GetProcessHeap () returned 0x630000 [0060.191] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e850 [0060.191] GetProcessHeap () returned 0x630000 [0060.191] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657210 [0060.191] GetProcessHeap () returned 0x630000 [0060.191] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0060.191] GetProcessHeap () returned 0x630000 [0060.191] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0060.191] GetProcessHeap () returned 0x630000 [0060.191] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0060.191] GetProcessHeap () returned 0x630000 [0060.191] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0060.191] GetProcessHeap () returned 0x630000 [0060.191] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0060.191] GetProcessHeap () returned 0x630000 [0060.191] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656db0 [0060.191] GetProcessHeap () returned 0x630000 [0060.191] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0060.191] GetProcessHeap () returned 0x630000 [0060.191] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0060.191] GetProcessHeap () returned 0x630000 [0060.191] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0060.191] GetProcessHeap () returned 0x630000 [0060.191] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0060.191] GetProcessHeap () returned 0x630000 [0060.191] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0060.191] GetProcessHeap () returned 0x630000 [0060.191] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0060.191] GetProcessHeap () returned 0x630000 [0060.191] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0060.191] GetProcessHeap () returned 0x630000 [0060.191] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x661728 [0060.191] GetProcessHeap () returned 0x630000 [0060.191] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0060.191] GetProcessHeap () returned 0x630000 [0060.192] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0060.192] GetProcessHeap () returned 0x630000 [0060.192] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0060.192] GetProcessHeap () returned 0x630000 [0060.192] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0060.192] GetProcessHeap () returned 0x630000 [0060.192] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e6a0 [0060.192] GetProcessHeap () returned 0x630000 [0060.192] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661728 | out: hHeap=0x630000) returned 1 [0060.192] GetProcessHeap () returned 0x630000 [0060.192] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0060.192] GetProcessHeap () returned 0x630000 [0060.192] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e6a0 | out: hHeap=0x630000) returned 1 [0060.192] GetProcessHeap () returned 0x630000 [0060.192] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0060.192] GetProcessHeap () returned 0x630000 [0060.192] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0060.192] GetProcessHeap () returned 0x630000 [0060.192] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0060.192] GetProcessHeap () returned 0x630000 [0060.192] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0060.192] GetProcessHeap () returned 0x630000 [0060.192] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0060.192] GetProcessHeap () returned 0x630000 [0060.192] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0060.192] GetProcessHeap () returned 0x630000 [0060.192] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0060.192] GetProcessHeap () returned 0x630000 [0060.192] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0060.192] GetProcessHeap () returned 0x630000 [0060.192] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0060.192] GetProcessHeap () returned 0x630000 [0060.192] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0060.192] GetProcessHeap () returned 0x630000 [0060.192] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0060.192] GetProcessHeap () returned 0x630000 [0060.193] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0060.193] GetProcessHeap () returned 0x630000 [0060.193] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0060.193] GetProcessHeap () returned 0x630000 [0060.193] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0060.193] GetProcessHeap () returned 0x630000 [0060.193] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0060.193] GetProcessHeap () returned 0x630000 [0060.193] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0060.193] GetProcessHeap () returned 0x630000 [0060.193] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0060.193] GetProcessHeap () returned 0x630000 [0060.193] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0060.193] GetProcessHeap () returned 0x630000 [0060.193] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0060.193] GetProcessHeap () returned 0x630000 [0060.193] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0060.193] GetProcessHeap () returned 0x630000 [0060.193] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0060.193] GetProcessHeap () returned 0x630000 [0060.193] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0060.193] GetProcessHeap () returned 0x630000 [0060.193] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0060.193] GetProcessHeap () returned 0x630000 [0060.193] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0060.193] GetProcessHeap () returned 0x630000 [0060.193] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0060.193] GetProcessHeap () returned 0x630000 [0060.193] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0060.193] GetProcessHeap () returned 0x630000 [0060.193] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0e8 [0060.193] GetProcessHeap () returned 0x630000 [0060.193] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0e8 | out: hHeap=0x630000) returned 1 [0060.193] GetProcessHeap () returned 0x630000 [0060.194] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0060.194] GetProcessHeap () returned 0x630000 [0060.194] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0060.194] GetProcessHeap () returned 0x630000 [0060.194] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0060.194] GetProcessHeap () returned 0x630000 [0060.194] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0060.194] GetProcessHeap () returned 0x630000 [0060.194] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0060.194] GetProcessHeap () returned 0x630000 [0060.194] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0060.194] GetProcessHeap () returned 0x630000 [0060.194] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0060.194] GetProcessHeap () returned 0x630000 [0060.194] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0060.194] GetProcessHeap () returned 0x630000 [0060.194] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0060.194] GetProcessHeap () returned 0x630000 [0060.194] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0060.194] GetProcessHeap () returned 0x630000 [0060.194] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0060.194] GetProcessHeap () returned 0x630000 [0060.194] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0060.194] GetProcessHeap () returned 0x630000 [0060.194] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0060.194] GetProcessHeap () returned 0x630000 [0060.194] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0060.194] GetProcessHeap () returned 0x630000 [0060.194] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0060.194] GetProcessHeap () returned 0x630000 [0060.194] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0060.194] GetProcessHeap () returned 0x630000 [0060.194] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0060.194] GetProcessHeap () returned 0x630000 [0060.194] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0060.195] GetProcessHeap () returned 0x630000 [0060.195] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0060.195] GetProcessHeap () returned 0x630000 [0060.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0060.195] GetProcessHeap () returned 0x630000 [0060.195] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0060.195] GetProcessHeap () returned 0x630000 [0060.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0060.195] GetProcessHeap () returned 0x630000 [0060.195] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0060.195] GetProcessHeap () returned 0x630000 [0060.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0060.195] GetProcessHeap () returned 0x630000 [0060.195] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0060.195] GetProcessHeap () returned 0x630000 [0060.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0060.195] GetProcessHeap () returned 0x630000 [0060.195] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0060.195] GetProcessHeap () returned 0x630000 [0060.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0060.195] GetProcessHeap () returned 0x630000 [0060.195] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0060.195] GetProcessHeap () returned 0x630000 [0060.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0060.195] GetProcessHeap () returned 0x630000 [0060.195] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0060.195] GetProcessHeap () returned 0x630000 [0060.196] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0060.196] GetProcessHeap () returned 0x630000 [0060.196] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0060.196] GetProcessHeap () returned 0x630000 [0060.196] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0060.196] GetProcessHeap () returned 0x630000 [0060.196] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0060.196] GetProcessHeap () returned 0x630000 [0060.196] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0060.196] GetProcessHeap () returned 0x630000 [0060.196] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0060.196] GetProcessHeap () returned 0x630000 [0060.196] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0060.196] GetProcessHeap () returned 0x630000 [0060.196] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0060.196] GetProcessHeap () returned 0x630000 [0060.196] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0060.196] GetProcessHeap () returned 0x630000 [0060.196] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0060.196] GetProcessHeap () returned 0x630000 [0060.196] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0060.196] GetProcessHeap () returned 0x630000 [0060.196] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a208 [0060.196] GetProcessHeap () returned 0x630000 [0060.196] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a208 | out: hHeap=0x630000) returned 1 [0060.196] GetProcessHeap () returned 0x630000 [0060.196] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0060.196] GetProcessHeap () returned 0x630000 [0060.196] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0060.196] GetProcessHeap () returned 0x630000 [0060.196] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0060.196] GetProcessHeap () returned 0x630000 [0060.196] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0060.196] GetProcessHeap () returned 0x630000 [0060.196] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a188 [0060.196] GetProcessHeap () returned 0x630000 [0060.196] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a188 | out: hHeap=0x630000) returned 1 [0060.197] GetProcessHeap () returned 0x630000 [0060.197] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0060.197] GetProcessHeap () returned 0x630000 [0060.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0060.197] GetProcessHeap () returned 0x630000 [0060.197] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0060.197] GetProcessHeap () returned 0x630000 [0060.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0060.197] GetProcessHeap () returned 0x630000 [0060.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0060.197] GetProcessHeap () returned 0x630000 [0060.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0060.197] GetProcessHeap () returned 0x630000 [0060.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0060.197] GetProcessHeap () returned 0x630000 [0060.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0060.197] GetProcessHeap () returned 0x630000 [0060.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0060.197] GetProcessHeap () returned 0x630000 [0060.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0060.197] GetProcessHeap () returned 0x630000 [0060.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0060.197] GetProcessHeap () returned 0x630000 [0060.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0060.197] GetProcessHeap () returned 0x630000 [0060.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0060.197] GetProcessHeap () returned 0x630000 [0060.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.197] GetProcessHeap () returned 0x630000 [0060.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0060.197] WriteFile (in: hFile=0x230, lpBuffer=0x6543b0*, nNumberOfBytesToWrite=0x387, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6543b0*, lpNumberOfBytesWritten=0x243d864*=0x387, lpOverlapped=0x0) returned 1 [0060.201] GetProcessHeap () returned 0x630000 [0060.201] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6543b0, Size=0x30) returned 0x6543b0 [0060.201] GetProcessHeap () returned 0x630000 [0060.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0060.201] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0060.201] GetProcessHeap () returned 0x630000 [0060.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9e20) returned 0x661be8 [0060.203] ReadFile (in: hFile=0x230, lpBuffer=0x661be8, nNumberOfBytesToRead=0x9e20, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661be8*, lpNumberOfBytesRead=0x243d7e8*=0x9e20, lpOverlapped=0x0) returned 1 [0060.203] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0060.203] WriteFile (in: hFile=0x230, lpBuffer=0x661be8*, nNumberOfBytesToWrite=0x9e20, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661be8*, lpNumberOfBytesWritten=0x243d7e4*=0x9e20, lpOverlapped=0x0) returned 1 [0060.205] GetProcessHeap () returned 0x630000 [0060.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661be8 | out: hHeap=0x630000) returned 1 [0060.206] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0060.206] WriteFile (in: hFile=0x230, lpBuffer=0x6543b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6543b0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0060.207] CloseHandle (hObject=0x230) returned 1 [0060.209] GetProcessHeap () returned 0x630000 [0060.209] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0060.209] GetProcessHeap () returned 0x630000 [0060.209] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6555f8 | out: hHeap=0x630000) returned 1 [0060.209] GetProcessHeap () returned 0x630000 [0060.209] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0060.209] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\PzTs VJ8hcM.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\PzTs VJ8hcM.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\PzTs VJ8hcM.jpg" [0060.209] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\PzTs VJ8hcM.jpg", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\PzTs VJ8hcM.jpg.happythreechoose") returned="C:\\Users\\FD1HVy\\Pictures\\PzTs VJ8hcM.jpg.happythreechoose" [0060.209] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\PzTs VJ8hcM.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\pzts vj8hcm.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\PzTs VJ8hcM.jpg.happythreechoose" (normalized: "c:\\users\\fd1hvy\\pictures\\pzts vj8hcm.jpg.happythreechoose"), dwFlags=0x1) returned 1 [0060.210] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\PzTs VJ8hcM.jpg" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0060.210] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0060.210] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" [0060.210] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\pictures\\decryption info.html")) returned 0x20 [0060.210] GetProcessHeap () returned 0x630000 [0060.210] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0060.210] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53528c30, ftCreationTime.dwHighDateTime=0x1d5d6ae, ftLastAccessTime.dwLowDateTime=0x92867e10, ftLastAccessTime.dwHighDateTime=0x1d5d754, ftLastWriteTime.dwLowDateTime=0x92867e10, ftLastWriteTime.dwHighDateTime=0x1d5d754, nFileSizeHigh=0x0, nFileSizeLow=0x15d95, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="S84Ptrqg19hlx0.bmp", cAlternateFileName="S84PTR~1.BMP")) returned 1 [0060.210] lstrcmpiW (lpString1="S84Ptrqg19hlx0.bmp", lpString2=".") returned 1 [0060.210] lstrcmpiW (lpString1="S84Ptrqg19hlx0.bmp", lpString2="..") returned 1 [0060.210] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="S84Ptrqg19hlx0.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\S84Ptrqg19hlx0.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\S84Ptrqg19hlx0.bmp" [0060.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="S84Ptrqg19hlx0.bmp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0060.210] GetProcessHeap () returned 0x630000 [0060.210] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x13) returned 0x645e78 [0060.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="S84Ptrqg19hlx0.bmp", cchWideChar=-1, lpMultiByteStr=0x645e78, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="S84Ptrqg19hlx0.bmp", lpUsedDefaultChar=0x0) returned 19 [0060.210] lstrlenA (lpString="S84Ptrqg19hlx0.bmp") returned 18 [0060.210] lstrlenA (lpString=".happythreechoose") returned 17 [0060.210] lstrlenA (lpString=".happythreechoose") returned 17 [0060.210] lstrlenA (lpString="S84Ptrqg19hlx0.bmp") returned 18 [0060.210] lstrcmpiA (lpString1="84Ptrqg19hlx0.bmp", lpString2=".happythreechoose") returned 1 [0060.210] lstrcmpiW (lpString1="S84Ptrqg19hlx0.bmp", lpString2="Decryption INFO.html") returned 1 [0060.210] lstrcmpiW (lpString1="S84Ptrqg19hlx0.bmp", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0060.210] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0060.211] lstrcmpiW (lpString1="S84Ptrqg19hlx0.bmp", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0060.211] GetProcessHeap () returned 0x630000 [0060.211] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0060.211] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\S84Ptrqg19hlx0.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\s84ptrqg19hlx0.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0060.258] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=89493) returned 1 [0060.258] GetProcessHeap () returned 0x630000 [0060.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655a30 [0060.258] GetProcessHeap () returned 0x630000 [0060.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0060.258] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\S84Ptrqg19hlx0.bmp") returned 43 [0060.258] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0060.258] GetProcessHeap () returned 0x630000 [0060.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0060.258] GetProcessHeap () returned 0x630000 [0060.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38b) returned 0x6543e8 [0060.259] lstrlenA (lpString="rsa_encrypt") returned 11 [0060.259] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0060.259] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0060.259] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0060.259] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0060.259] GetProcessHeap () returned 0x630000 [0060.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0060.259] lstrlenA (lpString="010001") returned 6 [0060.259] GetProcessHeap () returned 0x630000 [0060.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0060.259] GetProcessHeap () returned 0x630000 [0060.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0060.259] GetProcessHeap () returned 0x630000 [0060.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ebb0 [0060.260] GetProcessHeap () returned 0x630000 [0060.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0060.260] GetProcessHeap () returned 0x630000 [0060.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e3d0 [0060.260] GetProcessHeap () returned 0x630000 [0060.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656c98 [0060.260] GetProcessHeap () returned 0x630000 [0060.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0060.260] GetProcessHeap () returned 0x630000 [0060.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0060.260] GetProcessHeap () returned 0x630000 [0060.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0060.260] GetProcessHeap () returned 0x630000 [0060.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0060.260] GetProcessHeap () returned 0x630000 [0060.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0060.260] GetProcessHeap () returned 0x630000 [0060.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656db0 [0060.260] GetProcessHeap () returned 0x630000 [0060.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0060.260] GetProcessHeap () returned 0x630000 [0060.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0060.260] GetProcessHeap () returned 0x630000 [0060.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0060.260] GetProcessHeap () returned 0x630000 [0060.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0060.260] GetProcessHeap () returned 0x630000 [0060.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0060.260] GetProcessHeap () returned 0x630000 [0060.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0060.260] GetProcessHeap () returned 0x630000 [0060.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0060.260] GetProcessHeap () returned 0x630000 [0060.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0060.260] GetProcessHeap () returned 0x630000 [0060.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0060.260] GetProcessHeap () returned 0x630000 [0060.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0060.260] GetProcessHeap () returned 0x630000 [0060.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0060.261] GetProcessHeap () returned 0x630000 [0060.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0060.261] GetProcessHeap () returned 0x630000 [0060.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e6a0 [0060.261] GetProcessHeap () returned 0x630000 [0060.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0060.261] GetProcessHeap () returned 0x630000 [0060.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0060.261] GetProcessHeap () returned 0x630000 [0060.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e6a0 | out: hHeap=0x630000) returned 1 [0060.261] GetProcessHeap () returned 0x630000 [0060.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0060.261] GetProcessHeap () returned 0x630000 [0060.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0060.261] GetProcessHeap () returned 0x630000 [0060.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0060.261] GetProcessHeap () returned 0x630000 [0060.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0060.261] GetProcessHeap () returned 0x630000 [0060.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0060.261] GetProcessHeap () returned 0x630000 [0060.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0060.261] GetProcessHeap () returned 0x630000 [0060.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0060.261] GetProcessHeap () returned 0x630000 [0060.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0060.261] GetProcessHeap () returned 0x630000 [0060.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0060.261] GetProcessHeap () returned 0x630000 [0060.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0060.261] GetProcessHeap () returned 0x630000 [0060.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0060.261] GetProcessHeap () returned 0x630000 [0060.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0060.261] GetProcessHeap () returned 0x630000 [0060.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0060.261] GetProcessHeap () returned 0x630000 [0060.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0060.262] GetProcessHeap () returned 0x630000 [0060.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0060.262] GetProcessHeap () returned 0x630000 [0060.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0060.262] GetProcessHeap () returned 0x630000 [0060.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a208 [0060.262] GetProcessHeap () returned 0x630000 [0060.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a208 | out: hHeap=0x630000) returned 1 [0060.262] GetProcessHeap () returned 0x630000 [0060.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0060.262] GetProcessHeap () returned 0x630000 [0060.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0060.262] GetProcessHeap () returned 0x630000 [0060.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0060.262] GetProcessHeap () returned 0x630000 [0060.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0060.262] GetProcessHeap () returned 0x630000 [0060.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0060.262] GetProcessHeap () returned 0x630000 [0060.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0060.262] GetProcessHeap () returned 0x630000 [0060.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0060.262] GetProcessHeap () returned 0x630000 [0060.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0060.262] GetProcessHeap () returned 0x630000 [0060.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0060.262] GetProcessHeap () returned 0x630000 [0060.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0060.262] GetProcessHeap () returned 0x630000 [0060.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0060.262] GetProcessHeap () returned 0x630000 [0060.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0060.262] GetProcessHeap () returned 0x630000 [0060.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0060.262] GetProcessHeap () returned 0x630000 [0060.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0060.262] GetProcessHeap () returned 0x630000 [0060.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0060.263] GetProcessHeap () returned 0x630000 [0060.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0060.263] GetProcessHeap () returned 0x630000 [0060.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0060.263] GetProcessHeap () returned 0x630000 [0060.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0060.263] GetProcessHeap () returned 0x630000 [0060.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0060.263] GetProcessHeap () returned 0x630000 [0060.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0060.263] GetProcessHeap () returned 0x630000 [0060.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0060.263] GetProcessHeap () returned 0x630000 [0060.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0060.263] GetProcessHeap () returned 0x630000 [0060.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0060.263] GetProcessHeap () returned 0x630000 [0060.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0060.263] GetProcessHeap () returned 0x630000 [0060.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0060.263] GetProcessHeap () returned 0x630000 [0060.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0060.263] GetProcessHeap () returned 0x630000 [0060.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0060.263] GetProcessHeap () returned 0x630000 [0060.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0060.263] GetProcessHeap () returned 0x630000 [0060.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a208 [0060.263] GetProcessHeap () returned 0x630000 [0060.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a208 | out: hHeap=0x630000) returned 1 [0060.263] GetProcessHeap () returned 0x630000 [0060.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0060.263] GetProcessHeap () returned 0x630000 [0060.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0060.263] GetProcessHeap () returned 0x630000 [0060.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0060.264] GetProcessHeap () returned 0x630000 [0060.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0060.264] GetProcessHeap () returned 0x630000 [0060.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0060.264] GetProcessHeap () returned 0x630000 [0060.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0060.264] GetProcessHeap () returned 0x630000 [0060.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0060.264] GetProcessHeap () returned 0x630000 [0060.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0060.264] GetProcessHeap () returned 0x630000 [0060.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0060.264] GetProcessHeap () returned 0x630000 [0060.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0060.264] GetProcessHeap () returned 0x630000 [0060.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0060.264] GetProcessHeap () returned 0x630000 [0060.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0060.264] GetProcessHeap () returned 0x630000 [0060.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0060.264] GetProcessHeap () returned 0x630000 [0060.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0060.264] GetProcessHeap () returned 0x630000 [0060.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0060.264] GetProcessHeap () returned 0x630000 [0060.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0060.264] GetProcessHeap () returned 0x630000 [0060.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0060.264] GetProcessHeap () returned 0x630000 [0060.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0060.264] GetProcessHeap () returned 0x630000 [0060.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0060.264] GetProcessHeap () returned 0x630000 [0060.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0060.264] GetProcessHeap () returned 0x630000 [0060.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0060.264] GetProcessHeap () returned 0x630000 [0060.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0060.265] GetProcessHeap () returned 0x630000 [0060.265] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0060.265] GetProcessHeap () returned 0x630000 [0060.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0060.265] GetProcessHeap () returned 0x630000 [0060.265] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0060.265] GetProcessHeap () returned 0x630000 [0060.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0060.265] GetProcessHeap () returned 0x630000 [0060.265] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0060.265] GetProcessHeap () returned 0x630000 [0060.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0060.265] GetProcessHeap () returned 0x630000 [0060.265] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0060.265] GetProcessHeap () returned 0x630000 [0060.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0060.265] GetProcessHeap () returned 0x630000 [0060.265] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0060.265] GetProcessHeap () returned 0x630000 [0060.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0060.265] GetProcessHeap () returned 0x630000 [0060.265] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0060.265] GetProcessHeap () returned 0x630000 [0060.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0060.265] GetProcessHeap () returned 0x630000 [0060.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0060.265] GetProcessHeap () returned 0x630000 [0060.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0060.265] GetProcessHeap () returned 0x630000 [0060.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0060.265] GetProcessHeap () returned 0x630000 [0060.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0060.265] GetProcessHeap () returned 0x630000 [0060.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0060.265] GetProcessHeap () returned 0x630000 [0060.266] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0060.266] GetProcessHeap () returned 0x630000 [0060.266] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0060.266] GetProcessHeap () returned 0x630000 [0060.266] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0060.266] GetProcessHeap () returned 0x630000 [0060.266] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0060.266] GetProcessHeap () returned 0x630000 [0060.266] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.266] GetProcessHeap () returned 0x630000 [0060.266] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0060.266] WriteFile (in: hFile=0x230, lpBuffer=0x6543e8*, nNumberOfBytesToWrite=0x38b, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6543e8*, lpNumberOfBytesWritten=0x243d864*=0x38b, lpOverlapped=0x0) returned 1 [0060.268] GetProcessHeap () returned 0x630000 [0060.268] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6543e8, Size=0x30) returned 0x6543e8 [0060.268] GetProcessHeap () returned 0x630000 [0060.268] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0060.268] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0060.268] GetProcessHeap () returned 0x630000 [0060.268] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x15da0) returned 0x661be8 [0060.271] ReadFile (in: hFile=0x230, lpBuffer=0x661be8, nNumberOfBytesToRead=0x15da0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661be8*, lpNumberOfBytesRead=0x243d7e8*=0x15da0, lpOverlapped=0x0) returned 1 [0060.272] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0060.272] WriteFile (in: hFile=0x230, lpBuffer=0x661be8*, nNumberOfBytesToWrite=0x15da0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661be8*, lpNumberOfBytesWritten=0x243d7e4*=0x15da0, lpOverlapped=0x0) returned 1 [0060.279] GetProcessHeap () returned 0x630000 [0060.279] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661be8 | out: hHeap=0x630000) returned 1 [0060.279] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0060.279] WriteFile (in: hFile=0x230, lpBuffer=0x6543e8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6543e8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0060.280] CloseHandle (hObject=0x230) returned 1 [0060.283] GetProcessHeap () returned 0x630000 [0060.283] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0060.283] GetProcessHeap () returned 0x630000 [0060.283] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655a30 | out: hHeap=0x630000) returned 1 [0060.283] GetProcessHeap () returned 0x630000 [0060.283] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0060.283] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\S84Ptrqg19hlx0.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\S84Ptrqg19hlx0.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\S84Ptrqg19hlx0.bmp" [0060.283] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\S84Ptrqg19hlx0.bmp", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\S84Ptrqg19hlx0.bmp.happythreechoose") returned="C:\\Users\\FD1HVy\\Pictures\\S84Ptrqg19hlx0.bmp.happythreechoose" [0060.283] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\S84Ptrqg19hlx0.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\s84ptrqg19hlx0.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\S84Ptrqg19hlx0.bmp.happythreechoose" (normalized: "c:\\users\\fd1hvy\\pictures\\s84ptrqg19hlx0.bmp.happythreechoose"), dwFlags=0x1) returned 1 [0060.284] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\S84Ptrqg19hlx0.bmp" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0060.284] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0060.284] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" [0060.284] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\pictures\\decryption info.html")) returned 0x20 [0060.284] GetProcessHeap () returned 0x630000 [0060.284] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645e78 | out: hHeap=0x630000) returned 1 [0060.284] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Pictures", cAlternateFileName="SAVEDP~1")) returned 1 [0060.284] lstrcmpiW (lpString1="Saved Pictures", lpString2=".") returned 1 [0060.284] lstrcmpiW (lpString1="Saved Pictures", lpString2="..") returned 1 [0060.284] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="Saved Pictures" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures") returned="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures" [0060.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Saved Pictures", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0060.284] GetProcessHeap () returned 0x630000 [0060.284] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64ca20 [0060.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Saved Pictures", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Saved Pictures", lpUsedDefaultChar=0x0) returned 15 [0060.284] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0060.284] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0060.285] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0060.285] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0060.285] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0060.285] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0060.285] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0060.285] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0060.285] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0060.285] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0060.285] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0060.285] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0060.285] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0060.285] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0060.285] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0060.285] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0060.285] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0060.285] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0060.285] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0060.285] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0060.285] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0060.285] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0060.285] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0060.285] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0060.285] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0060.285] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0060.285] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0060.285] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0060.285] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0060.285] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0060.285] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0060.285] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0060.285] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0060.285] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0060.285] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0060.286] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0060.286] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0060.286] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0060.286] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0060.286] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0060.286] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0060.286] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0060.286] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Pictures", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0060.286] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\" [0060.286] GetProcessHeap () returned 0x630000 [0060.286] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a258 [0060.286] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\") returned 40 [0060.286] GetProcessHeap () returned 0x630000 [0060.286] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x52) returned 0x653930 [0060.286] lstrcpyW (in: lpString1=0x653930, lpString2="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\" [0060.286] GetProcessHeap () returned 0x630000 [0060.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0060.286] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4cb7bd0, ftCreationTime.dwHighDateTime=0x1d5ca24, ftLastAccessTime.dwLowDateTime=0x16f55960, ftLastAccessTime.dwHighDateTime=0x1d5d439, ftLastWriteTime.dwLowDateTime=0x16f55960, ftLastWriteTime.dwHighDateTime=0x1d5d439, nFileSizeHigh=0x0, nFileSizeLow=0x6b23, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="T82jEhXsa5Qy5aHk.jpg", cAlternateFileName="T82JEH~1.JPG")) returned 1 [0060.286] lstrcmpiW (lpString1="T82jEhXsa5Qy5aHk.jpg", lpString2=".") returned 1 [0060.286] lstrcmpiW (lpString1="T82jEhXsa5Qy5aHk.jpg", lpString2="..") returned 1 [0060.286] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="T82jEhXsa5Qy5aHk.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\T82jEhXsa5Qy5aHk.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\T82jEhXsa5Qy5aHk.jpg" [0060.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="T82jEhXsa5Qy5aHk.jpg", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0060.286] GetProcessHeap () returned 0x630000 [0060.286] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x15) returned 0x645e58 [0060.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="T82jEhXsa5Qy5aHk.jpg", cchWideChar=-1, lpMultiByteStr=0x645e58, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="T82jEhXsa5Qy5aHk.jpg", lpUsedDefaultChar=0x0) returned 21 [0060.286] lstrlenA (lpString="T82jEhXsa5Qy5aHk.jpg") returned 20 [0060.286] lstrlenA (lpString=".happythreechoose") returned 17 [0060.286] lstrlenA (lpString=".happythreechoose") returned 17 [0060.286] lstrlenA (lpString="T82jEhXsa5Qy5aHk.jpg") returned 20 [0060.286] lstrcmpiA (lpString1="jEhXsa5Qy5aHk.jpg", lpString2=".happythreechoose") returned 1 [0060.286] lstrcmpiW (lpString1="T82jEhXsa5Qy5aHk.jpg", lpString2="Decryption INFO.html") returned 1 [0060.286] lstrcmpiW (lpString1="T82jEhXsa5Qy5aHk.jpg", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0060.286] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0060.286] lstrcmpiW (lpString1="T82jEhXsa5Qy5aHk.jpg", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0060.286] GetProcessHeap () returned 0x630000 [0060.287] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0060.287] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\T82jEhXsa5Qy5aHk.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\t82jehxsa5qy5ahk.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0060.287] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=27427) returned 1 [0060.287] GetProcessHeap () returned 0x630000 [0060.287] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655670 [0060.287] GetProcessHeap () returned 0x630000 [0060.287] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0060.287] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\T82jEhXsa5Qy5aHk.jpg") returned 45 [0060.287] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0060.287] GetProcessHeap () returned 0x630000 [0060.287] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0060.287] GetProcessHeap () returned 0x630000 [0060.287] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x654420 [0060.287] lstrlenA (lpString="rsa_encrypt") returned 11 [0060.287] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0060.288] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0060.288] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0060.288] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0060.288] GetProcessHeap () returned 0x630000 [0060.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0060.288] lstrlenA (lpString="010001") returned 6 [0060.288] GetProcessHeap () returned 0x630000 [0060.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0060.288] GetProcessHeap () returned 0x630000 [0060.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0060.288] GetProcessHeap () returned 0x630000 [0060.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0060.288] GetProcessHeap () returned 0x630000 [0060.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0060.288] GetProcessHeap () returned 0x630000 [0060.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ecd0 [0060.288] GetProcessHeap () returned 0x630000 [0060.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x6570f8 [0060.288] GetProcessHeap () returned 0x630000 [0060.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a188 [0060.288] GetProcessHeap () returned 0x630000 [0060.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0060.288] GetProcessHeap () returned 0x630000 [0060.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a188 | out: hHeap=0x630000) returned 1 [0060.288] GetProcessHeap () returned 0x630000 [0060.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0060.288] GetProcessHeap () returned 0x630000 [0060.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0060.288] GetProcessHeap () returned 0x630000 [0060.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656b80 [0060.289] GetProcessHeap () returned 0x630000 [0060.289] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0060.289] GetProcessHeap () returned 0x630000 [0060.289] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0060.289] GetProcessHeap () returned 0x630000 [0060.289] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e100 [0060.289] GetProcessHeap () returned 0x630000 [0060.289] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0060.289] GetProcessHeap () returned 0x630000 [0060.289] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0060.289] GetProcessHeap () returned 0x630000 [0060.289] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0060.289] GetProcessHeap () returned 0x630000 [0060.289] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0060.289] GetProcessHeap () returned 0x630000 [0060.289] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0060.289] GetProcessHeap () returned 0x630000 [0060.289] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0060.289] GetProcessHeap () returned 0x630000 [0060.289] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0060.289] GetProcessHeap () returned 0x630000 [0060.289] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0060.289] GetProcessHeap () returned 0x630000 [0060.289] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0060.289] GetProcessHeap () returned 0x630000 [0060.289] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65df50 [0060.289] GetProcessHeap () returned 0x630000 [0060.289] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0060.289] GetProcessHeap () returned 0x630000 [0060.289] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0060.289] GetProcessHeap () returned 0x630000 [0060.289] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0060.290] GetProcessHeap () returned 0x630000 [0060.290] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0060.290] GetProcessHeap () returned 0x630000 [0060.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0060.290] GetProcessHeap () returned 0x630000 [0060.290] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0060.290] GetProcessHeap () returned 0x630000 [0060.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0060.290] GetProcessHeap () returned 0x630000 [0060.290] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0060.290] GetProcessHeap () returned 0x630000 [0060.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0060.290] GetProcessHeap () returned 0x630000 [0060.290] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0060.290] GetProcessHeap () returned 0x630000 [0060.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0060.290] GetProcessHeap () returned 0x630000 [0060.290] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0060.290] GetProcessHeap () returned 0x630000 [0060.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0060.290] GetProcessHeap () returned 0x630000 [0060.290] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0060.290] GetProcessHeap () returned 0x630000 [0060.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0060.290] GetProcessHeap () returned 0x630000 [0060.290] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0060.290] GetProcessHeap () returned 0x630000 [0060.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0060.290] GetProcessHeap () returned 0x630000 [0060.290] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0060.290] GetProcessHeap () returned 0x630000 [0060.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0060.290] GetProcessHeap () returned 0x630000 [0060.290] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0060.290] GetProcessHeap () returned 0x630000 [0060.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0060.290] GetProcessHeap () returned 0x630000 [0060.291] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0060.291] GetProcessHeap () returned 0x630000 [0060.291] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0060.291] GetProcessHeap () returned 0x630000 [0060.291] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0060.291] GetProcessHeap () returned 0x630000 [0060.291] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0060.291] GetProcessHeap () returned 0x630000 [0060.291] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0060.291] GetProcessHeap () returned 0x630000 [0060.291] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0060.291] GetProcessHeap () returned 0x630000 [0060.291] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0060.291] GetProcessHeap () returned 0x630000 [0060.291] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0060.291] GetProcessHeap () returned 0x630000 [0060.291] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1a8 [0060.291] GetProcessHeap () returned 0x630000 [0060.291] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1a8 | out: hHeap=0x630000) returned 1 [0060.291] GetProcessHeap () returned 0x630000 [0060.291] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0060.291] GetProcessHeap () returned 0x630000 [0060.291] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0060.291] GetProcessHeap () returned 0x630000 [0060.291] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0060.291] GetProcessHeap () returned 0x630000 [0060.291] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0060.291] GetProcessHeap () returned 0x630000 [0060.291] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0060.291] GetProcessHeap () returned 0x630000 [0060.291] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0060.291] GetProcessHeap () returned 0x630000 [0060.291] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0060.291] GetProcessHeap () returned 0x630000 [0060.291] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0060.291] GetProcessHeap () returned 0x630000 [0060.291] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0060.292] GetProcessHeap () returned 0x630000 [0060.292] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0060.292] GetProcessHeap () returned 0x630000 [0060.292] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0060.292] GetProcessHeap () returned 0x630000 [0060.292] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0060.292] GetProcessHeap () returned 0x630000 [0060.292] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0060.292] GetProcessHeap () returned 0x630000 [0060.292] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0060.292] GetProcessHeap () returned 0x630000 [0060.292] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0060.292] GetProcessHeap () returned 0x630000 [0060.292] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0060.292] GetProcessHeap () returned 0x630000 [0060.292] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0060.292] GetProcessHeap () returned 0x630000 [0060.292] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0060.292] GetProcessHeap () returned 0x630000 [0060.292] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0060.292] GetProcessHeap () returned 0x630000 [0060.292] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0060.292] GetProcessHeap () returned 0x630000 [0060.292] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0060.292] GetProcessHeap () returned 0x630000 [0060.292] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0060.292] GetProcessHeap () returned 0x630000 [0060.292] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0060.292] GetProcessHeap () returned 0x630000 [0060.292] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0060.292] GetProcessHeap () returned 0x630000 [0060.292] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0060.292] GetProcessHeap () returned 0x630000 [0060.292] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0060.292] GetProcessHeap () returned 0x630000 [0060.292] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0060.292] GetProcessHeap () returned 0x630000 [0060.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0060.293] GetProcessHeap () returned 0x630000 [0060.293] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0060.293] GetProcessHeap () returned 0x630000 [0060.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0060.293] GetProcessHeap () returned 0x630000 [0060.293] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0060.293] GetProcessHeap () returned 0x630000 [0060.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0060.293] GetProcessHeap () returned 0x630000 [0060.293] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0060.293] GetProcessHeap () returned 0x630000 [0060.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0060.293] GetProcessHeap () returned 0x630000 [0060.293] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a188 [0060.293] GetProcessHeap () returned 0x630000 [0060.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a188 | out: hHeap=0x630000) returned 1 [0060.293] GetProcessHeap () returned 0x630000 [0060.293] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0060.293] GetProcessHeap () returned 0x630000 [0060.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0060.293] GetProcessHeap () returned 0x630000 [0060.293] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0060.293] GetProcessHeap () returned 0x630000 [0060.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0060.293] GetProcessHeap () returned 0x630000 [0060.293] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0060.293] GetProcessHeap () returned 0x630000 [0060.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0060.293] GetProcessHeap () returned 0x630000 [0060.293] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0060.293] GetProcessHeap () returned 0x630000 [0060.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0060.293] GetProcessHeap () returned 0x630000 [0060.293] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0060.293] GetProcessHeap () returned 0x630000 [0060.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0060.293] GetProcessHeap () returned 0x630000 [0060.293] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0060.294] GetProcessHeap () returned 0x630000 [0060.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0060.294] GetProcessHeap () returned 0x630000 [0060.294] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0060.294] GetProcessHeap () returned 0x630000 [0060.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0060.294] GetProcessHeap () returned 0x630000 [0060.294] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0060.294] GetProcessHeap () returned 0x630000 [0060.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0060.294] GetProcessHeap () returned 0x630000 [0060.294] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0060.294] GetProcessHeap () returned 0x630000 [0060.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0060.294] GetProcessHeap () returned 0x630000 [0060.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0060.294] GetProcessHeap () returned 0x630000 [0060.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0060.294] GetProcessHeap () returned 0x630000 [0060.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0060.294] GetProcessHeap () returned 0x630000 [0060.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0060.294] GetProcessHeap () returned 0x630000 [0060.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0060.294] GetProcessHeap () returned 0x630000 [0060.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ecd0 | out: hHeap=0x630000) returned 1 [0060.294] GetProcessHeap () returned 0x630000 [0060.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0060.294] GetProcessHeap () returned 0x630000 [0060.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0060.294] GetProcessHeap () returned 0x630000 [0060.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0060.294] GetProcessHeap () returned 0x630000 [0060.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0060.294] GetProcessHeap () returned 0x630000 [0060.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0060.295] WriteFile (in: hFile=0x230, lpBuffer=0x654420*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654420*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0060.296] GetProcessHeap () returned 0x630000 [0060.296] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x654420, Size=0x30) returned 0x654420 [0060.296] GetProcessHeap () returned 0x630000 [0060.296] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0060.296] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0060.296] GetProcessHeap () returned 0x630000 [0060.297] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6b23) returned 0x661be8 [0060.297] ReadFile (in: hFile=0x230, lpBuffer=0x661be8, nNumberOfBytesToRead=0x6b23, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661be8*, lpNumberOfBytesRead=0x243d7e8*=0x6b23, lpOverlapped=0x0) returned 1 [0060.297] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0060.297] WriteFile (in: hFile=0x230, lpBuffer=0x661be8*, nNumberOfBytesToWrite=0x6b23, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661be8*, lpNumberOfBytesWritten=0x243d7e4*=0x6b23, lpOverlapped=0x0) returned 1 [0060.298] GetProcessHeap () returned 0x630000 [0060.298] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661be8 | out: hHeap=0x630000) returned 1 [0060.299] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0060.300] WriteFile (in: hFile=0x230, lpBuffer=0x654420*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654420*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0060.301] CloseHandle (hObject=0x230) returned 1 [0060.302] GetProcessHeap () returned 0x630000 [0060.302] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0060.302] GetProcessHeap () returned 0x630000 [0060.302] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655670 | out: hHeap=0x630000) returned 1 [0060.302] GetProcessHeap () returned 0x630000 [0060.302] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0060.302] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\T82jEhXsa5Qy5aHk.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\T82jEhXsa5Qy5aHk.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\T82jEhXsa5Qy5aHk.jpg" [0060.303] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\T82jEhXsa5Qy5aHk.jpg", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\T82jEhXsa5Qy5aHk.jpg.happythreechoose") returned="C:\\Users\\FD1HVy\\Pictures\\T82jEhXsa5Qy5aHk.jpg.happythreechoose" [0060.303] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\T82jEhXsa5Qy5aHk.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\t82jehxsa5qy5ahk.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\T82jEhXsa5Qy5aHk.jpg.happythreechoose" (normalized: "c:\\users\\fd1hvy\\pictures\\t82jehxsa5qy5ahk.jpg.happythreechoose"), dwFlags=0x1) returned 1 [0060.303] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\T82jEhXsa5Qy5aHk.jpg" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0060.303] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0060.303] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" [0060.303] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\pictures\\decryption info.html")) returned 0x20 [0060.303] GetProcessHeap () returned 0x630000 [0060.303] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645e58 | out: hHeap=0x630000) returned 1 [0060.303] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11d7e260, ftCreationTime.dwHighDateTime=0x1d5cf28, ftLastAccessTime.dwLowDateTime=0x96f18980, ftLastAccessTime.dwHighDateTime=0x1d5cd05, ftLastWriteTime.dwLowDateTime=0x96f18980, ftLastWriteTime.dwHighDateTime=0x1d5cd05, nFileSizeHigh=0x0, nFileSizeLow=0x1edd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="uW55Ut4sg.gif", cAlternateFileName="UW55UT~1.GIF")) returned 1 [0060.303] lstrcmpiW (lpString1="uW55Ut4sg.gif", lpString2=".") returned 1 [0060.303] lstrcmpiW (lpString1="uW55Ut4sg.gif", lpString2="..") returned 1 [0060.303] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="uW55Ut4sg.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\uW55Ut4sg.gif") returned="C:\\Users\\FD1HVy\\Pictures\\uW55Ut4sg.gif" [0060.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="uW55Ut4sg.gif", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0060.304] GetProcessHeap () returned 0x630000 [0060.304] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x64c9f0 [0060.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="uW55Ut4sg.gif", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="uW55Ut4sg.gif", lpUsedDefaultChar=0x0) returned 14 [0060.304] lstrlenA (lpString="uW55Ut4sg.gif") returned 13 [0060.304] lstrlenA (lpString=".happythreechoose") returned 17 [0060.304] lstrcmpiW (lpString1="uW55Ut4sg.gif", lpString2="Decryption INFO.html") returned 1 [0060.304] lstrcmpiW (lpString1="uW55Ut4sg.gif", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0060.304] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0060.304] lstrcmpiW (lpString1="uW55Ut4sg.gif", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0060.304] GetProcessHeap () returned 0x630000 [0060.304] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0060.304] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\uW55Ut4sg.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\uw55ut4sg.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0060.304] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=7901) returned 1 [0060.304] GetProcessHeap () returned 0x630000 [0060.304] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6555f8 [0060.304] GetProcessHeap () returned 0x630000 [0060.304] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0060.304] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\uW55Ut4sg.gif") returned 38 [0060.304] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0060.304] GetProcessHeap () returned 0x630000 [0060.304] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0060.304] GetProcessHeap () returned 0x630000 [0060.304] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x383) returned 0x654458 [0060.304] lstrlenA (lpString="rsa_encrypt") returned 11 [0060.305] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0060.305] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0060.305] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0060.305] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0060.305] GetProcessHeap () returned 0x630000 [0060.305] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0060.305] lstrlenA (lpString="010001") returned 6 [0060.305] GetProcessHeap () returned 0x630000 [0060.305] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0060.305] GetProcessHeap () returned 0x630000 [0060.305] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0060.305] GetProcessHeap () returned 0x630000 [0060.306] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e190 [0060.306] GetProcessHeap () returned 0x630000 [0060.306] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0060.306] GetProcessHeap () returned 0x630000 [0060.306] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0060.306] GetProcessHeap () returned 0x630000 [0060.306] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657210 [0060.306] GetProcessHeap () returned 0x630000 [0060.306] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a0c8 [0060.306] GetProcessHeap () returned 0x630000 [0060.306] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0060.306] GetProcessHeap () returned 0x630000 [0060.306] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0060.306] GetProcessHeap () returned 0x630000 [0060.306] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0060.306] GetProcessHeap () returned 0x630000 [0060.306] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0060.306] GetProcessHeap () returned 0x630000 [0060.306] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657558 [0060.306] GetProcessHeap () returned 0x630000 [0060.306] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0060.306] GetProcessHeap () returned 0x630000 [0060.306] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0060.306] GetProcessHeap () returned 0x630000 [0060.306] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0060.306] GetProcessHeap () returned 0x630000 [0060.306] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0060.306] GetProcessHeap () returned 0x630000 [0060.306] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0060.306] GetProcessHeap () returned 0x630000 [0060.306] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0060.306] GetProcessHeap () returned 0x630000 [0060.306] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0060.306] GetProcessHeap () returned 0x630000 [0060.306] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x6616b0 [0060.306] GetProcessHeap () returned 0x630000 [0060.306] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0060.306] GetProcessHeap () returned 0x630000 [0060.307] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0060.307] GetProcessHeap () returned 0x630000 [0060.307] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0060.307] GetProcessHeap () returned 0x630000 [0060.307] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0060.307] GetProcessHeap () returned 0x630000 [0060.307] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65eb20 [0060.307] GetProcessHeap () returned 0x630000 [0060.307] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6616b0 | out: hHeap=0x630000) returned 1 [0060.307] GetProcessHeap () returned 0x630000 [0060.307] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0060.307] GetProcessHeap () returned 0x630000 [0060.307] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0060.307] GetProcessHeap () returned 0x630000 [0060.307] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0060.307] GetProcessHeap () returned 0x630000 [0060.307] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0060.307] GetProcessHeap () returned 0x630000 [0060.307] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0e8 [0060.307] GetProcessHeap () returned 0x630000 [0060.307] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0e8 | out: hHeap=0x630000) returned 1 [0060.307] GetProcessHeap () returned 0x630000 [0060.307] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0060.307] GetProcessHeap () returned 0x630000 [0060.307] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0060.307] GetProcessHeap () returned 0x630000 [0060.307] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0060.307] GetProcessHeap () returned 0x630000 [0060.307] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0060.307] GetProcessHeap () returned 0x630000 [0060.307] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0060.307] GetProcessHeap () returned 0x630000 [0060.307] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0060.307] GetProcessHeap () returned 0x630000 [0060.307] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0060.307] GetProcessHeap () returned 0x630000 [0060.307] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0060.307] GetProcessHeap () returned 0x630000 [0060.308] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0060.308] GetProcessHeap () returned 0x630000 [0060.308] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0060.308] GetProcessHeap () returned 0x630000 [0060.308] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0060.308] GetProcessHeap () returned 0x630000 [0060.308] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0060.308] GetProcessHeap () returned 0x630000 [0060.308] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a188 [0060.308] GetProcessHeap () returned 0x630000 [0060.308] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a188 | out: hHeap=0x630000) returned 1 [0060.308] GetProcessHeap () returned 0x630000 [0060.308] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0060.308] GetProcessHeap () returned 0x630000 [0060.308] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0060.308] GetProcessHeap () returned 0x630000 [0060.308] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0060.308] GetProcessHeap () returned 0x630000 [0060.308] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0060.308] GetProcessHeap () returned 0x630000 [0060.308] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0060.308] GetProcessHeap () returned 0x630000 [0060.308] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0060.308] GetProcessHeap () returned 0x630000 [0060.308] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0060.308] GetProcessHeap () returned 0x630000 [0060.308] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0060.308] GetProcessHeap () returned 0x630000 [0060.308] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0060.308] GetProcessHeap () returned 0x630000 [0060.308] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0060.308] GetProcessHeap () returned 0x630000 [0060.308] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0060.308] GetProcessHeap () returned 0x630000 [0060.308] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0060.308] GetProcessHeap () returned 0x630000 [0060.308] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0060.309] GetProcessHeap () returned 0x630000 [0060.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0060.309] GetProcessHeap () returned 0x630000 [0060.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0060.309] GetProcessHeap () returned 0x630000 [0060.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0060.309] GetProcessHeap () returned 0x630000 [0060.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1a8 [0060.309] GetProcessHeap () returned 0x630000 [0060.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1a8 | out: hHeap=0x630000) returned 1 [0060.309] GetProcessHeap () returned 0x630000 [0060.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0060.309] GetProcessHeap () returned 0x630000 [0060.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0060.309] GetProcessHeap () returned 0x630000 [0060.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0060.309] GetProcessHeap () returned 0x630000 [0060.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0060.309] GetProcessHeap () returned 0x630000 [0060.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0060.309] GetProcessHeap () returned 0x630000 [0060.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0060.309] GetProcessHeap () returned 0x630000 [0060.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0060.309] GetProcessHeap () returned 0x630000 [0060.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0060.309] GetProcessHeap () returned 0x630000 [0060.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0060.309] GetProcessHeap () returned 0x630000 [0060.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0060.309] GetProcessHeap () returned 0x630000 [0060.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0060.309] GetProcessHeap () returned 0x630000 [0060.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0060.309] GetProcessHeap () returned 0x630000 [0060.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0060.309] GetProcessHeap () returned 0x630000 [0060.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0060.310] GetProcessHeap () returned 0x630000 [0060.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0060.310] GetProcessHeap () returned 0x630000 [0060.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0060.310] GetProcessHeap () returned 0x630000 [0060.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0060.310] GetProcessHeap () returned 0x630000 [0060.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0060.310] GetProcessHeap () returned 0x630000 [0060.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0060.310] GetProcessHeap () returned 0x630000 [0060.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0060.310] GetProcessHeap () returned 0x630000 [0060.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0060.310] GetProcessHeap () returned 0x630000 [0060.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0060.310] GetProcessHeap () returned 0x630000 [0060.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0060.310] GetProcessHeap () returned 0x630000 [0060.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0060.310] GetProcessHeap () returned 0x630000 [0060.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0060.310] GetProcessHeap () returned 0x630000 [0060.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0060.310] GetProcessHeap () returned 0x630000 [0060.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0060.310] GetProcessHeap () returned 0x630000 [0060.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0060.310] GetProcessHeap () returned 0x630000 [0060.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0060.310] GetProcessHeap () returned 0x630000 [0060.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0060.310] GetProcessHeap () returned 0x630000 [0060.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0060.310] GetProcessHeap () returned 0x630000 [0060.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0060.310] GetProcessHeap () returned 0x630000 [0060.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a188 [0060.311] GetProcessHeap () returned 0x630000 [0060.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a188 | out: hHeap=0x630000) returned 1 [0060.311] GetProcessHeap () returned 0x630000 [0060.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0060.311] GetProcessHeap () returned 0x630000 [0060.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0060.311] GetProcessHeap () returned 0x630000 [0060.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1a8 [0060.311] GetProcessHeap () returned 0x630000 [0060.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1a8 | out: hHeap=0x630000) returned 1 [0060.311] GetProcessHeap () returned 0x630000 [0060.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0060.311] GetProcessHeap () returned 0x630000 [0060.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0060.311] GetProcessHeap () returned 0x630000 [0060.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0060.311] GetProcessHeap () returned 0x630000 [0060.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0060.311] GetProcessHeap () returned 0x630000 [0060.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0060.311] GetProcessHeap () returned 0x630000 [0060.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0060.311] GetProcessHeap () returned 0x630000 [0060.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0060.311] GetProcessHeap () returned 0x630000 [0060.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0060.311] GetProcessHeap () returned 0x630000 [0060.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0060.311] GetProcessHeap () returned 0x630000 [0060.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0060.311] GetProcessHeap () returned 0x630000 [0060.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0060.311] GetProcessHeap () returned 0x630000 [0060.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0060.311] GetProcessHeap () returned 0x630000 [0060.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0060.312] GetProcessHeap () returned 0x630000 [0060.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0060.312] GetProcessHeap () returned 0x630000 [0060.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0060.312] GetProcessHeap () returned 0x630000 [0060.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0060.312] GetProcessHeap () returned 0x630000 [0060.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0060.312] GetProcessHeap () returned 0x630000 [0060.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0060.312] GetProcessHeap () returned 0x630000 [0060.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0060.312] WriteFile (in: hFile=0x230, lpBuffer=0x654458*, nNumberOfBytesToWrite=0x383, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654458*, lpNumberOfBytesWritten=0x243d864*=0x383, lpOverlapped=0x0) returned 1 [0060.315] GetProcessHeap () returned 0x630000 [0060.315] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x654458, Size=0x30) returned 0x654458 [0060.315] GetProcessHeap () returned 0x630000 [0060.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0060.315] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0060.315] GetProcessHeap () returned 0x630000 [0060.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1ee0) returned 0x661be8 [0060.316] ReadFile (in: hFile=0x230, lpBuffer=0x661be8, nNumberOfBytesToRead=0x1ee0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661be8*, lpNumberOfBytesRead=0x243d7e8*=0x1ee0, lpOverlapped=0x0) returned 1 [0060.316] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0060.316] WriteFile (in: hFile=0x230, lpBuffer=0x661be8*, nNumberOfBytesToWrite=0x1ee0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661be8*, lpNumberOfBytesWritten=0x243d7e4*=0x1ee0, lpOverlapped=0x0) returned 1 [0060.317] GetProcessHeap () returned 0x630000 [0060.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661be8 | out: hHeap=0x630000) returned 1 [0060.317] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0060.317] WriteFile (in: hFile=0x230, lpBuffer=0x654458*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654458*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0060.318] CloseHandle (hObject=0x230) returned 1 [0060.320] GetProcessHeap () returned 0x630000 [0060.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0060.320] GetProcessHeap () returned 0x630000 [0060.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6555f8 | out: hHeap=0x630000) returned 1 [0060.320] GetProcessHeap () returned 0x630000 [0060.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0060.320] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\uW55Ut4sg.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\uW55Ut4sg.gif") returned="C:\\Users\\FD1HVy\\Pictures\\uW55Ut4sg.gif" [0060.320] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\uW55Ut4sg.gif", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\uW55Ut4sg.gif.happythreechoose") returned="C:\\Users\\FD1HVy\\Pictures\\uW55Ut4sg.gif.happythreechoose" [0060.320] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\uW55Ut4sg.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\uw55ut4sg.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\uW55Ut4sg.gif.happythreechoose" (normalized: "c:\\users\\fd1hvy\\pictures\\uw55ut4sg.gif.happythreechoose"), dwFlags=0x1) returned 1 [0060.321] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\uW55Ut4sg.gif" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0060.321] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0060.321] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" [0060.321] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\pictures\\decryption info.html")) returned 0x20 [0060.321] GetProcessHeap () returned 0x630000 [0060.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0060.321] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc854740, ftCreationTime.dwHighDateTime=0x1d5ca13, ftLastAccessTime.dwLowDateTime=0x53f4d1a0, ftLastAccessTime.dwHighDateTime=0x1d5d5e8, ftLastWriteTime.dwLowDateTime=0x53f4d1a0, ftLastWriteTime.dwHighDateTime=0x1d5d5e8, nFileSizeHigh=0x0, nFileSizeLow=0xfe6c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WY3W.jpg", cAlternateFileName="")) returned 1 [0060.321] lstrcmpiW (lpString1="WY3W.jpg", lpString2=".") returned 1 [0060.321] lstrcmpiW (lpString1="WY3W.jpg", lpString2="..") returned 1 [0060.321] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="WY3W.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\WY3W.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\WY3W.jpg" [0060.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WY3W.jpg", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0060.321] GetProcessHeap () returned 0x630000 [0060.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9) returned 0x64c9f0 [0060.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WY3W.jpg", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WY3W.jpg", lpUsedDefaultChar=0x0) returned 9 [0060.321] lstrlenA (lpString="WY3W.jpg") returned 8 [0060.321] lstrlenA (lpString=".happythreechoose") returned 17 [0060.321] lstrcmpiW (lpString1="WY3W.jpg", lpString2="Decryption INFO.html") returned 1 [0060.321] lstrcmpiW (lpString1="WY3W.jpg", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0060.321] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0060.321] lstrcmpiW (lpString1="WY3W.jpg", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0060.321] GetProcessHeap () returned 0x630000 [0060.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f10 [0060.321] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\WY3W.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\wy3w.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0060.321] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=65132) returned 1 [0060.321] GetProcessHeap () returned 0x630000 [0060.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655490 [0060.321] GetProcessHeap () returned 0x630000 [0060.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0060.321] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\WY3W.jpg") returned 33 [0060.322] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0060.322] GetProcessHeap () returned 0x630000 [0060.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0060.322] GetProcessHeap () returned 0x630000 [0060.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x654490 [0060.322] lstrlenA (lpString="rsa_encrypt") returned 11 [0060.322] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0060.322] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0060.322] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0060.322] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0060.322] GetProcessHeap () returned 0x630000 [0060.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0060.322] lstrlenA (lpString="010001") returned 6 [0060.322] GetProcessHeap () returned 0x630000 [0060.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0060.323] GetProcessHeap () returned 0x630000 [0060.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0060.323] GetProcessHeap () returned 0x630000 [0060.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e580 [0060.323] GetProcessHeap () returned 0x630000 [0060.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0060.323] GetProcessHeap () returned 0x630000 [0060.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e7c0 [0060.323] GetProcessHeap () returned 0x630000 [0060.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x6570f8 [0060.323] GetProcessHeap () returned 0x630000 [0060.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a0a8 [0060.323] GetProcessHeap () returned 0x630000 [0060.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0060.323] GetProcessHeap () returned 0x630000 [0060.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0060.323] GetProcessHeap () returned 0x630000 [0060.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0060.323] GetProcessHeap () returned 0x630000 [0060.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0060.323] GetProcessHeap () returned 0x630000 [0060.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657670 [0060.323] GetProcessHeap () returned 0x630000 [0060.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0060.323] GetProcessHeap () returned 0x630000 [0060.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0060.323] GetProcessHeap () returned 0x630000 [0060.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0060.323] GetProcessHeap () returned 0x630000 [0060.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0060.323] GetProcessHeap () returned 0x630000 [0060.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0060.323] GetProcessHeap () returned 0x630000 [0060.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0060.323] GetProcessHeap () returned 0x630000 [0060.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0060.323] GetProcessHeap () returned 0x630000 [0060.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x661848 [0060.324] GetProcessHeap () returned 0x630000 [0060.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0060.324] GetProcessHeap () returned 0x630000 [0060.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0060.324] GetProcessHeap () returned 0x630000 [0060.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0060.324] GetProcessHeap () returned 0x630000 [0060.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0060.324] GetProcessHeap () returned 0x630000 [0060.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e3d0 [0060.324] GetProcessHeap () returned 0x630000 [0060.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661848 | out: hHeap=0x630000) returned 1 [0060.324] GetProcessHeap () returned 0x630000 [0060.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0060.324] GetProcessHeap () returned 0x630000 [0060.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0060.324] GetProcessHeap () returned 0x630000 [0060.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0060.324] GetProcessHeap () returned 0x630000 [0060.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0060.324] GetProcessHeap () returned 0x630000 [0060.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0060.324] GetProcessHeap () returned 0x630000 [0060.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0060.324] GetProcessHeap () returned 0x630000 [0060.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0060.324] GetProcessHeap () returned 0x630000 [0060.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0060.324] GetProcessHeap () returned 0x630000 [0060.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0060.324] GetProcessHeap () returned 0x630000 [0060.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0060.324] GetProcessHeap () returned 0x630000 [0060.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1a8 [0060.324] GetProcessHeap () returned 0x630000 [0060.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1a8 | out: hHeap=0x630000) returned 1 [0060.324] GetProcessHeap () returned 0x630000 [0060.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0060.325] GetProcessHeap () returned 0x630000 [0060.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0060.325] GetProcessHeap () returned 0x630000 [0060.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0060.325] GetProcessHeap () returned 0x630000 [0060.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0060.325] GetProcessHeap () returned 0x630000 [0060.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0060.325] GetProcessHeap () returned 0x630000 [0060.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0060.325] GetProcessHeap () returned 0x630000 [0060.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a188 [0060.325] GetProcessHeap () returned 0x630000 [0060.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a188 | out: hHeap=0x630000) returned 1 [0060.325] GetProcessHeap () returned 0x630000 [0060.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0060.325] GetProcessHeap () returned 0x630000 [0060.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0060.325] GetProcessHeap () returned 0x630000 [0060.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a188 [0060.325] GetProcessHeap () returned 0x630000 [0060.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a188 | out: hHeap=0x630000) returned 1 [0060.325] GetProcessHeap () returned 0x630000 [0060.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0060.325] GetProcessHeap () returned 0x630000 [0060.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0060.325] GetProcessHeap () returned 0x630000 [0060.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0060.325] GetProcessHeap () returned 0x630000 [0060.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0060.325] GetProcessHeap () returned 0x630000 [0060.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0e8 [0060.325] GetProcessHeap () returned 0x630000 [0060.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0e8 | out: hHeap=0x630000) returned 1 [0060.325] GetProcessHeap () returned 0x630000 [0060.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0060.326] GetProcessHeap () returned 0x630000 [0060.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0060.326] GetProcessHeap () returned 0x630000 [0060.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0060.326] GetProcessHeap () returned 0x630000 [0060.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0060.326] GetProcessHeap () returned 0x630000 [0060.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0060.326] GetProcessHeap () returned 0x630000 [0060.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0060.326] GetProcessHeap () returned 0x630000 [0060.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0060.326] GetProcessHeap () returned 0x630000 [0060.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0060.326] GetProcessHeap () returned 0x630000 [0060.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0060.326] GetProcessHeap () returned 0x630000 [0060.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0060.326] GetProcessHeap () returned 0x630000 [0060.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a188 [0060.326] GetProcessHeap () returned 0x630000 [0060.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a188 | out: hHeap=0x630000) returned 1 [0060.326] GetProcessHeap () returned 0x630000 [0060.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0060.326] GetProcessHeap () returned 0x630000 [0060.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0060.326] GetProcessHeap () returned 0x630000 [0060.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0060.326] GetProcessHeap () returned 0x630000 [0060.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0060.326] GetProcessHeap () returned 0x630000 [0060.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0060.326] GetProcessHeap () returned 0x630000 [0060.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0060.326] GetProcessHeap () returned 0x630000 [0060.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0060.326] GetProcessHeap () returned 0x630000 [0060.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0060.327] GetProcessHeap () returned 0x630000 [0060.327] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a208 [0060.327] GetProcessHeap () returned 0x630000 [0060.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a208 | out: hHeap=0x630000) returned 1 [0060.327] GetProcessHeap () returned 0x630000 [0060.327] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0060.327] GetProcessHeap () returned 0x630000 [0060.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0060.327] GetProcessHeap () returned 0x630000 [0060.327] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0060.327] GetProcessHeap () returned 0x630000 [0060.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0060.327] GetProcessHeap () returned 0x630000 [0060.327] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0060.327] GetProcessHeap () returned 0x630000 [0060.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0060.327] GetProcessHeap () returned 0x630000 [0060.327] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0060.327] GetProcessHeap () returned 0x630000 [0060.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0060.327] GetProcessHeap () returned 0x630000 [0060.327] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0060.327] GetProcessHeap () returned 0x630000 [0060.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0060.327] GetProcessHeap () returned 0x630000 [0060.327] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0060.327] GetProcessHeap () returned 0x630000 [0060.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0060.327] GetProcessHeap () returned 0x630000 [0060.327] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0060.327] GetProcessHeap () returned 0x630000 [0060.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0060.327] GetProcessHeap () returned 0x630000 [0060.327] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0060.327] GetProcessHeap () returned 0x630000 [0060.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0060.328] GetProcessHeap () returned 0x630000 [0060.328] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0060.328] GetProcessHeap () returned 0x630000 [0060.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0060.328] GetProcessHeap () returned 0x630000 [0060.328] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0060.328] GetProcessHeap () returned 0x630000 [0060.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0060.328] GetProcessHeap () returned 0x630000 [0060.328] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0060.328] GetProcessHeap () returned 0x630000 [0060.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0060.328] GetProcessHeap () returned 0x630000 [0060.328] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a098 [0060.328] GetProcessHeap () returned 0x630000 [0060.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a098 | out: hHeap=0x630000) returned 1 [0060.328] GetProcessHeap () returned 0x630000 [0060.328] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0060.328] GetProcessHeap () returned 0x630000 [0060.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0060.328] GetProcessHeap () returned 0x630000 [0060.328] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0060.328] GetProcessHeap () returned 0x630000 [0060.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0060.328] GetProcessHeap () returned 0x630000 [0060.328] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0060.328] GetProcessHeap () returned 0x630000 [0060.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0060.328] GetProcessHeap () returned 0x630000 [0060.328] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0060.328] GetProcessHeap () returned 0x630000 [0060.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0060.328] GetProcessHeap () returned 0x630000 [0060.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0060.328] GetProcessHeap () returned 0x630000 [0060.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0060.328] GetProcessHeap () returned 0x630000 [0060.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0060.329] GetProcessHeap () returned 0x630000 [0060.329] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0060.329] GetProcessHeap () returned 0x630000 [0060.329] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0060.329] GetProcessHeap () returned 0x630000 [0060.329] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e7c0 | out: hHeap=0x630000) returned 1 [0060.329] GetProcessHeap () returned 0x630000 [0060.329] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0060.329] GetProcessHeap () returned 0x630000 [0060.329] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0060.329] GetProcessHeap () returned 0x630000 [0060.329] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0060.329] GetProcessHeap () returned 0x630000 [0060.329] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0060.329] GetProcessHeap () returned 0x630000 [0060.329] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0060.329] WriteFile (in: hFile=0x230, lpBuffer=0x654490*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654490*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0060.331] GetProcessHeap () returned 0x630000 [0060.331] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x654490, Size=0x30) returned 0x654490 [0060.331] GetProcessHeap () returned 0x630000 [0060.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0060.332] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0060.332] GetProcessHeap () returned 0x630000 [0060.332] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfe6c) returned 0x661be8 [0060.333] ReadFile (in: hFile=0x230, lpBuffer=0x661be8, nNumberOfBytesToRead=0xfe6c, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661be8*, lpNumberOfBytesRead=0x243d7e8*=0xfe6c, lpOverlapped=0x0) returned 1 [0060.333] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0060.333] WriteFile (in: hFile=0x230, lpBuffer=0x661be8*, nNumberOfBytesToWrite=0xfe6c, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661be8*, lpNumberOfBytesWritten=0x243d7e4*=0xfe6c, lpOverlapped=0x0) returned 1 [0060.335] GetProcessHeap () returned 0x630000 [0060.335] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661be8 | out: hHeap=0x630000) returned 1 [0060.335] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0060.335] WriteFile (in: hFile=0x230, lpBuffer=0x654490*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654490*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0060.336] CloseHandle (hObject=0x230) returned 1 [0060.339] GetProcessHeap () returned 0x630000 [0060.339] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f10 | out: hHeap=0x630000) returned 1 [0060.339] GetProcessHeap () returned 0x630000 [0060.339] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655490 | out: hHeap=0x630000) returned 1 [0060.339] GetProcessHeap () returned 0x630000 [0060.339] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0060.339] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\WY3W.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\WY3W.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\WY3W.jpg" [0060.339] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\WY3W.jpg", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\WY3W.jpg.happythreechoose") returned="C:\\Users\\FD1HVy\\Pictures\\WY3W.jpg.happythreechoose" [0060.339] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\WY3W.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\wy3w.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\WY3W.jpg.happythreechoose" (normalized: "c:\\users\\fd1hvy\\pictures\\wy3w.jpg.happythreechoose"), dwFlags=0x1) returned 1 [0060.339] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\WY3W.jpg" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0060.339] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0060.339] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" [0060.339] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\pictures\\decryption info.html")) returned 0x20 [0060.340] GetProcessHeap () returned 0x630000 [0060.340] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0060.340] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffd5160, ftCreationTime.dwHighDateTime=0x1d5d48b, ftLastAccessTime.dwLowDateTime=0xc9e7f10, ftLastAccessTime.dwHighDateTime=0x1d5d253, ftLastWriteTime.dwLowDateTime=0xc9e7f10, ftLastWriteTime.dwHighDateTime=0x1d5d253, nFileSizeHigh=0x0, nFileSizeLow=0x1536a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="xC1p2U4DPwmLw9O3uF.png", cAlternateFileName="XC1P2U~1.PNG")) returned 1 [0060.340] lstrcmpiW (lpString1="xC1p2U4DPwmLw9O3uF.png", lpString2=".") returned 1 [0060.340] lstrcmpiW (lpString1="xC1p2U4DPwmLw9O3uF.png", lpString2="..") returned 1 [0060.340] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="xC1p2U4DPwmLw9O3uF.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\xC1p2U4DPwmLw9O3uF.png") returned="C:\\Users\\FD1HVy\\Pictures\\xC1p2U4DPwmLw9O3uF.png" [0060.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="xC1p2U4DPwmLw9O3uF.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0060.340] GetProcessHeap () returned 0x630000 [0060.340] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x17) returned 0x645d58 [0060.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="xC1p2U4DPwmLw9O3uF.png", cchWideChar=-1, lpMultiByteStr=0x645d58, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xC1p2U4DPwmLw9O3uF.png", lpUsedDefaultChar=0x0) returned 23 [0060.340] lstrlenA (lpString="xC1p2U4DPwmLw9O3uF.png") returned 22 [0060.340] lstrlenA (lpString=".happythreechoose") returned 17 [0060.340] lstrlenA (lpString=".happythreechoose") returned 17 [0060.340] lstrlenA (lpString="xC1p2U4DPwmLw9O3uF.png") returned 22 [0060.340] lstrcmpiA (lpString1="U4DPwmLw9O3uF.png", lpString2=".happythreechoose") returned 1 [0060.340] lstrcmpiW (lpString1="xC1p2U4DPwmLw9O3uF.png", lpString2="Decryption INFO.html") returned 1 [0060.340] lstrcmpiW (lpString1="xC1p2U4DPwmLw9O3uF.png", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0060.340] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0060.340] lstrcmpiW (lpString1="xC1p2U4DPwmLw9O3uF.png", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0060.340] GetProcessHeap () returned 0x630000 [0060.340] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0060.340] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\xC1p2U4DPwmLw9O3uF.png" (normalized: "c:\\users\\fd1hvy\\pictures\\xc1p2u4dpwmlw9o3uf.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0060.340] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=86890) returned 1 [0060.340] GetProcessHeap () returned 0x630000 [0060.340] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655a30 [0060.340] GetProcessHeap () returned 0x630000 [0060.340] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0060.340] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\xC1p2U4DPwmLw9O3uF.png") returned 47 [0060.340] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0060.341] GetProcessHeap () returned 0x630000 [0060.341] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0060.341] GetProcessHeap () returned 0x630000 [0060.341] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x386) returned 0x6544c8 [0060.341] lstrlenA (lpString="rsa_encrypt") returned 11 [0060.341] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0060.341] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0060.341] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0060.341] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0060.341] GetProcessHeap () returned 0x630000 [0060.341] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0060.341] lstrlenA (lpString="010001") returned 6 [0060.341] GetProcessHeap () returned 0x630000 [0060.341] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0060.341] GetProcessHeap () returned 0x630000 [0060.342] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0060.342] GetProcessHeap () returned 0x630000 [0060.342] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e850 [0060.342] GetProcessHeap () returned 0x630000 [0060.342] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0060.342] GetProcessHeap () returned 0x630000 [0060.342] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e7c0 [0060.342] GetProcessHeap () returned 0x630000 [0060.342] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656fe0 [0060.342] GetProcessHeap () returned 0x630000 [0060.342] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a078 [0060.342] GetProcessHeap () returned 0x630000 [0060.342] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0060.342] GetProcessHeap () returned 0x630000 [0060.342] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0060.342] GetProcessHeap () returned 0x630000 [0060.342] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0060.342] GetProcessHeap () returned 0x630000 [0060.342] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0060.342] GetProcessHeap () returned 0x630000 [0060.342] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657558 [0060.342] GetProcessHeap () returned 0x630000 [0060.342] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0060.342] GetProcessHeap () returned 0x630000 [0060.342] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0060.342] GetProcessHeap () returned 0x630000 [0060.342] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e610 [0060.342] GetProcessHeap () returned 0x630000 [0060.342] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0060.342] GetProcessHeap () returned 0x630000 [0060.342] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0060.342] GetProcessHeap () returned 0x630000 [0060.342] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0060.342] GetProcessHeap () returned 0x630000 [0060.342] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0060.342] GetProcessHeap () returned 0x630000 [0060.342] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0060.342] GetProcessHeap () returned 0x630000 [0060.343] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0060.343] GetProcessHeap () returned 0x630000 [0060.343] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0060.343] GetProcessHeap () returned 0x630000 [0060.343] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0060.343] GetProcessHeap () returned 0x630000 [0060.343] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0060.343] GetProcessHeap () returned 0x630000 [0060.343] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e8e0 [0060.343] GetProcessHeap () returned 0x630000 [0060.343] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0060.343] GetProcessHeap () returned 0x630000 [0060.343] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0060.343] GetProcessHeap () returned 0x630000 [0060.343] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0060.343] GetProcessHeap () returned 0x630000 [0060.343] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1a8 [0060.343] GetProcessHeap () returned 0x630000 [0060.343] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1a8 | out: hHeap=0x630000) returned 1 [0060.343] GetProcessHeap () returned 0x630000 [0060.343] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0060.343] GetProcessHeap () returned 0x630000 [0060.343] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0060.343] GetProcessHeap () returned 0x630000 [0060.343] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0060.343] GetProcessHeap () returned 0x630000 [0060.343] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0060.343] GetProcessHeap () returned 0x630000 [0060.343] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a208 [0060.343] GetProcessHeap () returned 0x630000 [0060.343] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a208 | out: hHeap=0x630000) returned 1 [0060.343] GetProcessHeap () returned 0x630000 [0060.343] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0060.343] GetProcessHeap () returned 0x630000 [0060.343] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0060.343] GetProcessHeap () returned 0x630000 [0060.343] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0060.344] GetProcessHeap () returned 0x630000 [0060.344] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0060.344] GetProcessHeap () returned 0x630000 [0060.344] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0060.344] GetProcessHeap () returned 0x630000 [0060.344] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0060.344] GetProcessHeap () returned 0x630000 [0060.344] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0060.344] GetProcessHeap () returned 0x630000 [0060.344] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0060.344] GetProcessHeap () returned 0x630000 [0060.344] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0060.344] GetProcessHeap () returned 0x630000 [0060.344] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0060.344] GetProcessHeap () returned 0x630000 [0060.344] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a208 [0060.344] GetProcessHeap () returned 0x630000 [0060.344] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a208 | out: hHeap=0x630000) returned 1 [0060.344] GetProcessHeap () returned 0x630000 [0060.344] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0060.344] GetProcessHeap () returned 0x630000 [0060.344] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0060.344] GetProcessHeap () returned 0x630000 [0060.344] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0060.344] GetProcessHeap () returned 0x630000 [0060.344] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0060.344] GetProcessHeap () returned 0x630000 [0060.344] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0060.344] GetProcessHeap () returned 0x630000 [0060.344] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0060.344] GetProcessHeap () returned 0x630000 [0060.344] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0060.344] GetProcessHeap () returned 0x630000 [0060.344] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0060.344] GetProcessHeap () returned 0x630000 [0060.344] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0060.345] GetProcessHeap () returned 0x630000 [0060.345] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0060.345] GetProcessHeap () returned 0x630000 [0060.345] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0060.345] GetProcessHeap () returned 0x630000 [0060.345] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0060.345] GetProcessHeap () returned 0x630000 [0060.345] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0060.345] GetProcessHeap () returned 0x630000 [0060.345] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0060.345] GetProcessHeap () returned 0x630000 [0060.345] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0060.345] GetProcessHeap () returned 0x630000 [0060.345] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0060.345] GetProcessHeap () returned 0x630000 [0060.345] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0060.345] GetProcessHeap () returned 0x630000 [0060.345] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0060.345] GetProcessHeap () returned 0x630000 [0060.345] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0060.345] GetProcessHeap () returned 0x630000 [0060.345] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0060.345] GetProcessHeap () returned 0x630000 [0060.345] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0060.345] GetProcessHeap () returned 0x630000 [0060.345] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0060.345] GetProcessHeap () returned 0x630000 [0060.345] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0060.345] GetProcessHeap () returned 0x630000 [0060.345] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0060.345] GetProcessHeap () returned 0x630000 [0060.345] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0060.345] GetProcessHeap () returned 0x630000 [0060.345] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0060.345] GetProcessHeap () returned 0x630000 [0060.345] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0060.345] GetProcessHeap () returned 0x630000 [0060.346] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0060.346] GetProcessHeap () returned 0x630000 [0060.346] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0060.346] GetProcessHeap () returned 0x630000 [0060.346] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0060.346] GetProcessHeap () returned 0x630000 [0060.346] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0060.346] GetProcessHeap () returned 0x630000 [0060.346] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0060.346] GetProcessHeap () returned 0x630000 [0060.346] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0060.346] GetProcessHeap () returned 0x630000 [0060.346] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0060.346] GetProcessHeap () returned 0x630000 [0060.346] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0060.346] GetProcessHeap () returned 0x630000 [0060.346] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0060.346] GetProcessHeap () returned 0x630000 [0060.346] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0060.346] GetProcessHeap () returned 0x630000 [0060.346] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0060.346] GetProcessHeap () returned 0x630000 [0060.346] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0060.346] GetProcessHeap () returned 0x630000 [0060.346] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0060.346] GetProcessHeap () returned 0x630000 [0060.346] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0e8 [0060.346] GetProcessHeap () returned 0x630000 [0060.346] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0e8 | out: hHeap=0x630000) returned 1 [0060.346] GetProcessHeap () returned 0x630000 [0060.346] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0060.346] GetProcessHeap () returned 0x630000 [0060.346] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0060.346] GetProcessHeap () returned 0x630000 [0060.346] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0060.346] GetProcessHeap () returned 0x630000 [0060.346] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0060.347] GetProcessHeap () returned 0x630000 [0060.347] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0060.347] GetProcessHeap () returned 0x630000 [0060.347] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0060.347] GetProcessHeap () returned 0x630000 [0060.347] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0060.347] GetProcessHeap () returned 0x630000 [0060.347] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0060.347] GetProcessHeap () returned 0x630000 [0060.347] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0060.347] GetProcessHeap () returned 0x630000 [0060.347] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0060.347] GetProcessHeap () returned 0x630000 [0060.347] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0060.347] GetProcessHeap () returned 0x630000 [0060.347] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0060.347] GetProcessHeap () returned 0x630000 [0060.347] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0060.347] GetProcessHeap () returned 0x630000 [0060.347] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0060.347] GetProcessHeap () returned 0x630000 [0060.347] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0060.347] GetProcessHeap () returned 0x630000 [0060.347] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0060.347] GetProcessHeap () returned 0x630000 [0060.347] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0060.347] GetProcessHeap () returned 0x630000 [0060.347] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0060.347] GetProcessHeap () returned 0x630000 [0060.347] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0060.347] GetProcessHeap () returned 0x630000 [0060.347] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0060.347] GetProcessHeap () returned 0x630000 [0060.349] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0060.349] GetProcessHeap () returned 0x630000 [0060.349] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0060.349] GetProcessHeap () returned 0x630000 [0060.349] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0060.349] GetProcessHeap () returned 0x630000 [0060.349] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0060.349] GetProcessHeap () returned 0x630000 [0060.349] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0060.349] GetProcessHeap () returned 0x630000 [0060.349] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e7c0 | out: hHeap=0x630000) returned 1 [0060.349] GetProcessHeap () returned 0x630000 [0060.349] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0060.349] GetProcessHeap () returned 0x630000 [0060.349] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0060.349] GetProcessHeap () returned 0x630000 [0060.349] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0060.349] GetProcessHeap () returned 0x630000 [0060.349] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0060.349] GetProcessHeap () returned 0x630000 [0060.349] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0060.349] WriteFile (in: hFile=0x230, lpBuffer=0x6544c8*, nNumberOfBytesToWrite=0x386, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6544c8*, lpNumberOfBytesWritten=0x243d864*=0x386, lpOverlapped=0x0) returned 1 [0060.351] GetProcessHeap () returned 0x630000 [0060.351] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6544c8, Size=0x30) returned 0x6544c8 [0060.351] GetProcessHeap () returned 0x630000 [0060.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0060.351] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0060.351] GetProcessHeap () returned 0x630000 [0060.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x15370) returned 0x661be8 [0060.351] ReadFile (in: hFile=0x230, lpBuffer=0x661be8, nNumberOfBytesToRead=0x15370, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661be8*, lpNumberOfBytesRead=0x243d7e8*=0x15370, lpOverlapped=0x0) returned 1 [0060.352] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0060.352] WriteFile (in: hFile=0x230, lpBuffer=0x661be8*, nNumberOfBytesToWrite=0x15370, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661be8*, lpNumberOfBytesWritten=0x243d7e4*=0x15370, lpOverlapped=0x0) returned 1 [0060.354] GetProcessHeap () returned 0x630000 [0060.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661be8 | out: hHeap=0x630000) returned 1 [0060.355] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0060.355] WriteFile (in: hFile=0x230, lpBuffer=0x6544c8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6544c8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0060.356] CloseHandle (hObject=0x230) returned 1 [0060.359] GetProcessHeap () returned 0x630000 [0060.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0060.359] GetProcessHeap () returned 0x630000 [0060.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655a30 | out: hHeap=0x630000) returned 1 [0060.359] GetProcessHeap () returned 0x630000 [0060.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0060.359] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\xC1p2U4DPwmLw9O3uF.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\xC1p2U4DPwmLw9O3uF.png") returned="C:\\Users\\FD1HVy\\Pictures\\xC1p2U4DPwmLw9O3uF.png" [0060.359] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\xC1p2U4DPwmLw9O3uF.png", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\xC1p2U4DPwmLw9O3uF.png.happythreechoose") returned="C:\\Users\\FD1HVy\\Pictures\\xC1p2U4DPwmLw9O3uF.png.happythreechoose" [0060.359] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\xC1p2U4DPwmLw9O3uF.png" (normalized: "c:\\users\\fd1hvy\\pictures\\xc1p2u4dpwmlw9o3uf.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\xC1p2U4DPwmLw9O3uF.png.happythreechoose" (normalized: "c:\\users\\fd1hvy\\pictures\\xc1p2u4dpwmlw9o3uf.png.happythreechoose"), dwFlags=0x1) returned 1 [0060.360] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\xC1p2U4DPwmLw9O3uF.png" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0060.360] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0060.360] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" [0060.360] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\pictures\\decryption info.html")) returned 0x20 [0060.360] GetProcessHeap () returned 0x630000 [0060.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645d58 | out: hHeap=0x630000) returned 1 [0060.360] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f149f90, ftCreationTime.dwHighDateTime=0x1d5cfca, ftLastAccessTime.dwLowDateTime=0x62c8a920, ftLastAccessTime.dwHighDateTime=0x1d5c997, ftLastWriteTime.dwLowDateTime=0x62c8a920, ftLastWriteTime.dwHighDateTime=0x1d5c997, nFileSizeHigh=0x0, nFileSizeLow=0x976b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="y0c2al.png", cAlternateFileName="")) returned 1 [0060.360] lstrcmpiW (lpString1="y0c2al.png", lpString2=".") returned 1 [0060.360] lstrcmpiW (lpString1="y0c2al.png", lpString2="..") returned 1 [0060.360] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="y0c2al.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\y0c2al.png") returned="C:\\Users\\FD1HVy\\Pictures\\y0c2al.png" [0060.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="y0c2al.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0060.360] GetProcessHeap () returned 0x630000 [0060.360] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb) returned 0x64c9f0 [0060.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="y0c2al.png", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="y0c2al.png", lpUsedDefaultChar=0x0) returned 11 [0060.360] lstrlenA (lpString="y0c2al.png") returned 10 [0060.360] lstrlenA (lpString=".happythreechoose") returned 17 [0060.360] lstrcmpiW (lpString1="y0c2al.png", lpString2="Decryption INFO.html") returned 1 [0060.360] lstrcmpiW (lpString1="y0c2al.png", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0060.360] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0060.360] lstrcmpiW (lpString1="y0c2al.png", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0060.360] GetProcessHeap () returned 0x630000 [0060.360] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0060.360] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\y0c2al.png" (normalized: "c:\\users\\fd1hvy\\pictures\\y0c2al.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0060.361] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=38763) returned 1 [0060.361] GetProcessHeap () returned 0x630000 [0060.361] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655850 [0060.361] GetProcessHeap () returned 0x630000 [0060.361] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0060.361] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\y0c2al.png") returned 35 [0060.361] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0060.361] GetProcessHeap () returned 0x630000 [0060.361] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0060.361] GetProcessHeap () returned 0x630000 [0060.361] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x385) returned 0x654500 [0060.361] lstrlenA (lpString="rsa_encrypt") returned 11 [0060.361] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0060.361] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0060.362] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0060.362] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0060.362] GetProcessHeap () returned 0x630000 [0060.362] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0060.362] lstrlenA (lpString="010001") returned 6 [0060.362] GetProcessHeap () returned 0x630000 [0060.362] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0060.362] GetProcessHeap () returned 0x630000 [0060.362] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0060.362] GetProcessHeap () returned 0x630000 [0060.362] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0060.362] GetProcessHeap () returned 0x630000 [0060.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0060.362] GetProcessHeap () returned 0x630000 [0060.362] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0060.362] GetProcessHeap () returned 0x630000 [0060.362] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657210 [0060.362] GetProcessHeap () returned 0x630000 [0060.362] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a138 [0060.362] GetProcessHeap () returned 0x630000 [0060.362] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0060.362] GetProcessHeap () returned 0x630000 [0060.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0060.362] GetProcessHeap () returned 0x630000 [0060.362] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0060.362] GetProcessHeap () returned 0x630000 [0060.362] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0060.362] GetProcessHeap () returned 0x630000 [0060.362] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657328 [0060.362] GetProcessHeap () returned 0x630000 [0060.362] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0060.362] GetProcessHeap () returned 0x630000 [0060.362] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0060.362] GetProcessHeap () returned 0x630000 [0060.363] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dec0 [0060.363] GetProcessHeap () returned 0x630000 [0060.363] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0060.363] GetProcessHeap () returned 0x630000 [0060.363] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0060.363] GetProcessHeap () returned 0x630000 [0060.363] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0060.363] GetProcessHeap () returned 0x630000 [0060.363] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0060.363] GetProcessHeap () returned 0x630000 [0060.363] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x6615f0 [0060.363] GetProcessHeap () returned 0x630000 [0060.363] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0060.363] GetProcessHeap () returned 0x630000 [0060.363] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0060.363] GetProcessHeap () returned 0x630000 [0060.363] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0060.363] GetProcessHeap () returned 0x630000 [0060.363] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0060.363] GetProcessHeap () returned 0x630000 [0060.363] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e4f0 [0060.363] GetProcessHeap () returned 0x630000 [0060.363] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6615f0 | out: hHeap=0x630000) returned 1 [0060.363] GetProcessHeap () returned 0x630000 [0060.363] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0060.363] GetProcessHeap () returned 0x630000 [0060.363] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0060.363] GetProcessHeap () returned 0x630000 [0060.363] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0060.363] GetProcessHeap () returned 0x630000 [0060.363] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0060.363] GetProcessHeap () returned 0x630000 [0060.363] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a208 [0060.363] GetProcessHeap () returned 0x630000 [0060.363] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a208 | out: hHeap=0x630000) returned 1 [0060.363] GetProcessHeap () returned 0x630000 [0060.363] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0060.363] GetProcessHeap () returned 0x630000 [0060.364] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0060.364] GetProcessHeap () returned 0x630000 [0060.364] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0060.364] GetProcessHeap () returned 0x630000 [0060.364] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0060.364] GetProcessHeap () returned 0x630000 [0060.364] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0060.364] GetProcessHeap () returned 0x630000 [0060.364] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0060.364] GetProcessHeap () returned 0x630000 [0060.364] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0060.364] GetProcessHeap () returned 0x630000 [0060.364] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0060.364] GetProcessHeap () returned 0x630000 [0060.364] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0060.364] GetProcessHeap () returned 0x630000 [0060.364] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0060.364] GetProcessHeap () returned 0x630000 [0060.364] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0060.364] GetProcessHeap () returned 0x630000 [0060.364] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0060.364] GetProcessHeap () returned 0x630000 [0060.364] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0060.364] GetProcessHeap () returned 0x630000 [0060.364] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0060.364] GetProcessHeap () returned 0x630000 [0060.364] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0060.364] GetProcessHeap () returned 0x630000 [0060.364] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0060.364] GetProcessHeap () returned 0x630000 [0060.364] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0060.364] GetProcessHeap () returned 0x630000 [0060.364] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0060.364] GetProcessHeap () returned 0x630000 [0060.364] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0060.364] GetProcessHeap () returned 0x630000 [0060.364] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0060.364] GetProcessHeap () returned 0x630000 [0060.365] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0060.365] GetProcessHeap () returned 0x630000 [0060.365] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0060.365] GetProcessHeap () returned 0x630000 [0060.365] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0060.365] GetProcessHeap () returned 0x630000 [0060.365] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0060.365] GetProcessHeap () returned 0x630000 [0060.365] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0060.365] GetProcessHeap () returned 0x630000 [0060.365] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0060.365] GetProcessHeap () returned 0x630000 [0060.365] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0060.365] GetProcessHeap () returned 0x630000 [0060.365] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0060.365] GetProcessHeap () returned 0x630000 [0060.365] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0060.365] GetProcessHeap () returned 0x630000 [0060.365] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0060.365] GetProcessHeap () returned 0x630000 [0060.365] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0060.365] GetProcessHeap () returned 0x630000 [0060.365] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0060.365] GetProcessHeap () returned 0x630000 [0060.365] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0060.365] GetProcessHeap () returned 0x630000 [0060.365] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0060.365] GetProcessHeap () returned 0x630000 [0060.365] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0060.365] GetProcessHeap () returned 0x630000 [0060.365] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0060.365] GetProcessHeap () returned 0x630000 [0060.365] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0060.365] GetProcessHeap () returned 0x630000 [0060.365] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0060.365] GetProcessHeap () returned 0x630000 [0060.365] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a208 [0060.365] GetProcessHeap () returned 0x630000 [0060.366] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a208 | out: hHeap=0x630000) returned 1 [0060.366] GetProcessHeap () returned 0x630000 [0060.366] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0060.366] GetProcessHeap () returned 0x630000 [0060.366] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0060.366] GetProcessHeap () returned 0x630000 [0060.366] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0060.366] GetProcessHeap () returned 0x630000 [0060.366] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0060.366] GetProcessHeap () returned 0x630000 [0060.366] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0060.366] GetProcessHeap () returned 0x630000 [0060.366] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0060.366] GetProcessHeap () returned 0x630000 [0060.366] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0060.366] GetProcessHeap () returned 0x630000 [0060.366] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0060.366] GetProcessHeap () returned 0x630000 [0060.366] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0060.366] GetProcessHeap () returned 0x630000 [0060.366] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0060.366] GetProcessHeap () returned 0x630000 [0060.366] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0060.366] GetProcessHeap () returned 0x630000 [0060.366] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0060.366] GetProcessHeap () returned 0x630000 [0060.366] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0060.366] GetProcessHeap () returned 0x630000 [0060.366] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0060.366] GetProcessHeap () returned 0x630000 [0060.366] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0060.366] GetProcessHeap () returned 0x630000 [0060.366] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0060.366] GetProcessHeap () returned 0x630000 [0060.366] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0060.366] GetProcessHeap () returned 0x630000 [0060.366] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0060.366] GetProcessHeap () returned 0x630000 [0060.367] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0060.367] GetProcessHeap () returned 0x630000 [0060.367] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0060.367] GetProcessHeap () returned 0x630000 [0060.367] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0060.367] GetProcessHeap () returned 0x630000 [0060.367] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0060.367] GetProcessHeap () returned 0x630000 [0060.367] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0060.367] GetProcessHeap () returned 0x630000 [0060.367] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0060.367] GetProcessHeap () returned 0x630000 [0060.367] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0060.367] GetProcessHeap () returned 0x630000 [0060.367] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0060.367] GetProcessHeap () returned 0x630000 [0060.367] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0060.367] GetProcessHeap () returned 0x630000 [0060.367] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0060.367] GetProcessHeap () returned 0x630000 [0060.367] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a208 [0060.367] GetProcessHeap () returned 0x630000 [0060.367] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a208 | out: hHeap=0x630000) returned 1 [0060.367] GetProcessHeap () returned 0x630000 [0060.367] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0060.367] GetProcessHeap () returned 0x630000 [0060.367] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0060.367] GetProcessHeap () returned 0x630000 [0060.367] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0060.367] GetProcessHeap () returned 0x630000 [0060.367] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0060.367] GetProcessHeap () returned 0x630000 [0060.367] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0060.367] GetProcessHeap () returned 0x630000 [0060.367] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0060.367] GetProcessHeap () returned 0x630000 [0060.367] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0060.368] GetProcessHeap () returned 0x630000 [0060.368] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0060.368] GetProcessHeap () returned 0x630000 [0060.368] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0060.368] GetProcessHeap () returned 0x630000 [0060.368] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0060.368] GetProcessHeap () returned 0x630000 [0060.368] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0060.368] GetProcessHeap () returned 0x630000 [0060.368] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0060.368] GetProcessHeap () returned 0x630000 [0060.368] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0060.368] GetProcessHeap () returned 0x630000 [0060.368] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0060.368] GetProcessHeap () returned 0x630000 [0060.368] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0060.368] GetProcessHeap () returned 0x630000 [0060.368] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0060.368] GetProcessHeap () returned 0x630000 [0060.368] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0060.368] GetProcessHeap () returned 0x630000 [0060.368] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0060.368] GetProcessHeap () returned 0x630000 [0060.368] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0060.368] WriteFile (in: hFile=0x230, lpBuffer=0x654500*, nNumberOfBytesToWrite=0x385, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654500*, lpNumberOfBytesWritten=0x243d864*=0x385, lpOverlapped=0x0) returned 1 [0060.370] GetProcessHeap () returned 0x630000 [0060.370] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x654500, Size=0x30) returned 0x654500 [0060.370] GetProcessHeap () returned 0x630000 [0060.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0060.370] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0060.370] GetProcessHeap () returned 0x630000 [0060.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9770) returned 0x661be8 [0060.375] ReadFile (in: hFile=0x230, lpBuffer=0x661be8, nNumberOfBytesToRead=0x9770, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661be8*, lpNumberOfBytesRead=0x243d7e8*=0x9770, lpOverlapped=0x0) returned 1 [0060.376] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0060.376] WriteFile (in: hFile=0x230, lpBuffer=0x661be8*, nNumberOfBytesToWrite=0x9770, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661be8*, lpNumberOfBytesWritten=0x243d7e4*=0x9770, lpOverlapped=0x0) returned 1 [0060.377] GetProcessHeap () returned 0x630000 [0060.377] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661be8 | out: hHeap=0x630000) returned 1 [0060.378] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0060.378] WriteFile (in: hFile=0x230, lpBuffer=0x654500*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654500*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0060.379] CloseHandle (hObject=0x230) returned 1 [0060.381] GetProcessHeap () returned 0x630000 [0060.381] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0060.381] GetProcessHeap () returned 0x630000 [0060.381] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655850 | out: hHeap=0x630000) returned 1 [0060.381] GetProcessHeap () returned 0x630000 [0060.381] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0060.381] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\y0c2al.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\y0c2al.png") returned="C:\\Users\\FD1HVy\\Pictures\\y0c2al.png" [0060.381] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\y0c2al.png", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\y0c2al.png.happythreechoose") returned="C:\\Users\\FD1HVy\\Pictures\\y0c2al.png.happythreechoose" [0060.381] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\y0c2al.png" (normalized: "c:\\users\\fd1hvy\\pictures\\y0c2al.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\y0c2al.png.happythreechoose" (normalized: "c:\\users\\fd1hvy\\pictures\\y0c2al.png.happythreechoose"), dwFlags=0x1) returned 1 [0060.382] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\y0c2al.png" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0060.382] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0060.382] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" [0060.382] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\pictures\\decryption info.html")) returned 0x20 [0060.382] GetProcessHeap () returned 0x630000 [0060.382] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0060.382] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcad7c610, ftCreationTime.dwHighDateTime=0x1d5d138, ftLastAccessTime.dwLowDateTime=0x926ac0, ftLastAccessTime.dwHighDateTime=0x1d5d059, ftLastWriteTime.dwLowDateTime=0x926ac0, ftLastWriteTime.dwHighDateTime=0x1d5d059, nFileSizeHigh=0x0, nFileSizeLow=0x1269d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZU1Btd.gif", cAlternateFileName="")) returned 1 [0060.382] lstrcmpiW (lpString1="ZU1Btd.gif", lpString2=".") returned 1 [0060.382] lstrcmpiW (lpString1="ZU1Btd.gif", lpString2="..") returned 1 [0060.382] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="ZU1Btd.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\ZU1Btd.gif") returned="C:\\Users\\FD1HVy\\Pictures\\ZU1Btd.gif" [0060.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ZU1Btd.gif", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0060.382] GetProcessHeap () returned 0x630000 [0060.382] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb) returned 0x64ca20 [0060.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ZU1Btd.gif", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ZU1Btd.gif", lpUsedDefaultChar=0x0) returned 11 [0060.382] lstrlenA (lpString="ZU1Btd.gif") returned 10 [0060.382] lstrlenA (lpString=".happythreechoose") returned 17 [0060.382] lstrcmpiW (lpString1="ZU1Btd.gif", lpString2="Decryption INFO.html") returned 1 [0060.382] lstrcmpiW (lpString1="ZU1Btd.gif", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0060.382] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0060.382] lstrcmpiW (lpString1="ZU1Btd.gif", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0060.382] GetProcessHeap () returned 0x630000 [0060.383] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0060.383] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ZU1Btd.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\zu1btd.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0060.383] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=75421) returned 1 [0060.383] GetProcessHeap () returned 0x630000 [0060.383] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655aa8 [0060.383] GetProcessHeap () returned 0x630000 [0060.383] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0060.383] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\ZU1Btd.gif") returned 35 [0060.383] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0060.383] GetProcessHeap () returned 0x630000 [0060.383] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0060.383] GetProcessHeap () returned 0x630000 [0060.383] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x654538 [0060.383] lstrlenA (lpString="rsa_encrypt") returned 11 [0060.383] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0060.384] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0060.384] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0060.384] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0060.384] GetProcessHeap () returned 0x630000 [0060.384] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0060.384] lstrlenA (lpString="010001") returned 6 [0060.384] GetProcessHeap () returned 0x630000 [0060.384] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0060.384] GetProcessHeap () returned 0x630000 [0060.384] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0060.384] GetProcessHeap () returned 0x630000 [0060.384] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dec0 [0060.384] GetProcessHeap () returned 0x630000 [0060.384] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0060.384] GetProcessHeap () returned 0x630000 [0060.384] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65eb20 [0060.384] GetProcessHeap () returned 0x630000 [0060.384] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657440 [0060.384] GetProcessHeap () returned 0x630000 [0060.384] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a088 [0060.384] GetProcessHeap () returned 0x630000 [0060.384] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0060.384] GetProcessHeap () returned 0x630000 [0060.384] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0060.384] GetProcessHeap () returned 0x630000 [0060.384] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0060.384] GetProcessHeap () returned 0x630000 [0060.384] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0060.384] GetProcessHeap () returned 0x630000 [0060.384] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656fe0 [0060.385] GetProcessHeap () returned 0x630000 [0060.385] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0060.385] GetProcessHeap () returned 0x630000 [0060.385] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0060.385] GetProcessHeap () returned 0x630000 [0060.385] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e730 [0060.385] GetProcessHeap () returned 0x630000 [0060.385] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0060.385] GetProcessHeap () returned 0x630000 [0060.385] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0060.385] GetProcessHeap () returned 0x630000 [0060.385] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0060.385] GetProcessHeap () returned 0x630000 [0060.385] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0060.385] GetProcessHeap () returned 0x630000 [0060.385] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x661758 [0060.385] GetProcessHeap () returned 0x630000 [0060.385] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0060.385] GetProcessHeap () returned 0x630000 [0060.385] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0060.385] GetProcessHeap () returned 0x630000 [0060.385] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0060.385] GetProcessHeap () returned 0x630000 [0060.385] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0060.385] GetProcessHeap () returned 0x630000 [0060.385] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65dfe0 [0060.385] GetProcessHeap () returned 0x630000 [0060.385] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661758 | out: hHeap=0x630000) returned 1 [0060.385] GetProcessHeap () returned 0x630000 [0060.385] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0060.385] GetProcessHeap () returned 0x630000 [0060.385] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0060.385] GetProcessHeap () returned 0x630000 [0060.385] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0060.385] GetProcessHeap () returned 0x630000 [0060.385] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0060.385] GetProcessHeap () returned 0x630000 [0060.385] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0060.385] GetProcessHeap () returned 0x630000 [0060.386] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0060.386] GetProcessHeap () returned 0x630000 [0060.386] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0060.386] GetProcessHeap () returned 0x630000 [0060.386] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0060.386] GetProcessHeap () returned 0x630000 [0060.386] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0060.386] GetProcessHeap () returned 0x630000 [0060.386] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0060.386] GetProcessHeap () returned 0x630000 [0060.386] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0060.386] GetProcessHeap () returned 0x630000 [0060.386] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0060.386] GetProcessHeap () returned 0x630000 [0060.386] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0060.386] GetProcessHeap () returned 0x630000 [0060.386] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0060.386] GetProcessHeap () returned 0x630000 [0060.386] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0060.386] GetProcessHeap () returned 0x630000 [0060.386] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0060.386] GetProcessHeap () returned 0x630000 [0060.386] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0060.386] GetProcessHeap () returned 0x630000 [0060.386] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0060.386] GetProcessHeap () returned 0x630000 [0060.386] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0060.386] GetProcessHeap () returned 0x630000 [0060.386] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0060.386] GetProcessHeap () returned 0x630000 [0060.386] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a198 [0060.386] GetProcessHeap () returned 0x630000 [0060.386] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a198 | out: hHeap=0x630000) returned 1 [0060.386] GetProcessHeap () returned 0x630000 [0060.386] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0060.386] GetProcessHeap () returned 0x630000 [0060.386] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0060.387] GetProcessHeap () returned 0x630000 [0060.387] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0e8 [0060.387] GetProcessHeap () returned 0x630000 [0060.387] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0e8 | out: hHeap=0x630000) returned 1 [0060.387] GetProcessHeap () returned 0x630000 [0060.387] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0060.387] GetProcessHeap () returned 0x630000 [0060.387] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0060.387] GetProcessHeap () returned 0x630000 [0060.387] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0060.387] GetProcessHeap () returned 0x630000 [0060.387] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0060.387] GetProcessHeap () returned 0x630000 [0060.387] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0060.387] GetProcessHeap () returned 0x630000 [0060.387] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0060.387] GetProcessHeap () returned 0x630000 [0060.387] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0060.387] GetProcessHeap () returned 0x630000 [0060.387] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0060.387] GetProcessHeap () returned 0x630000 [0060.387] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0060.387] GetProcessHeap () returned 0x630000 [0060.387] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0060.387] GetProcessHeap () returned 0x630000 [0060.387] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0060.387] GetProcessHeap () returned 0x630000 [0060.387] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0060.387] GetProcessHeap () returned 0x630000 [0060.387] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0060.387] GetProcessHeap () returned 0x630000 [0060.387] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0060.387] GetProcessHeap () returned 0x630000 [0060.387] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0060.387] GetProcessHeap () returned 0x630000 [0060.387] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0060.387] GetProcessHeap () returned 0x630000 [0060.388] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0060.388] GetProcessHeap () returned 0x630000 [0060.388] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0060.388] GetProcessHeap () returned 0x630000 [0060.388] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0060.388] GetProcessHeap () returned 0x630000 [0060.388] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0060.388] GetProcessHeap () returned 0x630000 [0060.388] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0060.388] GetProcessHeap () returned 0x630000 [0060.388] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0060.388] GetProcessHeap () returned 0x630000 [0060.388] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0060.388] GetProcessHeap () returned 0x630000 [0060.388] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0060.388] GetProcessHeap () returned 0x630000 [0060.388] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0060.388] GetProcessHeap () returned 0x630000 [0060.388] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0060.388] GetProcessHeap () returned 0x630000 [0060.388] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0060.388] GetProcessHeap () returned 0x630000 [0060.388] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0060.388] GetProcessHeap () returned 0x630000 [0060.388] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0060.388] GetProcessHeap () returned 0x630000 [0060.388] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0060.388] GetProcessHeap () returned 0x630000 [0060.388] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0060.388] GetProcessHeap () returned 0x630000 [0060.388] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0060.388] GetProcessHeap () returned 0x630000 [0060.388] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1a8 [0060.388] GetProcessHeap () returned 0x630000 [0060.388] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1a8 | out: hHeap=0x630000) returned 1 [0060.388] GetProcessHeap () returned 0x630000 [0060.388] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0060.388] GetProcessHeap () returned 0x630000 [0060.388] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0060.389] GetProcessHeap () returned 0x630000 [0060.389] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0060.389] GetProcessHeap () returned 0x630000 [0060.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0060.389] GetProcessHeap () returned 0x630000 [0060.389] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0060.389] GetProcessHeap () returned 0x630000 [0060.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0060.389] GetProcessHeap () returned 0x630000 [0060.389] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0060.389] GetProcessHeap () returned 0x630000 [0060.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0060.389] GetProcessHeap () returned 0x630000 [0060.389] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0060.389] GetProcessHeap () returned 0x630000 [0060.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0060.389] GetProcessHeap () returned 0x630000 [0060.389] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0060.389] GetProcessHeap () returned 0x630000 [0060.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0060.389] GetProcessHeap () returned 0x630000 [0060.389] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0060.389] GetProcessHeap () returned 0x630000 [0060.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0060.389] GetProcessHeap () returned 0x630000 [0060.389] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0060.389] GetProcessHeap () returned 0x630000 [0060.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0060.389] GetProcessHeap () returned 0x630000 [0060.389] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0060.389] GetProcessHeap () returned 0x630000 [0060.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0060.389] GetProcessHeap () returned 0x630000 [0060.389] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0060.389] GetProcessHeap () returned 0x630000 [0060.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0060.389] GetProcessHeap () returned 0x630000 [0060.389] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0060.389] GetProcessHeap () returned 0x630000 [0060.390] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0060.390] GetProcessHeap () returned 0x630000 [0060.390] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0060.390] GetProcessHeap () returned 0x630000 [0060.390] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0060.390] GetProcessHeap () returned 0x630000 [0060.390] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0060.390] GetProcessHeap () returned 0x630000 [0060.390] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0060.390] GetProcessHeap () returned 0x630000 [0060.390] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0060.390] GetProcessHeap () returned 0x630000 [0060.390] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0060.390] GetProcessHeap () returned 0x630000 [0060.390] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0060.390] GetProcessHeap () returned 0x630000 [0060.390] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0060.390] GetProcessHeap () returned 0x630000 [0060.390] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0060.390] GetProcessHeap () returned 0x630000 [0060.390] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0060.390] GetProcessHeap () returned 0x630000 [0060.390] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0060.390] GetProcessHeap () returned 0x630000 [0060.390] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0060.390] GetProcessHeap () returned 0x630000 [0060.390] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0060.390] WriteFile (in: hFile=0x230, lpBuffer=0x654538*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654538*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0060.392] GetProcessHeap () returned 0x630000 [0060.393] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x654538, Size=0x30) returned 0x654538 [0060.393] GetProcessHeap () returned 0x630000 [0060.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0060.393] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0060.393] GetProcessHeap () returned 0x630000 [0060.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1269d) returned 0x661be8 [0060.395] ReadFile (in: hFile=0x230, lpBuffer=0x661be8, nNumberOfBytesToRead=0x1269d, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x661be8*, lpNumberOfBytesRead=0x243d7e8*=0x1269d, lpOverlapped=0x0) returned 1 [0060.396] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0060.396] WriteFile (in: hFile=0x230, lpBuffer=0x661be8*, nNumberOfBytesToWrite=0x1269d, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x661be8*, lpNumberOfBytesWritten=0x243d7e4*=0x1269d, lpOverlapped=0x0) returned 1 [0060.397] GetProcessHeap () returned 0x630000 [0060.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661be8 | out: hHeap=0x630000) returned 1 [0060.397] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0060.398] WriteFile (in: hFile=0x230, lpBuffer=0x654538*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654538*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0060.399] CloseHandle (hObject=0x230) returned 1 [0060.401] GetProcessHeap () returned 0x630000 [0060.401] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0060.401] GetProcessHeap () returned 0x630000 [0060.401] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655aa8 | out: hHeap=0x630000) returned 1 [0060.401] GetProcessHeap () returned 0x630000 [0060.401] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0060.401] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\ZU1Btd.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\ZU1Btd.gif") returned="C:\\Users\\FD1HVy\\Pictures\\ZU1Btd.gif" [0060.401] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\ZU1Btd.gif", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\ZU1Btd.gif.happythreechoose") returned="C:\\Users\\FD1HVy\\Pictures\\ZU1Btd.gif.happythreechoose" [0060.402] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\ZU1Btd.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\zu1btd.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\ZU1Btd.gif.happythreechoose" (normalized: "c:\\users\\fd1hvy\\pictures\\zu1btd.gif.happythreechoose"), dwFlags=0x1) returned 1 [0060.411] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\ZU1Btd.gif" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0060.411] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0060.411] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" [0060.411] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\pictures\\decryption info.html")) returned 0x20 [0060.411] GetProcessHeap () returned 0x630000 [0060.411] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0060.411] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586ca770, ftCreationTime.dwHighDateTime=0x1d5c7ed, ftLastAccessTime.dwLowDateTime=0xb0a13f10, ftLastAccessTime.dwHighDateTime=0x1d5d5fc, ftLastWriteTime.dwLowDateTime=0xb0a13f10, ftLastWriteTime.dwHighDateTime=0x1d5d5fc, nFileSizeHigh=0x0, nFileSizeLow=0xacf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_sTleJ.jpg", cAlternateFileName="")) returned 1 [0060.411] lstrcmpiW (lpString1="_sTleJ.jpg", lpString2=".") returned 1 [0060.411] lstrcmpiW (lpString1="_sTleJ.jpg", lpString2="..") returned 1 [0060.411] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="_sTleJ.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\_sTleJ.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\_sTleJ.jpg" [0060.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="_sTleJ.jpg", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0060.411] GetProcessHeap () returned 0x630000 [0060.411] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb) returned 0x64c9f0 [0060.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="_sTleJ.jpg", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_sTleJ.jpg", lpUsedDefaultChar=0x0) returned 11 [0060.411] lstrlenA (lpString="_sTleJ.jpg") returned 10 [0060.411] lstrlenA (lpString=".happythreechoose") returned 17 [0060.411] lstrcmpiW (lpString1="_sTleJ.jpg", lpString2="Decryption INFO.html") returned -1 [0060.411] lstrcmpiW (lpString1="_sTleJ.jpg", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned -1 [0060.411] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0060.411] lstrcmpiW (lpString1="_sTleJ.jpg", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0060.411] GetProcessHeap () returned 0x630000 [0060.411] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0060.411] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\_sTleJ.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\_stlej.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0060.412] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=2767) returned 1 [0060.412] GetProcessHeap () returned 0x630000 [0060.412] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6558c8 [0060.412] GetProcessHeap () returned 0x630000 [0060.412] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0060.412] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\_sTleJ.jpg") returned 35 [0060.412] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0060.412] GetProcessHeap () returned 0x630000 [0060.412] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0060.412] GetProcessHeap () returned 0x630000 [0060.412] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x381) returned 0x654570 [0060.412] lstrlenA (lpString="rsa_encrypt") returned 11 [0060.412] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0060.413] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0060.413] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0060.413] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0060.413] GetProcessHeap () returned 0x630000 [0060.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0060.413] lstrlenA (lpString="010001") returned 6 [0060.413] GetProcessHeap () returned 0x630000 [0060.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0060.413] GetProcessHeap () returned 0x630000 [0060.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0060.413] GetProcessHeap () returned 0x630000 [0060.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e610 [0060.413] GetProcessHeap () returned 0x630000 [0060.413] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0060.413] GetProcessHeap () returned 0x630000 [0060.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ebb0 [0060.413] GetProcessHeap () returned 0x630000 [0060.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656ec8 [0060.413] GetProcessHeap () returned 0x630000 [0060.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a1f8 [0060.413] GetProcessHeap () returned 0x630000 [0060.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0060.413] GetProcessHeap () returned 0x630000 [0060.413] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0060.413] GetProcessHeap () returned 0x630000 [0060.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0060.413] GetProcessHeap () returned 0x630000 [0060.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0060.413] GetProcessHeap () returned 0x630000 [0060.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x6570f8 [0060.413] GetProcessHeap () returned 0x630000 [0060.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0060.413] GetProcessHeap () returned 0x630000 [0060.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0060.413] GetProcessHeap () returned 0x630000 [0060.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e3d0 [0060.414] GetProcessHeap () returned 0x630000 [0060.414] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0060.414] GetProcessHeap () returned 0x630000 [0060.414] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0060.414] GetProcessHeap () returned 0x630000 [0060.414] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0060.414] GetProcessHeap () returned 0x630000 [0060.414] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0060.414] GetProcessHeap () returned 0x630000 [0060.414] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x6617e8 [0060.441] GetProcessHeap () returned 0x630000 [0060.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0060.441] GetProcessHeap () returned 0x630000 [0060.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0060.441] GetProcessHeap () returned 0x630000 [0060.441] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0060.441] GetProcessHeap () returned 0x630000 [0060.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0060.441] GetProcessHeap () returned 0x630000 [0060.441] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e6a0 [0060.441] GetProcessHeap () returned 0x630000 [0060.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6617e8 | out: hHeap=0x630000) returned 1 [0060.442] GetProcessHeap () returned 0x630000 [0060.442] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0060.442] GetProcessHeap () returned 0x630000 [0060.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e6a0 | out: hHeap=0x630000) returned 1 [0060.442] GetProcessHeap () returned 0x630000 [0060.442] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0060.442] GetProcessHeap () returned 0x630000 [0060.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0060.442] GetProcessHeap () returned 0x630000 [0060.442] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0060.442] GetProcessHeap () returned 0x630000 [0060.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0060.442] GetProcessHeap () returned 0x630000 [0060.442] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0060.442] GetProcessHeap () returned 0x630000 [0060.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0060.442] GetProcessHeap () returned 0x630000 [0060.442] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0060.442] GetProcessHeap () returned 0x630000 [0060.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0060.442] GetProcessHeap () returned 0x630000 [0060.442] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0060.442] GetProcessHeap () returned 0x630000 [0060.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0060.442] GetProcessHeap () returned 0x630000 [0060.442] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0060.442] GetProcessHeap () returned 0x630000 [0060.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0060.442] GetProcessHeap () returned 0x630000 [0060.442] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0060.442] GetProcessHeap () returned 0x630000 [0060.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0060.442] GetProcessHeap () returned 0x630000 [0060.442] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0060.442] GetProcessHeap () returned 0x630000 [0060.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0060.443] GetProcessHeap () returned 0x630000 [0060.443] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a188 [0060.443] GetProcessHeap () returned 0x630000 [0060.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a188 | out: hHeap=0x630000) returned 1 [0060.443] GetProcessHeap () returned 0x630000 [0060.443] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0060.443] GetProcessHeap () returned 0x630000 [0060.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0060.443] GetProcessHeap () returned 0x630000 [0060.443] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0060.443] GetProcessHeap () returned 0x630000 [0060.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0060.443] GetProcessHeap () returned 0x630000 [0060.443] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0060.443] GetProcessHeap () returned 0x630000 [0060.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0060.443] GetProcessHeap () returned 0x630000 [0060.443] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0060.443] GetProcessHeap () returned 0x630000 [0060.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0060.443] GetProcessHeap () returned 0x630000 [0060.443] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0060.443] GetProcessHeap () returned 0x630000 [0060.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0060.443] GetProcessHeap () returned 0x630000 [0060.443] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0060.443] GetProcessHeap () returned 0x630000 [0060.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0060.443] GetProcessHeap () returned 0x630000 [0060.443] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0e8 [0060.443] GetProcessHeap () returned 0x630000 [0060.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0e8 | out: hHeap=0x630000) returned 1 [0060.443] GetProcessHeap () returned 0x630000 [0060.443] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0060.443] GetProcessHeap () returned 0x630000 [0060.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0060.444] GetProcessHeap () returned 0x630000 [0060.444] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0060.444] GetProcessHeap () returned 0x630000 [0060.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0060.444] GetProcessHeap () returned 0x630000 [0060.444] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0060.444] GetProcessHeap () returned 0x630000 [0060.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0060.444] GetProcessHeap () returned 0x630000 [0060.444] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0060.444] GetProcessHeap () returned 0x630000 [0060.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0060.444] GetProcessHeap () returned 0x630000 [0060.444] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0060.444] GetProcessHeap () returned 0x630000 [0060.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0060.444] GetProcessHeap () returned 0x630000 [0060.444] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0060.444] GetProcessHeap () returned 0x630000 [0060.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0060.444] GetProcessHeap () returned 0x630000 [0060.444] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a188 [0060.444] GetProcessHeap () returned 0x630000 [0060.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a188 | out: hHeap=0x630000) returned 1 [0060.444] GetProcessHeap () returned 0x630000 [0060.444] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0060.444] GetProcessHeap () returned 0x630000 [0060.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0060.444] GetProcessHeap () returned 0x630000 [0060.444] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0060.444] GetProcessHeap () returned 0x630000 [0060.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0060.444] GetProcessHeap () returned 0x630000 [0060.444] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a238 [0060.444] GetProcessHeap () returned 0x630000 [0060.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a238 | out: hHeap=0x630000) returned 1 [0060.444] GetProcessHeap () returned 0x630000 [0060.444] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a128 [0060.445] GetProcessHeap () returned 0x630000 [0060.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a128 | out: hHeap=0x630000) returned 1 [0060.445] GetProcessHeap () returned 0x630000 [0060.445] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0060.445] GetProcessHeap () returned 0x630000 [0060.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0060.445] GetProcessHeap () returned 0x630000 [0060.445] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0060.445] GetProcessHeap () returned 0x630000 [0060.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0060.445] GetProcessHeap () returned 0x630000 [0060.445] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0060.445] GetProcessHeap () returned 0x630000 [0060.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0060.445] GetProcessHeap () returned 0x630000 [0060.445] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0060.445] GetProcessHeap () returned 0x630000 [0060.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0060.445] GetProcessHeap () returned 0x630000 [0060.445] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1a8 [0060.445] GetProcessHeap () returned 0x630000 [0060.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1a8 | out: hHeap=0x630000) returned 1 [0060.445] GetProcessHeap () returned 0x630000 [0060.445] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0060.445] GetProcessHeap () returned 0x630000 [0060.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0060.445] GetProcessHeap () returned 0x630000 [0060.445] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0060.445] GetProcessHeap () returned 0x630000 [0060.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0060.445] GetProcessHeap () returned 0x630000 [0060.445] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0060.445] GetProcessHeap () returned 0x630000 [0060.446] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0060.446] GetProcessHeap () returned 0x630000 [0060.446] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a168 [0060.446] GetProcessHeap () returned 0x630000 [0060.446] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a168 | out: hHeap=0x630000) returned 1 [0060.446] GetProcessHeap () returned 0x630000 [0060.446] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0060.446] GetProcessHeap () returned 0x630000 [0060.446] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0060.446] GetProcessHeap () returned 0x630000 [0060.446] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1e8 [0060.446] GetProcessHeap () returned 0x630000 [0060.446] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1e8 | out: hHeap=0x630000) returned 1 [0060.446] GetProcessHeap () returned 0x630000 [0060.446] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0060.446] GetProcessHeap () returned 0x630000 [0060.446] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0060.446] GetProcessHeap () returned 0x630000 [0060.446] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0060.446] GetProcessHeap () returned 0x630000 [0060.446] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0060.446] GetProcessHeap () returned 0x630000 [0060.446] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a178 [0060.446] GetProcessHeap () returned 0x630000 [0060.446] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a178 | out: hHeap=0x630000) returned 1 [0060.446] GetProcessHeap () returned 0x630000 [0060.446] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0060.446] GetProcessHeap () returned 0x630000 [0060.446] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0060.446] GetProcessHeap () returned 0x630000 [0060.446] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0060.446] GetProcessHeap () returned 0x630000 [0060.446] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0060.446] GetProcessHeap () returned 0x630000 [0060.446] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0060.446] GetProcessHeap () returned 0x630000 [0060.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0060.447] GetProcessHeap () returned 0x630000 [0060.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0060.447] GetProcessHeap () returned 0x630000 [0060.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0060.447] GetProcessHeap () returned 0x630000 [0060.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0060.447] GetProcessHeap () returned 0x630000 [0060.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0060.447] GetProcessHeap () returned 0x630000 [0060.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0060.447] WriteFile (in: hFile=0x230, lpBuffer=0x654570*, nNumberOfBytesToWrite=0x381, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654570*, lpNumberOfBytesWritten=0x243d864*=0x381, lpOverlapped=0x0) returned 1 [0060.449] GetProcessHeap () returned 0x630000 [0060.449] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x654570, Size=0x30) returned 0x654570 [0060.449] GetProcessHeap () returned 0x630000 [0060.449] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0060.449] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0060.449] GetProcessHeap () returned 0x630000 [0060.449] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xad0) returned 0x6545a8 [0060.449] ReadFile (in: hFile=0x230, lpBuffer=0x6545a8, nNumberOfBytesToRead=0xad0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x6545a8*, lpNumberOfBytesRead=0x243d7e8*=0xad0, lpOverlapped=0x0) returned 1 [0060.449] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0060.449] WriteFile (in: hFile=0x230, lpBuffer=0x6545a8*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x6545a8*, lpNumberOfBytesWritten=0x243d7e4*=0xad0, lpOverlapped=0x0) returned 1 [0060.450] GetProcessHeap () returned 0x630000 [0060.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6545a8 | out: hHeap=0x630000) returned 1 [0060.450] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0060.450] WriteFile (in: hFile=0x230, lpBuffer=0x654570*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654570*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0060.451] CloseHandle (hObject=0x230) returned 1 [0060.452] GetProcessHeap () returned 0x630000 [0060.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0060.453] GetProcessHeap () returned 0x630000 [0060.453] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6558c8 | out: hHeap=0x630000) returned 1 [0060.453] GetProcessHeap () returned 0x630000 [0060.453] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0060.453] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\_sTleJ.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\_sTleJ.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\_sTleJ.jpg" [0060.453] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\_sTleJ.jpg", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\_sTleJ.jpg.happythreechoose") returned="C:\\Users\\FD1HVy\\Pictures\\_sTleJ.jpg.happythreechoose" [0060.453] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\_sTleJ.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\_stlej.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\_sTleJ.jpg.happythreechoose" (normalized: "c:\\users\\fd1hvy\\pictures\\_stlej.jpg.happythreechoose"), dwFlags=0x1) returned 1 [0060.453] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\_sTleJ.jpg" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0060.453] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0060.453] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" [0060.453] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\pictures\\decryption info.html")) returned 0x20 [0060.453] GetProcessHeap () returned 0x630000 [0060.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0060.454] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x586ca770, ftCreationTime.dwHighDateTime=0x1d5c7ed, ftLastAccessTime.dwLowDateTime=0xb0a13f10, ftLastAccessTime.dwHighDateTime=0x1d5d5fc, ftLastWriteTime.dwLowDateTime=0xb0a13f10, ftLastWriteTime.dwHighDateTime=0x1d5d5fc, nFileSizeHigh=0x0, nFileSizeLow=0xacf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_sTleJ.jpg", cAlternateFileName="")) returned 0 [0060.454] FindClose (in: hFindFile=0x648b10 | out: hFindFile=0x648b10) returned 1 [0060.454] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\" [0060.454] GetProcessHeap () returned 0x630000 [0060.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653930 | out: hHeap=0x630000) returned 1 [0060.454] GetProcessHeap () returned 0x630000 [0060.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.454] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\") returned 40 [0060.454] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*") returned="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*" [0060.454] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648b10 [0060.455] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0060.455] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.456] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0060.456] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0060.456] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0060.456] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0060.456] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0060.456] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini") returned="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini" [0060.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0060.456] GetProcessHeap () returned 0x630000 [0060.456] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0060.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0060.456] lstrlenA (lpString="desktop.ini") returned 11 [0060.456] lstrlenA (lpString=".happythreechoose") returned 17 [0060.456] lstrcmpiW (lpString1="desktop.ini", lpString2="Decryption INFO.html") returned 1 [0060.456] lstrcmpiW (lpString1="desktop.ini", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0060.456] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0060.456] lstrcmpiW (lpString1="desktop.ini", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0060.456] GetProcessHeap () returned 0x630000 [0060.456] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x652000 [0060.456] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\saved pictures\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0060.456] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=190) returned 1 [0060.457] GetProcessHeap () returned 0x630000 [0060.457] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6557d8 [0060.457] GetProcessHeap () returned 0x630000 [0060.457] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0060.457] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini") returned 51 [0060.457] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0060.457] GetProcessHeap () returned 0x630000 [0060.457] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0060.457] GetProcessHeap () returned 0x630000 [0060.457] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x382) returned 0x6545a8 [0060.457] lstrlenA (lpString="rsa_encrypt") returned 11 [0060.457] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0060.457] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0060.457] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0060.457] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0060.457] GetProcessHeap () returned 0x630000 [0060.457] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0060.458] lstrlenA (lpString="010001") returned 6 [0060.458] GetProcessHeap () returned 0x630000 [0060.458] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0060.458] GetProcessHeap () returned 0x630000 [0060.458] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0060.458] GetProcessHeap () returned 0x630000 [0060.458] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea90 [0060.458] GetProcessHeap () returned 0x630000 [0060.458] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0060.458] GetProcessHeap () returned 0x630000 [0060.458] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0060.458] GetProcessHeap () returned 0x630000 [0060.458] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x6570f8 [0060.458] GetProcessHeap () returned 0x630000 [0060.458] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0060.458] GetProcessHeap () returned 0x630000 [0060.458] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0060.458] GetProcessHeap () returned 0x630000 [0060.458] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0060.458] GetProcessHeap () returned 0x630000 [0060.458] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0060.458] GetProcessHeap () returned 0x630000 [0060.458] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0060.458] GetProcessHeap () returned 0x630000 [0060.458] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656950 [0060.458] GetProcessHeap () returned 0x630000 [0060.458] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0060.458] GetProcessHeap () returned 0x630000 [0060.458] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0060.458] GetProcessHeap () returned 0x630000 [0060.458] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e8e0 [0060.458] GetProcessHeap () returned 0x630000 [0060.458] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0060.458] GetProcessHeap () returned 0x630000 [0060.458] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0060.458] GetProcessHeap () returned 0x630000 [0060.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0060.459] GetProcessHeap () returned 0x630000 [0060.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0060.459] GetProcessHeap () returned 0x630000 [0060.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x661710 [0060.459] GetProcessHeap () returned 0x630000 [0060.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0060.459] GetProcessHeap () returned 0x630000 [0060.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0060.459] GetProcessHeap () returned 0x630000 [0060.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0e8 [0060.459] GetProcessHeap () returned 0x630000 [0060.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0e8 | out: hHeap=0x630000) returned 1 [0060.459] GetProcessHeap () returned 0x630000 [0060.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e7c0 [0060.459] GetProcessHeap () returned 0x630000 [0060.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661710 | out: hHeap=0x630000) returned 1 [0060.459] GetProcessHeap () returned 0x630000 [0060.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0060.459] GetProcessHeap () returned 0x630000 [0060.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e7c0 | out: hHeap=0x630000) returned 1 [0060.459] GetProcessHeap () returned 0x630000 [0060.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0060.459] GetProcessHeap () returned 0x630000 [0060.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0060.459] GetProcessHeap () returned 0x630000 [0060.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0060.459] GetProcessHeap () returned 0x630000 [0060.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0060.459] GetProcessHeap () returned 0x630000 [0060.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0060.459] GetProcessHeap () returned 0x630000 [0060.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0060.459] GetProcessHeap () returned 0x630000 [0060.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1c8 [0060.459] GetProcessHeap () returned 0x630000 [0060.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1c8 | out: hHeap=0x630000) returned 1 [0060.460] GetProcessHeap () returned 0x630000 [0060.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0060.460] GetProcessHeap () returned 0x630000 [0060.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0060.460] GetProcessHeap () returned 0x630000 [0060.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0060.460] GetProcessHeap () returned 0x630000 [0060.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0060.460] GetProcessHeap () returned 0x630000 [0060.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a138 [0060.460] GetProcessHeap () returned 0x630000 [0060.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x630000) returned 1 [0060.460] GetProcessHeap () returned 0x630000 [0060.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0060.460] GetProcessHeap () returned 0x630000 [0060.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0060.460] GetProcessHeap () returned 0x630000 [0060.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0a8 [0060.460] GetProcessHeap () returned 0x630000 [0060.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0a8 | out: hHeap=0x630000) returned 1 [0060.460] GetProcessHeap () returned 0x630000 [0060.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a228 [0060.460] GetProcessHeap () returned 0x630000 [0060.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a228 | out: hHeap=0x630000) returned 1 [0060.460] GetProcessHeap () returned 0x630000 [0060.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a208 [0060.460] GetProcessHeap () returned 0x630000 [0060.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a208 | out: hHeap=0x630000) returned 1 [0060.460] GetProcessHeap () returned 0x630000 [0060.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0060.460] GetProcessHeap () returned 0x630000 [0060.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0060.460] GetProcessHeap () returned 0x630000 [0060.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0060.460] GetProcessHeap () returned 0x630000 [0060.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0060.460] GetProcessHeap () returned 0x630000 [0060.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0060.460] GetProcessHeap () returned 0x630000 [0060.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0060.461] GetProcessHeap () returned 0x630000 [0060.461] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a068 [0060.461] GetProcessHeap () returned 0x630000 [0060.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a068 | out: hHeap=0x630000) returned 1 [0060.461] GetProcessHeap () returned 0x630000 [0060.461] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a058 [0060.461] GetProcessHeap () returned 0x630000 [0060.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a058 | out: hHeap=0x630000) returned 1 [0060.461] GetProcessHeap () returned 0x630000 [0060.461] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0060.461] GetProcessHeap () returned 0x630000 [0060.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0060.461] GetProcessHeap () returned 0x630000 [0060.461] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1d8 [0060.461] GetProcessHeap () returned 0x630000 [0060.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1d8 | out: hHeap=0x630000) returned 1 [0060.461] GetProcessHeap () returned 0x630000 [0060.461] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1a8 [0060.461] GetProcessHeap () returned 0x630000 [0060.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1a8 | out: hHeap=0x630000) returned 1 [0060.461] GetProcessHeap () returned 0x630000 [0060.461] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0f8 [0060.461] GetProcessHeap () returned 0x630000 [0060.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0f8 | out: hHeap=0x630000) returned 1 [0060.461] GetProcessHeap () returned 0x630000 [0060.461] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0060.461] GetProcessHeap () returned 0x630000 [0060.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0060.462] GetProcessHeap () returned 0x630000 [0060.462] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0060.462] GetProcessHeap () returned 0x630000 [0060.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0060.462] GetProcessHeap () returned 0x630000 [0060.462] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a188 [0060.462] GetProcessHeap () returned 0x630000 [0060.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a188 | out: hHeap=0x630000) returned 1 [0060.462] GetProcessHeap () returned 0x630000 [0060.462] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a048 [0060.462] GetProcessHeap () returned 0x630000 [0060.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a048 | out: hHeap=0x630000) returned 1 [0060.462] GetProcessHeap () returned 0x630000 [0060.462] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a188 [0060.462] GetProcessHeap () returned 0x630000 [0060.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a188 | out: hHeap=0x630000) returned 1 [0060.462] GetProcessHeap () returned 0x630000 [0060.462] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a108 [0060.462] GetProcessHeap () returned 0x630000 [0060.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a108 | out: hHeap=0x630000) returned 1 [0060.462] GetProcessHeap () returned 0x630000 [0060.462] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0d8 [0060.462] GetProcessHeap () returned 0x630000 [0060.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0d8 | out: hHeap=0x630000) returned 1 [0060.462] GetProcessHeap () returned 0x630000 [0060.462] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0e8 [0060.462] GetProcessHeap () returned 0x630000 [0060.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0e8 | out: hHeap=0x630000) returned 1 [0060.462] GetProcessHeap () returned 0x630000 [0060.462] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0b8 [0060.462] GetProcessHeap () returned 0x630000 [0060.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0b8 | out: hHeap=0x630000) returned 1 [0060.462] GetProcessHeap () returned 0x630000 [0060.462] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a218 [0060.462] GetProcessHeap () returned 0x630000 [0060.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a218 | out: hHeap=0x630000) returned 1 [0060.462] GetProcessHeap () returned 0x630000 [0060.463] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a148 [0060.463] GetProcessHeap () returned 0x630000 [0060.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a148 | out: hHeap=0x630000) returned 1 [0060.463] GetProcessHeap () returned 0x630000 [0060.463] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a158 [0060.463] GetProcessHeap () returned 0x630000 [0060.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a158 | out: hHeap=0x630000) returned 1 [0060.463] GetProcessHeap () returned 0x630000 [0060.463] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a0c8 [0060.463] GetProcessHeap () returned 0x630000 [0060.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a0c8 | out: hHeap=0x630000) returned 1 [0060.463] GetProcessHeap () returned 0x630000 [0060.463] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a188 [0060.463] GetProcessHeap () returned 0x630000 [0060.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a188 | out: hHeap=0x630000) returned 1 [0060.463] GetProcessHeap () returned 0x630000 [0060.463] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1f8 [0060.463] GetProcessHeap () returned 0x630000 [0060.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1f8 | out: hHeap=0x630000) returned 1 [0060.463] GetProcessHeap () returned 0x630000 [0060.463] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a118 [0060.463] GetProcessHeap () returned 0x630000 [0060.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a118 | out: hHeap=0x630000) returned 1 [0060.463] GetProcessHeap () returned 0x630000 [0060.463] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0060.463] GetProcessHeap () returned 0x630000 [0060.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0060.463] GetProcessHeap () returned 0x630000 [0060.463] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a078 [0060.463] GetProcessHeap () returned 0x630000 [0060.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a078 | out: hHeap=0x630000) returned 1 [0060.463] GetProcessHeap () returned 0x630000 [0060.463] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a208 [0060.463] GetProcessHeap () returned 0x630000 [0060.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a208 | out: hHeap=0x630000) returned 1 [0060.463] GetProcessHeap () returned 0x630000 [0060.463] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a1b8 [0060.464] GetProcessHeap () returned 0x630000 [0060.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a1b8 | out: hHeap=0x630000) returned 1 [0060.464] GetProcessHeap () returned 0x630000 [0060.464] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a088 [0060.464] GetProcessHeap () returned 0x630000 [0060.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a088 | out: hHeap=0x630000) returned 1 [0060.464] GetProcessHeap () returned 0x630000 [0060.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0060.464] GetProcessHeap () returned 0x630000 [0060.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0060.464] GetProcessHeap () returned 0x630000 [0060.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0060.464] GetProcessHeap () returned 0x630000 [0060.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0060.464] GetProcessHeap () returned 0x630000 [0060.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0060.464] GetProcessHeap () returned 0x630000 [0060.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0060.464] GetProcessHeap () returned 0x630000 [0060.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0060.464] GetProcessHeap () returned 0x630000 [0060.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea90 | out: hHeap=0x630000) returned 1 [0060.464] GetProcessHeap () returned 0x630000 [0060.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0060.464] GetProcessHeap () returned 0x630000 [0060.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.464] GetProcessHeap () returned 0x630000 [0060.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0060.464] WriteFile (in: hFile=0x230, lpBuffer=0x6545a8*, nNumberOfBytesToWrite=0x382, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6545a8*, lpNumberOfBytesWritten=0x243d864*=0x382, lpOverlapped=0x0) returned 1 [0060.468] GetProcessHeap () returned 0x630000 [0060.468] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6545a8, Size=0x30) returned 0x6545a8 [0060.468] GetProcessHeap () returned 0x630000 [0060.468] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0060.468] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0060.468] GetProcessHeap () returned 0x630000 [0060.468] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc0) returned 0x641530 [0060.468] ReadFile (in: hFile=0x230, lpBuffer=0x641530, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x641530*, lpNumberOfBytesRead=0x243d7e8*=0xc0, lpOverlapped=0x0) returned 1 [0060.469] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0060.469] WriteFile (in: hFile=0x230, lpBuffer=0x641530*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x641530*, lpNumberOfBytesWritten=0x243d7e4*=0xc0, lpOverlapped=0x0) returned 1 [0060.469] GetProcessHeap () returned 0x630000 [0060.469] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x641530 | out: hHeap=0x630000) returned 1 [0060.469] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0060.470] WriteFile (in: hFile=0x230, lpBuffer=0x6545a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6545a8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0060.470] CloseHandle (hObject=0x230) returned 1 [0060.472] GetProcessHeap () returned 0x630000 [0060.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x652000 | out: hHeap=0x630000) returned 1 [0060.472] GetProcessHeap () returned 0x630000 [0060.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6557d8 | out: hHeap=0x630000) returned 1 [0060.472] GetProcessHeap () returned 0x630000 [0060.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0060.472] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini") returned="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini" [0060.472] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini.happythreechoose") returned="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini.happythreechoose" [0060.472] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\saved pictures\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini.happythreechoose" (normalized: "c:\\users\\fd1hvy\\pictures\\saved pictures\\desktop.ini.happythreechoose"), dwFlags=0x1) returned 1 [0060.472] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures") returned 1 [0060.472] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\") returned="" [0060.472] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\Decryption INFO.html" [0060.473] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\pictures\\saved pictures\\decryption info.html")) returned 0xffffffff [0060.473] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\pictures\\saved pictures\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0060.473] GetProcessHeap () returned 0x630000 [0060.473] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655490 [0060.473] GetProcessHeap () returned 0x630000 [0060.473] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0060.480] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.481] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.481] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.481] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.481] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.481] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.481] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.481] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.481] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.481] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.481] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.482] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.482] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.482] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.482] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.482] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.482] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.482] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.482] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.482] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.482] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.482] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.482] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.483] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.483] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.483] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.483] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.483] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.483] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.483] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.483] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.483] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.483] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.483] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.483] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.483] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.484] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.485] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.485] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.485] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.485] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.486] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.486] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.486] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.486] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.486] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.486] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.486] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.486] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.486] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.486] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.486] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.486] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.486] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.486] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.487] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.487] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.487] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.487] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.487] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.487] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.487] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.487] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.487] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.487] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.487] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.487] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.487] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.488] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.488] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.488] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.488] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.488] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.488] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.488] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.488] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.488] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.488] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.488] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.488] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.488] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.488] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.489] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.489] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.489] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.489] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.489] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.489] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.489] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.489] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.489] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.489] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.489] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.489] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.489] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.489] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.490] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.490] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.490] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.490] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.490] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.490] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.490] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.490] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.490] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.490] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.490] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.490] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.490] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.490] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.491] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.491] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.491] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.491] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.491] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.491] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.491] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.491] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.491] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.491] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.491] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.491] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.491] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.491] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.492] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.492] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.492] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.492] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.492] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.492] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.493] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.493] GetProcessHeap () returned 0x630000 [0060.493] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655490 | out: hHeap=0x630000) returned 1 [0060.493] GetProcessHeap () returned 0x630000 [0060.493] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0060.493] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0060.493] GetProcessHeap () returned 0x630000 [0060.493] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655580 [0060.493] GetProcessHeap () returned 0x630000 [0060.493] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0060.500] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.500] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.500] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.500] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.500] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.500] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.500] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.500] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.500] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.500] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.500] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.501] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.501] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.501] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.501] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.501] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.501] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.501] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.501] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.501] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.501] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.501] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.501] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.501] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.501] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.502] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.502] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.502] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.502] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.502] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.502] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.502] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.502] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.502] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.502] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.502] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.502] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.502] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.503] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.503] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.503] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.503] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.503] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.503] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.503] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.503] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.503] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.503] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.503] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.503] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.503] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.503] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.504] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.504] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.504] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.504] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.504] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.504] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.504] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.504] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.504] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.504] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.504] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.504] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.504] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.504] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.505] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.505] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.505] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.505] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.505] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.505] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.505] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.505] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.505] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.505] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.505] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.505] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.505] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.506] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.506] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.506] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.506] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.506] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.506] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.506] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.506] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.506] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.506] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.506] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.506] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.506] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.507] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.507] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.507] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.507] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.507] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.507] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.507] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.507] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.507] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.507] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.507] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.507] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.507] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.528] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.528] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.528] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.528] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.528] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.528] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.528] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.529] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.529] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.529] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.529] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.529] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.529] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.530] GetProcessHeap () returned 0x630000 [0060.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655580 | out: hHeap=0x630000) returned 1 [0060.530] GetProcessHeap () returned 0x630000 [0060.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0060.530] CloseHandle (hObject=0x230) returned 1 [0060.530] GetProcessHeap () returned 0x630000 [0060.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0060.530] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0060.530] FindClose (in: hFindFile=0x648b10 | out: hFindFile=0x648b10) returned 1 [0060.530] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\") returned="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\" [0060.530] GetProcessHeap () returned 0x630000 [0060.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65f068 | out: hHeap=0x630000) returned 1 [0060.530] GetProcessHeap () returned 0x630000 [0060.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0060.531] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\") returned 37 [0060.531] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\*") returned="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\*" [0060.531] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648b10 [0060.532] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0060.532] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.532] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0060.532] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0060.532] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0060.532] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0060.532] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0060.532] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini") returned="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini" [0060.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0060.532] GetProcessHeap () returned 0x630000 [0060.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0060.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0060.532] lstrlenA (lpString="desktop.ini") returned 11 [0060.532] lstrlenA (lpString=".happythreechoose") returned 17 [0060.532] lstrcmpiW (lpString1="desktop.ini", lpString2="Decryption INFO.html") returned 1 [0060.532] lstrcmpiW (lpString1="desktop.ini", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0060.532] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0060.532] lstrcmpiW (lpString1="desktop.ini", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0060.532] GetProcessHeap () returned 0x630000 [0060.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x652000 [0060.532] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\camera roll\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0060.533] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=190) returned 1 [0060.533] GetProcessHeap () returned 0x630000 [0060.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655418 [0060.533] GetProcessHeap () returned 0x630000 [0060.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0060.533] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini") returned 48 [0060.533] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0060.533] GetProcessHeap () returned 0x630000 [0060.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0060.533] GetProcessHeap () returned 0x630000 [0060.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x382) returned 0x6545e0 [0060.533] lstrlenA (lpString="rsa_encrypt") returned 11 [0060.533] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0060.533] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0060.534] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0060.534] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0060.534] GetProcessHeap () returned 0x630000 [0060.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0060.534] lstrlenA (lpString="010001") returned 6 [0060.534] GetProcessHeap () returned 0x630000 [0060.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0060.534] GetProcessHeap () returned 0x630000 [0060.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0060.534] GetProcessHeap () returned 0x630000 [0060.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0060.534] GetProcessHeap () returned 0x630000 [0060.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0060.534] GetProcessHeap () returned 0x630000 [0060.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e100 [0060.534] GetProcessHeap () returned 0x630000 [0060.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656fe0 [0060.534] GetProcessHeap () returned 0x630000 [0060.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0060.534] GetProcessHeap () returned 0x630000 [0060.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0060.534] GetProcessHeap () returned 0x630000 [0060.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.534] GetProcessHeap () returned 0x630000 [0060.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0060.534] GetProcessHeap () returned 0x630000 [0060.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0060.534] GetProcessHeap () returned 0x630000 [0060.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657440 [0060.534] GetProcessHeap () returned 0x630000 [0060.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.534] GetProcessHeap () returned 0x630000 [0060.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0060.534] GetProcessHeap () returned 0x630000 [0060.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0060.535] GetProcessHeap () returned 0x630000 [0060.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0060.535] GetProcessHeap () returned 0x630000 [0060.535] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0060.535] GetProcessHeap () returned 0x630000 [0060.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0060.535] GetProcessHeap () returned 0x630000 [0060.535] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0060.535] GetProcessHeap () returned 0x630000 [0060.535] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x661950 [0060.535] GetProcessHeap () returned 0x630000 [0060.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.535] GetProcessHeap () returned 0x630000 [0060.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0060.535] GetProcessHeap () returned 0x630000 [0060.535] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.535] GetProcessHeap () returned 0x630000 [0060.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.535] GetProcessHeap () returned 0x630000 [0060.535] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e2b0 [0060.535] GetProcessHeap () returned 0x630000 [0060.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661950 | out: hHeap=0x630000) returned 1 [0060.535] GetProcessHeap () returned 0x630000 [0060.535] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0060.535] GetProcessHeap () returned 0x630000 [0060.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e2b0 | out: hHeap=0x630000) returned 1 [0060.535] GetProcessHeap () returned 0x630000 [0060.535] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.535] GetProcessHeap () returned 0x630000 [0060.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.535] GetProcessHeap () returned 0x630000 [0060.535] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.535] GetProcessHeap () returned 0x630000 [0060.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.535] GetProcessHeap () returned 0x630000 [0060.535] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.535] GetProcessHeap () returned 0x630000 [0060.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.535] GetProcessHeap () returned 0x630000 [0060.536] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.536] GetProcessHeap () returned 0x630000 [0060.536] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.536] GetProcessHeap () returned 0x630000 [0060.536] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.536] GetProcessHeap () returned 0x630000 [0060.536] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.536] GetProcessHeap () returned 0x630000 [0060.536] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.536] GetProcessHeap () returned 0x630000 [0060.536] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.536] GetProcessHeap () returned 0x630000 [0060.536] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.536] GetProcessHeap () returned 0x630000 [0060.536] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.536] GetProcessHeap () returned 0x630000 [0060.536] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.536] GetProcessHeap () returned 0x630000 [0060.536] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.536] GetProcessHeap () returned 0x630000 [0060.536] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.536] GetProcessHeap () returned 0x630000 [0060.536] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.536] GetProcessHeap () returned 0x630000 [0060.536] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0060.536] GetProcessHeap () returned 0x630000 [0060.536] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0060.536] GetProcessHeap () returned 0x630000 [0060.536] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.536] GetProcessHeap () returned 0x630000 [0060.536] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.536] GetProcessHeap () returned 0x630000 [0060.536] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0060.536] GetProcessHeap () returned 0x630000 [0060.536] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0060.536] GetProcessHeap () returned 0x630000 [0060.537] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.537] GetProcessHeap () returned 0x630000 [0060.537] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.537] GetProcessHeap () returned 0x630000 [0060.537] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.537] GetProcessHeap () returned 0x630000 [0060.537] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.537] GetProcessHeap () returned 0x630000 [0060.537] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.537] GetProcessHeap () returned 0x630000 [0060.537] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.537] GetProcessHeap () returned 0x630000 [0060.537] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.537] GetProcessHeap () returned 0x630000 [0060.537] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.537] GetProcessHeap () returned 0x630000 [0060.537] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.537] GetProcessHeap () returned 0x630000 [0060.537] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.537] GetProcessHeap () returned 0x630000 [0060.537] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.537] GetProcessHeap () returned 0x630000 [0060.537] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.537] GetProcessHeap () returned 0x630000 [0060.537] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.537] GetProcessHeap () returned 0x630000 [0060.537] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.537] GetProcessHeap () returned 0x630000 [0060.537] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.537] GetProcessHeap () returned 0x630000 [0060.537] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.537] GetProcessHeap () returned 0x630000 [0060.537] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.537] GetProcessHeap () returned 0x630000 [0060.537] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.537] GetProcessHeap () returned 0x630000 [0060.538] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.538] GetProcessHeap () returned 0x630000 [0060.538] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.538] GetProcessHeap () returned 0x630000 [0060.538] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.538] GetProcessHeap () returned 0x630000 [0060.538] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.538] GetProcessHeap () returned 0x630000 [0060.538] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.538] GetProcessHeap () returned 0x630000 [0060.538] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.538] GetProcessHeap () returned 0x630000 [0060.538] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.538] GetProcessHeap () returned 0x630000 [0060.538] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.538] GetProcessHeap () returned 0x630000 [0060.538] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.538] GetProcessHeap () returned 0x630000 [0060.538] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.538] GetProcessHeap () returned 0x630000 [0060.538] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.538] GetProcessHeap () returned 0x630000 [0060.538] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.538] GetProcessHeap () returned 0x630000 [0060.538] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.538] GetProcessHeap () returned 0x630000 [0060.538] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.538] GetProcessHeap () returned 0x630000 [0060.538] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.538] GetProcessHeap () returned 0x630000 [0060.538] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.538] GetProcessHeap () returned 0x630000 [0060.538] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.538] GetProcessHeap () returned 0x630000 [0060.538] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.538] GetProcessHeap () returned 0x630000 [0060.538] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.539] GetProcessHeap () returned 0x630000 [0060.539] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.539] GetProcessHeap () returned 0x630000 [0060.539] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.539] GetProcessHeap () returned 0x630000 [0060.539] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.539] GetProcessHeap () returned 0x630000 [0060.539] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.539] GetProcessHeap () returned 0x630000 [0060.539] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.539] GetProcessHeap () returned 0x630000 [0060.539] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.539] GetProcessHeap () returned 0x630000 [0060.539] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.539] GetProcessHeap () returned 0x630000 [0060.539] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0060.539] GetProcessHeap () returned 0x630000 [0060.539] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0060.539] GetProcessHeap () returned 0x630000 [0060.539] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.539] GetProcessHeap () returned 0x630000 [0060.539] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.539] GetProcessHeap () returned 0x630000 [0060.539] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.539] GetProcessHeap () returned 0x630000 [0060.539] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.539] GetProcessHeap () returned 0x630000 [0060.539] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.539] GetProcessHeap () returned 0x630000 [0060.539] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.539] GetProcessHeap () returned 0x630000 [0060.540] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.540] GetProcessHeap () returned 0x630000 [0060.540] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.540] GetProcessHeap () returned 0x630000 [0060.540] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.540] GetProcessHeap () returned 0x630000 [0060.540] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.540] GetProcessHeap () returned 0x630000 [0060.540] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.540] GetProcessHeap () returned 0x630000 [0060.540] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.540] GetProcessHeap () returned 0x630000 [0060.540] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0060.540] GetProcessHeap () returned 0x630000 [0060.540] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0060.540] GetProcessHeap () returned 0x630000 [0060.540] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0060.540] GetProcessHeap () returned 0x630000 [0060.540] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0060.540] GetProcessHeap () returned 0x630000 [0060.540] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0060.540] GetProcessHeap () returned 0x630000 [0060.540] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0060.540] GetProcessHeap () returned 0x630000 [0060.540] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0060.540] GetProcessHeap () returned 0x630000 [0060.540] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0060.540] GetProcessHeap () returned 0x630000 [0060.540] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0060.540] GetProcessHeap () returned 0x630000 [0060.540] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0060.540] GetProcessHeap () returned 0x630000 [0060.540] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0060.540] WriteFile (in: hFile=0x230, lpBuffer=0x6545e0*, nNumberOfBytesToWrite=0x382, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6545e0*, lpNumberOfBytesWritten=0x243d864*=0x382, lpOverlapped=0x0) returned 1 [0060.559] GetProcessHeap () returned 0x630000 [0060.559] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6545e0, Size=0x30) returned 0x6545e0 [0060.559] GetProcessHeap () returned 0x630000 [0060.559] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0060.559] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0060.559] GetProcessHeap () returned 0x630000 [0060.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc0) returned 0x641530 [0060.559] ReadFile (in: hFile=0x230, lpBuffer=0x641530, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x641530*, lpNumberOfBytesRead=0x243d7e8*=0xc0, lpOverlapped=0x0) returned 1 [0060.559] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0060.559] WriteFile (in: hFile=0x230, lpBuffer=0x641530*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x641530*, lpNumberOfBytesWritten=0x243d7e4*=0xc0, lpOverlapped=0x0) returned 1 [0060.561] GetProcessHeap () returned 0x630000 [0060.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x641530 | out: hHeap=0x630000) returned 1 [0060.561] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0060.561] WriteFile (in: hFile=0x230, lpBuffer=0x6545e0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6545e0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0060.562] CloseHandle (hObject=0x230) returned 1 [0060.564] GetProcessHeap () returned 0x630000 [0060.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x652000 | out: hHeap=0x630000) returned 1 [0060.564] GetProcessHeap () returned 0x630000 [0060.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655418 | out: hHeap=0x630000) returned 1 [0060.564] GetProcessHeap () returned 0x630000 [0060.564] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0060.564] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini") returned="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini" [0060.564] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini.happythreechoose") returned="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini.happythreechoose" [0060.564] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\pictures\\camera roll\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini.happythreechoose" (normalized: "c:\\users\\fd1hvy\\pictures\\camera roll\\desktop.ini.happythreechoose"), dwFlags=0x1) returned 1 [0060.565] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\Camera Roll") returned 1 [0060.565] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\Camera Roll" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\") returned="" [0060.565] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\Decryption INFO.html" [0060.565] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\pictures\\camera roll\\decryption info.html")) returned 0xffffffff [0060.565] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\pictures\\camera roll\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0060.565] GetProcessHeap () returned 0x630000 [0060.565] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6559b8 [0060.565] GetProcessHeap () returned 0x630000 [0060.565] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0060.572] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.573] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.573] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.573] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.573] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.573] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.573] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.573] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.573] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.573] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.574] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.574] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.574] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.574] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.574] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.574] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.574] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.574] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.574] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.574] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.574] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.574] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.575] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.575] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.575] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.575] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.575] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.575] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.575] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.575] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.575] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.575] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.575] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.575] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.575] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.576] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.576] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.576] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.576] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.577] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.577] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.577] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.577] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.577] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.577] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.577] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.577] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.577] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.577] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.577] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.577] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.577] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.577] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.578] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.578] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.578] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.578] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.578] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.578] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.578] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.578] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.578] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.578] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.578] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.578] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.578] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.578] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.579] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.579] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.579] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.579] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.579] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.579] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.579] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.579] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.579] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.579] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.579] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.579] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.579] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.579] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.580] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.580] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.580] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.580] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.580] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.580] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.580] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.580] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.580] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.580] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.580] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.580] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.580] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.581] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.581] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.581] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.581] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.581] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.581] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.581] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.581] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.581] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.581] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.581] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.581] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.581] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.581] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.582] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.582] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.582] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.582] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.582] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.582] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.582] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.582] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.582] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.582] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.582] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.582] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.582] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.582] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.583] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.583] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.583] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.583] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.583] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.583] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.583] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.583] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.583] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.583] GetProcessHeap () returned 0x630000 [0060.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6559b8 | out: hHeap=0x630000) returned 1 [0060.583] GetProcessHeap () returned 0x630000 [0060.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0060.583] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0060.583] GetProcessHeap () returned 0x630000 [0060.583] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655aa8 [0060.583] GetProcessHeap () returned 0x630000 [0060.583] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0060.593] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.593] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.593] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.593] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.593] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.594] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.594] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.594] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.594] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.594] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.594] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.594] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.594] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.594] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.594] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.594] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.594] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.594] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.595] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.595] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.595] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.595] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.595] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.595] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.595] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.595] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.595] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.595] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.595] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.595] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.595] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.595] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.596] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.596] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.596] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.596] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.596] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.596] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.596] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.596] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.596] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.596] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.596] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.596] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.596] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.597] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.597] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.597] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.597] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.597] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.597] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.597] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.597] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.597] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.597] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.597] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.597] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.597] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.597] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.598] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.598] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.598] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.598] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.598] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.598] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.598] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.598] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.598] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.598] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.598] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.598] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.598] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.599] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.599] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.599] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.599] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.599] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.599] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.599] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.599] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.599] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.599] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.599] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.599] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.599] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.600] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.600] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.600] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.600] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.600] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.600] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.600] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.600] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.600] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.600] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.600] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.600] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.600] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.600] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.601] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.601] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.601] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.601] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.601] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.601] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.601] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.601] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.601] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.601] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.621] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.621] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.621] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.621] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.622] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.622] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.622] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.622] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.622] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.623] GetProcessHeap () returned 0x630000 [0060.623] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655aa8 | out: hHeap=0x630000) returned 1 [0060.623] GetProcessHeap () returned 0x630000 [0060.623] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0060.623] CloseHandle (hObject=0x230) returned 1 [0060.623] GetProcessHeap () returned 0x630000 [0060.623] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0060.623] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0060.623] FindClose (in: hFindFile=0x648b10 | out: hFindFile=0x648b10) returned 1 [0060.623] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\OneDrive\\" | out: lpString1="C:\\Users\\FD1HVy\\OneDrive\\") returned="C:\\Users\\FD1HVy\\OneDrive\\" [0060.623] GetProcessHeap () returned 0x630000 [0060.623] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x648ad0 | out: hHeap=0x630000) returned 1 [0060.623] GetProcessHeap () returned 0x630000 [0060.623] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0060.623] lstrlenW (lpString="C:\\Users\\FD1HVy\\OneDrive\\") returned 25 [0060.624] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\OneDrive\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\OneDrive\\*") returned="C:\\Users\\FD1HVy\\OneDrive\\*" [0060.624] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\OneDrive\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648ad0 [0060.627] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0060.627] FindNextFileW (in: hFindFile=0x648ad0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.627] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0060.627] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0060.628] FindNextFileW (in: hFindFile=0x648ad0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3f0f0bc5, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x93ef127a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0060.628] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0060.628] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0060.628] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\OneDrive\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini") returned="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini" [0060.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0060.628] GetProcessHeap () returned 0x630000 [0060.628] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0060.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0060.628] lstrlenA (lpString="desktop.ini") returned 11 [0060.628] lstrlenA (lpString=".happythreechoose") returned 17 [0060.628] lstrcmpiW (lpString1="desktop.ini", lpString2="Decryption INFO.html") returned 1 [0060.628] lstrcmpiW (lpString1="desktop.ini", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0060.628] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0060.628] lstrcmpiW (lpString1="desktop.ini", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0060.628] GetProcessHeap () returned 0x630000 [0060.628] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0060.628] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\onedrive\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0060.628] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=97) returned 1 [0060.628] GetProcessHeap () returned 0x630000 [0060.628] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6556e8 [0060.628] GetProcessHeap () returned 0x630000 [0060.628] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0060.628] lstrlenW (lpString="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini") returned 36 [0060.628] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0060.628] GetProcessHeap () returned 0x630000 [0060.628] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0060.629] GetProcessHeap () returned 0x630000 [0060.629] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38f) returned 0x654618 [0060.629] lstrlenA (lpString="rsa_encrypt") returned 11 [0060.629] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0060.629] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0060.629] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0060.629] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0060.629] GetProcessHeap () returned 0x630000 [0060.629] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0060.629] lstrlenA (lpString="010001") returned 6 [0060.629] GetProcessHeap () returned 0x630000 [0060.629] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0060.629] GetProcessHeap () returned 0x630000 [0060.629] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0060.630] GetProcessHeap () returned 0x630000 [0060.630] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0060.630] GetProcessHeap () returned 0x630000 [0060.630] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0060.630] GetProcessHeap () returned 0x630000 [0060.630] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e730 [0060.630] GetProcessHeap () returned 0x630000 [0060.630] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657558 [0060.630] GetProcessHeap () returned 0x630000 [0060.630] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0060.630] GetProcessHeap () returned 0x630000 [0060.630] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0060.630] GetProcessHeap () returned 0x630000 [0060.630] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0060.630] GetProcessHeap () returned 0x630000 [0060.630] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0060.630] GetProcessHeap () returned 0x630000 [0060.630] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0060.630] GetProcessHeap () returned 0x630000 [0060.630] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657210 [0060.630] GetProcessHeap () returned 0x630000 [0060.630] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0060.630] GetProcessHeap () returned 0x630000 [0060.630] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0060.630] GetProcessHeap () returned 0x630000 [0060.630] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea00 [0060.630] GetProcessHeap () returned 0x630000 [0060.630] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0060.630] GetProcessHeap () returned 0x630000 [0060.630] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0060.630] GetProcessHeap () returned 0x630000 [0060.630] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0060.630] GetProcessHeap () returned 0x630000 [0060.630] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0060.630] GetProcessHeap () returned 0x630000 [0060.630] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x6615a8 [0060.630] GetProcessHeap () returned 0x630000 [0060.630] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0060.631] GetProcessHeap () returned 0x630000 [0060.631] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0060.631] GetProcessHeap () returned 0x630000 [0060.631] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0060.631] GetProcessHeap () returned 0x630000 [0060.631] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0060.631] GetProcessHeap () returned 0x630000 [0060.631] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e460 [0060.631] GetProcessHeap () returned 0x630000 [0060.631] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6615a8 | out: hHeap=0x630000) returned 1 [0060.631] GetProcessHeap () returned 0x630000 [0060.631] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0060.631] GetProcessHeap () returned 0x630000 [0060.631] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e460 | out: hHeap=0x630000) returned 1 [0060.631] GetProcessHeap () returned 0x630000 [0060.631] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0060.631] GetProcessHeap () returned 0x630000 [0060.631] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0060.631] GetProcessHeap () returned 0x630000 [0060.631] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0060.631] GetProcessHeap () returned 0x630000 [0060.631] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0060.631] GetProcessHeap () returned 0x630000 [0060.631] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0060.631] GetProcessHeap () returned 0x630000 [0060.631] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0060.631] GetProcessHeap () returned 0x630000 [0060.631] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0060.631] GetProcessHeap () returned 0x630000 [0060.631] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0060.631] GetProcessHeap () returned 0x630000 [0060.631] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0060.631] GetProcessHeap () returned 0x630000 [0060.631] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0060.631] GetProcessHeap () returned 0x630000 [0060.631] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0060.631] GetProcessHeap () returned 0x630000 [0060.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0060.632] GetProcessHeap () returned 0x630000 [0060.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0060.632] GetProcessHeap () returned 0x630000 [0060.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0060.632] GetProcessHeap () returned 0x630000 [0060.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0060.632] GetProcessHeap () returned 0x630000 [0060.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0060.632] GetProcessHeap () returned 0x630000 [0060.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0060.632] GetProcessHeap () returned 0x630000 [0060.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0060.632] GetProcessHeap () returned 0x630000 [0060.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0060.632] GetProcessHeap () returned 0x630000 [0060.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0060.632] GetProcessHeap () returned 0x630000 [0060.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0060.632] GetProcessHeap () returned 0x630000 [0060.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0060.632] GetProcessHeap () returned 0x630000 [0060.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0060.632] GetProcessHeap () returned 0x630000 [0060.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0060.632] GetProcessHeap () returned 0x630000 [0060.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0060.632] GetProcessHeap () returned 0x630000 [0060.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0060.632] GetProcessHeap () returned 0x630000 [0060.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0060.632] GetProcessHeap () returned 0x630000 [0060.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0060.632] GetProcessHeap () returned 0x630000 [0060.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0060.633] GetProcessHeap () returned 0x630000 [0060.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0060.633] GetProcessHeap () returned 0x630000 [0060.633] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0060.633] GetProcessHeap () returned 0x630000 [0060.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0060.633] GetProcessHeap () returned 0x630000 [0060.633] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0060.633] GetProcessHeap () returned 0x630000 [0060.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0060.633] GetProcessHeap () returned 0x630000 [0060.633] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0060.633] GetProcessHeap () returned 0x630000 [0060.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0060.633] GetProcessHeap () returned 0x630000 [0060.633] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0060.634] GetProcessHeap () returned 0x630000 [0060.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0060.634] GetProcessHeap () returned 0x630000 [0060.634] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0060.634] GetProcessHeap () returned 0x630000 [0060.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0060.634] GetProcessHeap () returned 0x630000 [0060.634] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0060.634] GetProcessHeap () returned 0x630000 [0060.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0060.634] GetProcessHeap () returned 0x630000 [0060.634] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0060.634] GetProcessHeap () returned 0x630000 [0060.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0060.634] GetProcessHeap () returned 0x630000 [0060.634] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0060.634] GetProcessHeap () returned 0x630000 [0060.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0060.634] GetProcessHeap () returned 0x630000 [0060.634] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0060.634] GetProcessHeap () returned 0x630000 [0060.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0060.634] GetProcessHeap () returned 0x630000 [0060.634] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0060.634] GetProcessHeap () returned 0x630000 [0060.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0060.634] GetProcessHeap () returned 0x630000 [0060.634] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0060.634] GetProcessHeap () returned 0x630000 [0060.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0060.634] GetProcessHeap () returned 0x630000 [0060.634] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0060.634] GetProcessHeap () returned 0x630000 [0060.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0060.635] GetProcessHeap () returned 0x630000 [0060.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0060.635] GetProcessHeap () returned 0x630000 [0060.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0060.635] GetProcessHeap () returned 0x630000 [0060.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0060.635] GetProcessHeap () returned 0x630000 [0060.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0060.635] GetProcessHeap () returned 0x630000 [0060.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0060.635] GetProcessHeap () returned 0x630000 [0060.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0060.635] GetProcessHeap () returned 0x630000 [0060.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0060.635] GetProcessHeap () returned 0x630000 [0060.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0060.635] GetProcessHeap () returned 0x630000 [0060.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0060.635] GetProcessHeap () returned 0x630000 [0060.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0060.635] GetProcessHeap () returned 0x630000 [0060.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0060.635] GetProcessHeap () returned 0x630000 [0060.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0060.635] GetProcessHeap () returned 0x630000 [0060.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0060.635] GetProcessHeap () returned 0x630000 [0060.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0060.635] GetProcessHeap () returned 0x630000 [0060.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0060.635] GetProcessHeap () returned 0x630000 [0060.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0060.635] GetProcessHeap () returned 0x630000 [0060.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0060.635] GetProcessHeap () returned 0x630000 [0060.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0060.635] GetProcessHeap () returned 0x630000 [0060.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0060.636] GetProcessHeap () returned 0x630000 [0060.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0060.636] GetProcessHeap () returned 0x630000 [0060.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0060.636] GetProcessHeap () returned 0x630000 [0060.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0060.636] GetProcessHeap () returned 0x630000 [0060.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0060.636] GetProcessHeap () returned 0x630000 [0060.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0060.636] GetProcessHeap () returned 0x630000 [0060.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0060.636] GetProcessHeap () returned 0x630000 [0060.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0060.636] GetProcessHeap () returned 0x630000 [0060.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0060.636] GetProcessHeap () returned 0x630000 [0060.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0060.636] GetProcessHeap () returned 0x630000 [0060.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0060.636] GetProcessHeap () returned 0x630000 [0060.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0060.636] GetProcessHeap () returned 0x630000 [0060.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0060.636] GetProcessHeap () returned 0x630000 [0060.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0060.636] GetProcessHeap () returned 0x630000 [0060.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0060.636] GetProcessHeap () returned 0x630000 [0060.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0060.636] GetProcessHeap () returned 0x630000 [0060.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0060.636] GetProcessHeap () returned 0x630000 [0060.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0060.636] GetProcessHeap () returned 0x630000 [0060.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0060.637] GetProcessHeap () returned 0x630000 [0060.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.637] GetProcessHeap () returned 0x630000 [0060.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0060.637] WriteFile (in: hFile=0x230, lpBuffer=0x654618*, nNumberOfBytesToWrite=0x38f, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654618*, lpNumberOfBytesWritten=0x243d864*=0x38f, lpOverlapped=0x0) returned 1 [0060.640] GetProcessHeap () returned 0x630000 [0060.640] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x654618, Size=0x30) returned 0x654618 [0060.640] GetProcessHeap () returned 0x630000 [0060.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0060.640] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0060.640] GetProcessHeap () returned 0x630000 [0060.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x70) returned 0x655670 [0060.640] ReadFile (in: hFile=0x230, lpBuffer=0x655670, nNumberOfBytesToRead=0x70, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x655670*, lpNumberOfBytesRead=0x243d7e8*=0x70, lpOverlapped=0x0) returned 1 [0060.641] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0060.641] WriteFile (in: hFile=0x230, lpBuffer=0x655670*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x655670*, lpNumberOfBytesWritten=0x243d7e4*=0x70, lpOverlapped=0x0) returned 1 [0060.642] GetProcessHeap () returned 0x630000 [0060.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655670 | out: hHeap=0x630000) returned 1 [0060.642] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0060.642] WriteFile (in: hFile=0x230, lpBuffer=0x654618*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654618*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0060.643] CloseHandle (hObject=0x230) returned 1 [0060.645] GetProcessHeap () returned 0x630000 [0060.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0060.645] GetProcessHeap () returned 0x630000 [0060.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6556e8 | out: hHeap=0x630000) returned 1 [0060.645] GetProcessHeap () returned 0x630000 [0060.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0060.645] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini") returned="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini" [0060.645] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini.happythreechoose") returned="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini.happythreechoose" [0060.645] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\onedrive\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini.happythreechoose" (normalized: "c:\\users\\fd1hvy\\onedrive\\desktop.ini.happythreechoose"), dwFlags=0x1) returned 1 [0060.646] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\OneDrive\\desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\OneDrive") returned 1 [0060.646] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\OneDrive" | out: pszPath="C:\\Users\\FD1HVy\\OneDrive\\") returned="" [0060.646] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\OneDrive\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\OneDrive\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\OneDrive\\Decryption INFO.html" [0060.646] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\OneDrive\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\onedrive\\decryption info.html")) returned 0xffffffff [0060.646] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\OneDrive\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\onedrive\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0060.646] GetProcessHeap () returned 0x630000 [0060.646] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655580 [0060.646] GetProcessHeap () returned 0x630000 [0060.646] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0060.654] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.656] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.657] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.657] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.657] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.657] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.657] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.657] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.657] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.657] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.657] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.657] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.657] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.657] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.657] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.658] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.658] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.658] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.658] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.658] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.658] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.658] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.658] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.658] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.658] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.658] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.658] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.659] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.659] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.659] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.659] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.659] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.659] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.659] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.659] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.659] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.659] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.662] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.662] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.662] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.662] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.662] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.662] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.662] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.662] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.663] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.663] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.663] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.663] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.663] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.663] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.663] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.663] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.663] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.663] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.663] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.663] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.663] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.663] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.664] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.664] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.664] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.664] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.664] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.664] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.664] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.664] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.665] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.665] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.665] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.665] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.665] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.665] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.665] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.665] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.665] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.665] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.665] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.665] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.665] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.665] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.666] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.666] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.666] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.666] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.666] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.666] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.666] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.666] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.666] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.666] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.666] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.666] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.666] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.666] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.667] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.667] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.667] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.667] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.667] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.667] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.667] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.667] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.667] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.667] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.667] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.667] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.667] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.667] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.668] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.668] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.668] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.668] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.668] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.668] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.668] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.668] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.668] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.668] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.668] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.668] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.668] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.668] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.668] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.669] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.669] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.669] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.669] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.669] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.669] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.669] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.669] GetProcessHeap () returned 0x630000 [0060.669] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655580 | out: hHeap=0x630000) returned 1 [0060.669] GetProcessHeap () returned 0x630000 [0060.669] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0060.669] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0060.669] GetProcessHeap () returned 0x630000 [0060.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655760 [0060.669] GetProcessHeap () returned 0x630000 [0060.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0060.676] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.676] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.676] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.676] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.677] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.677] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.677] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.677] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.677] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.677] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.677] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.677] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.677] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.677] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.677] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.677] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.677] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.677] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.678] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.678] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.678] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.678] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.678] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.678] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.678] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.678] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.678] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.678] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.678] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.678] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.678] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.678] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.679] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.679] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.679] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.679] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.679] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.679] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.679] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.679] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.679] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.679] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.679] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.679] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.707] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.707] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.708] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.708] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.708] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.708] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.708] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.708] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.708] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.708] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.708] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.708] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.708] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.708] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.708] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.708] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.709] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.709] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.709] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.709] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.709] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.709] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.709] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.709] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.709] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.709] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.709] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.709] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.709] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.709] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.710] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.710] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.710] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.710] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.710] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.710] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.710] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.710] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.710] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.710] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.710] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.710] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.711] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.711] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.711] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.711] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.711] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.711] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.711] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.712] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.712] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.712] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.712] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.712] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.712] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.712] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.712] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.712] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.712] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.712] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.712] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.712] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.712] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.713] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.713] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.713] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.713] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.713] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.713] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.713] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.713] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.713] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.713] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.713] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.714] GetProcessHeap () returned 0x630000 [0060.714] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655760 | out: hHeap=0x630000) returned 1 [0060.714] GetProcessHeap () returned 0x630000 [0060.714] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0060.714] CloseHandle (hObject=0x230) returned 1 [0060.720] GetProcessHeap () returned 0x630000 [0060.720] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0060.720] FindNextFileW (in: hFindFile=0x648ad0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3f0f0bc5, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x93ef127a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0060.720] FindClose (in: hFindFile=0x648ad0 | out: hFindFile=0x648ad0) returned 1 [0060.721] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\NetHood\\" | out: lpString1="C:\\Users\\FD1HVy\\NetHood\\") returned="C:\\Users\\FD1HVy\\NetHood\\" [0060.721] GetProcessHeap () returned 0x630000 [0060.721] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x648890 | out: hHeap=0x630000) returned 1 [0060.721] GetProcessHeap () returned 0x630000 [0060.721] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0060.721] lstrlenW (lpString="C:\\Users\\FD1HVy\\NetHood\\") returned 24 [0060.721] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\NetHood\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\NetHood\\*") returned="C:\\Users\\FD1HVy\\NetHood\\*" [0060.721] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\NetHood\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3f0f0bc5, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x93ef127a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0xffffffff [0060.721] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\My Documents\\" | out: lpString1="C:\\Users\\FD1HVy\\My Documents\\") returned="C:\\Users\\FD1HVy\\My Documents\\" [0060.721] GetProcessHeap () returned 0x630000 [0060.721] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x642238 | out: hHeap=0x630000) returned 1 [0060.721] GetProcessHeap () returned 0x630000 [0060.721] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0060.721] lstrlenW (lpString="C:\\Users\\FD1HVy\\My Documents\\") returned 29 [0060.721] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\My Documents\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\My Documents\\*") returned="C:\\Users\\FD1HVy\\My Documents\\*" [0060.721] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\My Documents\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x3f0f0bc5, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x93ef127a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0xffffffff [0060.721] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\Music\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0060.722] GetProcessHeap () returned 0x630000 [0060.722] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6522b0 | out: hHeap=0x630000) returned 1 [0060.722] GetProcessHeap () returned 0x630000 [0060.722] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0060.722] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\") returned 22 [0060.722] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Music\\*") returned="C:\\Users\\FD1HVy\\Music\\*" [0060.722] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3a784dd5, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3a784dd5, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648890 [0060.722] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0060.722] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3a784dd5, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3a784dd5, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.722] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0060.722] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0060.722] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52566f60, ftCreationTime.dwHighDateTime=0x1d5d6a2, ftLastAccessTime.dwLowDateTime=0xdf9a420, ftLastAccessTime.dwHighDateTime=0x1d5d636, ftLastWriteTime.dwLowDateTime=0xdf9a420, ftLastWriteTime.dwHighDateTime=0x1d5d636, nFileSizeHigh=0x0, nFileSizeLow=0x14ed4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8w9Yv9CkmDKx.mp3", cAlternateFileName="8W9YV9~1.MP3")) returned 1 [0060.722] lstrcmpiW (lpString1="8w9Yv9CkmDKx.mp3", lpString2=".") returned 1 [0060.722] lstrcmpiW (lpString1="8w9Yv9CkmDKx.mp3", lpString2="..") returned 1 [0060.722] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="8w9Yv9CkmDKx.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\8w9Yv9CkmDKx.mp3") returned="C:\\Users\\FD1HVy\\Music\\8w9Yv9CkmDKx.mp3" [0060.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="8w9Yv9CkmDKx.mp3", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0060.722] GetProcessHeap () returned 0x630000 [0060.722] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11) returned 0x645e58 [0060.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="8w9Yv9CkmDKx.mp3", cchWideChar=-1, lpMultiByteStr=0x645e58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8w9Yv9CkmDKx.mp3", lpUsedDefaultChar=0x0) returned 17 [0060.722] lstrlenA (lpString="8w9Yv9CkmDKx.mp3") returned 16 [0060.722] lstrlenA (lpString=".happythreechoose") returned 17 [0060.722] lstrcmpiW (lpString1="8w9Yv9CkmDKx.mp3", lpString2="Decryption INFO.html") returned -1 [0060.722] lstrcmpiW (lpString1="8w9Yv9CkmDKx.mp3", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0060.722] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0060.722] lstrcmpiW (lpString1="8w9Yv9CkmDKx.mp3", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0060.722] GetProcessHeap () returned 0x630000 [0060.722] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0060.722] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\8w9Yv9CkmDKx.mp3" (normalized: "c:\\users\\fd1hvy\\music\\8w9yv9ckmdkx.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0060.723] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=85716) returned 1 [0060.723] GetProcessHeap () returned 0x630000 [0060.723] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655418 [0060.723] GetProcessHeap () returned 0x630000 [0060.723] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0060.723] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\8w9Yv9CkmDKx.mp3") returned 38 [0060.723] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0060.723] GetProcessHeap () returned 0x630000 [0060.723] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0060.723] GetProcessHeap () returned 0x630000 [0060.723] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38c) returned 0x654650 [0060.723] lstrlenA (lpString="rsa_encrypt") returned 11 [0060.723] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0060.724] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0060.724] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0060.724] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0060.724] GetProcessHeap () returned 0x630000 [0060.724] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0060.724] lstrlenA (lpString="010001") returned 6 [0060.724] GetProcessHeap () returned 0x630000 [0060.724] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2b8 [0060.724] GetProcessHeap () returned 0x630000 [0060.724] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0060.724] GetProcessHeap () returned 0x630000 [0060.724] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0060.724] GetProcessHeap () returned 0x630000 [0060.724] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0060.724] GetProcessHeap () returned 0x630000 [0060.724] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e3d0 [0060.724] GetProcessHeap () returned 0x630000 [0060.724] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657328 [0060.724] GetProcessHeap () returned 0x630000 [0060.724] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0060.724] GetProcessHeap () returned 0x630000 [0060.724] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0060.724] GetProcessHeap () returned 0x630000 [0060.724] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0060.724] GetProcessHeap () returned 0x630000 [0060.724] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0060.724] GetProcessHeap () returned 0x630000 [0060.724] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0060.724] GetProcessHeap () returned 0x630000 [0060.725] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656a68 [0060.725] GetProcessHeap () returned 0x630000 [0060.725] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0060.725] GetProcessHeap () returned 0x630000 [0060.725] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0060.725] GetProcessHeap () returned 0x630000 [0060.725] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e2b0 [0060.725] GetProcessHeap () returned 0x630000 [0060.725] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0060.725] GetProcessHeap () returned 0x630000 [0060.725] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0060.725] GetProcessHeap () returned 0x630000 [0060.725] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e2b0 | out: hHeap=0x630000) returned 1 [0060.725] GetProcessHeap () returned 0x630000 [0060.725] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.725] GetProcessHeap () returned 0x630000 [0060.725] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0060.725] GetProcessHeap () returned 0x630000 [0060.725] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0060.725] GetProcessHeap () returned 0x630000 [0060.725] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.725] GetProcessHeap () returned 0x630000 [0060.725] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.725] GetProcessHeap () returned 0x630000 [0060.725] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.725] GetProcessHeap () returned 0x630000 [0060.725] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65eb20 [0060.725] GetProcessHeap () returned 0x630000 [0060.725] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0060.725] GetProcessHeap () returned 0x630000 [0060.725] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0060.725] GetProcessHeap () returned 0x630000 [0060.725] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0060.725] GetProcessHeap () returned 0x630000 [0060.725] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0060.725] GetProcessHeap () returned 0x630000 [0060.725] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0060.726] GetProcessHeap () returned 0x630000 [0060.726] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0060.726] GetProcessHeap () returned 0x630000 [0060.726] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0060.726] GetProcessHeap () returned 0x630000 [0060.726] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0060.726] GetProcessHeap () returned 0x630000 [0060.726] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0060.726] GetProcessHeap () returned 0x630000 [0060.726] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0060.726] GetProcessHeap () returned 0x630000 [0060.726] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0060.726] GetProcessHeap () returned 0x630000 [0060.726] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0060.726] GetProcessHeap () returned 0x630000 [0060.726] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0060.726] GetProcessHeap () returned 0x630000 [0060.726] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0060.726] GetProcessHeap () returned 0x630000 [0060.726] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0060.726] GetProcessHeap () returned 0x630000 [0060.726] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0060.726] GetProcessHeap () returned 0x630000 [0060.726] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0060.726] GetProcessHeap () returned 0x630000 [0060.726] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0060.726] GetProcessHeap () returned 0x630000 [0060.729] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0060.729] GetProcessHeap () returned 0x630000 [0060.729] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0060.729] GetProcessHeap () returned 0x630000 [0060.729] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0060.729] GetProcessHeap () returned 0x630000 [0060.729] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0060.729] GetProcessHeap () returned 0x630000 [0060.729] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0060.729] GetProcessHeap () returned 0x630000 [0060.729] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0060.729] GetProcessHeap () returned 0x630000 [0060.729] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0060.729] GetProcessHeap () returned 0x630000 [0060.729] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0060.729] GetProcessHeap () returned 0x630000 [0060.729] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0060.729] GetProcessHeap () returned 0x630000 [0060.729] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0060.730] GetProcessHeap () returned 0x630000 [0060.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0060.730] GetProcessHeap () returned 0x630000 [0060.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.730] GetProcessHeap () returned 0x630000 [0060.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.730] GetProcessHeap () returned 0x630000 [0060.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0060.730] GetProcessHeap () returned 0x630000 [0060.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0060.730] GetProcessHeap () returned 0x630000 [0060.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0060.730] GetProcessHeap () returned 0x630000 [0060.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0060.730] GetProcessHeap () returned 0x630000 [0060.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0060.730] GetProcessHeap () returned 0x630000 [0060.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0060.730] GetProcessHeap () returned 0x630000 [0060.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0060.730] GetProcessHeap () returned 0x630000 [0060.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0060.730] GetProcessHeap () returned 0x630000 [0060.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0060.730] GetProcessHeap () returned 0x630000 [0060.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0060.730] GetProcessHeap () returned 0x630000 [0060.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.730] GetProcessHeap () returned 0x630000 [0060.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.730] GetProcessHeap () returned 0x630000 [0060.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0060.730] GetProcessHeap () returned 0x630000 [0060.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0060.730] GetProcessHeap () returned 0x630000 [0060.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0060.730] GetProcessHeap () returned 0x630000 [0060.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0060.731] GetProcessHeap () returned 0x630000 [0060.731] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.731] GetProcessHeap () returned 0x630000 [0060.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.731] GetProcessHeap () returned 0x630000 [0060.731] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0060.731] GetProcessHeap () returned 0x630000 [0060.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0060.731] GetProcessHeap () returned 0x630000 [0060.731] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0060.731] GetProcessHeap () returned 0x630000 [0060.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0060.731] GetProcessHeap () returned 0x630000 [0060.731] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0060.731] GetProcessHeap () returned 0x630000 [0060.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0060.731] GetProcessHeap () returned 0x630000 [0060.731] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0060.731] GetProcessHeap () returned 0x630000 [0060.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0060.731] GetProcessHeap () returned 0x630000 [0060.731] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0060.731] GetProcessHeap () returned 0x630000 [0060.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0060.731] GetProcessHeap () returned 0x630000 [0060.731] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.731] GetProcessHeap () returned 0x630000 [0060.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.731] GetProcessHeap () returned 0x630000 [0060.731] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0060.731] GetProcessHeap () returned 0x630000 [0060.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0060.731] GetProcessHeap () returned 0x630000 [0060.731] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0060.731] GetProcessHeap () returned 0x630000 [0060.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0060.732] GetProcessHeap () returned 0x630000 [0060.732] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0060.732] GetProcessHeap () returned 0x630000 [0060.732] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0060.732] GetProcessHeap () returned 0x630000 [0060.732] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0060.732] GetProcessHeap () returned 0x630000 [0060.732] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0060.732] GetProcessHeap () returned 0x630000 [0060.732] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.732] GetProcessHeap () returned 0x630000 [0060.732] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.732] GetProcessHeap () returned 0x630000 [0060.732] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.732] GetProcessHeap () returned 0x630000 [0060.732] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.732] GetProcessHeap () returned 0x630000 [0060.732] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0060.732] GetProcessHeap () returned 0x630000 [0060.732] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0060.732] GetProcessHeap () returned 0x630000 [0060.732] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0060.732] GetProcessHeap () returned 0x630000 [0060.732] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0060.732] GetProcessHeap () returned 0x630000 [0060.732] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0060.732] GetProcessHeap () returned 0x630000 [0060.732] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0060.732] GetProcessHeap () returned 0x630000 [0060.732] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0060.732] GetProcessHeap () returned 0x630000 [0060.732] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0060.732] GetProcessHeap () returned 0x630000 [0060.732] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0060.732] GetProcessHeap () returned 0x630000 [0060.732] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0060.733] GetProcessHeap () returned 0x630000 [0060.733] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0060.733] GetProcessHeap () returned 0x630000 [0060.733] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0060.733] GetProcessHeap () returned 0x630000 [0060.733] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0060.733] GetProcessHeap () returned 0x630000 [0060.733] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0060.733] GetProcessHeap () returned 0x630000 [0060.733] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0060.733] GetProcessHeap () returned 0x630000 [0060.733] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0060.733] GetProcessHeap () returned 0x630000 [0060.733] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0060.733] GetProcessHeap () returned 0x630000 [0060.733] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0060.733] GetProcessHeap () returned 0x630000 [0060.733] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0060.733] GetProcessHeap () returned 0x630000 [0060.733] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0060.733] GetProcessHeap () returned 0x630000 [0060.733] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0060.733] GetProcessHeap () returned 0x630000 [0060.733] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0060.733] GetProcessHeap () returned 0x630000 [0060.733] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0060.733] WriteFile (in: hFile=0x230, lpBuffer=0x654650*, nNumberOfBytesToWrite=0x38c, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654650*, lpNumberOfBytesWritten=0x243d864*=0x38c, lpOverlapped=0x0) returned 1 [0060.906] GetProcessHeap () returned 0x630000 [0060.906] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x654650, Size=0x30) returned 0x654650 [0060.906] GetProcessHeap () returned 0x630000 [0060.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0060.906] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0060.906] GetProcessHeap () returned 0x630000 [0060.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14ee0) returned 0x671bf0 [0060.908] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0x14ee0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0x14ee0, lpOverlapped=0x0) returned 1 [0060.909] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0060.909] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x14ee0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0x14ee0, lpOverlapped=0x0) returned 1 [0060.911] GetProcessHeap () returned 0x630000 [0060.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0060.911] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0060.911] WriteFile (in: hFile=0x230, lpBuffer=0x654650*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654650*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0060.912] CloseHandle (hObject=0x230) returned 1 [0060.919] GetProcessHeap () returned 0x630000 [0060.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0060.919] GetProcessHeap () returned 0x630000 [0060.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655418 | out: hHeap=0x630000) returned 1 [0060.919] GetProcessHeap () returned 0x630000 [0060.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0060.919] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Music\\8w9Yv9CkmDKx.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\8w9Yv9CkmDKx.mp3") returned="C:\\Users\\FD1HVy\\Music\\8w9Yv9CkmDKx.mp3" [0060.919] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\8w9Yv9CkmDKx.mp3", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Music\\8w9Yv9CkmDKx.mp3.happythreechoose") returned="C:\\Users\\FD1HVy\\Music\\8w9Yv9CkmDKx.mp3.happythreechoose" [0060.919] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\8w9Yv9CkmDKx.mp3" (normalized: "c:\\users\\fd1hvy\\music\\8w9yv9ckmdkx.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\8w9Yv9CkmDKx.mp3.happythreechoose" (normalized: "c:\\users\\fd1hvy\\music\\8w9yv9ckmdkx.mp3.happythreechoose"), dwFlags=0x1) returned 1 [0060.920] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\8w9Yv9CkmDKx.mp3" | out: pszPath="C:\\Users\\FD1HVy\\Music") returned 1 [0060.920] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music" | out: pszPath="C:\\Users\\FD1HVy\\Music\\") returned="" [0060.920] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Music\\Decryption INFO.html" [0060.920] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\music\\decryption info.html")) returned 0xffffffff [0060.920] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\music\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0060.926] GetProcessHeap () returned 0x630000 [0060.926] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6559b8 [0060.926] GetProcessHeap () returned 0x630000 [0060.926] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0060.933] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.934] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.934] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.934] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.934] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.934] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.934] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.934] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.934] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.935] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.937] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.945] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.945] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.945] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.945] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.949] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.949] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.949] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.949] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.949] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.949] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.950] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.950] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.950] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.950] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.950] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.950] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.950] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.950] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.950] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.950] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.950] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.950] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.950] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.950] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.951] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.951] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.951] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.951] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.951] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.951] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.951] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.951] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.951] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.951] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.951] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.951] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.951] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.951] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.952] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.952] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.952] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.952] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.952] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.952] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.952] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.952] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.952] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.952] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.952] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.952] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.952] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.952] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.952] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.953] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.953] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.953] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.953] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.953] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.953] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.953] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.953] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.953] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.953] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.953] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.953] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.953] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.953] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.953] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.954] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.954] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.954] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.954] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.954] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.954] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.954] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.954] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.954] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.954] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.954] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.954] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.954] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.954] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.955] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.955] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.955] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.955] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.955] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.955] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.955] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.955] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.955] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.955] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.955] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.955] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.955] GetProcessHeap () returned 0x630000 [0060.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6559b8 | out: hHeap=0x630000) returned 1 [0060.955] GetProcessHeap () returned 0x630000 [0060.956] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0060.956] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0060.956] GetProcessHeap () returned 0x630000 [0060.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6558c8 [0060.956] GetProcessHeap () returned 0x630000 [0060.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0060.964] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.964] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.964] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.964] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.964] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.964] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.964] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.965] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.965] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.965] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.965] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.965] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.965] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.965] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.965] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.965] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.965] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.965] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.965] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.965] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.965] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.966] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.966] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.966] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.966] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.966] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.966] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.966] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.966] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.966] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.966] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.966] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.966] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.966] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.966] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.966] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.967] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.967] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.967] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.967] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.967] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.967] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.967] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.967] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.967] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.967] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.967] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.967] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.967] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.967] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.967] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.968] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.968] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.968] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.968] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.968] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.968] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.968] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.968] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.968] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.968] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.968] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.968] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.968] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.968] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.969] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.969] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.969] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.969] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.969] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.969] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.969] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.969] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.969] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.969] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.969] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.969] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.969] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.970] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.970] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.970] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.970] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.970] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.970] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.970] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.970] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.970] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.970] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.970] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.970] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.970] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.970] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.971] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.971] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.971] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.971] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.971] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.971] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.971] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.971] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.971] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.971] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.971] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.971] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.971] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.971] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.972] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.972] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.972] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.972] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.972] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.972] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.972] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.972] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.972] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.972] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.972] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.972] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0060.973] GetProcessHeap () returned 0x630000 [0060.973] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6558c8 | out: hHeap=0x630000) returned 1 [0060.973] GetProcessHeap () returned 0x630000 [0060.973] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0060.973] CloseHandle (hObject=0x230) returned 1 [0060.973] GetProcessHeap () returned 0x630000 [0060.973] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645e58 | out: hHeap=0x630000) returned 1 [0060.973] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6dd641a0, ftCreationTime.dwHighDateTime=0x1d5cabf, ftLastAccessTime.dwLowDateTime=0xf17151b0, ftLastAccessTime.dwHighDateTime=0x1d5d2a5, ftLastWriteTime.dwLowDateTime=0xf17151b0, ftLastWriteTime.dwHighDateTime=0x1d5d2a5, nFileSizeHigh=0x0, nFileSizeLow=0x6460, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AbkEp9_mUwoMem9lnnfe.wav", cAlternateFileName="ABKEP9~1.WAV")) returned 1 [0060.974] lstrcmpiW (lpString1="AbkEp9_mUwoMem9lnnfe.wav", lpString2=".") returned 1 [0060.974] lstrcmpiW (lpString1="AbkEp9_mUwoMem9lnnfe.wav", lpString2="..") returned 1 [0060.974] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="AbkEp9_mUwoMem9lnnfe.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\AbkEp9_mUwoMem9lnnfe.wav") returned="C:\\Users\\FD1HVy\\Music\\AbkEp9_mUwoMem9lnnfe.wav" [0060.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AbkEp9_mUwoMem9lnnfe.wav", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0060.974] GetProcessHeap () returned 0x630000 [0060.974] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x19) returned 0x651e98 [0060.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AbkEp9_mUwoMem9lnnfe.wav", cchWideChar=-1, lpMultiByteStr=0x651e98, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AbkEp9_mUwoMem9lnnfe.wav", lpUsedDefaultChar=0x0) returned 25 [0060.974] lstrlenA (lpString="AbkEp9_mUwoMem9lnnfe.wav") returned 24 [0060.974] lstrlenA (lpString=".happythreechoose") returned 17 [0060.974] lstrlenA (lpString=".happythreechoose") returned 17 [0060.974] lstrlenA (lpString="AbkEp9_mUwoMem9lnnfe.wav") returned 24 [0060.974] lstrcmpiA (lpString1="mUwoMem9lnnfe.wav", lpString2=".happythreechoose") returned 1 [0060.974] lstrcmpiW (lpString1="AbkEp9_mUwoMem9lnnfe.wav", lpString2="Decryption INFO.html") returned -1 [0060.974] lstrcmpiW (lpString1="AbkEp9_mUwoMem9lnnfe.wav", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0060.974] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0060.974] lstrcmpiW (lpString1="AbkEp9_mUwoMem9lnnfe.wav", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0060.974] GetProcessHeap () returned 0x630000 [0060.974] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0060.974] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\AbkEp9_mUwoMem9lnnfe.wav" (normalized: "c:\\users\\fd1hvy\\music\\abkep9_muwomem9lnnfe.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0060.974] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=25696) returned 1 [0060.974] GetProcessHeap () returned 0x630000 [0060.974] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655b20 [0060.974] GetProcessHeap () returned 0x630000 [0060.974] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0060.974] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\AbkEp9_mUwoMem9lnnfe.wav") returned 46 [0060.974] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0060.975] GetProcessHeap () returned 0x630000 [0060.975] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0060.975] GetProcessHeap () returned 0x630000 [0060.975] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x654688 [0060.975] lstrlenA (lpString="rsa_encrypt") returned 11 [0060.975] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0060.975] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0060.975] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0060.975] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0060.975] GetProcessHeap () returned 0x630000 [0060.975] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0060.975] lstrlenA (lpString="010001") returned 6 [0060.975] GetProcessHeap () returned 0x630000 [0060.975] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a348 [0060.976] GetProcessHeap () returned 0x630000 [0060.976] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0060.976] GetProcessHeap () returned 0x630000 [0060.976] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65df50 [0060.976] GetProcessHeap () returned 0x630000 [0060.976] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0060.976] GetProcessHeap () returned 0x630000 [0060.976] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e4f0 [0060.976] GetProcessHeap () returned 0x630000 [0060.976] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657670 [0060.976] GetProcessHeap () returned 0x630000 [0060.976] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0060.976] GetProcessHeap () returned 0x630000 [0060.976] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0060.976] GetProcessHeap () returned 0x630000 [0060.976] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0060.976] GetProcessHeap () returned 0x630000 [0060.976] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0060.976] GetProcessHeap () returned 0x630000 [0060.976] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0060.976] GetProcessHeap () returned 0x630000 [0060.976] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656c98 [0060.976] GetProcessHeap () returned 0x630000 [0060.976] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0060.976] GetProcessHeap () returned 0x630000 [0060.976] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0060.976] GetProcessHeap () returned 0x630000 [0060.976] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e8e0 [0061.021] GetProcessHeap () returned 0x630000 [0061.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.021] GetProcessHeap () returned 0x630000 [0061.021] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0061.021] GetProcessHeap () returned 0x630000 [0061.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0061.021] GetProcessHeap () returned 0x630000 [0061.021] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.021] GetProcessHeap () returned 0x630000 [0061.021] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0061.021] GetProcessHeap () returned 0x630000 [0061.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.021] GetProcessHeap () returned 0x630000 [0061.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.021] GetProcessHeap () returned 0x630000 [0061.021] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.021] GetProcessHeap () returned 0x630000 [0061.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.022] GetProcessHeap () returned 0x630000 [0061.022] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e100 [0061.022] GetProcessHeap () returned 0x630000 [0061.022] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0061.022] GetProcessHeap () returned 0x630000 [0061.022] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0061.022] GetProcessHeap () returned 0x630000 [0061.022] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0061.022] GetProcessHeap () returned 0x630000 [0061.022] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.022] GetProcessHeap () returned 0x630000 [0061.022] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.022] GetProcessHeap () returned 0x630000 [0061.022] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.022] GetProcessHeap () returned 0x630000 [0061.022] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.022] GetProcessHeap () returned 0x630000 [0061.022] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.022] GetProcessHeap () returned 0x630000 [0061.022] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.022] GetProcessHeap () returned 0x630000 [0061.022] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.022] GetProcessHeap () returned 0x630000 [0061.022] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.022] GetProcessHeap () returned 0x630000 [0061.022] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.022] GetProcessHeap () returned 0x630000 [0061.022] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.022] GetProcessHeap () returned 0x630000 [0061.022] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.022] GetProcessHeap () returned 0x630000 [0061.022] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.022] GetProcessHeap () returned 0x630000 [0061.022] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.022] GetProcessHeap () returned 0x630000 [0061.022] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.022] GetProcessHeap () returned 0x630000 [0061.023] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.023] GetProcessHeap () returned 0x630000 [0061.023] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.023] GetProcessHeap () returned 0x630000 [0061.023] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.023] GetProcessHeap () returned 0x630000 [0061.023] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.023] GetProcessHeap () returned 0x630000 [0061.023] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.023] GetProcessHeap () returned 0x630000 [0061.023] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.023] GetProcessHeap () returned 0x630000 [0061.023] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.023] GetProcessHeap () returned 0x630000 [0061.023] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.023] GetProcessHeap () returned 0x630000 [0061.023] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.023] GetProcessHeap () returned 0x630000 [0061.023] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.023] GetProcessHeap () returned 0x630000 [0061.023] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.023] GetProcessHeap () returned 0x630000 [0061.023] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.023] GetProcessHeap () returned 0x630000 [0061.025] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.025] GetProcessHeap () returned 0x630000 [0061.025] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.025] GetProcessHeap () returned 0x630000 [0061.026] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.026] GetProcessHeap () returned 0x630000 [0061.026] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.026] GetProcessHeap () returned 0x630000 [0061.026] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.026] GetProcessHeap () returned 0x630000 [0061.026] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.026] GetProcessHeap () returned 0x630000 [0061.026] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.026] GetProcessHeap () returned 0x630000 [0061.026] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.026] GetProcessHeap () returned 0x630000 [0061.026] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.026] GetProcessHeap () returned 0x630000 [0061.026] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.026] GetProcessHeap () returned 0x630000 [0061.026] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.026] GetProcessHeap () returned 0x630000 [0061.026] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.026] GetProcessHeap () returned 0x630000 [0061.026] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.026] GetProcessHeap () returned 0x630000 [0061.026] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.026] GetProcessHeap () returned 0x630000 [0061.026] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.026] GetProcessHeap () returned 0x630000 [0061.026] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.026] GetProcessHeap () returned 0x630000 [0061.026] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.026] GetProcessHeap () returned 0x630000 [0061.026] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.026] GetProcessHeap () returned 0x630000 [0061.026] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.026] GetProcessHeap () returned 0x630000 [0061.026] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.026] GetProcessHeap () returned 0x630000 [0061.026] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.027] GetProcessHeap () returned 0x630000 [0061.027] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.027] GetProcessHeap () returned 0x630000 [0061.027] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.027] GetProcessHeap () returned 0x630000 [0061.027] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.027] GetProcessHeap () returned 0x630000 [0061.027] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.027] GetProcessHeap () returned 0x630000 [0061.027] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.027] GetProcessHeap () returned 0x630000 [0061.027] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.027] GetProcessHeap () returned 0x630000 [0061.027] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.027] GetProcessHeap () returned 0x630000 [0061.027] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.027] GetProcessHeap () returned 0x630000 [0061.027] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.027] GetProcessHeap () returned 0x630000 [0061.027] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.027] GetProcessHeap () returned 0x630000 [0061.027] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.027] GetProcessHeap () returned 0x630000 [0061.027] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.027] GetProcessHeap () returned 0x630000 [0061.027] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.027] GetProcessHeap () returned 0x630000 [0061.027] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.027] GetProcessHeap () returned 0x630000 [0061.027] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.027] GetProcessHeap () returned 0x630000 [0061.027] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.027] GetProcessHeap () returned 0x630000 [0061.027] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.027] GetProcessHeap () returned 0x630000 [0061.027] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.027] GetProcessHeap () returned 0x630000 [0061.028] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.028] GetProcessHeap () returned 0x630000 [0061.028] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.028] GetProcessHeap () returned 0x630000 [0061.028] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.028] GetProcessHeap () returned 0x630000 [0061.028] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.028] GetProcessHeap () returned 0x630000 [0061.028] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.028] GetProcessHeap () returned 0x630000 [0061.028] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.028] GetProcessHeap () returned 0x630000 [0061.028] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.028] GetProcessHeap () returned 0x630000 [0061.028] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.028] GetProcessHeap () returned 0x630000 [0061.028] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.028] GetProcessHeap () returned 0x630000 [0061.028] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.028] GetProcessHeap () returned 0x630000 [0061.028] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.028] GetProcessHeap () returned 0x630000 [0061.028] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.028] GetProcessHeap () returned 0x630000 [0061.028] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.028] GetProcessHeap () returned 0x630000 [0061.028] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.028] GetProcessHeap () returned 0x630000 [0061.028] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.028] GetProcessHeap () returned 0x630000 [0061.028] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.028] GetProcessHeap () returned 0x630000 [0061.028] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.028] GetProcessHeap () returned 0x630000 [0061.028] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0061.028] GetProcessHeap () returned 0x630000 [0061.028] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0061.028] GetProcessHeap () returned 0x630000 [0061.028] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0061.029] GetProcessHeap () returned 0x630000 [0061.029] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0061.029] GetProcessHeap () returned 0x630000 [0061.029] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0061.029] GetProcessHeap () returned 0x630000 [0061.029] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0061.029] GetProcessHeap () returned 0x630000 [0061.029] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0061.029] GetProcessHeap () returned 0x630000 [0061.029] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0061.029] GetProcessHeap () returned 0x630000 [0061.029] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0061.029] GetProcessHeap () returned 0x630000 [0061.029] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0061.029] GetProcessHeap () returned 0x630000 [0061.029] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0061.029] WriteFile (in: hFile=0x230, lpBuffer=0x654688*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654688*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0061.077] GetProcessHeap () returned 0x630000 [0061.077] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x654688, Size=0x30) returned 0x654688 [0061.077] GetProcessHeap () returned 0x630000 [0061.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0061.077] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.077] GetProcessHeap () returned 0x630000 [0061.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6460) returned 0x671bf0 [0061.077] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0x6460, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0x6460, lpOverlapped=0x0) returned 1 [0061.078] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.078] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x6460, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0x6460, lpOverlapped=0x0) returned 1 [0061.079] GetProcessHeap () returned 0x630000 [0061.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0061.080] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.080] WriteFile (in: hFile=0x230, lpBuffer=0x654688*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654688*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0061.081] CloseHandle (hObject=0x230) returned 1 [0061.083] GetProcessHeap () returned 0x630000 [0061.083] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0061.083] GetProcessHeap () returned 0x630000 [0061.083] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655b20 | out: hHeap=0x630000) returned 1 [0061.083] GetProcessHeap () returned 0x630000 [0061.083] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0061.083] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Music\\AbkEp9_mUwoMem9lnnfe.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\AbkEp9_mUwoMem9lnnfe.wav") returned="C:\\Users\\FD1HVy\\Music\\AbkEp9_mUwoMem9lnnfe.wav" [0061.083] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\AbkEp9_mUwoMem9lnnfe.wav", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Music\\AbkEp9_mUwoMem9lnnfe.wav.happythreechoose") returned="C:\\Users\\FD1HVy\\Music\\AbkEp9_mUwoMem9lnnfe.wav.happythreechoose" [0061.083] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\AbkEp9_mUwoMem9lnnfe.wav" (normalized: "c:\\users\\fd1hvy\\music\\abkep9_muwomem9lnnfe.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\AbkEp9_mUwoMem9lnnfe.wav.happythreechoose" (normalized: "c:\\users\\fd1hvy\\music\\abkep9_muwomem9lnnfe.wav.happythreechoose"), dwFlags=0x1) returned 1 [0061.084] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\AbkEp9_mUwoMem9lnnfe.wav" | out: pszPath="C:\\Users\\FD1HVy\\Music") returned 1 [0061.084] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music" | out: pszPath="C:\\Users\\FD1HVy\\Music\\") returned="" [0061.084] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Music\\Decryption INFO.html" [0061.084] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\music\\decryption info.html")) returned 0x20 [0061.084] GetProcessHeap () returned 0x630000 [0061.084] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0061.084] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d0821d0, ftCreationTime.dwHighDateTime=0x1d5d1fb, ftLastAccessTime.dwLowDateTime=0xcc7de4d0, ftLastAccessTime.dwHighDateTime=0x1d5d210, ftLastWriteTime.dwLowDateTime=0xcc7de4d0, ftLastWriteTime.dwHighDateTime=0x1d5d210, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="d1_GTf7p7iJ-", cAlternateFileName="D1_GTF~1")) returned 1 [0061.084] lstrcmpiW (lpString1="d1_GTf7p7iJ-", lpString2=".") returned 1 [0061.084] lstrcmpiW (lpString1="d1_GTf7p7iJ-", lpString2="..") returned 1 [0061.084] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="d1_GTf7p7iJ-" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-" [0061.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="d1_GTf7p7iJ-", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0061.084] GetProcessHeap () returned 0x630000 [0061.084] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd) returned 0x64ca20 [0061.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="d1_GTf7p7iJ-", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="d1_GTf7p7iJ-", lpUsedDefaultChar=0x0) returned 13 [0061.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="d1_GTf7p7iJ-", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0061.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="d1_GTf7p7iJ-", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0061.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="d1_GTf7p7iJ-", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0061.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="d1_GTf7p7iJ-", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0061.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="d1_GTf7p7iJ-", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0061.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="d1_GTf7p7iJ-", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0061.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="d1_GTf7p7iJ-", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0061.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="d1_GTf7p7iJ-", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0061.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="d1_GTf7p7iJ-", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0061.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="d1_GTf7p7iJ-", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0061.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="d1_GTf7p7iJ-", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0061.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="d1_GTf7p7iJ-", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0061.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="d1_GTf7p7iJ-", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0061.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="d1_GTf7p7iJ-", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0061.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="d1_GTf7p7iJ-", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0061.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="d1_GTf7p7iJ-", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0061.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="d1_GTf7p7iJ-", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0061.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="d1_GTf7p7iJ-", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0061.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="d1_GTf7p7iJ-", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0061.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="d1_GTf7p7iJ-", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0061.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="d1_GTf7p7iJ-", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0061.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="d1_GTf7p7iJ-", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0061.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="d1_GTf7p7iJ-", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0061.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="d1_GTf7p7iJ-", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0061.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="d1_GTf7p7iJ-", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0061.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="d1_GTf7p7iJ-", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0061.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="d1_GTf7p7iJ-", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0061.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="d1_GTf7p7iJ-", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0061.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="d1_GTf7p7iJ-", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0061.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="d1_GTf7p7iJ-", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0061.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="d1_GTf7p7iJ-", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0061.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="d1_GTf7p7iJ-", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0061.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="d1_GTf7p7iJ-", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0061.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="d1_GTf7p7iJ-", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0061.085] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="d1_GTf7p7iJ-", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0061.086] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="d1_GTf7p7iJ-", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0061.086] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="d1_GTf7p7iJ-", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0061.086] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="d1_GTf7p7iJ-", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0061.086] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="d1_GTf7p7iJ-", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0061.086] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="d1_GTf7p7iJ-", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0061.086] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="d1_GTf7p7iJ-", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0061.086] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="d1_GTf7p7iJ-", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0061.086] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="d1_GTf7p7iJ-", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0061.086] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\" [0061.086] GetProcessHeap () returned 0x630000 [0061.086] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a258 [0061.086] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\") returned 35 [0061.086] GetProcessHeap () returned 0x630000 [0061.086] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x48) returned 0x65fe80 [0061.086] lstrcpyW (in: lpString1=0x65fe80, lpString2="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\" [0061.086] GetProcessHeap () returned 0x630000 [0061.086] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0061.086] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4409f518, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4409f518, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0061.086] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0061.086] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0061.086] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Music\\desktop.ini") returned="C:\\Users\\FD1HVy\\Music\\desktop.ini" [0061.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0061.086] GetProcessHeap () returned 0x630000 [0061.086] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0061.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0061.086] lstrlenA (lpString="desktop.ini") returned 11 [0061.086] lstrlenA (lpString=".happythreechoose") returned 17 [0061.086] lstrcmpiW (lpString1="desktop.ini", lpString2="Decryption INFO.html") returned 1 [0061.086] lstrcmpiW (lpString1="desktop.ini", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0061.086] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0061.086] lstrcmpiW (lpString1="desktop.ini", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0061.086] GetProcessHeap () returned 0x630000 [0061.087] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0061.087] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\music\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0061.087] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=504) returned 1 [0061.087] GetProcessHeap () returned 0x630000 [0061.087] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655490 [0061.087] GetProcessHeap () returned 0x630000 [0061.087] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0061.087] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\desktop.ini") returned 33 [0061.087] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.087] GetProcessHeap () returned 0x630000 [0061.087] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0061.087] GetProcessHeap () returned 0x630000 [0061.087] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x388) returned 0x6546c0 [0061.087] lstrlenA (lpString="rsa_encrypt") returned 11 [0061.087] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0061.088] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0061.088] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0061.088] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0061.088] GetProcessHeap () returned 0x630000 [0061.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0061.088] lstrlenA (lpString="010001") returned 6 [0061.088] GetProcessHeap () returned 0x630000 [0061.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0061.088] GetProcessHeap () returned 0x630000 [0061.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.088] GetProcessHeap () returned 0x630000 [0061.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dec0 [0061.088] GetProcessHeap () returned 0x630000 [0061.088] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.088] GetProcessHeap () returned 0x630000 [0061.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0061.088] GetProcessHeap () returned 0x630000 [0061.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656a68 [0061.088] GetProcessHeap () returned 0x630000 [0061.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0061.088] GetProcessHeap () returned 0x630000 [0061.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0061.088] GetProcessHeap () returned 0x630000 [0061.088] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.088] GetProcessHeap () returned 0x630000 [0061.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0061.088] GetProcessHeap () returned 0x630000 [0061.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.088] GetProcessHeap () returned 0x630000 [0061.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657440 [0061.088] GetProcessHeap () returned 0x630000 [0061.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.089] GetProcessHeap () returned 0x630000 [0061.089] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0061.089] GetProcessHeap () returned 0x630000 [0061.089] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ebb0 [0061.089] GetProcessHeap () returned 0x630000 [0061.089] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.089] GetProcessHeap () returned 0x630000 [0061.089] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0061.089] GetProcessHeap () returned 0x630000 [0061.089] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0061.089] GetProcessHeap () returned 0x630000 [0061.089] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.089] GetProcessHeap () returned 0x630000 [0061.089] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x661818 [0061.089] GetProcessHeap () returned 0x630000 [0061.089] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.089] GetProcessHeap () returned 0x630000 [0061.089] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.089] GetProcessHeap () returned 0x630000 [0061.089] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.089] GetProcessHeap () returned 0x630000 [0061.089] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.089] GetProcessHeap () returned 0x630000 [0061.089] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e850 [0061.089] GetProcessHeap () returned 0x630000 [0061.089] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661818 | out: hHeap=0x630000) returned 1 [0061.089] GetProcessHeap () returned 0x630000 [0061.089] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0061.089] GetProcessHeap () returned 0x630000 [0061.089] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0061.089] GetProcessHeap () returned 0x630000 [0061.089] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.089] GetProcessHeap () returned 0x630000 [0061.089] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.089] GetProcessHeap () returned 0x630000 [0061.089] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.089] GetProcessHeap () returned 0x630000 [0061.089] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.089] GetProcessHeap () returned 0x630000 [0061.089] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.090] GetProcessHeap () returned 0x630000 [0061.090] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.090] GetProcessHeap () returned 0x630000 [0061.090] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.090] GetProcessHeap () returned 0x630000 [0061.090] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.090] GetProcessHeap () returned 0x630000 [0061.090] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.090] GetProcessHeap () returned 0x630000 [0061.090] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.090] GetProcessHeap () returned 0x630000 [0061.090] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.090] GetProcessHeap () returned 0x630000 [0061.090] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.090] GetProcessHeap () returned 0x630000 [0061.090] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.090] GetProcessHeap () returned 0x630000 [0061.090] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.090] GetProcessHeap () returned 0x630000 [0061.090] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.090] GetProcessHeap () returned 0x630000 [0061.090] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.090] GetProcessHeap () returned 0x630000 [0061.090] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.090] GetProcessHeap () returned 0x630000 [0061.090] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.090] GetProcessHeap () returned 0x630000 [0061.090] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.090] GetProcessHeap () returned 0x630000 [0061.090] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.090] GetProcessHeap () returned 0x630000 [0061.090] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.090] GetProcessHeap () returned 0x630000 [0061.090] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.090] GetProcessHeap () returned 0x630000 [0061.090] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.090] GetProcessHeap () returned 0x630000 [0061.091] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.091] GetProcessHeap () returned 0x630000 [0061.091] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.091] GetProcessHeap () returned 0x630000 [0061.091] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.091] GetProcessHeap () returned 0x630000 [0061.091] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.091] GetProcessHeap () returned 0x630000 [0061.091] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.091] GetProcessHeap () returned 0x630000 [0061.091] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.091] GetProcessHeap () returned 0x630000 [0061.091] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.091] GetProcessHeap () returned 0x630000 [0061.091] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.091] GetProcessHeap () returned 0x630000 [0061.091] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.091] GetProcessHeap () returned 0x630000 [0061.091] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0061.091] GetProcessHeap () returned 0x630000 [0061.091] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0061.091] GetProcessHeap () returned 0x630000 [0061.091] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.091] GetProcessHeap () returned 0x630000 [0061.091] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.091] GetProcessHeap () returned 0x630000 [0061.091] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.091] GetProcessHeap () returned 0x630000 [0061.091] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.091] GetProcessHeap () returned 0x630000 [0061.091] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.091] GetProcessHeap () returned 0x630000 [0061.091] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.091] GetProcessHeap () returned 0x630000 [0061.091] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.091] GetProcessHeap () returned 0x630000 [0061.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.092] GetProcessHeap () returned 0x630000 [0061.092] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.092] GetProcessHeap () returned 0x630000 [0061.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.092] GetProcessHeap () returned 0x630000 [0061.092] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.092] GetProcessHeap () returned 0x630000 [0061.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.092] GetProcessHeap () returned 0x630000 [0061.092] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.092] GetProcessHeap () returned 0x630000 [0061.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.092] GetProcessHeap () returned 0x630000 [0061.092] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.092] GetProcessHeap () returned 0x630000 [0061.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.092] GetProcessHeap () returned 0x630000 [0061.092] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.092] GetProcessHeap () returned 0x630000 [0061.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.092] GetProcessHeap () returned 0x630000 [0061.092] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.092] GetProcessHeap () returned 0x630000 [0061.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.092] GetProcessHeap () returned 0x630000 [0061.092] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.092] GetProcessHeap () returned 0x630000 [0061.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.092] GetProcessHeap () returned 0x630000 [0061.092] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.092] GetProcessHeap () returned 0x630000 [0061.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.092] GetProcessHeap () returned 0x630000 [0061.092] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.092] GetProcessHeap () returned 0x630000 [0061.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.092] GetProcessHeap () returned 0x630000 [0061.092] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.093] GetProcessHeap () returned 0x630000 [0061.093] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.093] GetProcessHeap () returned 0x630000 [0061.093] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.093] GetProcessHeap () returned 0x630000 [0061.093] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.093] GetProcessHeap () returned 0x630000 [0061.093] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.093] GetProcessHeap () returned 0x630000 [0061.093] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.093] GetProcessHeap () returned 0x630000 [0061.093] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.093] GetProcessHeap () returned 0x630000 [0061.093] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.093] GetProcessHeap () returned 0x630000 [0061.093] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.093] GetProcessHeap () returned 0x630000 [0061.093] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.093] GetProcessHeap () returned 0x630000 [0061.093] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.093] GetProcessHeap () returned 0x630000 [0061.093] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.093] GetProcessHeap () returned 0x630000 [0061.093] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.093] GetProcessHeap () returned 0x630000 [0061.093] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.093] GetProcessHeap () returned 0x630000 [0061.093] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.093] GetProcessHeap () returned 0x630000 [0061.093] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.093] GetProcessHeap () returned 0x630000 [0061.093] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.093] GetProcessHeap () returned 0x630000 [0061.093] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.093] GetProcessHeap () returned 0x630000 [0061.093] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.093] GetProcessHeap () returned 0x630000 [0061.093] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.093] GetProcessHeap () returned 0x630000 [0061.094] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.094] GetProcessHeap () returned 0x630000 [0061.094] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.094] GetProcessHeap () returned 0x630000 [0061.094] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0061.094] GetProcessHeap () returned 0x630000 [0061.094] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0061.094] GetProcessHeap () returned 0x630000 [0061.094] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0061.094] GetProcessHeap () returned 0x630000 [0061.094] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0061.094] GetProcessHeap () returned 0x630000 [0061.094] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0061.094] GetProcessHeap () returned 0x630000 [0061.094] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0061.094] GetProcessHeap () returned 0x630000 [0061.094] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0061.094] GetProcessHeap () returned 0x630000 [0061.094] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0061.094] GetProcessHeap () returned 0x630000 [0061.094] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0061.094] GetProcessHeap () returned 0x630000 [0061.094] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.094] GetProcessHeap () returned 0x630000 [0061.094] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0061.094] WriteFile (in: hFile=0x230, lpBuffer=0x6546c0*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6546c0*, lpNumberOfBytesWritten=0x243d864*=0x388, lpOverlapped=0x0) returned 1 [0061.097] GetProcessHeap () returned 0x630000 [0061.097] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6546c0, Size=0x30) returned 0x6546c0 [0061.097] GetProcessHeap () returned 0x630000 [0061.097] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0061.097] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.097] GetProcessHeap () returned 0x630000 [0061.097] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0061.097] ReadFile (in: hFile=0x230, lpBuffer=0x64cc78, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x64cc78*, lpNumberOfBytesRead=0x243d7e8*=0x200, lpOverlapped=0x0) returned 1 [0061.097] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.097] WriteFile (in: hFile=0x230, lpBuffer=0x64cc78*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x64cc78*, lpNumberOfBytesWritten=0x243d7e4*=0x200, lpOverlapped=0x0) returned 1 [0061.098] GetProcessHeap () returned 0x630000 [0061.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0061.098] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.099] WriteFile (in: hFile=0x230, lpBuffer=0x6546c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6546c0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0061.100] CloseHandle (hObject=0x230) returned 1 [0061.101] GetProcessHeap () returned 0x630000 [0061.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0061.101] GetProcessHeap () returned 0x630000 [0061.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655490 | out: hHeap=0x630000) returned 1 [0061.101] GetProcessHeap () returned 0x630000 [0061.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0061.101] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Music\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Music\\desktop.ini") returned="C:\\Users\\FD1HVy\\Music\\desktop.ini" [0061.101] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\desktop.ini", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Music\\desktop.ini.happythreechoose") returned="C:\\Users\\FD1HVy\\Music\\desktop.ini.happythreechoose" [0061.101] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\music\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\desktop.ini.happythreechoose" (normalized: "c:\\users\\fd1hvy\\music\\desktop.ini.happythreechoose"), dwFlags=0x1) returned 1 [0061.104] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\Music") returned 1 [0061.104] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music" | out: pszPath="C:\\Users\\FD1HVy\\Music\\") returned="" [0061.104] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Music\\Decryption INFO.html" [0061.104] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\music\\decryption info.html")) returned 0x20 [0061.104] GetProcessHeap () returned 0x630000 [0061.104] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0061.104] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc21d2fb0, ftCreationTime.dwHighDateTime=0x1d5d62e, ftLastAccessTime.dwLowDateTime=0x17be8460, ftLastAccessTime.dwHighDateTime=0x1d5ce68, ftLastWriteTime.dwLowDateTime=0x17be8460, ftLastWriteTime.dwHighDateTime=0x1d5ce68, nFileSizeHigh=0x0, nFileSizeLow=0x127b2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="g4vOK-TiElqldQ.wav", cAlternateFileName="G4VOK-~1.WAV")) returned 1 [0061.104] lstrcmpiW (lpString1="g4vOK-TiElqldQ.wav", lpString2=".") returned 1 [0061.104] lstrcmpiW (lpString1="g4vOK-TiElqldQ.wav", lpString2="..") returned 1 [0061.104] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="g4vOK-TiElqldQ.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\g4vOK-TiElqldQ.wav") returned="C:\\Users\\FD1HVy\\Music\\g4vOK-TiElqldQ.wav" [0061.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="g4vOK-TiElqldQ.wav", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0061.104] GetProcessHeap () returned 0x630000 [0061.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x13) returned 0x645c58 [0061.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="g4vOK-TiElqldQ.wav", cchWideChar=-1, lpMultiByteStr=0x645c58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="g4vOK-TiElqldQ.wav", lpUsedDefaultChar=0x0) returned 19 [0061.105] lstrlenA (lpString="g4vOK-TiElqldQ.wav") returned 18 [0061.105] lstrlenA (lpString=".happythreechoose") returned 17 [0061.105] lstrlenA (lpString=".happythreechoose") returned 17 [0061.105] lstrlenA (lpString="g4vOK-TiElqldQ.wav") returned 18 [0061.105] lstrcmpiA (lpString1="4vOK-TiElqldQ.wav", lpString2=".happythreechoose") returned 1 [0061.105] lstrcmpiW (lpString1="g4vOK-TiElqldQ.wav", lpString2="Decryption INFO.html") returned 1 [0061.105] lstrcmpiW (lpString1="g4vOK-TiElqldQ.wav", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0061.105] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0061.105] lstrcmpiW (lpString1="g4vOK-TiElqldQ.wav", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0061.105] GetProcessHeap () returned 0x630000 [0061.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0061.105] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\g4vOK-TiElqldQ.wav" (normalized: "c:\\users\\fd1hvy\\music\\g4vok-tielqldq.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0061.105] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=75698) returned 1 [0061.105] GetProcessHeap () returned 0x630000 [0061.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655490 [0061.105] GetProcessHeap () returned 0x630000 [0061.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0061.105] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\g4vOK-TiElqldQ.wav") returned 40 [0061.105] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.105] GetProcessHeap () returned 0x630000 [0061.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0061.105] GetProcessHeap () returned 0x630000 [0061.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x6546f8 [0061.105] lstrlenA (lpString="rsa_encrypt") returned 11 [0061.105] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0061.106] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0061.106] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0061.106] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0061.106] GetProcessHeap () returned 0x630000 [0061.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0061.106] lstrlenA (lpString="010001") returned 6 [0061.106] GetProcessHeap () returned 0x630000 [0061.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0061.106] GetProcessHeap () returned 0x630000 [0061.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.106] GetProcessHeap () returned 0x630000 [0061.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0061.106] GetProcessHeap () returned 0x630000 [0061.106] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.106] GetProcessHeap () returned 0x630000 [0061.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e100 [0061.106] GetProcessHeap () returned 0x630000 [0061.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656fe0 [0061.106] GetProcessHeap () returned 0x630000 [0061.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0061.107] GetProcessHeap () returned 0x630000 [0061.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0061.107] GetProcessHeap () returned 0x630000 [0061.107] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.107] GetProcessHeap () returned 0x630000 [0061.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0061.107] GetProcessHeap () returned 0x630000 [0061.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.107] GetProcessHeap () returned 0x630000 [0061.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657440 [0061.107] GetProcessHeap () returned 0x630000 [0061.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.107] GetProcessHeap () returned 0x630000 [0061.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0061.107] GetProcessHeap () returned 0x630000 [0061.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ecd0 [0061.107] GetProcessHeap () returned 0x630000 [0061.107] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.107] GetProcessHeap () returned 0x630000 [0061.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0061.107] GetProcessHeap () returned 0x630000 [0061.107] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ecd0 | out: hHeap=0x630000) returned 1 [0061.107] GetProcessHeap () returned 0x630000 [0061.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.107] GetProcessHeap () returned 0x630000 [0061.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0061.107] GetProcessHeap () returned 0x630000 [0061.107] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.107] GetProcessHeap () returned 0x630000 [0061.107] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.107] GetProcessHeap () returned 0x630000 [0061.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.107] GetProcessHeap () returned 0x630000 [0061.107] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.107] GetProcessHeap () returned 0x630000 [0061.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ea90 [0061.107] GetProcessHeap () returned 0x630000 [0061.107] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0061.107] GetProcessHeap () returned 0x630000 [0061.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0061.108] GetProcessHeap () returned 0x630000 [0061.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea90 | out: hHeap=0x630000) returned 1 [0061.108] GetProcessHeap () returned 0x630000 [0061.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.108] GetProcessHeap () returned 0x630000 [0061.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.108] GetProcessHeap () returned 0x630000 [0061.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.108] GetProcessHeap () returned 0x630000 [0061.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.108] GetProcessHeap () returned 0x630000 [0061.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.108] GetProcessHeap () returned 0x630000 [0061.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.108] GetProcessHeap () returned 0x630000 [0061.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.108] GetProcessHeap () returned 0x630000 [0061.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.108] GetProcessHeap () returned 0x630000 [0061.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.108] GetProcessHeap () returned 0x630000 [0061.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.108] GetProcessHeap () returned 0x630000 [0061.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.108] GetProcessHeap () returned 0x630000 [0061.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.108] GetProcessHeap () returned 0x630000 [0061.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.108] GetProcessHeap () returned 0x630000 [0061.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.108] GetProcessHeap () returned 0x630000 [0061.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.108] GetProcessHeap () returned 0x630000 [0061.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.108] GetProcessHeap () returned 0x630000 [0061.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.108] GetProcessHeap () returned 0x630000 [0061.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.109] GetProcessHeap () returned 0x630000 [0061.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.109] GetProcessHeap () returned 0x630000 [0061.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.109] GetProcessHeap () returned 0x630000 [0061.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.109] GetProcessHeap () returned 0x630000 [0061.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.109] GetProcessHeap () returned 0x630000 [0061.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.109] GetProcessHeap () returned 0x630000 [0061.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.109] GetProcessHeap () returned 0x630000 [0061.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.109] GetProcessHeap () returned 0x630000 [0061.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.109] GetProcessHeap () returned 0x630000 [0061.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.109] GetProcessHeap () returned 0x630000 [0061.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.109] GetProcessHeap () returned 0x630000 [0061.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.109] GetProcessHeap () returned 0x630000 [0061.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.109] GetProcessHeap () returned 0x630000 [0061.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.109] GetProcessHeap () returned 0x630000 [0061.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.109] GetProcessHeap () returned 0x630000 [0061.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.109] GetProcessHeap () returned 0x630000 [0061.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.109] GetProcessHeap () returned 0x630000 [0061.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.109] GetProcessHeap () returned 0x630000 [0061.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.110] GetProcessHeap () returned 0x630000 [0061.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.110] GetProcessHeap () returned 0x630000 [0061.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.110] GetProcessHeap () returned 0x630000 [0061.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.110] GetProcessHeap () returned 0x630000 [0061.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.110] GetProcessHeap () returned 0x630000 [0061.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.110] GetProcessHeap () returned 0x630000 [0061.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.110] GetProcessHeap () returned 0x630000 [0061.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.110] GetProcessHeap () returned 0x630000 [0061.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.110] GetProcessHeap () returned 0x630000 [0061.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.110] GetProcessHeap () returned 0x630000 [0061.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.110] GetProcessHeap () returned 0x630000 [0061.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.110] GetProcessHeap () returned 0x630000 [0061.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.110] GetProcessHeap () returned 0x630000 [0061.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.110] GetProcessHeap () returned 0x630000 [0061.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.110] GetProcessHeap () returned 0x630000 [0061.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.110] GetProcessHeap () returned 0x630000 [0061.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.110] GetProcessHeap () returned 0x630000 [0061.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0061.110] GetProcessHeap () returned 0x630000 [0061.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0061.110] GetProcessHeap () returned 0x630000 [0061.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.111] GetProcessHeap () returned 0x630000 [0061.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.111] GetProcessHeap () returned 0x630000 [0061.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.111] GetProcessHeap () returned 0x630000 [0061.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.111] GetProcessHeap () returned 0x630000 [0061.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.111] GetProcessHeap () returned 0x630000 [0061.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.111] GetProcessHeap () returned 0x630000 [0061.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.111] GetProcessHeap () returned 0x630000 [0061.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.111] GetProcessHeap () returned 0x630000 [0061.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.111] GetProcessHeap () returned 0x630000 [0061.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.111] GetProcessHeap () returned 0x630000 [0061.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.111] GetProcessHeap () returned 0x630000 [0061.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.111] GetProcessHeap () returned 0x630000 [0061.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.111] GetProcessHeap () returned 0x630000 [0061.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.111] GetProcessHeap () returned 0x630000 [0061.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.111] GetProcessHeap () returned 0x630000 [0061.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.111] GetProcessHeap () returned 0x630000 [0061.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.111] GetProcessHeap () returned 0x630000 [0061.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.111] GetProcessHeap () returned 0x630000 [0061.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.112] GetProcessHeap () returned 0x630000 [0061.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.112] GetProcessHeap () returned 0x630000 [0061.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.112] GetProcessHeap () returned 0x630000 [0061.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.112] GetProcessHeap () returned 0x630000 [0061.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.112] GetProcessHeap () returned 0x630000 [0061.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.112] GetProcessHeap () returned 0x630000 [0061.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.112] GetProcessHeap () returned 0x630000 [0061.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.112] GetProcessHeap () returned 0x630000 [0061.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.112] GetProcessHeap () returned 0x630000 [0061.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.112] GetProcessHeap () returned 0x630000 [0061.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0061.112] GetProcessHeap () returned 0x630000 [0061.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0061.112] GetProcessHeap () returned 0x630000 [0061.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0061.112] GetProcessHeap () returned 0x630000 [0061.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0061.112] GetProcessHeap () returned 0x630000 [0061.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0061.112] GetProcessHeap () returned 0x630000 [0061.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0061.112] GetProcessHeap () returned 0x630000 [0061.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0061.112] GetProcessHeap () returned 0x630000 [0061.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0061.112] GetProcessHeap () returned 0x630000 [0061.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0061.112] GetProcessHeap () returned 0x630000 [0061.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.113] GetProcessHeap () returned 0x630000 [0061.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0061.113] WriteFile (in: hFile=0x230, lpBuffer=0x6546f8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6546f8*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0061.161] GetProcessHeap () returned 0x630000 [0061.161] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6546f8, Size=0x30) returned 0x6546f8 [0061.161] GetProcessHeap () returned 0x630000 [0061.161] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0061.161] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.161] GetProcessHeap () returned 0x630000 [0061.161] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x127b2) returned 0x671bf0 [0061.163] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0x127b2, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0x127b2, lpOverlapped=0x0) returned 1 [0061.164] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.164] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x127b2, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0x127b2, lpOverlapped=0x0) returned 1 [0061.168] GetProcessHeap () returned 0x630000 [0061.168] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0061.169] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.169] WriteFile (in: hFile=0x230, lpBuffer=0x6546f8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6546f8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0061.170] CloseHandle (hObject=0x230) returned 1 [0061.173] GetProcessHeap () returned 0x630000 [0061.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0061.173] GetProcessHeap () returned 0x630000 [0061.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655490 | out: hHeap=0x630000) returned 1 [0061.173] GetProcessHeap () returned 0x630000 [0061.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0061.173] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Music\\g4vOK-TiElqldQ.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\g4vOK-TiElqldQ.wav") returned="C:\\Users\\FD1HVy\\Music\\g4vOK-TiElqldQ.wav" [0061.173] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\g4vOK-TiElqldQ.wav", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Music\\g4vOK-TiElqldQ.wav.happythreechoose") returned="C:\\Users\\FD1HVy\\Music\\g4vOK-TiElqldQ.wav.happythreechoose" [0061.173] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\g4vOK-TiElqldQ.wav" (normalized: "c:\\users\\fd1hvy\\music\\g4vok-tielqldq.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\g4vOK-TiElqldQ.wav.happythreechoose" (normalized: "c:\\users\\fd1hvy\\music\\g4vok-tielqldq.wav.happythreechoose"), dwFlags=0x1) returned 1 [0061.174] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\g4vOK-TiElqldQ.wav" | out: pszPath="C:\\Users\\FD1HVy\\Music") returned 1 [0061.174] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music" | out: pszPath="C:\\Users\\FD1HVy\\Music\\") returned="" [0061.174] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Music\\Decryption INFO.html" [0061.174] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\music\\decryption info.html")) returned 0x20 [0061.174] GetProcessHeap () returned 0x630000 [0061.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645c58 | out: hHeap=0x630000) returned 1 [0061.174] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf21af10, ftCreationTime.dwHighDateTime=0x1d5c814, ftLastAccessTime.dwLowDateTime=0x51067af0, ftLastAccessTime.dwHighDateTime=0x1d5c7a8, ftLastWriteTime.dwLowDateTime=0x51067af0, ftLastWriteTime.dwHighDateTime=0x1d5c7a8, nFileSizeHigh=0x0, nFileSizeLow=0x17378, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hyYj8_bS-vjS3.mp3", cAlternateFileName="HYYJ8_~1.MP3")) returned 1 [0061.174] lstrcmpiW (lpString1="hyYj8_bS-vjS3.mp3", lpString2=".") returned 1 [0061.174] lstrcmpiW (lpString1="hyYj8_bS-vjS3.mp3", lpString2="..") returned 1 [0061.174] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="hyYj8_bS-vjS3.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\hyYj8_bS-vjS3.mp3") returned="C:\\Users\\FD1HVy\\Music\\hyYj8_bS-vjS3.mp3" [0061.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hyYj8_bS-vjS3.mp3", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0061.174] GetProcessHeap () returned 0x630000 [0061.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x645cd8 [0061.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hyYj8_bS-vjS3.mp3", cchWideChar=-1, lpMultiByteStr=0x645cd8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hyYj8_bS-vjS3.mp3", lpUsedDefaultChar=0x0) returned 18 [0061.174] lstrlenA (lpString="hyYj8_bS-vjS3.mp3") returned 17 [0061.174] lstrlenA (lpString=".happythreechoose") returned 17 [0061.174] lstrlenA (lpString=".happythreechoose") returned 17 [0061.174] lstrlenA (lpString="hyYj8_bS-vjS3.mp3") returned 17 [0061.174] lstrcmpiA (lpString1="hyYj8_bS-vjS3.mp3", lpString2=".happythreechoose") returned 1 [0061.174] lstrcmpiW (lpString1="hyYj8_bS-vjS3.mp3", lpString2="Decryption INFO.html") returned 1 [0061.174] lstrcmpiW (lpString1="hyYj8_bS-vjS3.mp3", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0061.174] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0061.174] lstrcmpiW (lpString1="hyYj8_bS-vjS3.mp3", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0061.174] GetProcessHeap () returned 0x630000 [0061.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0061.175] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\hyYj8_bS-vjS3.mp3" (normalized: "c:\\users\\fd1hvy\\music\\hyyj8_bs-vjs3.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0061.175] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=95096) returned 1 [0061.175] GetProcessHeap () returned 0x630000 [0061.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6559b8 [0061.175] GetProcessHeap () returned 0x630000 [0061.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0061.175] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\hyYj8_bS-vjS3.mp3") returned 39 [0061.175] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.175] GetProcessHeap () returned 0x630000 [0061.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0061.175] GetProcessHeap () returned 0x630000 [0061.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x654730 [0061.175] lstrlenA (lpString="rsa_encrypt") returned 11 [0061.175] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0061.176] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0061.176] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0061.176] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0061.176] GetProcessHeap () returned 0x630000 [0061.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0061.176] lstrlenA (lpString="010001") returned 6 [0061.176] GetProcessHeap () returned 0x630000 [0061.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a318 [0061.176] GetProcessHeap () returned 0x630000 [0061.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.176] GetProcessHeap () returned 0x630000 [0061.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e850 [0061.176] GetProcessHeap () returned 0x630000 [0061.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.176] GetProcessHeap () returned 0x630000 [0061.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e4f0 [0061.176] GetProcessHeap () returned 0x630000 [0061.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656950 [0061.176] GetProcessHeap () returned 0x630000 [0061.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2b8 [0061.176] GetProcessHeap () returned 0x630000 [0061.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0061.176] GetProcessHeap () returned 0x630000 [0061.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.176] GetProcessHeap () returned 0x630000 [0061.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0061.176] GetProcessHeap () returned 0x630000 [0061.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.176] GetProcessHeap () returned 0x630000 [0061.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657670 [0061.176] GetProcessHeap () returned 0x630000 [0061.177] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.177] GetProcessHeap () returned 0x630000 [0061.177] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0061.177] GetProcessHeap () returned 0x630000 [0061.177] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e2b0 [0061.177] GetProcessHeap () returned 0x630000 [0061.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.177] GetProcessHeap () returned 0x630000 [0061.177] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0061.177] GetProcessHeap () returned 0x630000 [0061.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e2b0 | out: hHeap=0x630000) returned 1 [0061.177] GetProcessHeap () returned 0x630000 [0061.177] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.177] GetProcessHeap () returned 0x630000 [0061.177] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0061.177] GetProcessHeap () returned 0x630000 [0061.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.177] GetProcessHeap () returned 0x630000 [0061.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.177] GetProcessHeap () returned 0x630000 [0061.177] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.177] GetProcessHeap () returned 0x630000 [0061.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.177] GetProcessHeap () returned 0x630000 [0061.177] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e580 [0061.177] GetProcessHeap () returned 0x630000 [0061.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0061.177] GetProcessHeap () returned 0x630000 [0061.177] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0061.177] GetProcessHeap () returned 0x630000 [0061.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0061.177] GetProcessHeap () returned 0x630000 [0061.177] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.177] GetProcessHeap () returned 0x630000 [0061.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.177] GetProcessHeap () returned 0x630000 [0061.177] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.177] GetProcessHeap () returned 0x630000 [0061.178] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.178] GetProcessHeap () returned 0x630000 [0061.178] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.178] GetProcessHeap () returned 0x630000 [0061.178] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.178] GetProcessHeap () returned 0x630000 [0061.178] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.178] GetProcessHeap () returned 0x630000 [0061.178] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.178] GetProcessHeap () returned 0x630000 [0061.178] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.178] GetProcessHeap () returned 0x630000 [0061.178] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.178] GetProcessHeap () returned 0x630000 [0061.178] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.178] GetProcessHeap () returned 0x630000 [0061.178] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.178] GetProcessHeap () returned 0x630000 [0061.178] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.178] GetProcessHeap () returned 0x630000 [0061.178] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.178] GetProcessHeap () returned 0x630000 [0061.178] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.178] GetProcessHeap () returned 0x630000 [0061.178] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.178] GetProcessHeap () returned 0x630000 [0061.178] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.178] GetProcessHeap () returned 0x630000 [0061.178] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.178] GetProcessHeap () returned 0x630000 [0061.178] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.178] GetProcessHeap () returned 0x630000 [0061.178] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.178] GetProcessHeap () returned 0x630000 [0061.178] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.178] GetProcessHeap () returned 0x630000 [0061.179] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.179] GetProcessHeap () returned 0x630000 [0061.179] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.179] GetProcessHeap () returned 0x630000 [0061.179] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.179] GetProcessHeap () returned 0x630000 [0061.179] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.179] GetProcessHeap () returned 0x630000 [0061.179] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.179] GetProcessHeap () returned 0x630000 [0061.179] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.179] GetProcessHeap () returned 0x630000 [0061.179] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.179] GetProcessHeap () returned 0x630000 [0061.179] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0061.179] GetProcessHeap () returned 0x630000 [0061.179] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0061.179] GetProcessHeap () returned 0x630000 [0061.179] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.179] GetProcessHeap () returned 0x630000 [0061.179] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.179] GetProcessHeap () returned 0x630000 [0061.179] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.179] GetProcessHeap () returned 0x630000 [0061.179] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.179] GetProcessHeap () returned 0x630000 [0061.179] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.179] GetProcessHeap () returned 0x630000 [0061.179] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.179] GetProcessHeap () returned 0x630000 [0061.179] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.179] GetProcessHeap () returned 0x630000 [0061.180] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.180] GetProcessHeap () returned 0x630000 [0061.180] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.180] GetProcessHeap () returned 0x630000 [0061.180] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.180] GetProcessHeap () returned 0x630000 [0061.180] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.180] GetProcessHeap () returned 0x630000 [0061.180] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.180] GetProcessHeap () returned 0x630000 [0061.180] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.180] GetProcessHeap () returned 0x630000 [0061.180] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.180] GetProcessHeap () returned 0x630000 [0061.180] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.180] GetProcessHeap () returned 0x630000 [0061.180] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.180] GetProcessHeap () returned 0x630000 [0061.180] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.180] GetProcessHeap () returned 0x630000 [0061.180] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.180] GetProcessHeap () returned 0x630000 [0061.180] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.180] GetProcessHeap () returned 0x630000 [0061.180] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.180] GetProcessHeap () returned 0x630000 [0061.180] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.180] GetProcessHeap () returned 0x630000 [0061.180] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.180] GetProcessHeap () returned 0x630000 [0061.180] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.180] GetProcessHeap () returned 0x630000 [0061.180] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.181] GetProcessHeap () returned 0x630000 [0061.181] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.181] GetProcessHeap () returned 0x630000 [0061.181] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.181] GetProcessHeap () returned 0x630000 [0061.181] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.181] GetProcessHeap () returned 0x630000 [0061.181] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.181] GetProcessHeap () returned 0x630000 [0061.181] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.181] GetProcessHeap () returned 0x630000 [0061.181] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.181] GetProcessHeap () returned 0x630000 [0061.181] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.181] GetProcessHeap () returned 0x630000 [0061.181] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.181] GetProcessHeap () returned 0x630000 [0061.181] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.181] GetProcessHeap () returned 0x630000 [0061.181] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.181] GetProcessHeap () returned 0x630000 [0061.181] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.181] GetProcessHeap () returned 0x630000 [0061.181] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.181] GetProcessHeap () returned 0x630000 [0061.181] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.181] GetProcessHeap () returned 0x630000 [0061.181] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.181] GetProcessHeap () returned 0x630000 [0061.181] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.181] GetProcessHeap () returned 0x630000 [0061.181] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.181] GetProcessHeap () returned 0x630000 [0061.181] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.181] GetProcessHeap () returned 0x630000 [0061.181] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.181] GetProcessHeap () returned 0x630000 [0061.181] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.182] GetProcessHeap () returned 0x630000 [0061.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.182] GetProcessHeap () returned 0x630000 [0061.182] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.182] GetProcessHeap () returned 0x630000 [0061.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.182] GetProcessHeap () returned 0x630000 [0061.182] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.182] GetProcessHeap () returned 0x630000 [0061.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.182] GetProcessHeap () returned 0x630000 [0061.182] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.182] GetProcessHeap () returned 0x630000 [0061.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.182] GetProcessHeap () returned 0x630000 [0061.182] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.182] GetProcessHeap () returned 0x630000 [0061.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.182] GetProcessHeap () returned 0x630000 [0061.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0061.182] GetProcessHeap () returned 0x630000 [0061.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0061.182] GetProcessHeap () returned 0x630000 [0061.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0061.182] GetProcessHeap () returned 0x630000 [0061.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0061.182] GetProcessHeap () returned 0x630000 [0061.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0061.182] GetProcessHeap () returned 0x630000 [0061.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0061.182] GetProcessHeap () returned 0x630000 [0061.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0061.182] GetProcessHeap () returned 0x630000 [0061.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0061.182] GetProcessHeap () returned 0x630000 [0061.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0061.183] GetProcessHeap () returned 0x630000 [0061.183] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.183] GetProcessHeap () returned 0x630000 [0061.183] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0061.183] WriteFile (in: hFile=0x230, lpBuffer=0x654730*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654730*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0061.184] GetProcessHeap () returned 0x630000 [0061.184] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x654730, Size=0x30) returned 0x654730 [0061.184] GetProcessHeap () returned 0x630000 [0061.184] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0061.184] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.184] GetProcessHeap () returned 0x630000 [0061.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x17378) returned 0x671bf0 [0061.187] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0x17378, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0x17378, lpOverlapped=0x0) returned 1 [0061.188] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.188] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x17378, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0x17378, lpOverlapped=0x0) returned 1 [0061.190] GetProcessHeap () returned 0x630000 [0061.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0061.190] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.190] WriteFile (in: hFile=0x230, lpBuffer=0x654730*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654730*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0061.191] CloseHandle (hObject=0x230) returned 1 [0061.194] GetProcessHeap () returned 0x630000 [0061.194] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0061.194] GetProcessHeap () returned 0x630000 [0061.194] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6559b8 | out: hHeap=0x630000) returned 1 [0061.194] GetProcessHeap () returned 0x630000 [0061.194] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0061.194] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Music\\hyYj8_bS-vjS3.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\hyYj8_bS-vjS3.mp3") returned="C:\\Users\\FD1HVy\\Music\\hyYj8_bS-vjS3.mp3" [0061.194] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\hyYj8_bS-vjS3.mp3", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Music\\hyYj8_bS-vjS3.mp3.happythreechoose") returned="C:\\Users\\FD1HVy\\Music\\hyYj8_bS-vjS3.mp3.happythreechoose" [0061.194] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\hyYj8_bS-vjS3.mp3" (normalized: "c:\\users\\fd1hvy\\music\\hyyj8_bs-vjs3.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\hyYj8_bS-vjS3.mp3.happythreechoose" (normalized: "c:\\users\\fd1hvy\\music\\hyyj8_bs-vjs3.mp3.happythreechoose"), dwFlags=0x1) returned 1 [0061.195] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\hyYj8_bS-vjS3.mp3" | out: pszPath="C:\\Users\\FD1HVy\\Music") returned 1 [0061.195] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music" | out: pszPath="C:\\Users\\FD1HVy\\Music\\") returned="" [0061.195] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Music\\Decryption INFO.html" [0061.195] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\music\\decryption info.html")) returned 0x20 [0061.195] GetProcessHeap () returned 0x630000 [0061.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645cd8 | out: hHeap=0x630000) returned 1 [0061.195] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28de95e0, ftCreationTime.dwHighDateTime=0x1d5cff9, ftLastAccessTime.dwLowDateTime=0x90a74590, ftLastAccessTime.dwHighDateTime=0x1d5ca55, ftLastWriteTime.dwLowDateTime=0x90a74590, ftLastWriteTime.dwHighDateTime=0x1d5ca55, nFileSizeHigh=0x0, nFileSizeLow=0xdb27, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="iy3RchGXqk6KtHtM.mp3", cAlternateFileName="IY3RCH~1.MP3")) returned 1 [0061.195] lstrcmpiW (lpString1="iy3RchGXqk6KtHtM.mp3", lpString2=".") returned 1 [0061.195] lstrcmpiW (lpString1="iy3RchGXqk6KtHtM.mp3", lpString2="..") returned 1 [0061.195] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="iy3RchGXqk6KtHtM.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\iy3RchGXqk6KtHtM.mp3") returned="C:\\Users\\FD1HVy\\Music\\iy3RchGXqk6KtHtM.mp3" [0061.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iy3RchGXqk6KtHtM.mp3", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0061.195] GetProcessHeap () returned 0x630000 [0061.195] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x15) returned 0x645e58 [0061.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iy3RchGXqk6KtHtM.mp3", cchWideChar=-1, lpMultiByteStr=0x645e58, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iy3RchGXqk6KtHtM.mp3", lpUsedDefaultChar=0x0) returned 21 [0061.195] lstrlenA (lpString="iy3RchGXqk6KtHtM.mp3") returned 20 [0061.195] lstrlenA (lpString=".happythreechoose") returned 17 [0061.195] lstrlenA (lpString=".happythreechoose") returned 17 [0061.195] lstrlenA (lpString="iy3RchGXqk6KtHtM.mp3") returned 20 [0061.195] lstrcmpiA (lpString1="RchGXqk6KtHtM.mp3", lpString2=".happythreechoose") returned 1 [0061.195] lstrcmpiW (lpString1="iy3RchGXqk6KtHtM.mp3", lpString2="Decryption INFO.html") returned 1 [0061.195] lstrcmpiW (lpString1="iy3RchGXqk6KtHtM.mp3", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0061.195] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0061.196] lstrcmpiW (lpString1="iy3RchGXqk6KtHtM.mp3", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0061.196] GetProcessHeap () returned 0x630000 [0061.196] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0061.196] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\iy3RchGXqk6KtHtM.mp3" (normalized: "c:\\users\\fd1hvy\\music\\iy3rchgxqk6kthtm.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0061.196] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=56103) returned 1 [0061.196] GetProcessHeap () returned 0x630000 [0061.196] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655aa8 [0061.196] GetProcessHeap () returned 0x630000 [0061.196] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0061.196] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\iy3RchGXqk6KtHtM.mp3") returned 42 [0061.196] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.196] GetProcessHeap () returned 0x630000 [0061.196] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0061.196] GetProcessHeap () returned 0x630000 [0061.196] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x389) returned 0x654768 [0061.196] lstrlenA (lpString="rsa_encrypt") returned 11 [0061.196] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0061.197] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0061.197] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0061.197] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0061.197] GetProcessHeap () returned 0x630000 [0061.197] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0061.197] lstrlenA (lpString="010001") returned 6 [0061.197] GetProcessHeap () returned 0x630000 [0061.197] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a318 [0061.197] GetProcessHeap () returned 0x630000 [0061.197] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.197] GetProcessHeap () returned 0x630000 [0061.197] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0061.197] GetProcessHeap () returned 0x630000 [0061.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.197] GetProcessHeap () returned 0x630000 [0061.197] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e100 [0061.197] GetProcessHeap () returned 0x630000 [0061.197] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657670 [0061.197] GetProcessHeap () returned 0x630000 [0061.197] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0061.197] GetProcessHeap () returned 0x630000 [0061.197] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0061.197] GetProcessHeap () returned 0x630000 [0061.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.197] GetProcessHeap () returned 0x630000 [0061.197] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0061.197] GetProcessHeap () returned 0x630000 [0061.197] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.198] GetProcessHeap () returned 0x630000 [0061.198] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657328 [0061.198] GetProcessHeap () returned 0x630000 [0061.198] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.198] GetProcessHeap () returned 0x630000 [0061.198] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0061.198] GetProcessHeap () returned 0x630000 [0061.198] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dec0 [0061.198] GetProcessHeap () returned 0x630000 [0061.198] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.198] GetProcessHeap () returned 0x630000 [0061.198] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0061.198] GetProcessHeap () returned 0x630000 [0061.198] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0061.198] GetProcessHeap () returned 0x630000 [0061.198] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.198] GetProcessHeap () returned 0x630000 [0061.198] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0061.198] GetProcessHeap () returned 0x630000 [0061.198] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.198] GetProcessHeap () returned 0x630000 [0061.198] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.198] GetProcessHeap () returned 0x630000 [0061.198] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.198] GetProcessHeap () returned 0x630000 [0061.198] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.198] GetProcessHeap () returned 0x630000 [0061.198] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ebb0 [0061.198] GetProcessHeap () returned 0x630000 [0061.198] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0061.198] GetProcessHeap () returned 0x630000 [0061.198] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0061.198] GetProcessHeap () returned 0x630000 [0061.198] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0061.198] GetProcessHeap () returned 0x630000 [0061.198] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0061.198] GetProcessHeap () returned 0x630000 [0061.199] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0061.199] GetProcessHeap () returned 0x630000 [0061.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.199] GetProcessHeap () returned 0x630000 [0061.199] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.199] GetProcessHeap () returned 0x630000 [0061.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.199] GetProcessHeap () returned 0x630000 [0061.199] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.199] GetProcessHeap () returned 0x630000 [0061.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.199] GetProcessHeap () returned 0x630000 [0061.199] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.199] GetProcessHeap () returned 0x630000 [0061.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.199] GetProcessHeap () returned 0x630000 [0061.199] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.199] GetProcessHeap () returned 0x630000 [0061.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.199] GetProcessHeap () returned 0x630000 [0061.199] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.199] GetProcessHeap () returned 0x630000 [0061.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.199] GetProcessHeap () returned 0x630000 [0061.199] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.199] GetProcessHeap () returned 0x630000 [0061.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.199] GetProcessHeap () returned 0x630000 [0061.199] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.199] GetProcessHeap () returned 0x630000 [0061.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.199] GetProcessHeap () returned 0x630000 [0061.199] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.199] GetProcessHeap () returned 0x630000 [0061.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.199] GetProcessHeap () returned 0x630000 [0061.199] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.200] GetProcessHeap () returned 0x630000 [0061.200] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.200] GetProcessHeap () returned 0x630000 [0061.200] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.200] GetProcessHeap () returned 0x630000 [0061.200] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.200] GetProcessHeap () returned 0x630000 [0061.200] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.200] GetProcessHeap () returned 0x630000 [0061.200] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.200] GetProcessHeap () returned 0x630000 [0061.200] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.200] GetProcessHeap () returned 0x630000 [0061.200] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.200] GetProcessHeap () returned 0x630000 [0061.200] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.200] GetProcessHeap () returned 0x630000 [0061.200] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.200] GetProcessHeap () returned 0x630000 [0061.200] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.200] GetProcessHeap () returned 0x630000 [0061.200] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.200] GetProcessHeap () returned 0x630000 [0061.200] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.200] GetProcessHeap () returned 0x630000 [0061.200] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.200] GetProcessHeap () returned 0x630000 [0061.200] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.200] GetProcessHeap () returned 0x630000 [0061.200] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.200] GetProcessHeap () returned 0x630000 [0061.200] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.200] GetProcessHeap () returned 0x630000 [0061.200] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.200] GetProcessHeap () returned 0x630000 [0061.200] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.201] GetProcessHeap () returned 0x630000 [0061.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.201] GetProcessHeap () returned 0x630000 [0061.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.201] GetProcessHeap () returned 0x630000 [0061.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.201] GetProcessHeap () returned 0x630000 [0061.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.201] GetProcessHeap () returned 0x630000 [0061.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.201] GetProcessHeap () returned 0x630000 [0061.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.201] GetProcessHeap () returned 0x630000 [0061.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.201] GetProcessHeap () returned 0x630000 [0061.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.201] GetProcessHeap () returned 0x630000 [0061.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.201] GetProcessHeap () returned 0x630000 [0061.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.201] GetProcessHeap () returned 0x630000 [0061.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.201] GetProcessHeap () returned 0x630000 [0061.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.201] GetProcessHeap () returned 0x630000 [0061.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.201] GetProcessHeap () returned 0x630000 [0061.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.201] GetProcessHeap () returned 0x630000 [0061.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.201] GetProcessHeap () returned 0x630000 [0061.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.201] GetProcessHeap () returned 0x630000 [0061.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.201] GetProcessHeap () returned 0x630000 [0061.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.201] GetProcessHeap () returned 0x630000 [0061.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.202] GetProcessHeap () returned 0x630000 [0061.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.202] GetProcessHeap () returned 0x630000 [0061.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.202] GetProcessHeap () returned 0x630000 [0061.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.202] GetProcessHeap () returned 0x630000 [0061.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.202] GetProcessHeap () returned 0x630000 [0061.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.202] GetProcessHeap () returned 0x630000 [0061.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.202] GetProcessHeap () returned 0x630000 [0061.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.202] GetProcessHeap () returned 0x630000 [0061.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.202] GetProcessHeap () returned 0x630000 [0061.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.202] GetProcessHeap () returned 0x630000 [0061.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.202] GetProcessHeap () returned 0x630000 [0061.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.202] GetProcessHeap () returned 0x630000 [0061.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.202] GetProcessHeap () returned 0x630000 [0061.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.202] GetProcessHeap () returned 0x630000 [0061.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.202] GetProcessHeap () returned 0x630000 [0061.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.202] GetProcessHeap () returned 0x630000 [0061.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.202] GetProcessHeap () returned 0x630000 [0061.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.202] GetProcessHeap () returned 0x630000 [0061.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.203] GetProcessHeap () returned 0x630000 [0061.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.203] GetProcessHeap () returned 0x630000 [0061.203] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.203] GetProcessHeap () returned 0x630000 [0061.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.203] GetProcessHeap () returned 0x630000 [0061.203] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.203] GetProcessHeap () returned 0x630000 [0061.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.203] GetProcessHeap () returned 0x630000 [0061.203] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.203] GetProcessHeap () returned 0x630000 [0061.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.203] GetProcessHeap () returned 0x630000 [0061.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0061.203] GetProcessHeap () returned 0x630000 [0061.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0061.203] GetProcessHeap () returned 0x630000 [0061.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0061.203] GetProcessHeap () returned 0x630000 [0061.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0061.203] GetProcessHeap () returned 0x630000 [0061.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0061.203] GetProcessHeap () returned 0x630000 [0061.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0061.203] GetProcessHeap () returned 0x630000 [0061.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0061.203] GetProcessHeap () returned 0x630000 [0061.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0061.203] GetProcessHeap () returned 0x630000 [0061.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0061.203] GetProcessHeap () returned 0x630000 [0061.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.203] GetProcessHeap () returned 0x630000 [0061.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0061.204] WriteFile (in: hFile=0x230, lpBuffer=0x654768*, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654768*, lpNumberOfBytesWritten=0x243d864*=0x389, lpOverlapped=0x0) returned 1 [0061.220] GetProcessHeap () returned 0x630000 [0061.220] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x654768, Size=0x30) returned 0x654768 [0061.220] GetProcessHeap () returned 0x630000 [0061.220] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0061.220] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.220] GetProcessHeap () returned 0x630000 [0061.220] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xdb30) returned 0x671bf0 [0061.220] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0xdb30, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0xdb30, lpOverlapped=0x0) returned 1 [0061.220] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.221] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0xdb30, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0xdb30, lpOverlapped=0x0) returned 1 [0061.222] GetProcessHeap () returned 0x630000 [0061.222] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0061.224] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.224] WriteFile (in: hFile=0x230, lpBuffer=0x654768*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654768*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0061.225] CloseHandle (hObject=0x230) returned 1 [0061.227] GetProcessHeap () returned 0x630000 [0061.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0061.227] GetProcessHeap () returned 0x630000 [0061.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655aa8 | out: hHeap=0x630000) returned 1 [0061.227] GetProcessHeap () returned 0x630000 [0061.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0061.227] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Music\\iy3RchGXqk6KtHtM.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\iy3RchGXqk6KtHtM.mp3") returned="C:\\Users\\FD1HVy\\Music\\iy3RchGXqk6KtHtM.mp3" [0061.228] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\iy3RchGXqk6KtHtM.mp3", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Music\\iy3RchGXqk6KtHtM.mp3.happythreechoose") returned="C:\\Users\\FD1HVy\\Music\\iy3RchGXqk6KtHtM.mp3.happythreechoose" [0061.228] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\iy3RchGXqk6KtHtM.mp3" (normalized: "c:\\users\\fd1hvy\\music\\iy3rchgxqk6kthtm.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\iy3RchGXqk6KtHtM.mp3.happythreechoose" (normalized: "c:\\users\\fd1hvy\\music\\iy3rchgxqk6kthtm.mp3.happythreechoose"), dwFlags=0x1) returned 1 [0061.228] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\iy3RchGXqk6KtHtM.mp3" | out: pszPath="C:\\Users\\FD1HVy\\Music") returned 1 [0061.228] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music" | out: pszPath="C:\\Users\\FD1HVy\\Music\\") returned="" [0061.229] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Music\\Decryption INFO.html" [0061.229] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\music\\decryption info.html")) returned 0x20 [0061.229] GetProcessHeap () returned 0x630000 [0061.229] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645e58 | out: hHeap=0x630000) returned 1 [0061.229] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec2e0b0, ftCreationTime.dwHighDateTime=0x1d5d71d, ftLastAccessTime.dwLowDateTime=0xea6f3740, ftLastAccessTime.dwHighDateTime=0x1d5cf78, ftLastWriteTime.dwLowDateTime=0xea6f3740, ftLastWriteTime.dwHighDateTime=0x1d5cf78, nFileSizeHigh=0x0, nFileSizeLow=0x128af, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rO8U44s1q.m4a", cAlternateFileName="RO8U44~1.M4A")) returned 1 [0061.229] lstrcmpiW (lpString1="rO8U44s1q.m4a", lpString2=".") returned 1 [0061.229] lstrcmpiW (lpString1="rO8U44s1q.m4a", lpString2="..") returned 1 [0061.229] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="rO8U44s1q.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\rO8U44s1q.m4a") returned="C:\\Users\\FD1HVy\\Music\\rO8U44s1q.m4a" [0061.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rO8U44s1q.m4a", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0061.229] GetProcessHeap () returned 0x630000 [0061.229] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x64c9f0 [0061.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rO8U44s1q.m4a", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rO8U44s1q.m4a", lpUsedDefaultChar=0x0) returned 14 [0061.229] lstrlenA (lpString="rO8U44s1q.m4a") returned 13 [0061.229] lstrlenA (lpString=".happythreechoose") returned 17 [0061.229] lstrcmpiW (lpString1="rO8U44s1q.m4a", lpString2="Decryption INFO.html") returned 1 [0061.229] lstrcmpiW (lpString1="rO8U44s1q.m4a", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0061.229] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0061.229] lstrcmpiW (lpString1="rO8U44s1q.m4a", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0061.229] GetProcessHeap () returned 0x630000 [0061.229] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0061.229] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\rO8U44s1q.m4a" (normalized: "c:\\users\\fd1hvy\\music\\ro8u44s1q.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0061.229] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=75951) returned 1 [0061.229] GetProcessHeap () returned 0x630000 [0061.229] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655a30 [0061.229] GetProcessHeap () returned 0x630000 [0061.229] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0061.229] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\rO8U44s1q.m4a") returned 35 [0061.230] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.230] GetProcessHeap () returned 0x630000 [0061.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0061.230] GetProcessHeap () returned 0x630000 [0061.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x6547a0 [0061.230] lstrlenA (lpString="rsa_encrypt") returned 11 [0061.230] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0061.230] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0061.230] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0061.230] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0061.230] GetProcessHeap () returned 0x630000 [0061.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0061.230] lstrlenA (lpString="010001") returned 6 [0061.230] GetProcessHeap () returned 0x630000 [0061.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0061.231] GetProcessHeap () returned 0x630000 [0061.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.231] GetProcessHeap () returned 0x630000 [0061.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0061.231] GetProcessHeap () returned 0x630000 [0061.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.231] GetProcessHeap () returned 0x630000 [0061.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0061.231] GetProcessHeap () returned 0x630000 [0061.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x6570f8 [0061.231] GetProcessHeap () returned 0x630000 [0061.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0061.231] GetProcessHeap () returned 0x630000 [0061.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0061.231] GetProcessHeap () returned 0x630000 [0061.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.231] GetProcessHeap () returned 0x630000 [0061.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0061.231] GetProcessHeap () returned 0x630000 [0061.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.231] GetProcessHeap () returned 0x630000 [0061.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657328 [0061.231] GetProcessHeap () returned 0x630000 [0061.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.231] GetProcessHeap () returned 0x630000 [0061.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0061.231] GetProcessHeap () returned 0x630000 [0061.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dec0 [0061.231] GetProcessHeap () returned 0x630000 [0061.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.231] GetProcessHeap () returned 0x630000 [0061.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0061.231] GetProcessHeap () returned 0x630000 [0061.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0061.231] GetProcessHeap () returned 0x630000 [0061.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.231] GetProcessHeap () returned 0x630000 [0061.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x6616c8 [0061.232] GetProcessHeap () returned 0x630000 [0061.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.232] GetProcessHeap () returned 0x630000 [0061.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.232] GetProcessHeap () returned 0x630000 [0061.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.232] GetProcessHeap () returned 0x630000 [0061.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.232] GetProcessHeap () returned 0x630000 [0061.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ecd0 [0061.232] GetProcessHeap () returned 0x630000 [0061.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6616c8 | out: hHeap=0x630000) returned 1 [0061.232] GetProcessHeap () returned 0x630000 [0061.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0061.232] GetProcessHeap () returned 0x630000 [0061.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ecd0 | out: hHeap=0x630000) returned 1 [0061.232] GetProcessHeap () returned 0x630000 [0061.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.232] GetProcessHeap () returned 0x630000 [0061.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.232] GetProcessHeap () returned 0x630000 [0061.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0061.232] GetProcessHeap () returned 0x630000 [0061.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0061.232] GetProcessHeap () returned 0x630000 [0061.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.232] GetProcessHeap () returned 0x630000 [0061.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.232] GetProcessHeap () returned 0x630000 [0061.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.232] GetProcessHeap () returned 0x630000 [0061.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.232] GetProcessHeap () returned 0x630000 [0061.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.232] GetProcessHeap () returned 0x630000 [0061.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.232] GetProcessHeap () returned 0x630000 [0061.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.233] GetProcessHeap () returned 0x630000 [0061.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.233] GetProcessHeap () returned 0x630000 [0061.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.233] GetProcessHeap () returned 0x630000 [0061.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.233] GetProcessHeap () returned 0x630000 [0061.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.233] GetProcessHeap () returned 0x630000 [0061.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.233] GetProcessHeap () returned 0x630000 [0061.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.233] GetProcessHeap () returned 0x630000 [0061.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.233] GetProcessHeap () returned 0x630000 [0061.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.233] GetProcessHeap () returned 0x630000 [0061.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.233] GetProcessHeap () returned 0x630000 [0061.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.233] GetProcessHeap () returned 0x630000 [0061.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.233] GetProcessHeap () returned 0x630000 [0061.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.233] GetProcessHeap () returned 0x630000 [0061.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.233] GetProcessHeap () returned 0x630000 [0061.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.233] GetProcessHeap () returned 0x630000 [0061.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.233] GetProcessHeap () returned 0x630000 [0061.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.233] GetProcessHeap () returned 0x630000 [0061.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.233] GetProcessHeap () returned 0x630000 [0061.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.233] GetProcessHeap () returned 0x630000 [0061.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.234] GetProcessHeap () returned 0x630000 [0061.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.234] GetProcessHeap () returned 0x630000 [0061.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.234] GetProcessHeap () returned 0x630000 [0061.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.234] GetProcessHeap () returned 0x630000 [0061.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.234] GetProcessHeap () returned 0x630000 [0061.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.234] GetProcessHeap () returned 0x630000 [0061.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.234] GetProcessHeap () returned 0x630000 [0061.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.234] GetProcessHeap () returned 0x630000 [0061.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.234] GetProcessHeap () returned 0x630000 [0061.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.234] GetProcessHeap () returned 0x630000 [0061.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.234] GetProcessHeap () returned 0x630000 [0061.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.234] GetProcessHeap () returned 0x630000 [0061.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.234] GetProcessHeap () returned 0x630000 [0061.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.234] GetProcessHeap () returned 0x630000 [0061.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.234] GetProcessHeap () returned 0x630000 [0061.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.234] GetProcessHeap () returned 0x630000 [0061.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.234] GetProcessHeap () returned 0x630000 [0061.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.234] GetProcessHeap () returned 0x630000 [0061.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.235] GetProcessHeap () returned 0x630000 [0061.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.235] GetProcessHeap () returned 0x630000 [0061.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.235] GetProcessHeap () returned 0x630000 [0061.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.235] GetProcessHeap () returned 0x630000 [0061.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.235] GetProcessHeap () returned 0x630000 [0061.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.235] GetProcessHeap () returned 0x630000 [0061.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.235] GetProcessHeap () returned 0x630000 [0061.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.235] GetProcessHeap () returned 0x630000 [0061.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.235] GetProcessHeap () returned 0x630000 [0061.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.235] GetProcessHeap () returned 0x630000 [0061.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.235] GetProcessHeap () returned 0x630000 [0061.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.235] GetProcessHeap () returned 0x630000 [0061.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.235] GetProcessHeap () returned 0x630000 [0061.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0061.235] GetProcessHeap () returned 0x630000 [0061.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0061.235] GetProcessHeap () returned 0x630000 [0061.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.235] GetProcessHeap () returned 0x630000 [0061.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.235] GetProcessHeap () returned 0x630000 [0061.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.235] GetProcessHeap () returned 0x630000 [0061.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.235] GetProcessHeap () returned 0x630000 [0061.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.236] GetProcessHeap () returned 0x630000 [0061.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.236] GetProcessHeap () returned 0x630000 [0061.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.236] GetProcessHeap () returned 0x630000 [0061.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.236] GetProcessHeap () returned 0x630000 [0061.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.236] GetProcessHeap () returned 0x630000 [0061.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.236] GetProcessHeap () returned 0x630000 [0061.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.236] GetProcessHeap () returned 0x630000 [0061.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.236] GetProcessHeap () returned 0x630000 [0061.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.236] GetProcessHeap () returned 0x630000 [0061.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.236] GetProcessHeap () returned 0x630000 [0061.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.236] GetProcessHeap () returned 0x630000 [0061.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.236] GetProcessHeap () returned 0x630000 [0061.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.236] GetProcessHeap () returned 0x630000 [0061.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.236] GetProcessHeap () returned 0x630000 [0061.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.236] GetProcessHeap () returned 0x630000 [0061.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.236] GetProcessHeap () returned 0x630000 [0061.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0061.236] GetProcessHeap () returned 0x630000 [0061.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0061.236] GetProcessHeap () returned 0x630000 [0061.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0061.237] GetProcessHeap () returned 0x630000 [0061.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0061.237] GetProcessHeap () returned 0x630000 [0061.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0061.237] GetProcessHeap () returned 0x630000 [0061.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0061.237] GetProcessHeap () returned 0x630000 [0061.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0061.237] GetProcessHeap () returned 0x630000 [0061.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0061.237] GetProcessHeap () returned 0x630000 [0061.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0061.237] GetProcessHeap () returned 0x630000 [0061.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.237] GetProcessHeap () returned 0x630000 [0061.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0061.237] WriteFile (in: hFile=0x230, lpBuffer=0x6547a0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6547a0*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0061.242] GetProcessHeap () returned 0x630000 [0061.242] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6547a0, Size=0x30) returned 0x6547a0 [0061.242] GetProcessHeap () returned 0x630000 [0061.242] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0061.242] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.242] GetProcessHeap () returned 0x630000 [0061.242] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x128af) returned 0x671bf0 [0061.244] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0x128af, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0x128af, lpOverlapped=0x0) returned 1 [0061.245] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.245] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x128af, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0x128af, lpOverlapped=0x0) returned 1 [0061.247] GetProcessHeap () returned 0x630000 [0061.247] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0061.247] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.247] WriteFile (in: hFile=0x230, lpBuffer=0x6547a0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6547a0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0061.248] CloseHandle (hObject=0x230) returned 1 [0061.250] GetProcessHeap () returned 0x630000 [0061.250] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0061.250] GetProcessHeap () returned 0x630000 [0061.250] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655a30 | out: hHeap=0x630000) returned 1 [0061.250] GetProcessHeap () returned 0x630000 [0061.250] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0061.250] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Music\\rO8U44s1q.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\rO8U44s1q.m4a") returned="C:\\Users\\FD1HVy\\Music\\rO8U44s1q.m4a" [0061.250] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\rO8U44s1q.m4a", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Music\\rO8U44s1q.m4a.happythreechoose") returned="C:\\Users\\FD1HVy\\Music\\rO8U44s1q.m4a.happythreechoose" [0061.250] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\rO8U44s1q.m4a" (normalized: "c:\\users\\fd1hvy\\music\\ro8u44s1q.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\rO8U44s1q.m4a.happythreechoose" (normalized: "c:\\users\\fd1hvy\\music\\ro8u44s1q.m4a.happythreechoose"), dwFlags=0x1) returned 1 [0061.251] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\rO8U44s1q.m4a" | out: pszPath="C:\\Users\\FD1HVy\\Music") returned 1 [0061.251] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music" | out: pszPath="C:\\Users\\FD1HVy\\Music\\") returned="" [0061.251] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Music\\Decryption INFO.html" [0061.251] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\music\\decryption info.html")) returned 0x20 [0061.251] GetProcessHeap () returned 0x630000 [0061.251] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0061.251] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x876c44a0, ftCreationTime.dwHighDateTime=0x1d5cb66, ftLastAccessTime.dwLowDateTime=0x57c4f0, ftLastAccessTime.dwHighDateTime=0x1d5c9c5, ftLastWriteTime.dwLowDateTime=0x57c4f0, ftLastWriteTime.dwHighDateTime=0x1d5c9c5, nFileSizeHigh=0x0, nFileSizeLow=0x120f1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="T57mOAnFPiHZVJuX_.m4a", cAlternateFileName="T57MOA~1.M4A")) returned 1 [0061.251] lstrcmpiW (lpString1="T57mOAnFPiHZVJuX_.m4a", lpString2=".") returned 1 [0061.251] lstrcmpiW (lpString1="T57mOAnFPiHZVJuX_.m4a", lpString2="..") returned 1 [0061.251] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="T57mOAnFPiHZVJuX_.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\T57mOAnFPiHZVJuX_.m4a") returned="C:\\Users\\FD1HVy\\Music\\T57mOAnFPiHZVJuX_.m4a" [0061.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="T57mOAnFPiHZVJuX_.m4a", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0061.251] GetProcessHeap () returned 0x630000 [0061.251] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x645ff8 [0061.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="T57mOAnFPiHZVJuX_.m4a", cchWideChar=-1, lpMultiByteStr=0x645ff8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="T57mOAnFPiHZVJuX_.m4a", lpUsedDefaultChar=0x0) returned 22 [0061.251] lstrlenA (lpString="T57mOAnFPiHZVJuX_.m4a") returned 21 [0061.251] lstrlenA (lpString=".happythreechoose") returned 17 [0061.252] lstrlenA (lpString=".happythreechoose") returned 17 [0061.252] lstrlenA (lpString="T57mOAnFPiHZVJuX_.m4a") returned 21 [0061.252] lstrcmpiA (lpString1="OAnFPiHZVJuX_.m4a", lpString2=".happythreechoose") returned 1 [0061.252] lstrcmpiW (lpString1="T57mOAnFPiHZVJuX_.m4a", lpString2="Decryption INFO.html") returned 1 [0061.252] lstrcmpiW (lpString1="T57mOAnFPiHZVJuX_.m4a", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0061.252] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0061.252] lstrcmpiW (lpString1="T57mOAnFPiHZVJuX_.m4a", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0061.252] GetProcessHeap () returned 0x630000 [0061.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0061.252] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\T57mOAnFPiHZVJuX_.m4a" (normalized: "c:\\users\\fd1hvy\\music\\t57moanfpihzvjux_.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0061.252] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=73969) returned 1 [0061.252] GetProcessHeap () returned 0x630000 [0061.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655aa8 [0061.252] GetProcessHeap () returned 0x630000 [0061.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0061.252] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\T57mOAnFPiHZVJuX_.m4a") returned 43 [0061.252] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.252] GetProcessHeap () returned 0x630000 [0061.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0061.252] GetProcessHeap () returned 0x630000 [0061.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x6547d8 [0061.252] lstrlenA (lpString="rsa_encrypt") returned 11 [0061.252] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0061.254] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0061.254] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0061.254] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0061.254] GetProcessHeap () returned 0x630000 [0061.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0061.254] lstrlenA (lpString="010001") returned 6 [0061.254] GetProcessHeap () returned 0x630000 [0061.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0061.254] GetProcessHeap () returned 0x630000 [0061.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.254] GetProcessHeap () returned 0x630000 [0061.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e100 [0061.254] GetProcessHeap () returned 0x630000 [0061.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.254] GetProcessHeap () returned 0x630000 [0061.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e610 [0061.254] GetProcessHeap () returned 0x630000 [0061.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656ec8 [0061.255] GetProcessHeap () returned 0x630000 [0061.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2b8 [0061.255] GetProcessHeap () returned 0x630000 [0061.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0061.255] GetProcessHeap () returned 0x630000 [0061.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.255] GetProcessHeap () returned 0x630000 [0061.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0061.255] GetProcessHeap () returned 0x630000 [0061.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.255] GetProcessHeap () returned 0x630000 [0061.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x6570f8 [0061.255] GetProcessHeap () returned 0x630000 [0061.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.255] GetProcessHeap () returned 0x630000 [0061.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0061.255] GetProcessHeap () returned 0x630000 [0061.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e460 [0061.255] GetProcessHeap () returned 0x630000 [0061.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.255] GetProcessHeap () returned 0x630000 [0061.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0061.255] GetProcessHeap () returned 0x630000 [0061.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e460 | out: hHeap=0x630000) returned 1 [0061.255] GetProcessHeap () returned 0x630000 [0061.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.255] GetProcessHeap () returned 0x630000 [0061.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0061.255] GetProcessHeap () returned 0x630000 [0061.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.255] GetProcessHeap () returned 0x630000 [0061.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.255] GetProcessHeap () returned 0x630000 [0061.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.255] GetProcessHeap () returned 0x630000 [0061.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.255] GetProcessHeap () returned 0x630000 [0061.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e190 [0061.255] GetProcessHeap () returned 0x630000 [0061.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0061.256] GetProcessHeap () returned 0x630000 [0061.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0061.256] GetProcessHeap () returned 0x630000 [0061.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0061.256] GetProcessHeap () returned 0x630000 [0061.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.256] GetProcessHeap () returned 0x630000 [0061.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.256] GetProcessHeap () returned 0x630000 [0061.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.256] GetProcessHeap () returned 0x630000 [0061.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.256] GetProcessHeap () returned 0x630000 [0061.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.256] GetProcessHeap () returned 0x630000 [0061.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.256] GetProcessHeap () returned 0x630000 [0061.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.256] GetProcessHeap () returned 0x630000 [0061.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.256] GetProcessHeap () returned 0x630000 [0061.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.256] GetProcessHeap () returned 0x630000 [0061.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.256] GetProcessHeap () returned 0x630000 [0061.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.256] GetProcessHeap () returned 0x630000 [0061.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.256] GetProcessHeap () returned 0x630000 [0061.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.256] GetProcessHeap () returned 0x630000 [0061.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.256] GetProcessHeap () returned 0x630000 [0061.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.256] GetProcessHeap () returned 0x630000 [0061.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.256] GetProcessHeap () returned 0x630000 [0061.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.257] GetProcessHeap () returned 0x630000 [0061.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.257] GetProcessHeap () returned 0x630000 [0061.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.257] GetProcessHeap () returned 0x630000 [0061.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.257] GetProcessHeap () returned 0x630000 [0061.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.257] GetProcessHeap () returned 0x630000 [0061.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.257] GetProcessHeap () returned 0x630000 [0061.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.257] GetProcessHeap () returned 0x630000 [0061.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.257] GetProcessHeap () returned 0x630000 [0061.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.257] GetProcessHeap () returned 0x630000 [0061.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.257] GetProcessHeap () returned 0x630000 [0061.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.257] GetProcessHeap () returned 0x630000 [0061.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.257] GetProcessHeap () returned 0x630000 [0061.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.257] GetProcessHeap () returned 0x630000 [0061.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.257] GetProcessHeap () returned 0x630000 [0061.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.257] GetProcessHeap () returned 0x630000 [0061.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.257] GetProcessHeap () returned 0x630000 [0061.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.257] GetProcessHeap () returned 0x630000 [0061.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.258] GetProcessHeap () returned 0x630000 [0061.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0061.258] GetProcessHeap () returned 0x630000 [0061.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0061.258] GetProcessHeap () returned 0x630000 [0061.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.258] GetProcessHeap () returned 0x630000 [0061.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.258] GetProcessHeap () returned 0x630000 [0061.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.258] GetProcessHeap () returned 0x630000 [0061.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.258] GetProcessHeap () returned 0x630000 [0061.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.258] GetProcessHeap () returned 0x630000 [0061.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.258] GetProcessHeap () returned 0x630000 [0061.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.258] GetProcessHeap () returned 0x630000 [0061.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.258] GetProcessHeap () returned 0x630000 [0061.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.258] GetProcessHeap () returned 0x630000 [0061.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.258] GetProcessHeap () returned 0x630000 [0061.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.258] GetProcessHeap () returned 0x630000 [0061.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.259] GetProcessHeap () returned 0x630000 [0061.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.259] GetProcessHeap () returned 0x630000 [0061.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.259] GetProcessHeap () returned 0x630000 [0061.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.259] GetProcessHeap () returned 0x630000 [0061.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.259] GetProcessHeap () returned 0x630000 [0061.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.259] GetProcessHeap () returned 0x630000 [0061.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.259] GetProcessHeap () returned 0x630000 [0061.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.259] GetProcessHeap () returned 0x630000 [0061.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.259] GetProcessHeap () returned 0x630000 [0061.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.259] GetProcessHeap () returned 0x630000 [0061.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.259] GetProcessHeap () returned 0x630000 [0061.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.259] GetProcessHeap () returned 0x630000 [0061.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.259] GetProcessHeap () returned 0x630000 [0061.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.259] GetProcessHeap () returned 0x630000 [0061.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.259] GetProcessHeap () returned 0x630000 [0061.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.259] GetProcessHeap () returned 0x630000 [0061.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.259] GetProcessHeap () returned 0x630000 [0061.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.259] GetProcessHeap () returned 0x630000 [0061.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.260] GetProcessHeap () returned 0x630000 [0061.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.260] GetProcessHeap () returned 0x630000 [0061.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.260] GetProcessHeap () returned 0x630000 [0061.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.260] GetProcessHeap () returned 0x630000 [0061.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.260] GetProcessHeap () returned 0x630000 [0061.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.260] GetProcessHeap () returned 0x630000 [0061.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.260] GetProcessHeap () returned 0x630000 [0061.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.260] GetProcessHeap () returned 0x630000 [0061.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.260] GetProcessHeap () returned 0x630000 [0061.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.260] GetProcessHeap () returned 0x630000 [0061.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.260] GetProcessHeap () returned 0x630000 [0061.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.260] GetProcessHeap () returned 0x630000 [0061.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.260] GetProcessHeap () returned 0x630000 [0061.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.260] GetProcessHeap () returned 0x630000 [0061.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.260] GetProcessHeap () returned 0x630000 [0061.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.260] GetProcessHeap () returned 0x630000 [0061.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.260] GetProcessHeap () returned 0x630000 [0061.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0061.260] GetProcessHeap () returned 0x630000 [0061.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0061.260] GetProcessHeap () returned 0x630000 [0061.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0061.260] GetProcessHeap () returned 0x630000 [0061.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0061.261] GetProcessHeap () returned 0x630000 [0061.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0061.261] GetProcessHeap () returned 0x630000 [0061.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0061.261] GetProcessHeap () returned 0x630000 [0061.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0061.261] GetProcessHeap () returned 0x630000 [0061.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0061.261] GetProcessHeap () returned 0x630000 [0061.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0061.261] GetProcessHeap () returned 0x630000 [0061.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.261] GetProcessHeap () returned 0x630000 [0061.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0061.261] WriteFile (in: hFile=0x230, lpBuffer=0x6547d8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6547d8*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0061.273] GetProcessHeap () returned 0x630000 [0061.273] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6547d8, Size=0x30) returned 0x6547d8 [0061.273] GetProcessHeap () returned 0x630000 [0061.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0061.273] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.273] GetProcessHeap () returned 0x630000 [0061.273] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x120f1) returned 0x671bf0 [0061.273] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0x120f1, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0x120f1, lpOverlapped=0x0) returned 1 [0061.274] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.274] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x120f1, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0x120f1, lpOverlapped=0x0) returned 1 [0061.275] GetProcessHeap () returned 0x630000 [0061.275] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0061.277] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.277] WriteFile (in: hFile=0x230, lpBuffer=0x6547d8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6547d8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0061.278] CloseHandle (hObject=0x230) returned 1 [0061.280] GetProcessHeap () returned 0x630000 [0061.280] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0061.280] GetProcessHeap () returned 0x630000 [0061.280] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655aa8 | out: hHeap=0x630000) returned 1 [0061.280] GetProcessHeap () returned 0x630000 [0061.280] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0061.280] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Music\\T57mOAnFPiHZVJuX_.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\T57mOAnFPiHZVJuX_.m4a") returned="C:\\Users\\FD1HVy\\Music\\T57mOAnFPiHZVJuX_.m4a" [0061.280] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\T57mOAnFPiHZVJuX_.m4a", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Music\\T57mOAnFPiHZVJuX_.m4a.happythreechoose") returned="C:\\Users\\FD1HVy\\Music\\T57mOAnFPiHZVJuX_.m4a.happythreechoose" [0061.280] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\T57mOAnFPiHZVJuX_.m4a" (normalized: "c:\\users\\fd1hvy\\music\\t57moanfpihzvjux_.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\T57mOAnFPiHZVJuX_.m4a.happythreechoose" (normalized: "c:\\users\\fd1hvy\\music\\t57moanfpihzvjux_.m4a.happythreechoose"), dwFlags=0x1) returned 1 [0061.281] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\T57mOAnFPiHZVJuX_.m4a" | out: pszPath="C:\\Users\\FD1HVy\\Music") returned 1 [0061.281] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music" | out: pszPath="C:\\Users\\FD1HVy\\Music\\") returned="" [0061.281] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Music\\Decryption INFO.html" [0061.281] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\music\\decryption info.html")) returned 0x20 [0061.281] GetProcessHeap () returned 0x630000 [0061.281] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645ff8 | out: hHeap=0x630000) returned 1 [0061.281] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b949b80, ftCreationTime.dwHighDateTime=0x1d5d72e, ftLastAccessTime.dwLowDateTime=0xe104d1d0, ftLastAccessTime.dwHighDateTime=0x1d5d30e, ftLastWriteTime.dwLowDateTime=0xe104d1d0, ftLastWriteTime.dwHighDateTime=0x1d5d30e, nFileSizeHigh=0x0, nFileSizeLow=0x2f91, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WdAiooww.wav", cAlternateFileName="")) returned 1 [0061.281] lstrcmpiW (lpString1="WdAiooww.wav", lpString2=".") returned 1 [0061.281] lstrcmpiW (lpString1="WdAiooww.wav", lpString2="..") returned 1 [0061.282] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="WdAiooww.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\WdAiooww.wav") returned="C:\\Users\\FD1HVy\\Music\\WdAiooww.wav" [0061.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WdAiooww.wav", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0061.282] GetProcessHeap () returned 0x630000 [0061.282] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd) returned 0x64c9f0 [0061.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WdAiooww.wav", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WdAiooww.wav", lpUsedDefaultChar=0x0) returned 13 [0061.282] lstrlenA (lpString="WdAiooww.wav") returned 12 [0061.282] lstrlenA (lpString=".happythreechoose") returned 17 [0061.282] lstrcmpiW (lpString1="WdAiooww.wav", lpString2="Decryption INFO.html") returned 1 [0061.282] lstrcmpiW (lpString1="WdAiooww.wav", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0061.282] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0061.282] lstrcmpiW (lpString1="WdAiooww.wav", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0061.282] GetProcessHeap () returned 0x630000 [0061.282] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x652000 [0061.282] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\WdAiooww.wav" (normalized: "c:\\users\\fd1hvy\\music\\wdaiooww.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0061.282] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=12177) returned 1 [0061.282] GetProcessHeap () returned 0x630000 [0061.282] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6555f8 [0061.282] GetProcessHeap () returned 0x630000 [0061.282] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0061.282] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\WdAiooww.wav") returned 34 [0061.282] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.282] GetProcessHeap () returned 0x630000 [0061.282] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0061.282] GetProcessHeap () returned 0x630000 [0061.282] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x654810 [0061.282] lstrlenA (lpString="rsa_encrypt") returned 11 [0061.282] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0061.283] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0061.283] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0061.283] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0061.283] GetProcessHeap () returned 0x630000 [0061.283] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0061.283] lstrlenA (lpString="010001") returned 6 [0061.283] GetProcessHeap () returned 0x630000 [0061.283] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a318 [0061.283] GetProcessHeap () returned 0x630000 [0061.283] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.283] GetProcessHeap () returned 0x630000 [0061.283] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ec40 [0061.283] GetProcessHeap () returned 0x630000 [0061.283] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.283] GetProcessHeap () returned 0x630000 [0061.283] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dec0 [0061.283] GetProcessHeap () returned 0x630000 [0061.283] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657670 [0061.284] GetProcessHeap () returned 0x630000 [0061.284] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0061.284] GetProcessHeap () returned 0x630000 [0061.284] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0061.284] GetProcessHeap () returned 0x630000 [0061.284] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.284] GetProcessHeap () returned 0x630000 [0061.284] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0061.284] GetProcessHeap () returned 0x630000 [0061.284] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.284] GetProcessHeap () returned 0x630000 [0061.284] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656fe0 [0061.284] GetProcessHeap () returned 0x630000 [0061.284] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.284] GetProcessHeap () returned 0x630000 [0061.284] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0061.284] GetProcessHeap () returned 0x630000 [0061.284] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e340 [0061.284] GetProcessHeap () returned 0x630000 [0061.284] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.284] GetProcessHeap () returned 0x630000 [0061.284] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0061.284] GetProcessHeap () returned 0x630000 [0061.284] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0061.284] GetProcessHeap () returned 0x630000 [0061.284] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.284] GetProcessHeap () returned 0x630000 [0061.284] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x661620 [0061.284] GetProcessHeap () returned 0x630000 [0061.284] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.284] GetProcessHeap () returned 0x630000 [0061.284] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.284] GetProcessHeap () returned 0x630000 [0061.284] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.284] GetProcessHeap () returned 0x630000 [0061.284] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.284] GetProcessHeap () returned 0x630000 [0061.284] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e220 [0061.284] GetProcessHeap () returned 0x630000 [0061.284] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661620 | out: hHeap=0x630000) returned 1 [0061.285] GetProcessHeap () returned 0x630000 [0061.285] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0061.285] GetProcessHeap () returned 0x630000 [0061.285] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0061.285] GetProcessHeap () returned 0x630000 [0061.285] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.285] GetProcessHeap () returned 0x630000 [0061.285] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.285] GetProcessHeap () returned 0x630000 [0061.285] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.285] GetProcessHeap () returned 0x630000 [0061.285] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.285] GetProcessHeap () returned 0x630000 [0061.285] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.285] GetProcessHeap () returned 0x630000 [0061.285] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.285] GetProcessHeap () returned 0x630000 [0061.285] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.285] GetProcessHeap () returned 0x630000 [0061.285] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.285] GetProcessHeap () returned 0x630000 [0061.285] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.285] GetProcessHeap () returned 0x630000 [0061.285] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.285] GetProcessHeap () returned 0x630000 [0061.285] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.285] GetProcessHeap () returned 0x630000 [0061.285] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.285] GetProcessHeap () returned 0x630000 [0061.285] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.285] GetProcessHeap () returned 0x630000 [0061.285] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.285] GetProcessHeap () returned 0x630000 [0061.285] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.285] GetProcessHeap () returned 0x630000 [0061.285] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.286] GetProcessHeap () returned 0x630000 [0061.286] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.286] GetProcessHeap () returned 0x630000 [0061.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.286] GetProcessHeap () returned 0x630000 [0061.286] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.286] GetProcessHeap () returned 0x630000 [0061.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.286] GetProcessHeap () returned 0x630000 [0061.286] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.286] GetProcessHeap () returned 0x630000 [0061.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.286] GetProcessHeap () returned 0x630000 [0061.286] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.286] GetProcessHeap () returned 0x630000 [0061.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.286] GetProcessHeap () returned 0x630000 [0061.286] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.286] GetProcessHeap () returned 0x630000 [0061.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.286] GetProcessHeap () returned 0x630000 [0061.286] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.286] GetProcessHeap () returned 0x630000 [0061.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.286] GetProcessHeap () returned 0x630000 [0061.286] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0061.286] GetProcessHeap () returned 0x630000 [0061.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0061.286] GetProcessHeap () returned 0x630000 [0061.286] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.286] GetProcessHeap () returned 0x630000 [0061.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.286] GetProcessHeap () returned 0x630000 [0061.286] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.286] GetProcessHeap () returned 0x630000 [0061.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.286] GetProcessHeap () returned 0x630000 [0061.287] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.287] GetProcessHeap () returned 0x630000 [0061.287] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.287] GetProcessHeap () returned 0x630000 [0061.287] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.287] GetProcessHeap () returned 0x630000 [0061.287] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.287] GetProcessHeap () returned 0x630000 [0061.287] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.287] GetProcessHeap () returned 0x630000 [0061.287] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.287] GetProcessHeap () returned 0x630000 [0061.287] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.287] GetProcessHeap () returned 0x630000 [0061.287] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.287] GetProcessHeap () returned 0x630000 [0061.287] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.287] GetProcessHeap () returned 0x630000 [0061.287] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.287] GetProcessHeap () returned 0x630000 [0061.287] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.287] GetProcessHeap () returned 0x630000 [0061.287] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.287] GetProcessHeap () returned 0x630000 [0061.287] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.287] GetProcessHeap () returned 0x630000 [0061.287] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.287] GetProcessHeap () returned 0x630000 [0061.287] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.287] GetProcessHeap () returned 0x630000 [0061.287] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.287] GetProcessHeap () returned 0x630000 [0061.287] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.287] GetProcessHeap () returned 0x630000 [0061.287] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.287] GetProcessHeap () returned 0x630000 [0061.287] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.288] GetProcessHeap () returned 0x630000 [0061.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.288] GetProcessHeap () returned 0x630000 [0061.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.288] GetProcessHeap () returned 0x630000 [0061.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.288] GetProcessHeap () returned 0x630000 [0061.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.288] GetProcessHeap () returned 0x630000 [0061.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.288] GetProcessHeap () returned 0x630000 [0061.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.288] GetProcessHeap () returned 0x630000 [0061.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.288] GetProcessHeap () returned 0x630000 [0061.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.288] GetProcessHeap () returned 0x630000 [0061.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.288] GetProcessHeap () returned 0x630000 [0061.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.288] GetProcessHeap () returned 0x630000 [0061.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.288] GetProcessHeap () returned 0x630000 [0061.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.288] GetProcessHeap () returned 0x630000 [0061.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.288] GetProcessHeap () returned 0x630000 [0061.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.288] GetProcessHeap () returned 0x630000 [0061.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.288] GetProcessHeap () returned 0x630000 [0061.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.288] GetProcessHeap () returned 0x630000 [0061.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.288] GetProcessHeap () returned 0x630000 [0061.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.288] GetProcessHeap () returned 0x630000 [0061.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.289] GetProcessHeap () returned 0x630000 [0061.289] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.289] GetProcessHeap () returned 0x630000 [0061.289] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.289] GetProcessHeap () returned 0x630000 [0061.289] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.289] GetProcessHeap () returned 0x630000 [0061.289] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.289] GetProcessHeap () returned 0x630000 [0061.289] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.289] GetProcessHeap () returned 0x630000 [0061.289] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.289] GetProcessHeap () returned 0x630000 [0061.289] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.289] GetProcessHeap () returned 0x630000 [0061.289] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.289] GetProcessHeap () returned 0x630000 [0061.289] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.289] GetProcessHeap () returned 0x630000 [0061.289] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.289] GetProcessHeap () returned 0x630000 [0061.289] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0061.289] GetProcessHeap () returned 0x630000 [0061.289] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0061.290] GetProcessHeap () returned 0x630000 [0061.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0061.290] GetProcessHeap () returned 0x630000 [0061.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0061.290] GetProcessHeap () returned 0x630000 [0061.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0061.290] GetProcessHeap () returned 0x630000 [0061.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0061.290] GetProcessHeap () returned 0x630000 [0061.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0061.290] GetProcessHeap () returned 0x630000 [0061.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ec40 | out: hHeap=0x630000) returned 1 [0061.290] GetProcessHeap () returned 0x630000 [0061.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0061.290] GetProcessHeap () returned 0x630000 [0061.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.290] GetProcessHeap () returned 0x630000 [0061.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0061.290] WriteFile (in: hFile=0x230, lpBuffer=0x654810*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654810*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0061.299] GetProcessHeap () returned 0x630000 [0061.299] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x654810, Size=0x30) returned 0x654810 [0061.299] GetProcessHeap () returned 0x630000 [0061.299] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0061.299] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.299] GetProcessHeap () returned 0x630000 [0061.299] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2f91) returned 0x671bf0 [0061.300] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0x2f91, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0x2f91, lpOverlapped=0x0) returned 1 [0061.300] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.301] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x2f91, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0x2f91, lpOverlapped=0x0) returned 1 [0061.301] GetProcessHeap () returned 0x630000 [0061.302] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0061.302] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.302] WriteFile (in: hFile=0x230, lpBuffer=0x654810*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654810*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0061.303] CloseHandle (hObject=0x230) returned 1 [0061.304] GetProcessHeap () returned 0x630000 [0061.304] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x652000 | out: hHeap=0x630000) returned 1 [0061.304] GetProcessHeap () returned 0x630000 [0061.304] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6555f8 | out: hHeap=0x630000) returned 1 [0061.304] GetProcessHeap () returned 0x630000 [0061.304] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0061.304] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Music\\WdAiooww.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\WdAiooww.wav") returned="C:\\Users\\FD1HVy\\Music\\WdAiooww.wav" [0061.305] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\WdAiooww.wav", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Music\\WdAiooww.wav.happythreechoose") returned="C:\\Users\\FD1HVy\\Music\\WdAiooww.wav.happythreechoose" [0061.305] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\WdAiooww.wav" (normalized: "c:\\users\\fd1hvy\\music\\wdaiooww.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\WdAiooww.wav.happythreechoose" (normalized: "c:\\users\\fd1hvy\\music\\wdaiooww.wav.happythreechoose"), dwFlags=0x1) returned 1 [0061.305] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\WdAiooww.wav" | out: pszPath="C:\\Users\\FD1HVy\\Music") returned 1 [0061.305] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music" | out: pszPath="C:\\Users\\FD1HVy\\Music\\") returned="" [0061.305] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Music\\Decryption INFO.html" [0061.305] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\music\\decryption info.html")) returned 0x20 [0061.305] GetProcessHeap () returned 0x630000 [0061.305] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0061.305] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf001f540, ftCreationTime.dwHighDateTime=0x1d5ceaa, ftLastAccessTime.dwLowDateTime=0x10168ee0, ftLastAccessTime.dwHighDateTime=0x1d5d671, ftLastWriteTime.dwLowDateTime=0x10168ee0, ftLastWriteTime.dwHighDateTime=0x1d5d671, nFileSizeHigh=0x0, nFileSizeLow=0x1297b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="y8-5HZWOY0.m4a", cAlternateFileName="Y8-5HZ~1.M4A")) returned 1 [0061.305] lstrcmpiW (lpString1="y8-5HZWOY0.m4a", lpString2=".") returned 1 [0061.305] lstrcmpiW (lpString1="y8-5HZWOY0.m4a", lpString2="..") returned 1 [0061.305] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="y8-5HZWOY0.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\y8-5HZWOY0.m4a") returned="C:\\Users\\FD1HVy\\Music\\y8-5HZWOY0.m4a" [0061.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="y8-5HZWOY0.m4a", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0061.305] GetProcessHeap () returned 0x630000 [0061.305] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0061.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="y8-5HZWOY0.m4a", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="y8-5HZWOY0.m4a", lpUsedDefaultChar=0x0) returned 15 [0061.306] lstrlenA (lpString="y8-5HZWOY0.m4a") returned 14 [0061.306] lstrlenA (lpString=".happythreechoose") returned 17 [0061.306] lstrcmpiW (lpString1="y8-5HZWOY0.m4a", lpString2="Decryption INFO.html") returned 1 [0061.306] lstrcmpiW (lpString1="y8-5HZWOY0.m4a", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0061.306] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0061.306] lstrcmpiW (lpString1="y8-5HZWOY0.m4a", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0061.306] GetProcessHeap () returned 0x630000 [0061.306] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0061.306] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\y8-5HZWOY0.m4a" (normalized: "c:\\users\\fd1hvy\\music\\y8-5hzwoy0.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0061.306] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=76155) returned 1 [0061.306] GetProcessHeap () returned 0x630000 [0061.306] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6557d8 [0061.306] GetProcessHeap () returned 0x630000 [0061.306] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0061.306] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\y8-5HZWOY0.m4a") returned 36 [0061.306] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.306] GetProcessHeap () returned 0x630000 [0061.306] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0061.306] GetProcessHeap () returned 0x630000 [0061.306] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x654848 [0061.306] lstrlenA (lpString="rsa_encrypt") returned 11 [0061.306] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0061.307] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0061.307] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0061.307] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0061.307] GetProcessHeap () returned 0x630000 [0061.307] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0061.307] lstrlenA (lpString="010001") returned 6 [0061.307] GetProcessHeap () returned 0x630000 [0061.307] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0061.307] GetProcessHeap () returned 0x630000 [0061.307] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.307] GetProcessHeap () returned 0x630000 [0061.307] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e460 [0061.307] GetProcessHeap () returned 0x630000 [0061.307] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.307] GetProcessHeap () returned 0x630000 [0061.307] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dfe0 [0061.307] GetProcessHeap () returned 0x630000 [0061.307] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656950 [0061.307] GetProcessHeap () returned 0x630000 [0061.307] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a318 [0061.307] GetProcessHeap () returned 0x630000 [0061.307] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0061.308] GetProcessHeap () returned 0x630000 [0061.308] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.308] GetProcessHeap () returned 0x630000 [0061.308] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0061.308] GetProcessHeap () returned 0x630000 [0061.308] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.308] GetProcessHeap () returned 0x630000 [0061.308] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656fe0 [0061.308] GetProcessHeap () returned 0x630000 [0061.308] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.308] GetProcessHeap () returned 0x630000 [0061.308] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0061.308] GetProcessHeap () returned 0x630000 [0061.308] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e730 [0061.308] GetProcessHeap () returned 0x630000 [0061.308] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.308] GetProcessHeap () returned 0x630000 [0061.308] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0061.308] GetProcessHeap () returned 0x630000 [0061.308] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0061.308] GetProcessHeap () returned 0x630000 [0061.308] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0061.308] GetProcessHeap () returned 0x630000 [0061.308] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x6617e8 [0061.308] GetProcessHeap () returned 0x630000 [0061.308] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.308] GetProcessHeap () returned 0x630000 [0061.308] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0061.308] GetProcessHeap () returned 0x630000 [0061.308] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.308] GetProcessHeap () returned 0x630000 [0061.308] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.308] GetProcessHeap () returned 0x630000 [0061.308] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e8e0 [0061.308] GetProcessHeap () returned 0x630000 [0061.308] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6617e8 | out: hHeap=0x630000) returned 1 [0061.308] GetProcessHeap () returned 0x630000 [0061.308] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0061.308] GetProcessHeap () returned 0x630000 [0061.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0061.309] GetProcessHeap () returned 0x630000 [0061.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.309] GetProcessHeap () returned 0x630000 [0061.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.309] GetProcessHeap () returned 0x630000 [0061.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.309] GetProcessHeap () returned 0x630000 [0061.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.309] GetProcessHeap () returned 0x630000 [0061.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.309] GetProcessHeap () returned 0x630000 [0061.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.309] GetProcessHeap () returned 0x630000 [0061.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.309] GetProcessHeap () returned 0x630000 [0061.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.309] GetProcessHeap () returned 0x630000 [0061.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.309] GetProcessHeap () returned 0x630000 [0061.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.309] GetProcessHeap () returned 0x630000 [0061.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.309] GetProcessHeap () returned 0x630000 [0061.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.309] GetProcessHeap () returned 0x630000 [0061.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.309] GetProcessHeap () returned 0x630000 [0061.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.309] GetProcessHeap () returned 0x630000 [0061.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.309] GetProcessHeap () returned 0x630000 [0061.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.309] GetProcessHeap () returned 0x630000 [0061.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.309] GetProcessHeap () returned 0x630000 [0061.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.310] GetProcessHeap () returned 0x630000 [0061.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.310] GetProcessHeap () returned 0x630000 [0061.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.310] GetProcessHeap () returned 0x630000 [0061.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.310] GetProcessHeap () returned 0x630000 [0061.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.310] GetProcessHeap () returned 0x630000 [0061.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.310] GetProcessHeap () returned 0x630000 [0061.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.310] GetProcessHeap () returned 0x630000 [0061.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.310] GetProcessHeap () returned 0x630000 [0061.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.310] GetProcessHeap () returned 0x630000 [0061.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.310] GetProcessHeap () returned 0x630000 [0061.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.310] GetProcessHeap () returned 0x630000 [0061.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.310] GetProcessHeap () returned 0x630000 [0061.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.310] GetProcessHeap () returned 0x630000 [0061.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.310] GetProcessHeap () returned 0x630000 [0061.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.310] GetProcessHeap () returned 0x630000 [0061.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.310] GetProcessHeap () returned 0x630000 [0061.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.310] GetProcessHeap () returned 0x630000 [0061.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.310] GetProcessHeap () returned 0x630000 [0061.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.310] GetProcessHeap () returned 0x630000 [0061.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.311] GetProcessHeap () returned 0x630000 [0061.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.311] GetProcessHeap () returned 0x630000 [0061.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0061.311] GetProcessHeap () returned 0x630000 [0061.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0061.311] GetProcessHeap () returned 0x630000 [0061.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.311] GetProcessHeap () returned 0x630000 [0061.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.311] GetProcessHeap () returned 0x630000 [0061.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.311] GetProcessHeap () returned 0x630000 [0061.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.311] GetProcessHeap () returned 0x630000 [0061.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.311] GetProcessHeap () returned 0x630000 [0061.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.311] GetProcessHeap () returned 0x630000 [0061.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.311] GetProcessHeap () returned 0x630000 [0061.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.311] GetProcessHeap () returned 0x630000 [0061.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.311] GetProcessHeap () returned 0x630000 [0061.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.311] GetProcessHeap () returned 0x630000 [0061.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.311] GetProcessHeap () returned 0x630000 [0061.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.311] GetProcessHeap () returned 0x630000 [0061.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.311] GetProcessHeap () returned 0x630000 [0061.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.311] GetProcessHeap () returned 0x630000 [0061.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.312] GetProcessHeap () returned 0x630000 [0061.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.312] GetProcessHeap () returned 0x630000 [0061.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.312] GetProcessHeap () returned 0x630000 [0061.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.312] GetProcessHeap () returned 0x630000 [0061.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.312] GetProcessHeap () returned 0x630000 [0061.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.312] GetProcessHeap () returned 0x630000 [0061.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.312] GetProcessHeap () returned 0x630000 [0061.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.312] GetProcessHeap () returned 0x630000 [0061.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.312] GetProcessHeap () returned 0x630000 [0061.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.312] GetProcessHeap () returned 0x630000 [0061.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.312] GetProcessHeap () returned 0x630000 [0061.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.312] GetProcessHeap () returned 0x630000 [0061.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.312] GetProcessHeap () returned 0x630000 [0061.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.312] GetProcessHeap () returned 0x630000 [0061.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.312] GetProcessHeap () returned 0x630000 [0061.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.312] GetProcessHeap () returned 0x630000 [0061.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.312] GetProcessHeap () returned 0x630000 [0061.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.312] GetProcessHeap () returned 0x630000 [0061.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.312] GetProcessHeap () returned 0x630000 [0061.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.313] GetProcessHeap () returned 0x630000 [0061.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.313] GetProcessHeap () returned 0x630000 [0061.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.313] GetProcessHeap () returned 0x630000 [0061.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.313] GetProcessHeap () returned 0x630000 [0061.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.313] GetProcessHeap () returned 0x630000 [0061.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0061.313] GetProcessHeap () returned 0x630000 [0061.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0061.313] GetProcessHeap () returned 0x630000 [0061.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.313] GetProcessHeap () returned 0x630000 [0061.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.313] GetProcessHeap () returned 0x630000 [0061.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0061.313] GetProcessHeap () returned 0x630000 [0061.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0061.313] GetProcessHeap () returned 0x630000 [0061.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0061.313] GetProcessHeap () returned 0x630000 [0061.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0061.313] GetProcessHeap () returned 0x630000 [0061.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0061.313] GetProcessHeap () returned 0x630000 [0061.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0061.313] GetProcessHeap () returned 0x630000 [0061.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0061.313] GetProcessHeap () returned 0x630000 [0061.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e460 | out: hHeap=0x630000) returned 1 [0061.313] GetProcessHeap () returned 0x630000 [0061.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0061.313] GetProcessHeap () returned 0x630000 [0061.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.314] GetProcessHeap () returned 0x630000 [0061.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0061.314] WriteFile (in: hFile=0x230, lpBuffer=0x654848*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654848*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0061.352] GetProcessHeap () returned 0x630000 [0061.352] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x654848, Size=0x30) returned 0x654848 [0061.353] GetProcessHeap () returned 0x630000 [0061.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0061.353] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.353] GetProcessHeap () returned 0x630000 [0061.353] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1297b) returned 0x671bf0 [0061.354] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0x1297b, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0x1297b, lpOverlapped=0x0) returned 1 [0061.355] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.355] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x1297b, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0x1297b, lpOverlapped=0x0) returned 1 [0061.470] GetProcessHeap () returned 0x630000 [0061.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0061.472] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.472] WriteFile (in: hFile=0x230, lpBuffer=0x654848*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654848*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0061.477] CloseHandle (hObject=0x230) returned 1 [0061.479] GetProcessHeap () returned 0x630000 [0061.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0061.479] GetProcessHeap () returned 0x630000 [0061.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6557d8 | out: hHeap=0x630000) returned 1 [0061.479] GetProcessHeap () returned 0x630000 [0061.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0061.479] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Music\\y8-5HZWOY0.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\y8-5HZWOY0.m4a") returned="C:\\Users\\FD1HVy\\Music\\y8-5HZWOY0.m4a" [0061.479] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\y8-5HZWOY0.m4a", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Music\\y8-5HZWOY0.m4a.happythreechoose") returned="C:\\Users\\FD1HVy\\Music\\y8-5HZWOY0.m4a.happythreechoose" [0061.479] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\y8-5HZWOY0.m4a" (normalized: "c:\\users\\fd1hvy\\music\\y8-5hzwoy0.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\y8-5HZWOY0.m4a.happythreechoose" (normalized: "c:\\users\\fd1hvy\\music\\y8-5hzwoy0.m4a.happythreechoose"), dwFlags=0x1) returned 1 [0061.480] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\y8-5HZWOY0.m4a" | out: pszPath="C:\\Users\\FD1HVy\\Music") returned 1 [0061.480] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music" | out: pszPath="C:\\Users\\FD1HVy\\Music\\") returned="" [0061.480] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Music\\Decryption INFO.html" [0061.480] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\music\\decryption info.html")) returned 0x20 [0061.480] GetProcessHeap () returned 0x630000 [0061.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0061.480] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0c1beb0, ftCreationTime.dwHighDateTime=0x1d5d4f2, ftLastAccessTime.dwLowDateTime=0x8a287550, ftLastAccessTime.dwHighDateTime=0x1d5cd51, ftLastWriteTime.dwLowDateTime=0x8a287550, ftLastWriteTime.dwHighDateTime=0x1d5cd51, nFileSizeHigh=0x0, nFileSizeLow=0x170bc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Zy39i7.m4a", cAlternateFileName="")) returned 1 [0061.480] lstrcmpiW (lpString1="Zy39i7.m4a", lpString2=".") returned 1 [0061.480] lstrcmpiW (lpString1="Zy39i7.m4a", lpString2="..") returned 1 [0061.480] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="Zy39i7.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Zy39i7.m4a") returned="C:\\Users\\FD1HVy\\Music\\Zy39i7.m4a" [0061.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Zy39i7.m4a", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0061.480] GetProcessHeap () returned 0x630000 [0061.480] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb) returned 0x64c9f0 [0061.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Zy39i7.m4a", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Zy39i7.m4a", lpUsedDefaultChar=0x0) returned 11 [0061.481] lstrlenA (lpString="Zy39i7.m4a") returned 10 [0061.481] lstrlenA (lpString=".happythreechoose") returned 17 [0061.481] lstrcmpiW (lpString1="Zy39i7.m4a", lpString2="Decryption INFO.html") returned 1 [0061.481] lstrcmpiW (lpString1="Zy39i7.m4a", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0061.481] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0061.481] lstrcmpiW (lpString1="Zy39i7.m4a", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0061.481] GetProcessHeap () returned 0x630000 [0061.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0061.481] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Zy39i7.m4a" (normalized: "c:\\users\\fd1hvy\\music\\zy39i7.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0061.481] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=94396) returned 1 [0061.481] GetProcessHeap () returned 0x630000 [0061.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655508 [0061.481] GetProcessHeap () returned 0x630000 [0061.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0061.481] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\Zy39i7.m4a") returned 32 [0061.481] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.481] GetProcessHeap () returned 0x630000 [0061.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0061.481] GetProcessHeap () returned 0x630000 [0061.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x654880 [0061.481] lstrlenA (lpString="rsa_encrypt") returned 11 [0061.481] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0061.482] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0061.482] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0061.482] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0061.482] GetProcessHeap () returned 0x630000 [0061.482] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0061.482] lstrlenA (lpString="010001") returned 6 [0061.482] GetProcessHeap () returned 0x630000 [0061.482] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a318 [0061.482] GetProcessHeap () returned 0x630000 [0061.482] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.482] GetProcessHeap () returned 0x630000 [0061.482] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dfe0 [0061.482] GetProcessHeap () returned 0x630000 [0061.482] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.482] GetProcessHeap () returned 0x630000 [0061.482] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e580 [0061.482] GetProcessHeap () returned 0x630000 [0061.482] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657558 [0061.482] GetProcessHeap () returned 0x630000 [0061.482] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0061.482] GetProcessHeap () returned 0x630000 [0061.482] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0061.482] GetProcessHeap () returned 0x630000 [0061.482] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.483] GetProcessHeap () returned 0x630000 [0061.483] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0061.483] GetProcessHeap () returned 0x630000 [0061.483] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.483] GetProcessHeap () returned 0x630000 [0061.483] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657328 [0061.483] GetProcessHeap () returned 0x630000 [0061.483] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.483] GetProcessHeap () returned 0x630000 [0061.483] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0061.483] GetProcessHeap () returned 0x630000 [0061.483] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e3d0 [0061.483] GetProcessHeap () returned 0x630000 [0061.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.483] GetProcessHeap () returned 0x630000 [0061.483] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0061.483] GetProcessHeap () returned 0x630000 [0061.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0061.483] GetProcessHeap () returned 0x630000 [0061.483] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.483] GetProcessHeap () returned 0x630000 [0061.483] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x661638 [0061.483] GetProcessHeap () returned 0x630000 [0061.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.483] GetProcessHeap () returned 0x630000 [0061.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.483] GetProcessHeap () returned 0x630000 [0061.483] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.483] GetProcessHeap () returned 0x630000 [0061.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.483] GetProcessHeap () returned 0x630000 [0061.483] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e340 [0061.483] GetProcessHeap () returned 0x630000 [0061.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x661638 | out: hHeap=0x630000) returned 1 [0061.483] GetProcessHeap () returned 0x630000 [0061.483] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0061.483] GetProcessHeap () returned 0x630000 [0061.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0061.484] GetProcessHeap () returned 0x630000 [0061.484] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.484] GetProcessHeap () returned 0x630000 [0061.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.484] GetProcessHeap () returned 0x630000 [0061.484] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.484] GetProcessHeap () returned 0x630000 [0061.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.484] GetProcessHeap () returned 0x630000 [0061.484] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.484] GetProcessHeap () returned 0x630000 [0061.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.484] GetProcessHeap () returned 0x630000 [0061.484] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.484] GetProcessHeap () returned 0x630000 [0061.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.484] GetProcessHeap () returned 0x630000 [0061.484] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.484] GetProcessHeap () returned 0x630000 [0061.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.484] GetProcessHeap () returned 0x630000 [0061.484] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.484] GetProcessHeap () returned 0x630000 [0061.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.484] GetProcessHeap () returned 0x630000 [0061.484] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.484] GetProcessHeap () returned 0x630000 [0061.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.484] GetProcessHeap () returned 0x630000 [0061.484] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.484] GetProcessHeap () returned 0x630000 [0061.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.484] GetProcessHeap () returned 0x630000 [0061.484] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.484] GetProcessHeap () returned 0x630000 [0061.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.484] GetProcessHeap () returned 0x630000 [0061.485] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.485] GetProcessHeap () returned 0x630000 [0061.485] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.485] GetProcessHeap () returned 0x630000 [0061.485] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.485] GetProcessHeap () returned 0x630000 [0061.485] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.485] GetProcessHeap () returned 0x630000 [0061.485] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.485] GetProcessHeap () returned 0x630000 [0061.485] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.485] GetProcessHeap () returned 0x630000 [0061.485] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.485] GetProcessHeap () returned 0x630000 [0061.485] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.485] GetProcessHeap () returned 0x630000 [0061.485] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.485] GetProcessHeap () returned 0x630000 [0061.485] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.485] GetProcessHeap () returned 0x630000 [0061.485] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.485] GetProcessHeap () returned 0x630000 [0061.485] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.485] GetProcessHeap () returned 0x630000 [0061.485] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.485] GetProcessHeap () returned 0x630000 [0061.485] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.485] GetProcessHeap () returned 0x630000 [0061.485] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.485] GetProcessHeap () returned 0x630000 [0061.485] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.485] GetProcessHeap () returned 0x630000 [0061.485] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.485] GetProcessHeap () returned 0x630000 [0061.485] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.485] GetProcessHeap () returned 0x630000 [0061.486] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.486] GetProcessHeap () returned 0x630000 [0061.486] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.486] GetProcessHeap () returned 0x630000 [0061.486] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.486] GetProcessHeap () returned 0x630000 [0061.486] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.486] GetProcessHeap () returned 0x630000 [0061.486] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.486] GetProcessHeap () returned 0x630000 [0061.486] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.486] GetProcessHeap () returned 0x630000 [0061.486] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.486] GetProcessHeap () returned 0x630000 [0061.486] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.486] GetProcessHeap () returned 0x630000 [0061.486] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0061.486] GetProcessHeap () returned 0x630000 [0061.486] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0061.486] GetProcessHeap () returned 0x630000 [0061.486] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.486] GetProcessHeap () returned 0x630000 [0061.486] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.486] GetProcessHeap () returned 0x630000 [0061.486] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.486] GetProcessHeap () returned 0x630000 [0061.486] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.486] GetProcessHeap () returned 0x630000 [0061.486] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.486] GetProcessHeap () returned 0x630000 [0061.486] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.486] GetProcessHeap () returned 0x630000 [0061.486] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.486] GetProcessHeap () returned 0x630000 [0061.486] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.486] GetProcessHeap () returned 0x630000 [0061.487] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.487] GetProcessHeap () returned 0x630000 [0061.487] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.487] GetProcessHeap () returned 0x630000 [0061.487] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.487] GetProcessHeap () returned 0x630000 [0061.487] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.487] GetProcessHeap () returned 0x630000 [0061.487] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.487] GetProcessHeap () returned 0x630000 [0061.487] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.487] GetProcessHeap () returned 0x630000 [0061.487] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.487] GetProcessHeap () returned 0x630000 [0061.487] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.487] GetProcessHeap () returned 0x630000 [0061.487] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.487] GetProcessHeap () returned 0x630000 [0061.487] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.487] GetProcessHeap () returned 0x630000 [0061.487] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.487] GetProcessHeap () returned 0x630000 [0061.487] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.487] GetProcessHeap () returned 0x630000 [0061.487] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.487] GetProcessHeap () returned 0x630000 [0061.487] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.487] GetProcessHeap () returned 0x630000 [0061.487] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.487] GetProcessHeap () returned 0x630000 [0061.487] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.487] GetProcessHeap () returned 0x630000 [0061.487] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.487] GetProcessHeap () returned 0x630000 [0061.487] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.487] GetProcessHeap () returned 0x630000 [0061.487] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.488] GetProcessHeap () returned 0x630000 [0061.488] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.488] GetProcessHeap () returned 0x630000 [0061.488] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.488] GetProcessHeap () returned 0x630000 [0061.488] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.488] GetProcessHeap () returned 0x630000 [0061.488] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.488] GetProcessHeap () returned 0x630000 [0061.488] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.488] GetProcessHeap () returned 0x630000 [0061.488] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.488] GetProcessHeap () returned 0x630000 [0061.488] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.488] GetProcessHeap () returned 0x630000 [0061.488] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.488] GetProcessHeap () returned 0x630000 [0061.488] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.488] GetProcessHeap () returned 0x630000 [0061.488] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0061.488] GetProcessHeap () returned 0x630000 [0061.488] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0061.488] GetProcessHeap () returned 0x630000 [0061.488] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0061.488] GetProcessHeap () returned 0x630000 [0061.488] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0061.488] GetProcessHeap () returned 0x630000 [0061.488] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0061.488] GetProcessHeap () returned 0x630000 [0061.488] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0061.488] GetProcessHeap () returned 0x630000 [0061.488] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0061.488] GetProcessHeap () returned 0x630000 [0061.488] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0061.488] GetProcessHeap () returned 0x630000 [0061.488] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0061.489] GetProcessHeap () returned 0x630000 [0061.489] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.489] GetProcessHeap () returned 0x630000 [0061.489] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0061.489] WriteFile (in: hFile=0x230, lpBuffer=0x654880*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654880*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0061.493] GetProcessHeap () returned 0x630000 [0061.493] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x654880, Size=0x30) returned 0x654880 [0061.493] GetProcessHeap () returned 0x630000 [0061.493] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0061.493] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.493] GetProcessHeap () returned 0x630000 [0061.493] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x170bc) returned 0x671bf0 [0061.496] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0x170bc, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0x170bc, lpOverlapped=0x0) returned 1 [0061.497] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.497] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x170bc, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0x170bc, lpOverlapped=0x0) returned 1 [0061.514] GetProcessHeap () returned 0x630000 [0061.514] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0061.514] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.515] WriteFile (in: hFile=0x230, lpBuffer=0x654880*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x654880*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0061.518] CloseHandle (hObject=0x230) returned 1 [0061.522] GetProcessHeap () returned 0x630000 [0061.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0061.522] GetProcessHeap () returned 0x630000 [0061.523] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655508 | out: hHeap=0x630000) returned 1 [0061.523] GetProcessHeap () returned 0x630000 [0061.523] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0061.523] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Music\\Zy39i7.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Zy39i7.m4a") returned="C:\\Users\\FD1HVy\\Music\\Zy39i7.m4a" [0061.523] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\Zy39i7.m4a", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Zy39i7.m4a.happythreechoose") returned="C:\\Users\\FD1HVy\\Music\\Zy39i7.m4a.happythreechoose" [0061.523] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Zy39i7.m4a" (normalized: "c:\\users\\fd1hvy\\music\\zy39i7.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Zy39i7.m4a.happythreechoose" (normalized: "c:\\users\\fd1hvy\\music\\zy39i7.m4a.happythreechoose"), dwFlags=0x1) returned 1 [0061.525] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\Zy39i7.m4a" | out: pszPath="C:\\Users\\FD1HVy\\Music") returned 1 [0061.525] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music" | out: pszPath="C:\\Users\\FD1HVy\\Music\\") returned="" [0061.525] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Music\\Decryption INFO.html" [0061.525] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\music\\decryption info.html")) returned 0x20 [0061.525] GetProcessHeap () returned 0x630000 [0061.525] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0061.525] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd43e5830, ftCreationTime.dwHighDateTime=0x1d5cab3, ftLastAccessTime.dwLowDateTime=0xe8fbbc0, ftLastAccessTime.dwHighDateTime=0x1d5d548, ftLastWriteTime.dwLowDateTime=0xe8fbbc0, ftLastWriteTime.dwHighDateTime=0x1d5d548, nFileSizeHigh=0x0, nFileSizeLow=0x1f0a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zyiqDO9Irne784IltUO.mp3", cAlternateFileName="ZYIQDO~1.MP3")) returned 1 [0061.525] lstrcmpiW (lpString1="zyiqDO9Irne784IltUO.mp3", lpString2=".") returned 1 [0061.525] lstrcmpiW (lpString1="zyiqDO9Irne784IltUO.mp3", lpString2="..") returned 1 [0061.525] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="zyiqDO9Irne784IltUO.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\zyiqDO9Irne784IltUO.mp3") returned="C:\\Users\\FD1HVy\\Music\\zyiqDO9Irne784IltUO.mp3" [0061.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="zyiqDO9Irne784IltUO.mp3", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0061.525] GetProcessHeap () returned 0x630000 [0061.525] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18) returned 0x645fb8 [0061.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="zyiqDO9Irne784IltUO.mp3", cchWideChar=-1, lpMultiByteStr=0x645fb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zyiqDO9Irne784IltUO.mp3", lpUsedDefaultChar=0x0) returned 24 [0061.525] lstrlenA (lpString="zyiqDO9Irne784IltUO.mp3") returned 23 [0061.525] lstrlenA (lpString=".happythreechoose") returned 17 [0061.525] lstrlenA (lpString=".happythreechoose") returned 17 [0061.525] lstrlenA (lpString="zyiqDO9Irne784IltUO.mp3") returned 23 [0061.525] lstrcmpiA (lpString1="9Irne784IltUO.mp3", lpString2=".happythreechoose") returned 1 [0061.525] lstrcmpiW (lpString1="zyiqDO9Irne784IltUO.mp3", lpString2="Decryption INFO.html") returned 1 [0061.525] lstrcmpiW (lpString1="zyiqDO9Irne784IltUO.mp3", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0061.526] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0061.526] lstrcmpiW (lpString1="zyiqDO9Irne784IltUO.mp3", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0061.526] GetProcessHeap () returned 0x630000 [0061.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0061.526] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\zyiqDO9Irne784IltUO.mp3" (normalized: "c:\\users\\fd1hvy\\music\\zyiqdo9irne784iltuo.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0061.526] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=7946) returned 1 [0061.526] GetProcessHeap () returned 0x630000 [0061.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655670 [0061.526] GetProcessHeap () returned 0x630000 [0061.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0061.526] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\zyiqDO9Irne784IltUO.mp3") returned 45 [0061.526] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.526] GetProcessHeap () returned 0x630000 [0061.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0061.526] GetProcessHeap () returned 0x630000 [0061.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x386) returned 0x661578 [0061.526] lstrlenA (lpString="rsa_encrypt") returned 11 [0061.526] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0061.528] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0061.528] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0061.528] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0061.528] GetProcessHeap () returned 0x630000 [0061.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0061.528] lstrlenA (lpString="010001") returned 6 [0061.528] GetProcessHeap () returned 0x630000 [0061.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0061.528] GetProcessHeap () returned 0x630000 [0061.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.528] GetProcessHeap () returned 0x630000 [0061.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0061.528] GetProcessHeap () returned 0x630000 [0061.528] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.528] GetProcessHeap () returned 0x630000 [0061.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65df50 [0061.528] GetProcessHeap () returned 0x630000 [0061.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657440 [0061.528] GetProcessHeap () returned 0x630000 [0061.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0061.528] GetProcessHeap () returned 0x630000 [0061.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0061.528] GetProcessHeap () returned 0x630000 [0061.528] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.528] GetProcessHeap () returned 0x630000 [0061.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0061.528] GetProcessHeap () returned 0x630000 [0061.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.528] GetProcessHeap () returned 0x630000 [0061.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657670 [0061.528] GetProcessHeap () returned 0x630000 [0061.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.529] GetProcessHeap () returned 0x630000 [0061.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0061.529] GetProcessHeap () returned 0x630000 [0061.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dfe0 [0061.529] GetProcessHeap () returned 0x630000 [0061.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.529] GetProcessHeap () returned 0x630000 [0061.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0061.529] GetProcessHeap () returned 0x630000 [0061.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0061.529] GetProcessHeap () returned 0x630000 [0061.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.529] GetProcessHeap () returned 0x630000 [0061.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0061.529] GetProcessHeap () returned 0x630000 [0061.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.529] GetProcessHeap () returned 0x630000 [0061.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.529] GetProcessHeap () returned 0x630000 [0061.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.529] GetProcessHeap () returned 0x630000 [0061.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.529] GetProcessHeap () returned 0x630000 [0061.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ec40 [0061.529] GetProcessHeap () returned 0x630000 [0061.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0061.529] GetProcessHeap () returned 0x630000 [0061.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0061.529] GetProcessHeap () returned 0x630000 [0061.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ec40 | out: hHeap=0x630000) returned 1 [0061.529] GetProcessHeap () returned 0x630000 [0061.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.529] GetProcessHeap () returned 0x630000 [0061.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.529] GetProcessHeap () returned 0x630000 [0061.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.529] GetProcessHeap () returned 0x630000 [0061.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.529] GetProcessHeap () returned 0x630000 [0061.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.530] GetProcessHeap () returned 0x630000 [0061.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.530] GetProcessHeap () returned 0x630000 [0061.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.530] GetProcessHeap () returned 0x630000 [0061.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.530] GetProcessHeap () returned 0x630000 [0061.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.530] GetProcessHeap () returned 0x630000 [0061.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.530] GetProcessHeap () returned 0x630000 [0061.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.530] GetProcessHeap () returned 0x630000 [0061.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.530] GetProcessHeap () returned 0x630000 [0061.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.530] GetProcessHeap () returned 0x630000 [0061.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.530] GetProcessHeap () returned 0x630000 [0061.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.530] GetProcessHeap () returned 0x630000 [0061.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.530] GetProcessHeap () returned 0x630000 [0061.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.530] GetProcessHeap () returned 0x630000 [0061.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.530] GetProcessHeap () returned 0x630000 [0061.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.530] GetProcessHeap () returned 0x630000 [0061.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.530] GetProcessHeap () returned 0x630000 [0061.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.530] GetProcessHeap () returned 0x630000 [0061.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.530] GetProcessHeap () returned 0x630000 [0061.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.531] GetProcessHeap () returned 0x630000 [0061.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.531] GetProcessHeap () returned 0x630000 [0061.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.531] GetProcessHeap () returned 0x630000 [0061.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.531] GetProcessHeap () returned 0x630000 [0061.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.531] GetProcessHeap () returned 0x630000 [0061.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.531] GetProcessHeap () returned 0x630000 [0061.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.531] GetProcessHeap () returned 0x630000 [0061.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.531] GetProcessHeap () returned 0x630000 [0061.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.531] GetProcessHeap () returned 0x630000 [0061.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.531] GetProcessHeap () returned 0x630000 [0061.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.531] GetProcessHeap () returned 0x630000 [0061.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.531] GetProcessHeap () returned 0x630000 [0061.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.531] GetProcessHeap () returned 0x630000 [0061.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.531] GetProcessHeap () returned 0x630000 [0061.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.531] GetProcessHeap () returned 0x630000 [0061.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.531] GetProcessHeap () returned 0x630000 [0061.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.531] GetProcessHeap () returned 0x630000 [0061.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.531] GetProcessHeap () returned 0x630000 [0061.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.532] GetProcessHeap () returned 0x630000 [0061.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.532] GetProcessHeap () returned 0x630000 [0061.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.532] GetProcessHeap () returned 0x630000 [0061.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.532] GetProcessHeap () returned 0x630000 [0061.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.532] GetProcessHeap () returned 0x630000 [0061.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.532] GetProcessHeap () returned 0x630000 [0061.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.532] GetProcessHeap () returned 0x630000 [0061.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.532] GetProcessHeap () returned 0x630000 [0061.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.532] GetProcessHeap () returned 0x630000 [0061.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.532] GetProcessHeap () returned 0x630000 [0061.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.532] GetProcessHeap () returned 0x630000 [0061.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.532] GetProcessHeap () returned 0x630000 [0061.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.532] GetProcessHeap () returned 0x630000 [0061.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.532] GetProcessHeap () returned 0x630000 [0061.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.532] GetProcessHeap () returned 0x630000 [0061.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.532] GetProcessHeap () returned 0x630000 [0061.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.532] GetProcessHeap () returned 0x630000 [0061.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.532] GetProcessHeap () returned 0x630000 [0061.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.532] GetProcessHeap () returned 0x630000 [0061.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.533] GetProcessHeap () returned 0x630000 [0061.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.533] GetProcessHeap () returned 0x630000 [0061.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.533] GetProcessHeap () returned 0x630000 [0061.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.533] GetProcessHeap () returned 0x630000 [0061.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.533] GetProcessHeap () returned 0x630000 [0061.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0061.533] GetProcessHeap () returned 0x630000 [0061.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0061.533] GetProcessHeap () returned 0x630000 [0061.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.533] GetProcessHeap () returned 0x630000 [0061.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.533] GetProcessHeap () returned 0x630000 [0061.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.533] GetProcessHeap () returned 0x630000 [0061.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.533] GetProcessHeap () returned 0x630000 [0061.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.533] GetProcessHeap () returned 0x630000 [0061.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.533] GetProcessHeap () returned 0x630000 [0061.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.533] GetProcessHeap () returned 0x630000 [0061.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.533] GetProcessHeap () returned 0x630000 [0061.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.533] GetProcessHeap () returned 0x630000 [0061.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.533] GetProcessHeap () returned 0x630000 [0061.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.533] GetProcessHeap () returned 0x630000 [0061.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.533] GetProcessHeap () returned 0x630000 [0061.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.534] GetProcessHeap () returned 0x630000 [0061.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.534] GetProcessHeap () returned 0x630000 [0061.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.534] GetProcessHeap () returned 0x630000 [0061.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.534] GetProcessHeap () returned 0x630000 [0061.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0061.534] GetProcessHeap () returned 0x630000 [0061.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0061.534] GetProcessHeap () returned 0x630000 [0061.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0061.534] GetProcessHeap () returned 0x630000 [0061.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0061.534] GetProcessHeap () returned 0x630000 [0061.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0061.534] GetProcessHeap () returned 0x630000 [0061.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0061.534] GetProcessHeap () returned 0x630000 [0061.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0061.534] GetProcessHeap () returned 0x630000 [0061.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0061.534] GetProcessHeap () returned 0x630000 [0061.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0061.534] GetProcessHeap () returned 0x630000 [0061.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.534] GetProcessHeap () returned 0x630000 [0061.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0061.534] WriteFile (in: hFile=0x230, lpBuffer=0x661578*, nNumberOfBytesToWrite=0x386, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661578*, lpNumberOfBytesWritten=0x243d864*=0x386, lpOverlapped=0x0) returned 1 [0061.577] GetProcessHeap () returned 0x630000 [0061.577] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x661578, Size=0x30) returned 0x661578 [0061.577] GetProcessHeap () returned 0x630000 [0061.577] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0061.577] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.577] GetProcessHeap () returned 0x630000 [0061.577] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1f10) returned 0x671bf0 [0061.578] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0x1f10, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0x1f10, lpOverlapped=0x0) returned 1 [0061.578] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.578] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0x1f10, lpOverlapped=0x0) returned 1 [0061.579] GetProcessHeap () returned 0x630000 [0061.579] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0061.579] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.579] WriteFile (in: hFile=0x230, lpBuffer=0x661578*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x661578*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0061.580] CloseHandle (hObject=0x230) returned 1 [0061.581] GetProcessHeap () returned 0x630000 [0061.582] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0061.582] GetProcessHeap () returned 0x630000 [0061.582] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655670 | out: hHeap=0x630000) returned 1 [0061.582] GetProcessHeap () returned 0x630000 [0061.582] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0061.582] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Music\\zyiqDO9Irne784IltUO.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\zyiqDO9Irne784IltUO.mp3") returned="C:\\Users\\FD1HVy\\Music\\zyiqDO9Irne784IltUO.mp3" [0061.582] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\zyiqDO9Irne784IltUO.mp3", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Music\\zyiqDO9Irne784IltUO.mp3.happythreechoose") returned="C:\\Users\\FD1HVy\\Music\\zyiqDO9Irne784IltUO.mp3.happythreechoose" [0061.582] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\zyiqDO9Irne784IltUO.mp3" (normalized: "c:\\users\\fd1hvy\\music\\zyiqdo9irne784iltuo.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\zyiqDO9Irne784IltUO.mp3.happythreechoose" (normalized: "c:\\users\\fd1hvy\\music\\zyiqdo9irne784iltuo.mp3.happythreechoose"), dwFlags=0x1) returned 1 [0061.582] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\zyiqDO9Irne784IltUO.mp3" | out: pszPath="C:\\Users\\FD1HVy\\Music") returned 1 [0061.582] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music" | out: pszPath="C:\\Users\\FD1HVy\\Music\\") returned="" [0061.582] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Music\\Decryption INFO.html" [0061.583] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\music\\decryption info.html")) returned 0x20 [0061.583] GetProcessHeap () returned 0x630000 [0061.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645fb8 | out: hHeap=0x630000) returned 1 [0061.583] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd43e5830, ftCreationTime.dwHighDateTime=0x1d5cab3, ftLastAccessTime.dwLowDateTime=0xe8fbbc0, ftLastAccessTime.dwHighDateTime=0x1d5d548, ftLastWriteTime.dwLowDateTime=0xe8fbbc0, ftLastWriteTime.dwHighDateTime=0x1d5d548, nFileSizeHigh=0x0, nFileSizeLow=0x1f0a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zyiqDO9Irne784IltUO.mp3", cAlternateFileName="ZYIQDO~1.MP3")) returned 0 [0061.583] FindClose (in: hFindFile=0x648890 | out: hFindFile=0x648890) returned 1 [0061.583] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\" [0061.583] GetProcessHeap () returned 0x630000 [0061.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65fe80 | out: hHeap=0x630000) returned 1 [0061.583] GetProcessHeap () returned 0x630000 [0061.583] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.583] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\") returned 35 [0061.583] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\*") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\*" [0061.583] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d0821d0, ftCreationTime.dwHighDateTime=0x1d5d1fb, ftLastAccessTime.dwLowDateTime=0xcc7de4d0, ftLastAccessTime.dwHighDateTime=0x1d5d210, ftLastWriteTime.dwLowDateTime=0xcc7de4d0, ftLastWriteTime.dwHighDateTime=0x1d5d210, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648890 [0061.583] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0061.583] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d0821d0, ftCreationTime.dwHighDateTime=0x1d5d1fb, ftLastAccessTime.dwLowDateTime=0xcc7de4d0, ftLastAccessTime.dwHighDateTime=0x1d5d210, ftLastWriteTime.dwLowDateTime=0xcc7de4d0, ftLastWriteTime.dwHighDateTime=0x1d5d210, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.583] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0061.583] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0061.583] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd63ecee0, ftCreationTime.dwHighDateTime=0x1d5ce9f, ftLastAccessTime.dwLowDateTime=0x19ee4110, ftLastAccessTime.dwHighDateTime=0x1d5cd75, ftLastWriteTime.dwLowDateTime=0x19ee4110, ftLastWriteTime.dwHighDateTime=0x1d5cd75, nFileSizeHigh=0x0, nFileSizeLow=0xc728, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="6UZh3TWWEO_.wav", cAlternateFileName="6UZH3T~1.WAV")) returned 1 [0061.583] lstrcmpiW (lpString1="6UZh3TWWEO_.wav", lpString2=".") returned 1 [0061.583] lstrcmpiW (lpString1="6UZh3TWWEO_.wav", lpString2="..") returned 1 [0061.583] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\", lpString2="6UZh3TWWEO_.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\6UZh3TWWEO_.wav") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\6UZh3TWWEO_.wav" [0061.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="6UZh3TWWEO_.wav", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0061.583] GetProcessHeap () returned 0x630000 [0061.584] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x64c9f0 [0061.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="6UZh3TWWEO_.wav", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6UZh3TWWEO_.wav", lpUsedDefaultChar=0x0) returned 16 [0061.584] lstrlenA (lpString="6UZh3TWWEO_.wav") returned 15 [0061.584] lstrlenA (lpString=".happythreechoose") returned 17 [0061.584] lstrcmpiW (lpString1="6UZh3TWWEO_.wav", lpString2="Decryption INFO.html") returned -1 [0061.584] lstrcmpiW (lpString1="6UZh3TWWEO_.wav", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0061.584] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0061.584] lstrcmpiW (lpString1="6UZh3TWWEO_.wav", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0061.584] GetProcessHeap () returned 0x630000 [0061.584] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0061.584] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\6UZh3TWWEO_.wav" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\6uzh3twweo_.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0061.584] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=50984) returned 1 [0061.584] GetProcessHeap () returned 0x630000 [0061.584] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655850 [0061.584] GetProcessHeap () returned 0x630000 [0061.584] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0061.584] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\6UZh3TWWEO_.wav") returned 50 [0061.584] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.584] GetProcessHeap () returned 0x630000 [0061.584] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0061.584] GetProcessHeap () returned 0x630000 [0061.584] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x388) returned 0x6615b0 [0061.584] lstrlenA (lpString="rsa_encrypt") returned 11 [0061.584] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0061.585] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0061.585] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0061.585] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0061.585] GetProcessHeap () returned 0x630000 [0061.585] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0061.585] lstrlenA (lpString="010001") returned 6 [0061.585] GetProcessHeap () returned 0x630000 [0061.585] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0061.585] GetProcessHeap () returned 0x630000 [0061.585] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.585] GetProcessHeap () returned 0x630000 [0061.585] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e340 [0061.585] GetProcessHeap () returned 0x630000 [0061.585] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.585] GetProcessHeap () returned 0x630000 [0061.585] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dfe0 [0061.585] GetProcessHeap () returned 0x630000 [0061.585] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657440 [0061.585] GetProcessHeap () returned 0x630000 [0061.585] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0061.585] GetProcessHeap () returned 0x630000 [0061.585] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0061.586] GetProcessHeap () returned 0x630000 [0061.586] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.586] GetProcessHeap () returned 0x630000 [0061.586] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0061.586] GetProcessHeap () returned 0x630000 [0061.588] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.588] GetProcessHeap () returned 0x630000 [0061.588] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657558 [0061.588] GetProcessHeap () returned 0x630000 [0061.588] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.588] GetProcessHeap () returned 0x630000 [0061.588] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0061.588] GetProcessHeap () returned 0x630000 [0061.588] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e3d0 [0061.588] GetProcessHeap () returned 0x630000 [0061.588] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.588] GetProcessHeap () returned 0x630000 [0061.588] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0061.588] GetProcessHeap () returned 0x630000 [0061.588] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0061.588] GetProcessHeap () returned 0x630000 [0061.588] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.588] GetProcessHeap () returned 0x630000 [0061.588] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cdf0 [0061.588] GetProcessHeap () returned 0x630000 [0061.588] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.589] GetProcessHeap () returned 0x630000 [0061.589] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.589] GetProcessHeap () returned 0x630000 [0061.589] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.589] GetProcessHeap () returned 0x630000 [0061.589] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.589] GetProcessHeap () returned 0x630000 [0061.589] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65dec0 [0061.589] GetProcessHeap () returned 0x630000 [0061.589] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cdf0 | out: hHeap=0x630000) returned 1 [0061.589] GetProcessHeap () returned 0x630000 [0061.589] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0061.589] GetProcessHeap () returned 0x630000 [0061.589] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0061.589] GetProcessHeap () returned 0x630000 [0061.589] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.589] GetProcessHeap () returned 0x630000 [0061.589] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.589] GetProcessHeap () returned 0x630000 [0061.589] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.589] GetProcessHeap () returned 0x630000 [0061.589] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.589] GetProcessHeap () returned 0x630000 [0061.589] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.589] GetProcessHeap () returned 0x630000 [0061.589] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.589] GetProcessHeap () returned 0x630000 [0061.589] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.589] GetProcessHeap () returned 0x630000 [0061.589] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.589] GetProcessHeap () returned 0x630000 [0061.589] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.589] GetProcessHeap () returned 0x630000 [0061.589] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.589] GetProcessHeap () returned 0x630000 [0061.589] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.589] GetProcessHeap () returned 0x630000 [0061.589] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.590] GetProcessHeap () returned 0x630000 [0061.590] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.590] GetProcessHeap () returned 0x630000 [0061.590] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.590] GetProcessHeap () returned 0x630000 [0061.590] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.590] GetProcessHeap () returned 0x630000 [0061.590] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.590] GetProcessHeap () returned 0x630000 [0061.590] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.590] GetProcessHeap () returned 0x630000 [0061.590] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.590] GetProcessHeap () returned 0x630000 [0061.590] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.590] GetProcessHeap () returned 0x630000 [0061.590] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.590] GetProcessHeap () returned 0x630000 [0061.590] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.590] GetProcessHeap () returned 0x630000 [0061.590] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.590] GetProcessHeap () returned 0x630000 [0061.590] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.590] GetProcessHeap () returned 0x630000 [0061.590] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.590] GetProcessHeap () returned 0x630000 [0061.590] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.590] GetProcessHeap () returned 0x630000 [0061.590] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.590] GetProcessHeap () returned 0x630000 [0061.590] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.590] GetProcessHeap () returned 0x630000 [0061.590] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.590] GetProcessHeap () returned 0x630000 [0061.590] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.590] GetProcessHeap () returned 0x630000 [0061.590] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.590] GetProcessHeap () returned 0x630000 [0061.591] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.591] GetProcessHeap () returned 0x630000 [0061.591] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.591] GetProcessHeap () returned 0x630000 [0061.591] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.591] GetProcessHeap () returned 0x630000 [0061.591] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.591] GetProcessHeap () returned 0x630000 [0061.591] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.591] GetProcessHeap () returned 0x630000 [0061.591] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.591] GetProcessHeap () returned 0x630000 [0061.591] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.591] GetProcessHeap () returned 0x630000 [0061.591] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.591] GetProcessHeap () returned 0x630000 [0061.591] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.591] GetProcessHeap () returned 0x630000 [0061.591] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.591] GetProcessHeap () returned 0x630000 [0061.591] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.591] GetProcessHeap () returned 0x630000 [0061.591] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.591] GetProcessHeap () returned 0x630000 [0061.591] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.591] GetProcessHeap () returned 0x630000 [0061.591] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.591] GetProcessHeap () returned 0x630000 [0061.591] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.591] GetProcessHeap () returned 0x630000 [0061.591] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.591] GetProcessHeap () returned 0x630000 [0061.591] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.591] GetProcessHeap () returned 0x630000 [0061.591] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.591] GetProcessHeap () returned 0x630000 [0061.591] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.592] GetProcessHeap () returned 0x630000 [0061.592] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.592] GetProcessHeap () returned 0x630000 [0061.592] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.592] GetProcessHeap () returned 0x630000 [0061.592] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.592] GetProcessHeap () returned 0x630000 [0061.592] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.592] GetProcessHeap () returned 0x630000 [0061.592] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.592] GetProcessHeap () returned 0x630000 [0061.592] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.592] GetProcessHeap () returned 0x630000 [0061.592] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.592] GetProcessHeap () returned 0x630000 [0061.592] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.592] GetProcessHeap () returned 0x630000 [0061.592] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.592] GetProcessHeap () returned 0x630000 [0061.592] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.592] GetProcessHeap () returned 0x630000 [0061.592] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.592] GetProcessHeap () returned 0x630000 [0061.592] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0061.592] GetProcessHeap () returned 0x630000 [0061.592] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0061.592] GetProcessHeap () returned 0x630000 [0061.592] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.592] GetProcessHeap () returned 0x630000 [0061.592] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.592] GetProcessHeap () returned 0x630000 [0061.592] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.592] GetProcessHeap () returned 0x630000 [0061.592] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.592] GetProcessHeap () returned 0x630000 [0061.592] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.592] GetProcessHeap () returned 0x630000 [0061.592] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.593] GetProcessHeap () returned 0x630000 [0061.593] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.593] GetProcessHeap () returned 0x630000 [0061.593] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.593] GetProcessHeap () returned 0x630000 [0061.593] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.593] GetProcessHeap () returned 0x630000 [0061.593] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.593] GetProcessHeap () returned 0x630000 [0061.593] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.593] GetProcessHeap () returned 0x630000 [0061.593] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.593] GetProcessHeap () returned 0x630000 [0061.593] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.593] GetProcessHeap () returned 0x630000 [0061.593] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.593] GetProcessHeap () returned 0x630000 [0061.593] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0061.593] GetProcessHeap () returned 0x630000 [0061.593] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0061.593] GetProcessHeap () returned 0x630000 [0061.593] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.593] GetProcessHeap () returned 0x630000 [0061.593] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.593] GetProcessHeap () returned 0x630000 [0061.593] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.593] GetProcessHeap () returned 0x630000 [0061.593] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.593] GetProcessHeap () returned 0x630000 [0061.593] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0061.593] GetProcessHeap () returned 0x630000 [0061.593] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0061.593] GetProcessHeap () returned 0x630000 [0061.593] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0061.593] GetProcessHeap () returned 0x630000 [0061.593] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0061.593] GetProcessHeap () returned 0x630000 [0061.593] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0061.594] GetProcessHeap () returned 0x630000 [0061.594] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0061.594] GetProcessHeap () returned 0x630000 [0061.594] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0061.594] GetProcessHeap () returned 0x630000 [0061.594] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0061.594] GetProcessHeap () returned 0x630000 [0061.594] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0061.594] GetProcessHeap () returned 0x630000 [0061.594] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.594] GetProcessHeap () returned 0x630000 [0061.594] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0061.594] WriteFile (in: hFile=0x230, lpBuffer=0x6615b0*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6615b0*, lpNumberOfBytesWritten=0x243d864*=0x388, lpOverlapped=0x0) returned 1 [0061.595] GetProcessHeap () returned 0x630000 [0061.596] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6615b0, Size=0x30) returned 0x6615b0 [0061.596] GetProcessHeap () returned 0x630000 [0061.596] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0061.596] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.596] GetProcessHeap () returned 0x630000 [0061.596] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc730) returned 0x671bf0 [0061.596] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0xc730, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0xc730, lpOverlapped=0x0) returned 1 [0061.596] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.596] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0xc730, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0xc730, lpOverlapped=0x0) returned 1 [0061.598] GetProcessHeap () returned 0x630000 [0061.598] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0061.598] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.598] WriteFile (in: hFile=0x230, lpBuffer=0x6615b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6615b0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0061.599] CloseHandle (hObject=0x230) returned 1 [0061.602] GetProcessHeap () returned 0x630000 [0061.602] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0061.602] GetProcessHeap () returned 0x630000 [0061.602] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655850 | out: hHeap=0x630000) returned 1 [0061.602] GetProcessHeap () returned 0x630000 [0061.602] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0061.602] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\6UZh3TWWEO_.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\6UZh3TWWEO_.wav") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\6UZh3TWWEO_.wav" [0061.602] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\6UZh3TWWEO_.wav", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\6UZh3TWWEO_.wav.happythreechoose") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\6UZh3TWWEO_.wav.happythreechoose" [0061.602] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\6UZh3TWWEO_.wav" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\6uzh3twweo_.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\6UZh3TWWEO_.wav.happythreechoose" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\6uzh3twweo_.wav.happythreechoose"), dwFlags=0x1) returned 1 [0061.603] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\6UZh3TWWEO_.wav" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-") returned 1 [0061.603] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\") returned="" [0061.603] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\Decryption INFO.html" [0061.603] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\decryption info.html")) returned 0xffffffff [0061.603] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0061.603] GetProcessHeap () returned 0x630000 [0061.603] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655940 [0061.603] GetProcessHeap () returned 0x630000 [0061.603] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0061.610] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.611] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.611] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.611] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.611] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.612] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.612] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.612] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.612] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.612] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.612] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.612] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.612] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.612] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.612] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.612] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.612] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.612] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.613] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.613] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.613] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.613] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.613] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.613] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.613] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.613] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.613] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.613] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.613] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.613] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.613] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.614] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.614] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.614] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.614] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.614] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.614] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.615] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.615] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.615] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.615] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.615] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.615] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.615] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.615] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.615] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.615] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.615] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.616] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.616] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.616] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.616] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.616] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.616] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.616] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.616] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.616] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.616] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.616] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.616] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.616] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.617] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.617] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.617] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.617] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.617] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.617] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.617] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.617] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.617] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.617] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.617] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.617] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.617] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.618] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.618] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.618] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.618] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.618] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.618] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.618] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.618] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.618] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.618] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.618] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.618] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.618] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.618] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.619] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.619] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.619] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.619] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.619] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.619] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.619] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.619] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.619] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.619] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.619] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.619] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.619] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.620] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.620] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.620] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.620] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.620] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.620] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.620] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.620] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.620] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.620] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.620] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.620] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.620] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.620] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.620] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.621] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.621] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.621] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.621] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.621] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.621] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.621] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.621] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.621] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.621] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.621] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.621] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.621] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.621] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.622] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.622] GetProcessHeap () returned 0x630000 [0061.622] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655940 | out: hHeap=0x630000) returned 1 [0061.622] GetProcessHeap () returned 0x630000 [0061.622] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0061.622] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0061.622] GetProcessHeap () returned 0x630000 [0061.622] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6559b8 [0061.622] GetProcessHeap () returned 0x630000 [0061.622] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0061.629] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.629] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.629] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.629] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.629] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.629] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.629] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.629] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.629] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.629] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.630] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.630] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.630] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.630] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.630] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.630] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.630] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.630] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.630] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.630] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.630] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.630] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.630] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.630] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.631] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.631] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.631] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.631] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.631] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.631] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.631] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.631] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.631] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.631] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.631] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.631] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.631] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.631] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.632] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.632] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.632] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.632] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.632] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.632] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.632] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.632] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.632] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.632] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.632] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.632] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.632] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.633] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.633] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.633] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.633] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.634] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.634] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.634] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.634] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.634] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.634] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.634] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.634] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.634] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.634] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.634] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.634] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.634] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.634] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.635] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.635] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.635] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.635] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.635] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.635] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.635] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.635] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.635] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.635] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.635] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.635] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.636] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.636] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.636] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.636] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.636] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.636] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.636] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.636] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.636] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.636] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.636] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.636] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.636] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.636] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.637] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.637] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.637] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.637] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.637] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.637] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.637] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.637] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.637] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.637] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.637] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.637] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.637] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.637] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.638] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.638] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.638] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.638] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.638] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.638] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.638] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.638] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.638] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.639] GetProcessHeap () returned 0x630000 [0061.639] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6559b8 | out: hHeap=0x630000) returned 1 [0061.639] GetProcessHeap () returned 0x630000 [0061.639] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0061.639] CloseHandle (hObject=0x230) returned 1 [0061.639] GetProcessHeap () returned 0x630000 [0061.639] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0061.639] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec29c50, ftCreationTime.dwHighDateTime=0x1d5cb68, ftLastAccessTime.dwLowDateTime=0x62491d40, ftLastAccessTime.dwHighDateTime=0x1d5d379, ftLastWriteTime.dwLowDateTime=0x62491d40, ftLastWriteTime.dwHighDateTime=0x1d5d379, nFileSizeHigh=0x0, nFileSizeLow=0x1710d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8PwLuaLcBVkei7G.mp3", cAlternateFileName="8PWLUA~1.MP3")) returned 1 [0061.639] lstrcmpiW (lpString1="8PwLuaLcBVkei7G.mp3", lpString2=".") returned 1 [0061.639] lstrcmpiW (lpString1="8PwLuaLcBVkei7G.mp3", lpString2="..") returned 1 [0061.639] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\", lpString2="8PwLuaLcBVkei7G.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\8PwLuaLcBVkei7G.mp3") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\8PwLuaLcBVkei7G.mp3" [0061.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="8PwLuaLcBVkei7G.mp3", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0061.639] GetProcessHeap () returned 0x630000 [0061.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x645cd8 [0061.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="8PwLuaLcBVkei7G.mp3", cchWideChar=-1, lpMultiByteStr=0x645cd8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8PwLuaLcBVkei7G.mp3", lpUsedDefaultChar=0x0) returned 20 [0061.640] lstrlenA (lpString="8PwLuaLcBVkei7G.mp3") returned 19 [0061.640] lstrlenA (lpString=".happythreechoose") returned 17 [0061.640] lstrlenA (lpString=".happythreechoose") returned 17 [0061.640] lstrlenA (lpString="8PwLuaLcBVkei7G.mp3") returned 19 [0061.640] lstrcmpiA (lpString1="wLuaLcBVkei7G.mp3", lpString2=".happythreechoose") returned 1 [0061.640] lstrcmpiW (lpString1="8PwLuaLcBVkei7G.mp3", lpString2="Decryption INFO.html") returned -1 [0061.640] lstrcmpiW (lpString1="8PwLuaLcBVkei7G.mp3", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0061.640] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0061.640] lstrcmpiW (lpString1="8PwLuaLcBVkei7G.mp3", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0061.640] GetProcessHeap () returned 0x630000 [0061.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0061.640] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\8PwLuaLcBVkei7G.mp3" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\8pwlualcbvkei7g.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0061.640] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=94477) returned 1 [0061.640] GetProcessHeap () returned 0x630000 [0061.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655940 [0061.640] GetProcessHeap () returned 0x630000 [0061.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0061.640] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\8PwLuaLcBVkei7G.mp3") returned 54 [0061.640] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.640] GetProcessHeap () returned 0x630000 [0061.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0061.640] GetProcessHeap () returned 0x630000 [0061.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x6615e8 [0061.640] lstrlenA (lpString="rsa_encrypt") returned 11 [0061.640] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0061.641] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0061.641] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0061.641] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0061.641] GetProcessHeap () returned 0x630000 [0061.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0061.641] lstrlenA (lpString="010001") returned 6 [0061.641] GetProcessHeap () returned 0x630000 [0061.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a318 [0061.641] GetProcessHeap () returned 0x630000 [0061.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.641] GetProcessHeap () returned 0x630000 [0061.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e580 [0061.641] GetProcessHeap () returned 0x630000 [0061.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.641] GetProcessHeap () returned 0x630000 [0061.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0061.641] GetProcessHeap () returned 0x630000 [0061.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656db0 [0061.642] GetProcessHeap () returned 0x630000 [0061.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0061.642] GetProcessHeap () returned 0x630000 [0061.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0061.642] GetProcessHeap () returned 0x630000 [0061.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.642] GetProcessHeap () returned 0x630000 [0061.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0061.642] GetProcessHeap () returned 0x630000 [0061.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.642] GetProcessHeap () returned 0x630000 [0061.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656950 [0061.642] GetProcessHeap () returned 0x630000 [0061.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.642] GetProcessHeap () returned 0x630000 [0061.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0061.642] GetProcessHeap () returned 0x630000 [0061.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e970 [0061.642] GetProcessHeap () returned 0x630000 [0061.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.642] GetProcessHeap () returned 0x630000 [0061.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0061.642] GetProcessHeap () returned 0x630000 [0061.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0061.642] GetProcessHeap () returned 0x630000 [0061.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0061.642] GetProcessHeap () returned 0x630000 [0061.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0061.642] GetProcessHeap () returned 0x630000 [0061.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.642] GetProcessHeap () returned 0x630000 [0061.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0061.642] GetProcessHeap () returned 0x630000 [0061.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.642] GetProcessHeap () returned 0x630000 [0061.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.642] GetProcessHeap () returned 0x630000 [0061.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65dec0 [0061.643] GetProcessHeap () returned 0x630000 [0061.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0061.643] GetProcessHeap () returned 0x630000 [0061.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0061.643] GetProcessHeap () returned 0x630000 [0061.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0061.643] GetProcessHeap () returned 0x630000 [0061.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.643] GetProcessHeap () returned 0x630000 [0061.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.643] GetProcessHeap () returned 0x630000 [0061.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.643] GetProcessHeap () returned 0x630000 [0061.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.643] GetProcessHeap () returned 0x630000 [0061.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.643] GetProcessHeap () returned 0x630000 [0061.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.643] GetProcessHeap () returned 0x630000 [0061.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.643] GetProcessHeap () returned 0x630000 [0061.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.643] GetProcessHeap () returned 0x630000 [0061.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.643] GetProcessHeap () returned 0x630000 [0061.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.643] GetProcessHeap () returned 0x630000 [0061.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0061.643] GetProcessHeap () returned 0x630000 [0061.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0061.643] GetProcessHeap () returned 0x630000 [0061.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.643] GetProcessHeap () returned 0x630000 [0061.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.643] GetProcessHeap () returned 0x630000 [0061.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.643] GetProcessHeap () returned 0x630000 [0061.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.644] GetProcessHeap () returned 0x630000 [0061.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.644] GetProcessHeap () returned 0x630000 [0061.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.644] GetProcessHeap () returned 0x630000 [0061.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.644] GetProcessHeap () returned 0x630000 [0061.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.644] GetProcessHeap () returned 0x630000 [0061.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.644] GetProcessHeap () returned 0x630000 [0061.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.644] GetProcessHeap () returned 0x630000 [0061.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.644] GetProcessHeap () returned 0x630000 [0061.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.644] GetProcessHeap () returned 0x630000 [0061.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.644] GetProcessHeap () returned 0x630000 [0061.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.644] GetProcessHeap () returned 0x630000 [0061.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.644] GetProcessHeap () returned 0x630000 [0061.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.644] GetProcessHeap () returned 0x630000 [0061.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.644] GetProcessHeap () returned 0x630000 [0061.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.644] GetProcessHeap () returned 0x630000 [0061.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.644] GetProcessHeap () returned 0x630000 [0061.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.644] GetProcessHeap () returned 0x630000 [0061.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.644] GetProcessHeap () returned 0x630000 [0061.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.645] GetProcessHeap () returned 0x630000 [0061.645] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.645] GetProcessHeap () returned 0x630000 [0061.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.645] GetProcessHeap () returned 0x630000 [0061.645] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.645] GetProcessHeap () returned 0x630000 [0061.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.645] GetProcessHeap () returned 0x630000 [0061.645] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.645] GetProcessHeap () returned 0x630000 [0061.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.645] GetProcessHeap () returned 0x630000 [0061.645] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.645] GetProcessHeap () returned 0x630000 [0061.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.645] GetProcessHeap () returned 0x630000 [0061.645] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.645] GetProcessHeap () returned 0x630000 [0061.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.645] GetProcessHeap () returned 0x630000 [0061.645] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0061.645] GetProcessHeap () returned 0x630000 [0061.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0061.645] GetProcessHeap () returned 0x630000 [0061.645] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.645] GetProcessHeap () returned 0x630000 [0061.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.645] GetProcessHeap () returned 0x630000 [0061.645] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.645] GetProcessHeap () returned 0x630000 [0061.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.645] GetProcessHeap () returned 0x630000 [0061.645] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.645] GetProcessHeap () returned 0x630000 [0061.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.645] GetProcessHeap () returned 0x630000 [0061.646] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.646] GetProcessHeap () returned 0x630000 [0061.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.646] GetProcessHeap () returned 0x630000 [0061.646] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.646] GetProcessHeap () returned 0x630000 [0061.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.646] GetProcessHeap () returned 0x630000 [0061.646] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.646] GetProcessHeap () returned 0x630000 [0061.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.646] GetProcessHeap () returned 0x630000 [0061.646] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.646] GetProcessHeap () returned 0x630000 [0061.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.646] GetProcessHeap () returned 0x630000 [0061.646] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.646] GetProcessHeap () returned 0x630000 [0061.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.646] GetProcessHeap () returned 0x630000 [0061.646] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.646] GetProcessHeap () returned 0x630000 [0061.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.646] GetProcessHeap () returned 0x630000 [0061.646] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.646] GetProcessHeap () returned 0x630000 [0061.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.646] GetProcessHeap () returned 0x630000 [0061.646] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.646] GetProcessHeap () returned 0x630000 [0061.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.646] GetProcessHeap () returned 0x630000 [0061.646] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.646] GetProcessHeap () returned 0x630000 [0061.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.646] GetProcessHeap () returned 0x630000 [0061.646] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.646] GetProcessHeap () returned 0x630000 [0061.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.647] GetProcessHeap () returned 0x630000 [0061.647] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.647] GetProcessHeap () returned 0x630000 [0061.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.647] GetProcessHeap () returned 0x630000 [0061.647] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.647] GetProcessHeap () returned 0x630000 [0061.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.647] GetProcessHeap () returned 0x630000 [0061.647] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.647] GetProcessHeap () returned 0x630000 [0061.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.647] GetProcessHeap () returned 0x630000 [0061.647] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.647] GetProcessHeap () returned 0x630000 [0061.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.647] GetProcessHeap () returned 0x630000 [0061.647] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.647] GetProcessHeap () returned 0x630000 [0061.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.647] GetProcessHeap () returned 0x630000 [0061.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0061.647] GetProcessHeap () returned 0x630000 [0061.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0061.647] GetProcessHeap () returned 0x630000 [0061.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0061.647] GetProcessHeap () returned 0x630000 [0061.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0061.647] GetProcessHeap () returned 0x630000 [0061.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0061.647] GetProcessHeap () returned 0x630000 [0061.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0061.647] GetProcessHeap () returned 0x630000 [0061.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0061.647] GetProcessHeap () returned 0x630000 [0061.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0061.648] GetProcessHeap () returned 0x630000 [0061.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0061.648] GetProcessHeap () returned 0x630000 [0061.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.648] GetProcessHeap () returned 0x630000 [0061.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0061.648] WriteFile (in: hFile=0x230, lpBuffer=0x6615e8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6615e8*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0061.653] GetProcessHeap () returned 0x630000 [0061.653] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6615e8, Size=0x30) returned 0x6615e8 [0061.653] GetProcessHeap () returned 0x630000 [0061.653] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0061.653] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.653] GetProcessHeap () returned 0x630000 [0061.653] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1710d) returned 0x671bf0 [0061.653] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0x1710d, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0x1710d, lpOverlapped=0x0) returned 1 [0061.654] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.654] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x1710d, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0x1710d, lpOverlapped=0x0) returned 1 [0061.656] GetProcessHeap () returned 0x630000 [0061.656] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0061.656] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.656] WriteFile (in: hFile=0x230, lpBuffer=0x6615e8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6615e8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0061.657] CloseHandle (hObject=0x230) returned 1 [0061.660] GetProcessHeap () returned 0x630000 [0061.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0061.660] GetProcessHeap () returned 0x630000 [0061.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655940 | out: hHeap=0x630000) returned 1 [0061.660] GetProcessHeap () returned 0x630000 [0061.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0061.660] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\8PwLuaLcBVkei7G.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\8PwLuaLcBVkei7G.mp3") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\8PwLuaLcBVkei7G.mp3" [0061.660] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\8PwLuaLcBVkei7G.mp3", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\8PwLuaLcBVkei7G.mp3.happythreechoose") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\8PwLuaLcBVkei7G.mp3.happythreechoose" [0061.660] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\8PwLuaLcBVkei7G.mp3" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\8pwlualcbvkei7g.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\8PwLuaLcBVkei7G.mp3.happythreechoose" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\8pwlualcbvkei7g.mp3.happythreechoose"), dwFlags=0x1) returned 1 [0061.661] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\8PwLuaLcBVkei7G.mp3" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-") returned 1 [0061.661] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\") returned="" [0061.661] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\Decryption INFO.html" [0061.661] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\decryption info.html")) returned 0x20 [0061.661] GetProcessHeap () returned 0x630000 [0061.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645cd8 | out: hHeap=0x630000) returned 1 [0061.661] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b455ea0, ftCreationTime.dwHighDateTime=0x1d5c97b, ftLastAccessTime.dwLowDateTime=0x86110d40, ftLastAccessTime.dwHighDateTime=0x1d5d370, ftLastWriteTime.dwLowDateTime=0x86110d40, ftLastWriteTime.dwHighDateTime=0x1d5d370, nFileSizeHigh=0x0, nFileSizeLow=0x6eaf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CA6Ig.wav", cAlternateFileName="")) returned 1 [0061.661] lstrcmpiW (lpString1="CA6Ig.wav", lpString2=".") returned 1 [0061.661] lstrcmpiW (lpString1="CA6Ig.wav", lpString2="..") returned 1 [0061.661] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\", lpString2="CA6Ig.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\CA6Ig.wav") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\CA6Ig.wav" [0061.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CA6Ig.wav", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0061.661] GetProcessHeap () returned 0x630000 [0061.661] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x64c9f0 [0061.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CA6Ig.wav", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CA6Ig.wav", lpUsedDefaultChar=0x0) returned 10 [0061.661] lstrlenA (lpString="CA6Ig.wav") returned 9 [0061.661] lstrlenA (lpString=".happythreechoose") returned 17 [0061.661] lstrcmpiW (lpString1="CA6Ig.wav", lpString2="Decryption INFO.html") returned -1 [0061.661] lstrcmpiW (lpString1="CA6Ig.wav", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0061.661] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0061.662] lstrcmpiW (lpString1="CA6Ig.wav", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0061.662] GetProcessHeap () returned 0x630000 [0061.662] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f10 [0061.662] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\CA6Ig.wav" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\ca6ig.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0061.662] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=28335) returned 1 [0061.662] GetProcessHeap () returned 0x630000 [0061.662] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6559b8 [0061.662] GetProcessHeap () returned 0x630000 [0061.662] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0061.662] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\CA6Ig.wav") returned 44 [0061.662] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.662] GetProcessHeap () returned 0x630000 [0061.662] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0061.662] GetProcessHeap () returned 0x630000 [0061.662] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x659010 [0061.662] lstrlenA (lpString="rsa_encrypt") returned 11 [0061.662] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0061.663] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0061.663] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0061.663] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0061.663] GetProcessHeap () returned 0x630000 [0061.663] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0061.663] lstrlenA (lpString="010001") returned 6 [0061.663] GetProcessHeap () returned 0x630000 [0061.663] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0061.663] GetProcessHeap () returned 0x630000 [0061.663] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.663] GetProcessHeap () returned 0x630000 [0061.663] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e580 [0061.663] GetProcessHeap () returned 0x630000 [0061.663] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.663] GetProcessHeap () returned 0x630000 [0061.663] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0061.663] GetProcessHeap () returned 0x630000 [0061.663] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656ec8 [0061.663] GetProcessHeap () returned 0x630000 [0061.663] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0061.663] GetProcessHeap () returned 0x630000 [0061.663] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0061.663] GetProcessHeap () returned 0x630000 [0061.663] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.663] GetProcessHeap () returned 0x630000 [0061.663] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0061.663] GetProcessHeap () returned 0x630000 [0061.663] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.663] GetProcessHeap () returned 0x630000 [0061.663] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656fe0 [0061.664] GetProcessHeap () returned 0x630000 [0061.664] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.664] GetProcessHeap () returned 0x630000 [0061.664] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0061.664] GetProcessHeap () returned 0x630000 [0061.664] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ebb0 [0061.664] GetProcessHeap () returned 0x630000 [0061.664] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.664] GetProcessHeap () returned 0x630000 [0061.664] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0061.664] GetProcessHeap () returned 0x630000 [0061.664] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0061.664] GetProcessHeap () returned 0x630000 [0061.664] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.664] GetProcessHeap () returned 0x630000 [0061.664] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cf10 [0061.664] GetProcessHeap () returned 0x630000 [0061.664] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.664] GetProcessHeap () returned 0x630000 [0061.664] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.664] GetProcessHeap () returned 0x630000 [0061.664] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.664] GetProcessHeap () returned 0x630000 [0061.664] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.664] GetProcessHeap () returned 0x630000 [0061.664] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e6a0 [0061.664] GetProcessHeap () returned 0x630000 [0061.664] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cf10 | out: hHeap=0x630000) returned 1 [0061.664] GetProcessHeap () returned 0x630000 [0061.664] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0061.665] GetProcessHeap () returned 0x630000 [0061.665] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e6a0 | out: hHeap=0x630000) returned 1 [0061.665] GetProcessHeap () returned 0x630000 [0061.665] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.665] GetProcessHeap () returned 0x630000 [0061.665] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.665] GetProcessHeap () returned 0x630000 [0061.665] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.665] GetProcessHeap () returned 0x630000 [0061.665] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.665] GetProcessHeap () returned 0x630000 [0061.665] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.665] GetProcessHeap () returned 0x630000 [0061.665] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.665] GetProcessHeap () returned 0x630000 [0061.665] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.665] GetProcessHeap () returned 0x630000 [0061.665] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.665] GetProcessHeap () returned 0x630000 [0061.665] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.665] GetProcessHeap () returned 0x630000 [0061.665] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.665] GetProcessHeap () returned 0x630000 [0061.665] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.665] GetProcessHeap () returned 0x630000 [0061.665] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.665] GetProcessHeap () returned 0x630000 [0061.665] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.665] GetProcessHeap () returned 0x630000 [0061.665] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.665] GetProcessHeap () returned 0x630000 [0061.665] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.665] GetProcessHeap () returned 0x630000 [0061.665] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.665] GetProcessHeap () returned 0x630000 [0061.665] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.665] GetProcessHeap () returned 0x630000 [0061.666] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.666] GetProcessHeap () returned 0x630000 [0061.666] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.666] GetProcessHeap () returned 0x630000 [0061.666] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.666] GetProcessHeap () returned 0x630000 [0061.666] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.666] GetProcessHeap () returned 0x630000 [0061.666] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.666] GetProcessHeap () returned 0x630000 [0061.666] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.666] GetProcessHeap () returned 0x630000 [0061.666] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.666] GetProcessHeap () returned 0x630000 [0061.666] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.666] GetProcessHeap () returned 0x630000 [0061.666] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.666] GetProcessHeap () returned 0x630000 [0061.666] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.666] GetProcessHeap () returned 0x630000 [0061.666] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.666] GetProcessHeap () returned 0x630000 [0061.666] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.666] GetProcessHeap () returned 0x630000 [0061.666] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.666] GetProcessHeap () returned 0x630000 [0061.666] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.666] GetProcessHeap () returned 0x630000 [0061.666] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.666] GetProcessHeap () returned 0x630000 [0061.666] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.666] GetProcessHeap () returned 0x630000 [0061.666] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.666] GetProcessHeap () returned 0x630000 [0061.666] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.666] GetProcessHeap () returned 0x630000 [0061.666] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.667] GetProcessHeap () returned 0x630000 [0061.667] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.667] GetProcessHeap () returned 0x630000 [0061.667] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.667] GetProcessHeap () returned 0x630000 [0061.667] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.667] GetProcessHeap () returned 0x630000 [0061.667] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.667] GetProcessHeap () returned 0x630000 [0061.667] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.667] GetProcessHeap () returned 0x630000 [0061.667] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.667] GetProcessHeap () returned 0x630000 [0061.667] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.667] GetProcessHeap () returned 0x630000 [0061.667] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.667] GetProcessHeap () returned 0x630000 [0061.667] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.667] GetProcessHeap () returned 0x630000 [0061.667] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.667] GetProcessHeap () returned 0x630000 [0061.667] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.667] GetProcessHeap () returned 0x630000 [0061.667] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.667] GetProcessHeap () returned 0x630000 [0061.667] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.667] GetProcessHeap () returned 0x630000 [0061.667] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.667] GetProcessHeap () returned 0x630000 [0061.667] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.667] GetProcessHeap () returned 0x630000 [0061.667] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.667] GetProcessHeap () returned 0x630000 [0061.667] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.667] GetProcessHeap () returned 0x630000 [0061.667] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.667] GetProcessHeap () returned 0x630000 [0061.667] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.668] GetProcessHeap () returned 0x630000 [0061.668] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.668] GetProcessHeap () returned 0x630000 [0061.668] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.668] GetProcessHeap () returned 0x630000 [0061.668] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.668] GetProcessHeap () returned 0x630000 [0061.668] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.668] GetProcessHeap () returned 0x630000 [0061.668] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.668] GetProcessHeap () returned 0x630000 [0061.668] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.668] GetProcessHeap () returned 0x630000 [0061.668] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.668] GetProcessHeap () returned 0x630000 [0061.668] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.668] GetProcessHeap () returned 0x630000 [0061.668] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.668] GetProcessHeap () returned 0x630000 [0061.668] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.668] GetProcessHeap () returned 0x630000 [0061.668] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.668] GetProcessHeap () returned 0x630000 [0061.668] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.668] GetProcessHeap () returned 0x630000 [0061.668] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.668] GetProcessHeap () returned 0x630000 [0061.668] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.668] GetProcessHeap () returned 0x630000 [0061.668] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.668] GetProcessHeap () returned 0x630000 [0061.668] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.668] GetProcessHeap () returned 0x630000 [0061.668] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.668] GetProcessHeap () returned 0x630000 [0061.668] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.668] GetProcessHeap () returned 0x630000 [0061.668] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.669] GetProcessHeap () returned 0x630000 [0061.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.669] GetProcessHeap () returned 0x630000 [0061.669] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.669] GetProcessHeap () returned 0x630000 [0061.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.669] GetProcessHeap () returned 0x630000 [0061.669] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.669] GetProcessHeap () returned 0x630000 [0061.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0061.669] GetProcessHeap () returned 0x630000 [0061.669] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0061.669] GetProcessHeap () returned 0x630000 [0061.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.669] GetProcessHeap () returned 0x630000 [0061.669] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.669] GetProcessHeap () returned 0x630000 [0061.669] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0061.669] GetProcessHeap () returned 0x630000 [0061.669] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0061.669] GetProcessHeap () returned 0x630000 [0061.669] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0061.669] GetProcessHeap () returned 0x630000 [0061.669] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0061.669] GetProcessHeap () returned 0x630000 [0061.669] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0061.669] GetProcessHeap () returned 0x630000 [0061.669] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0061.669] GetProcessHeap () returned 0x630000 [0061.669] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0061.669] GetProcessHeap () returned 0x630000 [0061.669] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0061.669] GetProcessHeap () returned 0x630000 [0061.669] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0061.669] GetProcessHeap () returned 0x630000 [0061.669] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.670] GetProcessHeap () returned 0x630000 [0061.670] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0061.670] WriteFile (in: hFile=0x230, lpBuffer=0x659010*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659010*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0061.682] GetProcessHeap () returned 0x630000 [0061.682] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659010, Size=0x30) returned 0x659010 [0061.682] GetProcessHeap () returned 0x630000 [0061.682] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0061.682] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.682] GetProcessHeap () returned 0x630000 [0061.682] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6eaf) returned 0x671bf0 [0061.682] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0x6eaf, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0x6eaf, lpOverlapped=0x0) returned 1 [0061.682] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.682] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x6eaf, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0x6eaf, lpOverlapped=0x0) returned 1 [0061.684] GetProcessHeap () returned 0x630000 [0061.684] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0061.685] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.685] WriteFile (in: hFile=0x230, lpBuffer=0x659010*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659010*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0061.686] CloseHandle (hObject=0x230) returned 1 [0061.688] GetProcessHeap () returned 0x630000 [0061.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f10 | out: hHeap=0x630000) returned 1 [0061.688] GetProcessHeap () returned 0x630000 [0061.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6559b8 | out: hHeap=0x630000) returned 1 [0061.688] GetProcessHeap () returned 0x630000 [0061.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0061.688] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\CA6Ig.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\CA6Ig.wav") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\CA6Ig.wav" [0061.688] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\CA6Ig.wav", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\CA6Ig.wav.happythreechoose") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\CA6Ig.wav.happythreechoose" [0061.688] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\CA6Ig.wav" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\ca6ig.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\CA6Ig.wav.happythreechoose" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\ca6ig.wav.happythreechoose"), dwFlags=0x1) returned 1 [0061.689] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\CA6Ig.wav" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-") returned 1 [0061.689] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\") returned="" [0061.689] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\Decryption INFO.html" [0061.689] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\decryption info.html")) returned 0x20 [0061.689] GetProcessHeap () returned 0x630000 [0061.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0061.689] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x594f8980, ftCreationTime.dwHighDateTime=0x1d5d055, ftLastAccessTime.dwLowDateTime=0xab6d6db0, ftLastAccessTime.dwHighDateTime=0x1d5d73d, ftLastWriteTime.dwLowDateTime=0xab6d6db0, ftLastWriteTime.dwHighDateTime=0x1d5d73d, nFileSizeHigh=0x0, nFileSizeLow=0x16ce1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Jry6QpSrlbtGf.wav", cAlternateFileName="JRY6QP~1.WAV")) returned 1 [0061.689] lstrcmpiW (lpString1="Jry6QpSrlbtGf.wav", lpString2=".") returned 1 [0061.689] lstrcmpiW (lpString1="Jry6QpSrlbtGf.wav", lpString2="..") returned 1 [0061.689] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\", lpString2="Jry6QpSrlbtGf.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\Jry6QpSrlbtGf.wav") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\Jry6QpSrlbtGf.wav" [0061.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Jry6QpSrlbtGf.wav", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0061.689] GetProcessHeap () returned 0x630000 [0061.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x645cd8 [0061.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Jry6QpSrlbtGf.wav", cchWideChar=-1, lpMultiByteStr=0x645cd8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Jry6QpSrlbtGf.wav", lpUsedDefaultChar=0x0) returned 18 [0061.689] lstrlenA (lpString="Jry6QpSrlbtGf.wav") returned 17 [0061.689] lstrlenA (lpString=".happythreechoose") returned 17 [0061.689] lstrlenA (lpString=".happythreechoose") returned 17 [0061.689] lstrlenA (lpString="Jry6QpSrlbtGf.wav") returned 17 [0061.689] lstrcmpiA (lpString1="Jry6QpSrlbtGf.wav", lpString2=".happythreechoose") returned 1 [0061.689] lstrcmpiW (lpString1="Jry6QpSrlbtGf.wav", lpString2="Decryption INFO.html") returned 1 [0061.689] lstrcmpiW (lpString1="Jry6QpSrlbtGf.wav", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0061.689] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0061.689] lstrcmpiW (lpString1="Jry6QpSrlbtGf.wav", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0061.689] GetProcessHeap () returned 0x630000 [0061.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0061.689] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\Jry6QpSrlbtGf.wav" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\jry6qpsrlbtgf.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0061.690] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=93409) returned 1 [0061.690] GetProcessHeap () returned 0x630000 [0061.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655418 [0061.690] GetProcessHeap () returned 0x630000 [0061.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0061.690] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\Jry6QpSrlbtGf.wav") returned 52 [0061.690] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.690] GetProcessHeap () returned 0x630000 [0061.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0061.690] GetProcessHeap () returned 0x630000 [0061.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x659048 [0061.690] lstrlenA (lpString="rsa_encrypt") returned 11 [0061.690] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0061.691] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0061.691] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0061.691] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0061.691] GetProcessHeap () returned 0x630000 [0061.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0061.691] lstrlenA (lpString="010001") returned 6 [0061.691] GetProcessHeap () returned 0x630000 [0061.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2b8 [0061.691] GetProcessHeap () returned 0x630000 [0061.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.691] GetProcessHeap () returned 0x630000 [0061.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65df50 [0061.691] GetProcessHeap () returned 0x630000 [0061.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.691] GetProcessHeap () returned 0x630000 [0061.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e970 [0061.691] GetProcessHeap () returned 0x630000 [0061.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656950 [0061.691] GetProcessHeap () returned 0x630000 [0061.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0061.691] GetProcessHeap () returned 0x630000 [0061.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0061.691] GetProcessHeap () returned 0x630000 [0061.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.691] GetProcessHeap () returned 0x630000 [0061.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0061.691] GetProcessHeap () returned 0x630000 [0061.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.691] GetProcessHeap () returned 0x630000 [0061.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657788 [0061.691] GetProcessHeap () returned 0x630000 [0061.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.691] GetProcessHeap () returned 0x630000 [0061.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0061.691] GetProcessHeap () returned 0x630000 [0061.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dfe0 [0061.691] GetProcessHeap () returned 0x630000 [0061.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.692] GetProcessHeap () returned 0x630000 [0061.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0061.692] GetProcessHeap () returned 0x630000 [0061.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0061.692] GetProcessHeap () returned 0x630000 [0061.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.692] GetProcessHeap () returned 0x630000 [0061.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0061.692] GetProcessHeap () returned 0x630000 [0061.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.692] GetProcessHeap () returned 0x630000 [0061.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.692] GetProcessHeap () returned 0x630000 [0061.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.692] GetProcessHeap () returned 0x630000 [0061.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.692] GetProcessHeap () returned 0x630000 [0061.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e340 [0061.692] GetProcessHeap () returned 0x630000 [0061.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0061.692] GetProcessHeap () returned 0x630000 [0061.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0061.692] GetProcessHeap () returned 0x630000 [0061.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0061.692] GetProcessHeap () returned 0x630000 [0061.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.692] GetProcessHeap () returned 0x630000 [0061.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.692] GetProcessHeap () returned 0x630000 [0061.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.692] GetProcessHeap () returned 0x630000 [0061.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.692] GetProcessHeap () returned 0x630000 [0061.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0061.692] GetProcessHeap () returned 0x630000 [0061.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0061.693] GetProcessHeap () returned 0x630000 [0061.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.693] GetProcessHeap () returned 0x630000 [0061.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.693] GetProcessHeap () returned 0x630000 [0061.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.693] GetProcessHeap () returned 0x630000 [0061.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.693] GetProcessHeap () returned 0x630000 [0061.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.693] GetProcessHeap () returned 0x630000 [0061.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.693] GetProcessHeap () returned 0x630000 [0061.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.693] GetProcessHeap () returned 0x630000 [0061.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.693] GetProcessHeap () returned 0x630000 [0061.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.693] GetProcessHeap () returned 0x630000 [0061.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.693] GetProcessHeap () returned 0x630000 [0061.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.693] GetProcessHeap () returned 0x630000 [0061.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.693] GetProcessHeap () returned 0x630000 [0061.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.693] GetProcessHeap () returned 0x630000 [0061.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.693] GetProcessHeap () returned 0x630000 [0061.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.693] GetProcessHeap () returned 0x630000 [0061.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.693] GetProcessHeap () returned 0x630000 [0061.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.693] GetProcessHeap () returned 0x630000 [0061.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.693] GetProcessHeap () returned 0x630000 [0061.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.694] GetProcessHeap () returned 0x630000 [0061.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.694] GetProcessHeap () returned 0x630000 [0061.694] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.694] GetProcessHeap () returned 0x630000 [0061.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.694] GetProcessHeap () returned 0x630000 [0061.694] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.694] GetProcessHeap () returned 0x630000 [0061.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.694] GetProcessHeap () returned 0x630000 [0061.694] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.694] GetProcessHeap () returned 0x630000 [0061.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.694] GetProcessHeap () returned 0x630000 [0061.694] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.694] GetProcessHeap () returned 0x630000 [0061.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.694] GetProcessHeap () returned 0x630000 [0061.694] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.694] GetProcessHeap () returned 0x630000 [0061.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.694] GetProcessHeap () returned 0x630000 [0061.694] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.694] GetProcessHeap () returned 0x630000 [0061.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.694] GetProcessHeap () returned 0x630000 [0061.694] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.694] GetProcessHeap () returned 0x630000 [0061.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.694] GetProcessHeap () returned 0x630000 [0061.694] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.694] GetProcessHeap () returned 0x630000 [0061.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.694] GetProcessHeap () returned 0x630000 [0061.694] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.695] GetProcessHeap () returned 0x630000 [0061.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.695] GetProcessHeap () returned 0x630000 [0061.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.695] GetProcessHeap () returned 0x630000 [0061.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.695] GetProcessHeap () returned 0x630000 [0061.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.695] GetProcessHeap () returned 0x630000 [0061.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.695] GetProcessHeap () returned 0x630000 [0061.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.695] GetProcessHeap () returned 0x630000 [0061.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.695] GetProcessHeap () returned 0x630000 [0061.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.695] GetProcessHeap () returned 0x630000 [0061.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.695] GetProcessHeap () returned 0x630000 [0061.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.695] GetProcessHeap () returned 0x630000 [0061.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.695] GetProcessHeap () returned 0x630000 [0061.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.695] GetProcessHeap () returned 0x630000 [0061.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.696] GetProcessHeap () returned 0x630000 [0061.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.696] GetProcessHeap () returned 0x630000 [0061.696] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.696] GetProcessHeap () returned 0x630000 [0061.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.696] GetProcessHeap () returned 0x630000 [0061.696] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.696] GetProcessHeap () returned 0x630000 [0061.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.696] GetProcessHeap () returned 0x630000 [0061.696] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.696] GetProcessHeap () returned 0x630000 [0061.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.696] GetProcessHeap () returned 0x630000 [0061.696] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.696] GetProcessHeap () returned 0x630000 [0061.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.696] GetProcessHeap () returned 0x630000 [0061.696] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.696] GetProcessHeap () returned 0x630000 [0061.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.696] GetProcessHeap () returned 0x630000 [0061.696] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.696] GetProcessHeap () returned 0x630000 [0061.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.696] GetProcessHeap () returned 0x630000 [0061.696] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.696] GetProcessHeap () returned 0x630000 [0061.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.696] GetProcessHeap () returned 0x630000 [0061.696] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.696] GetProcessHeap () returned 0x630000 [0061.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.696] GetProcessHeap () returned 0x630000 [0061.696] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.696] GetProcessHeap () returned 0x630000 [0061.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.697] GetProcessHeap () returned 0x630000 [0061.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.697] GetProcessHeap () returned 0x630000 [0061.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.697] GetProcessHeap () returned 0x630000 [0061.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.697] GetProcessHeap () returned 0x630000 [0061.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.697] GetProcessHeap () returned 0x630000 [0061.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.697] GetProcessHeap () returned 0x630000 [0061.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.697] GetProcessHeap () returned 0x630000 [0061.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.697] GetProcessHeap () returned 0x630000 [0061.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0061.697] GetProcessHeap () returned 0x630000 [0061.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0061.697] GetProcessHeap () returned 0x630000 [0061.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0061.697] GetProcessHeap () returned 0x630000 [0061.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0061.697] GetProcessHeap () returned 0x630000 [0061.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0061.697] GetProcessHeap () returned 0x630000 [0061.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0061.697] GetProcessHeap () returned 0x630000 [0061.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0061.697] GetProcessHeap () returned 0x630000 [0061.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0061.697] GetProcessHeap () returned 0x630000 [0061.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0061.697] GetProcessHeap () returned 0x630000 [0061.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.697] GetProcessHeap () returned 0x630000 [0061.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0061.698] WriteFile (in: hFile=0x230, lpBuffer=0x659048*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659048*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0061.704] GetProcessHeap () returned 0x630000 [0061.704] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659048, Size=0x30) returned 0x659048 [0061.704] GetProcessHeap () returned 0x630000 [0061.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0061.704] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.704] GetProcessHeap () returned 0x630000 [0061.704] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16ce1) returned 0x671bf0 [0061.706] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0x16ce1, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0x16ce1, lpOverlapped=0x0) returned 1 [0061.707] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.707] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x16ce1, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0x16ce1, lpOverlapped=0x0) returned 1 [0061.709] GetProcessHeap () returned 0x630000 [0061.709] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0061.709] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.709] WriteFile (in: hFile=0x230, lpBuffer=0x659048*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659048*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0061.710] CloseHandle (hObject=0x230) returned 1 [0061.713] GetProcessHeap () returned 0x630000 [0061.713] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0061.713] GetProcessHeap () returned 0x630000 [0061.713] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655418 | out: hHeap=0x630000) returned 1 [0061.713] GetProcessHeap () returned 0x630000 [0061.713] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0061.713] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\Jry6QpSrlbtGf.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\Jry6QpSrlbtGf.wav") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\Jry6QpSrlbtGf.wav" [0061.713] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\Jry6QpSrlbtGf.wav", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\Jry6QpSrlbtGf.wav.happythreechoose") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\Jry6QpSrlbtGf.wav.happythreechoose" [0061.713] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\Jry6QpSrlbtGf.wav" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\jry6qpsrlbtgf.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\Jry6QpSrlbtGf.wav.happythreechoose" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\jry6qpsrlbtgf.wav.happythreechoose"), dwFlags=0x1) returned 1 [0061.714] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\Jry6QpSrlbtGf.wav" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-") returned 1 [0061.714] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\") returned="" [0061.714] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\Decryption INFO.html" [0061.714] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\decryption info.html")) returned 0x20 [0061.714] GetProcessHeap () returned 0x630000 [0061.714] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645cd8 | out: hHeap=0x630000) returned 1 [0061.714] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb4c3c50, ftCreationTime.dwHighDateTime=0x1d5d144, ftLastAccessTime.dwLowDateTime=0x1412e850, ftLastAccessTime.dwHighDateTime=0x1d5cdf6, ftLastWriteTime.dwLowDateTime=0x1412e850, ftLastWriteTime.dwHighDateTime=0x1d5cdf6, nFileSizeHigh=0x0, nFileSizeLow=0xff9f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NvPppj.mp3", cAlternateFileName="")) returned 1 [0061.714] lstrcmpiW (lpString1="NvPppj.mp3", lpString2=".") returned 1 [0061.714] lstrcmpiW (lpString1="NvPppj.mp3", lpString2="..") returned 1 [0061.714] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\", lpString2="NvPppj.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\NvPppj.mp3") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\NvPppj.mp3" [0061.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NvPppj.mp3", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0061.714] GetProcessHeap () returned 0x630000 [0061.715] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb) returned 0x64c9f0 [0061.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NvPppj.mp3", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NvPppj.mp3", lpUsedDefaultChar=0x0) returned 11 [0061.715] lstrlenA (lpString="NvPppj.mp3") returned 10 [0061.715] lstrlenA (lpString=".happythreechoose") returned 17 [0061.715] lstrcmpiW (lpString1="NvPppj.mp3", lpString2="Decryption INFO.html") returned 1 [0061.715] lstrcmpiW (lpString1="NvPppj.mp3", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0061.715] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0061.715] lstrcmpiW (lpString1="NvPppj.mp3", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0061.715] GetProcessHeap () returned 0x630000 [0061.715] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651ec0 [0061.715] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\NvPppj.mp3" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\nvpppj.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0061.715] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=65439) returned 1 [0061.715] GetProcessHeap () returned 0x630000 [0061.715] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6555f8 [0061.715] GetProcessHeap () returned 0x630000 [0061.715] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0061.715] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\NvPppj.mp3") returned 45 [0061.715] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.715] GetProcessHeap () returned 0x630000 [0061.715] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0061.715] GetProcessHeap () returned 0x630000 [0061.715] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x659080 [0061.715] lstrlenA (lpString="rsa_encrypt") returned 11 [0061.715] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0061.716] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0061.716] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0061.716] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0061.716] GetProcessHeap () returned 0x630000 [0061.716] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0061.716] lstrlenA (lpString="010001") returned 6 [0061.716] GetProcessHeap () returned 0x630000 [0061.716] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a318 [0061.716] GetProcessHeap () returned 0x630000 [0061.716] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.716] GetProcessHeap () returned 0x630000 [0061.716] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e190 [0061.716] GetProcessHeap () returned 0x630000 [0061.716] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.716] GetProcessHeap () returned 0x630000 [0061.716] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e850 [0061.716] GetProcessHeap () returned 0x630000 [0061.716] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656ec8 [0061.716] GetProcessHeap () returned 0x630000 [0061.716] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0061.716] GetProcessHeap () returned 0x630000 [0061.716] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0061.717] GetProcessHeap () returned 0x630000 [0061.717] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.717] GetProcessHeap () returned 0x630000 [0061.717] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0061.717] GetProcessHeap () returned 0x630000 [0061.717] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.717] GetProcessHeap () returned 0x630000 [0061.717] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657558 [0061.717] GetProcessHeap () returned 0x630000 [0061.717] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.717] GetProcessHeap () returned 0x630000 [0061.717] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0061.717] GetProcessHeap () returned 0x630000 [0061.717] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0061.717] GetProcessHeap () returned 0x630000 [0061.717] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.717] GetProcessHeap () returned 0x630000 [0061.717] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0061.717] GetProcessHeap () returned 0x630000 [0061.717] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0061.717] GetProcessHeap () returned 0x630000 [0061.717] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.717] GetProcessHeap () returned 0x630000 [0061.717] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65d048 [0061.717] GetProcessHeap () returned 0x630000 [0061.717] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.717] GetProcessHeap () returned 0x630000 [0061.717] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.717] GetProcessHeap () returned 0x630000 [0061.717] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.717] GetProcessHeap () returned 0x630000 [0061.717] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.717] GetProcessHeap () returned 0x630000 [0061.717] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e070 [0061.717] GetProcessHeap () returned 0x630000 [0061.717] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65d048 | out: hHeap=0x630000) returned 1 [0061.717] GetProcessHeap () returned 0x630000 [0061.717] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0061.717] GetProcessHeap () returned 0x630000 [0061.718] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0061.718] GetProcessHeap () returned 0x630000 [0061.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.718] GetProcessHeap () returned 0x630000 [0061.718] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.718] GetProcessHeap () returned 0x630000 [0061.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.718] GetProcessHeap () returned 0x630000 [0061.718] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.718] GetProcessHeap () returned 0x630000 [0061.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.718] GetProcessHeap () returned 0x630000 [0061.718] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.718] GetProcessHeap () returned 0x630000 [0061.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.718] GetProcessHeap () returned 0x630000 [0061.718] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.718] GetProcessHeap () returned 0x630000 [0061.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.718] GetProcessHeap () returned 0x630000 [0061.718] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.718] GetProcessHeap () returned 0x630000 [0061.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.718] GetProcessHeap () returned 0x630000 [0061.718] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.718] GetProcessHeap () returned 0x630000 [0061.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.718] GetProcessHeap () returned 0x630000 [0061.718] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.718] GetProcessHeap () returned 0x630000 [0061.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.718] GetProcessHeap () returned 0x630000 [0061.718] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.718] GetProcessHeap () returned 0x630000 [0061.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.719] GetProcessHeap () returned 0x630000 [0061.719] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.719] GetProcessHeap () returned 0x630000 [0061.719] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.719] GetProcessHeap () returned 0x630000 [0061.719] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.719] GetProcessHeap () returned 0x630000 [0061.719] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.719] GetProcessHeap () returned 0x630000 [0061.719] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.719] GetProcessHeap () returned 0x630000 [0061.719] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.719] GetProcessHeap () returned 0x630000 [0061.719] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.719] GetProcessHeap () returned 0x630000 [0061.719] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.719] GetProcessHeap () returned 0x630000 [0061.719] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.719] GetProcessHeap () returned 0x630000 [0061.719] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.719] GetProcessHeap () returned 0x630000 [0061.719] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.719] GetProcessHeap () returned 0x630000 [0061.719] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.719] GetProcessHeap () returned 0x630000 [0061.719] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.719] GetProcessHeap () returned 0x630000 [0061.719] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.719] GetProcessHeap () returned 0x630000 [0061.719] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.719] GetProcessHeap () returned 0x630000 [0061.719] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.719] GetProcessHeap () returned 0x630000 [0061.719] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.719] GetProcessHeap () returned 0x630000 [0061.719] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.719] GetProcessHeap () returned 0x630000 [0061.719] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.720] GetProcessHeap () returned 0x630000 [0061.720] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.720] GetProcessHeap () returned 0x630000 [0061.720] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.720] GetProcessHeap () returned 0x630000 [0061.720] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.720] GetProcessHeap () returned 0x630000 [0061.720] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.720] GetProcessHeap () returned 0x630000 [0061.720] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.720] GetProcessHeap () returned 0x630000 [0061.720] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.720] GetProcessHeap () returned 0x630000 [0061.720] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.720] GetProcessHeap () returned 0x630000 [0061.720] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.720] GetProcessHeap () returned 0x630000 [0061.720] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.720] GetProcessHeap () returned 0x630000 [0061.720] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.720] GetProcessHeap () returned 0x630000 [0061.720] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.720] GetProcessHeap () returned 0x630000 [0061.720] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.720] GetProcessHeap () returned 0x630000 [0061.720] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.720] GetProcessHeap () returned 0x630000 [0061.720] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.720] GetProcessHeap () returned 0x630000 [0061.720] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.720] GetProcessHeap () returned 0x630000 [0061.720] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.720] GetProcessHeap () returned 0x630000 [0061.720] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.720] GetProcessHeap () returned 0x630000 [0061.720] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.720] GetProcessHeap () returned 0x630000 [0061.721] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.721] GetProcessHeap () returned 0x630000 [0061.721] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.721] GetProcessHeap () returned 0x630000 [0061.721] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.721] GetProcessHeap () returned 0x630000 [0061.721] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.721] GetProcessHeap () returned 0x630000 [0061.721] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0061.721] GetProcessHeap () returned 0x630000 [0061.721] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0061.721] GetProcessHeap () returned 0x630000 [0061.721] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.721] GetProcessHeap () returned 0x630000 [0061.721] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.721] GetProcessHeap () returned 0x630000 [0061.721] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.721] GetProcessHeap () returned 0x630000 [0061.721] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.721] GetProcessHeap () returned 0x630000 [0061.721] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.721] GetProcessHeap () returned 0x630000 [0061.721] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.721] GetProcessHeap () returned 0x630000 [0061.721] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.721] GetProcessHeap () returned 0x630000 [0061.721] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.721] GetProcessHeap () returned 0x630000 [0061.721] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.721] GetProcessHeap () returned 0x630000 [0061.721] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.721] GetProcessHeap () returned 0x630000 [0061.721] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.721] GetProcessHeap () returned 0x630000 [0061.721] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.721] GetProcessHeap () returned 0x630000 [0061.721] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.721] GetProcessHeap () returned 0x630000 [0061.722] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.722] GetProcessHeap () returned 0x630000 [0061.722] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.722] GetProcessHeap () returned 0x630000 [0061.722] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.722] GetProcessHeap () returned 0x630000 [0061.722] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0061.722] GetProcessHeap () returned 0x630000 [0061.722] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0061.722] GetProcessHeap () returned 0x630000 [0061.722] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.722] GetProcessHeap () returned 0x630000 [0061.722] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.722] GetProcessHeap () returned 0x630000 [0061.722] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.722] GetProcessHeap () returned 0x630000 [0061.722] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.722] GetProcessHeap () returned 0x630000 [0061.722] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0061.722] GetProcessHeap () returned 0x630000 [0061.722] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0061.722] GetProcessHeap () returned 0x630000 [0061.722] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0061.722] GetProcessHeap () returned 0x630000 [0061.722] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0061.722] GetProcessHeap () returned 0x630000 [0061.722] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0061.722] GetProcessHeap () returned 0x630000 [0061.722] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0061.722] GetProcessHeap () returned 0x630000 [0061.722] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0061.722] GetProcessHeap () returned 0x630000 [0061.722] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0061.722] GetProcessHeap () returned 0x630000 [0061.722] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0061.723] GetProcessHeap () returned 0x630000 [0061.723] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.723] GetProcessHeap () returned 0x630000 [0061.723] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0061.723] WriteFile (in: hFile=0x230, lpBuffer=0x659080*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659080*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0061.728] GetProcessHeap () returned 0x630000 [0061.728] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659080, Size=0x30) returned 0x659080 [0061.728] GetProcessHeap () returned 0x630000 [0061.728] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0061.728] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.728] GetProcessHeap () returned 0x630000 [0061.728] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xff9f) returned 0x671bf0 [0061.728] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0xff9f, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0xff9f, lpOverlapped=0x0) returned 1 [0061.729] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.729] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0xff9f, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0xff9f, lpOverlapped=0x0) returned 1 [0061.730] GetProcessHeap () returned 0x630000 [0061.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0061.731] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.731] WriteFile (in: hFile=0x230, lpBuffer=0x659080*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659080*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0061.732] CloseHandle (hObject=0x230) returned 1 [0061.735] GetProcessHeap () returned 0x630000 [0061.735] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651ec0 | out: hHeap=0x630000) returned 1 [0061.735] GetProcessHeap () returned 0x630000 [0061.735] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6555f8 | out: hHeap=0x630000) returned 1 [0061.735] GetProcessHeap () returned 0x630000 [0061.735] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0061.735] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\NvPppj.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\NvPppj.mp3") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\NvPppj.mp3" [0061.735] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\NvPppj.mp3", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\NvPppj.mp3.happythreechoose") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\NvPppj.mp3.happythreechoose" [0061.735] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\NvPppj.mp3" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\nvpppj.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\NvPppj.mp3.happythreechoose" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\nvpppj.mp3.happythreechoose"), dwFlags=0x1) returned 1 [0061.736] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\NvPppj.mp3" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-") returned 1 [0061.736] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\") returned="" [0061.736] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\Decryption INFO.html" [0061.736] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\decryption info.html")) returned 0x20 [0061.736] GetProcessHeap () returned 0x630000 [0061.736] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0061.736] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e162640, ftCreationTime.dwHighDateTime=0x1d5ca49, ftLastAccessTime.dwLowDateTime=0xa6e12ce0, ftLastAccessTime.dwHighDateTime=0x1d5d41e, ftLastWriteTime.dwLowDateTime=0xa6e12ce0, ftLastWriteTime.dwHighDateTime=0x1d5d41e, nFileSizeHigh=0x0, nFileSizeLow=0xf196, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OtVfZtC4b.wav", cAlternateFileName="OTVFZT~1.WAV")) returned 1 [0061.736] lstrcmpiW (lpString1="OtVfZtC4b.wav", lpString2=".") returned 1 [0061.736] lstrcmpiW (lpString1="OtVfZtC4b.wav", lpString2="..") returned 1 [0061.736] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\", lpString2="OtVfZtC4b.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\OtVfZtC4b.wav") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\OtVfZtC4b.wav" [0061.736] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="OtVfZtC4b.wav", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0061.736] GetProcessHeap () returned 0x630000 [0061.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x64c9f0 [0061.736] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="OtVfZtC4b.wav", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OtVfZtC4b.wav", lpUsedDefaultChar=0x0) returned 14 [0061.736] lstrlenA (lpString="OtVfZtC4b.wav") returned 13 [0061.736] lstrlenA (lpString=".happythreechoose") returned 17 [0061.737] lstrcmpiW (lpString1="OtVfZtC4b.wav", lpString2="Decryption INFO.html") returned 1 [0061.737] lstrcmpiW (lpString1="OtVfZtC4b.wav", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0061.737] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0061.737] lstrcmpiW (lpString1="OtVfZtC4b.wav", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0061.737] GetProcessHeap () returned 0x630000 [0061.737] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0061.737] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\OtVfZtC4b.wav" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\otvfztc4b.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0061.737] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=61846) returned 1 [0061.737] GetProcessHeap () returned 0x630000 [0061.737] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655670 [0061.737] GetProcessHeap () returned 0x630000 [0061.737] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0061.737] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\OtVfZtC4b.wav") returned 48 [0061.737] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.737] GetProcessHeap () returned 0x630000 [0061.737] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0061.737] GetProcessHeap () returned 0x630000 [0061.737] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x6590b8 [0061.737] lstrlenA (lpString="rsa_encrypt") returned 11 [0061.737] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0061.738] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0061.738] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0061.738] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0061.738] GetProcessHeap () returned 0x630000 [0061.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0061.738] lstrlenA (lpString="010001") returned 6 [0061.738] GetProcessHeap () returned 0x630000 [0061.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0061.738] GetProcessHeap () returned 0x630000 [0061.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.738] GetProcessHeap () returned 0x630000 [0061.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ecd0 [0061.738] GetProcessHeap () returned 0x630000 [0061.738] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.738] GetProcessHeap () returned 0x630000 [0061.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e460 [0061.738] GetProcessHeap () returned 0x630000 [0061.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657788 [0061.738] GetProcessHeap () returned 0x630000 [0061.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a318 [0061.738] GetProcessHeap () returned 0x630000 [0061.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0061.738] GetProcessHeap () returned 0x630000 [0061.738] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.738] GetProcessHeap () returned 0x630000 [0061.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0061.739] GetProcessHeap () returned 0x630000 [0061.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.739] GetProcessHeap () returned 0x630000 [0061.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657328 [0061.739] GetProcessHeap () returned 0x630000 [0061.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.739] GetProcessHeap () returned 0x630000 [0061.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0061.739] GetProcessHeap () returned 0x630000 [0061.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dec0 [0061.739] GetProcessHeap () returned 0x630000 [0061.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.739] GetProcessHeap () returned 0x630000 [0061.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0061.739] GetProcessHeap () returned 0x630000 [0061.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0061.739] GetProcessHeap () returned 0x630000 [0061.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.739] GetProcessHeap () returned 0x630000 [0061.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65ce20 [0061.739] GetProcessHeap () returned 0x630000 [0061.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.739] GetProcessHeap () returned 0x630000 [0061.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.739] GetProcessHeap () returned 0x630000 [0061.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.739] GetProcessHeap () returned 0x630000 [0061.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.739] GetProcessHeap () returned 0x630000 [0061.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e190 [0061.739] GetProcessHeap () returned 0x630000 [0061.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ce20 | out: hHeap=0x630000) returned 1 [0061.739] GetProcessHeap () returned 0x630000 [0061.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0061.739] GetProcessHeap () returned 0x630000 [0061.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0061.739] GetProcessHeap () returned 0x630000 [0061.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.740] GetProcessHeap () returned 0x630000 [0061.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.740] GetProcessHeap () returned 0x630000 [0061.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.740] GetProcessHeap () returned 0x630000 [0061.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.740] GetProcessHeap () returned 0x630000 [0061.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.740] GetProcessHeap () returned 0x630000 [0061.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.740] GetProcessHeap () returned 0x630000 [0061.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.740] GetProcessHeap () returned 0x630000 [0061.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.740] GetProcessHeap () returned 0x630000 [0061.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.740] GetProcessHeap () returned 0x630000 [0061.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.740] GetProcessHeap () returned 0x630000 [0061.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.740] GetProcessHeap () returned 0x630000 [0061.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.740] GetProcessHeap () returned 0x630000 [0061.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.740] GetProcessHeap () returned 0x630000 [0061.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.740] GetProcessHeap () returned 0x630000 [0061.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.740] GetProcessHeap () returned 0x630000 [0061.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.740] GetProcessHeap () returned 0x630000 [0061.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.740] GetProcessHeap () returned 0x630000 [0061.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.740] GetProcessHeap () returned 0x630000 [0061.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.740] GetProcessHeap () returned 0x630000 [0061.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.741] GetProcessHeap () returned 0x630000 [0061.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.741] GetProcessHeap () returned 0x630000 [0061.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.741] GetProcessHeap () returned 0x630000 [0061.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.741] GetProcessHeap () returned 0x630000 [0061.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.741] GetProcessHeap () returned 0x630000 [0061.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.741] GetProcessHeap () returned 0x630000 [0061.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.741] GetProcessHeap () returned 0x630000 [0061.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.741] GetProcessHeap () returned 0x630000 [0061.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.741] GetProcessHeap () returned 0x630000 [0061.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.741] GetProcessHeap () returned 0x630000 [0061.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.741] GetProcessHeap () returned 0x630000 [0061.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.741] GetProcessHeap () returned 0x630000 [0061.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.741] GetProcessHeap () returned 0x630000 [0061.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.741] GetProcessHeap () returned 0x630000 [0061.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.741] GetProcessHeap () returned 0x630000 [0061.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.741] GetProcessHeap () returned 0x630000 [0061.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.741] GetProcessHeap () returned 0x630000 [0061.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0061.741] GetProcessHeap () returned 0x630000 [0061.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0061.742] GetProcessHeap () returned 0x630000 [0061.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.742] GetProcessHeap () returned 0x630000 [0061.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.742] GetProcessHeap () returned 0x630000 [0061.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.742] GetProcessHeap () returned 0x630000 [0061.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.742] GetProcessHeap () returned 0x630000 [0061.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.742] GetProcessHeap () returned 0x630000 [0061.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.742] GetProcessHeap () returned 0x630000 [0061.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.742] GetProcessHeap () returned 0x630000 [0061.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.742] GetProcessHeap () returned 0x630000 [0061.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.742] GetProcessHeap () returned 0x630000 [0061.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.742] GetProcessHeap () returned 0x630000 [0061.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.742] GetProcessHeap () returned 0x630000 [0061.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.742] GetProcessHeap () returned 0x630000 [0061.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.742] GetProcessHeap () returned 0x630000 [0061.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.742] GetProcessHeap () returned 0x630000 [0061.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.742] GetProcessHeap () returned 0x630000 [0061.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.743] GetProcessHeap () returned 0x630000 [0061.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.743] GetProcessHeap () returned 0x630000 [0061.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.743] GetProcessHeap () returned 0x630000 [0061.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0061.743] GetProcessHeap () returned 0x630000 [0061.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0061.743] GetProcessHeap () returned 0x630000 [0061.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.743] GetProcessHeap () returned 0x630000 [0061.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.743] GetProcessHeap () returned 0x630000 [0061.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.743] GetProcessHeap () returned 0x630000 [0061.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.743] GetProcessHeap () returned 0x630000 [0061.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.743] GetProcessHeap () returned 0x630000 [0061.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.743] GetProcessHeap () returned 0x630000 [0061.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.743] GetProcessHeap () returned 0x630000 [0061.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.743] GetProcessHeap () returned 0x630000 [0061.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.743] GetProcessHeap () returned 0x630000 [0061.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.743] GetProcessHeap () returned 0x630000 [0061.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.743] GetProcessHeap () returned 0x630000 [0061.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.743] GetProcessHeap () returned 0x630000 [0061.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.743] GetProcessHeap () returned 0x630000 [0061.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.743] GetProcessHeap () returned 0x630000 [0061.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.744] GetProcessHeap () returned 0x630000 [0061.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.744] GetProcessHeap () returned 0x630000 [0061.744] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.744] GetProcessHeap () returned 0x630000 [0061.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.744] GetProcessHeap () returned 0x630000 [0061.744] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.744] GetProcessHeap () returned 0x630000 [0061.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.744] GetProcessHeap () returned 0x630000 [0061.744] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.744] GetProcessHeap () returned 0x630000 [0061.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.744] GetProcessHeap () returned 0x630000 [0061.744] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.744] GetProcessHeap () returned 0x630000 [0061.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.744] GetProcessHeap () returned 0x630000 [0061.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0061.744] GetProcessHeap () returned 0x630000 [0061.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0061.744] GetProcessHeap () returned 0x630000 [0061.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0061.744] GetProcessHeap () returned 0x630000 [0061.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0061.744] GetProcessHeap () returned 0x630000 [0061.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0061.744] GetProcessHeap () returned 0x630000 [0061.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e460 | out: hHeap=0x630000) returned 1 [0061.744] GetProcessHeap () returned 0x630000 [0061.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0061.744] GetProcessHeap () returned 0x630000 [0061.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ecd0 | out: hHeap=0x630000) returned 1 [0061.744] GetProcessHeap () returned 0x630000 [0061.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0061.744] GetProcessHeap () returned 0x630000 [0061.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.745] GetProcessHeap () returned 0x630000 [0061.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0061.745] WriteFile (in: hFile=0x230, lpBuffer=0x6590b8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6590b8*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0061.747] GetProcessHeap () returned 0x630000 [0061.747] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6590b8, Size=0x30) returned 0x6590b8 [0061.747] GetProcessHeap () returned 0x630000 [0061.747] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0061.747] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.747] GetProcessHeap () returned 0x630000 [0061.747] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf196) returned 0x671bf0 [0061.749] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0xf196, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0xf196, lpOverlapped=0x0) returned 1 [0061.750] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.750] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0xf196, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0xf196, lpOverlapped=0x0) returned 1 [0061.752] GetProcessHeap () returned 0x630000 [0061.752] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0061.753] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.753] WriteFile (in: hFile=0x230, lpBuffer=0x6590b8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6590b8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0061.754] CloseHandle (hObject=0x230) returned 1 [0061.756] GetProcessHeap () returned 0x630000 [0061.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0061.756] GetProcessHeap () returned 0x630000 [0061.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655670 | out: hHeap=0x630000) returned 1 [0061.756] GetProcessHeap () returned 0x630000 [0061.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0061.756] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\OtVfZtC4b.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\OtVfZtC4b.wav") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\OtVfZtC4b.wav" [0061.756] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\OtVfZtC4b.wav", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\OtVfZtC4b.wav.happythreechoose") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\OtVfZtC4b.wav.happythreechoose" [0061.756] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\OtVfZtC4b.wav" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\otvfztc4b.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\OtVfZtC4b.wav.happythreechoose" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\otvfztc4b.wav.happythreechoose"), dwFlags=0x1) returned 1 [0061.757] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\OtVfZtC4b.wav" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-") returned 1 [0061.757] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\") returned="" [0061.757] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\Decryption INFO.html" [0061.757] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\decryption info.html")) returned 0x20 [0061.757] GetProcessHeap () returned 0x630000 [0061.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0061.757] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd286e140, ftCreationTime.dwHighDateTime=0x1d5d3d4, ftLastAccessTime.dwLowDateTime=0x34c3360, ftLastAccessTime.dwHighDateTime=0x1d5d787, ftLastWriteTime.dwLowDateTime=0x34c3360, ftLastWriteTime.dwHighDateTime=0x1d5d787, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tIxsJBLL WO2", cAlternateFileName="TIXSJB~1")) returned 1 [0061.757] lstrcmpiW (lpString1="tIxsJBLL WO2", lpString2=".") returned 1 [0061.757] lstrcmpiW (lpString1="tIxsJBLL WO2", lpString2="..") returned 1 [0061.757] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\", lpString2="tIxsJBLL WO2" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2" [0061.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tIxsJBLL WO2", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0061.757] GetProcessHeap () returned 0x630000 [0061.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd) returned 0x64ca20 [0061.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tIxsJBLL WO2", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tIxsJBLL WO2", lpUsedDefaultChar=0x0) returned 13 [0061.758] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tIxsJBLL WO2", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0061.758] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tIxsJBLL WO2", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0061.758] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tIxsJBLL WO2", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0061.758] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tIxsJBLL WO2", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0061.758] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tIxsJBLL WO2", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0061.758] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tIxsJBLL WO2", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0061.758] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tIxsJBLL WO2", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0061.758] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tIxsJBLL WO2", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0061.758] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tIxsJBLL WO2", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0061.758] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tIxsJBLL WO2", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0061.758] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tIxsJBLL WO2", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0061.758] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tIxsJBLL WO2", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0061.758] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tIxsJBLL WO2", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0061.758] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tIxsJBLL WO2", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0061.758] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tIxsJBLL WO2", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0061.758] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tIxsJBLL WO2", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0061.758] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tIxsJBLL WO2", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0061.759] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tIxsJBLL WO2", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0061.759] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tIxsJBLL WO2", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0061.759] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tIxsJBLL WO2", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0061.759] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tIxsJBLL WO2", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0061.759] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tIxsJBLL WO2", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0061.759] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tIxsJBLL WO2", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0061.759] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tIxsJBLL WO2", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0061.759] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tIxsJBLL WO2", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 3 [0061.759] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tIxsJBLL WO2", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 3 [0061.759] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tIxsJBLL WO2", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0061.759] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tIxsJBLL WO2", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0061.759] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tIxsJBLL WO2", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 3 [0061.759] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tIxsJBLL WO2", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 3 [0061.759] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tIxsJBLL WO2", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 3 [0061.759] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tIxsJBLL WO2", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0061.759] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tIxsJBLL WO2", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0061.759] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tIxsJBLL WO2", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0061.759] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tIxsJBLL WO2", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0061.759] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tIxsJBLL WO2", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0061.759] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tIxsJBLL WO2", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0061.759] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tIxsJBLL WO2", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0061.759] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tIxsJBLL WO2", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0061.759] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tIxsJBLL WO2", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0061.759] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tIxsJBLL WO2", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0061.759] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tIxsJBLL WO2", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0061.759] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="tIxsJBLL WO2", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0061.759] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\" [0061.759] GetProcessHeap () returned 0x630000 [0061.759] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a3b8 [0061.759] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\") returned 48 [0061.759] GetProcessHeap () returned 0x630000 [0061.759] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x62) returned 0x6548e0 [0061.759] lstrcpyW (in: lpString1=0x6548e0, lpString2="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\" [0061.760] GetProcessHeap () returned 0x630000 [0061.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0061.760] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9ce3500, ftCreationTime.dwHighDateTime=0x1d5ceb7, ftLastAccessTime.dwLowDateTime=0x72bd2d40, ftLastAccessTime.dwHighDateTime=0x1d5cee9, ftLastWriteTime.dwLowDateTime=0x72bd2d40, ftLastWriteTime.dwHighDateTime=0x1d5cee9, nFileSizeHigh=0x0, nFileSizeLow=0xdec0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vF1d8ev.mp3", cAlternateFileName="")) returned 1 [0061.760] lstrcmpiW (lpString1="vF1d8ev.mp3", lpString2=".") returned 1 [0061.760] lstrcmpiW (lpString1="vF1d8ev.mp3", lpString2="..") returned 1 [0061.760] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\", lpString2="vF1d8ev.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\vF1d8ev.mp3") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\vF1d8ev.mp3" [0061.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vF1d8ev.mp3", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0061.760] GetProcessHeap () returned 0x630000 [0061.760] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0061.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vF1d8ev.mp3", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vF1d8ev.mp3", lpUsedDefaultChar=0x0) returned 12 [0061.760] lstrlenA (lpString="vF1d8ev.mp3") returned 11 [0061.760] lstrlenA (lpString=".happythreechoose") returned 17 [0061.760] lstrcmpiW (lpString1="vF1d8ev.mp3", lpString2="Decryption INFO.html") returned 1 [0061.760] lstrcmpiW (lpString1="vF1d8ev.mp3", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0061.760] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0061.760] lstrcmpiW (lpString1="vF1d8ev.mp3", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0061.760] GetProcessHeap () returned 0x630000 [0061.760] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0061.760] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\vF1d8ev.mp3" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\vf1d8ev.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0061.760] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=57024) returned 1 [0061.760] GetProcessHeap () returned 0x630000 [0061.760] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655aa8 [0061.760] GetProcessHeap () returned 0x630000 [0061.760] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0061.760] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\vF1d8ev.mp3") returned 46 [0061.760] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.760] GetProcessHeap () returned 0x630000 [0061.760] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0061.760] GetProcessHeap () returned 0x630000 [0061.761] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x6590f0 [0061.761] lstrlenA (lpString="rsa_encrypt") returned 11 [0061.761] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0061.761] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0061.761] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0061.761] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0061.761] GetProcessHeap () returned 0x630000 [0061.761] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0061.761] lstrlenA (lpString="010001") returned 6 [0061.761] GetProcessHeap () returned 0x630000 [0061.761] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a318 [0061.761] GetProcessHeap () returned 0x630000 [0061.761] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.761] GetProcessHeap () returned 0x630000 [0061.761] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0061.761] GetProcessHeap () returned 0x630000 [0061.762] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.762] GetProcessHeap () returned 0x630000 [0061.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e100 [0061.762] GetProcessHeap () returned 0x630000 [0061.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657670 [0061.762] GetProcessHeap () returned 0x630000 [0061.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0061.762] GetProcessHeap () returned 0x630000 [0061.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0061.762] GetProcessHeap () returned 0x630000 [0061.762] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.762] GetProcessHeap () returned 0x630000 [0061.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0061.762] GetProcessHeap () returned 0x630000 [0061.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.762] GetProcessHeap () returned 0x630000 [0061.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657328 [0061.762] GetProcessHeap () returned 0x630000 [0061.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.762] GetProcessHeap () returned 0x630000 [0061.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0061.762] GetProcessHeap () returned 0x630000 [0061.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dec0 [0061.762] GetProcessHeap () returned 0x630000 [0061.762] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.762] GetProcessHeap () returned 0x630000 [0061.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0061.762] GetProcessHeap () returned 0x630000 [0061.762] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0061.762] GetProcessHeap () returned 0x630000 [0061.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.762] GetProcessHeap () returned 0x630000 [0061.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65ceb0 [0061.762] GetProcessHeap () returned 0x630000 [0061.762] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.762] GetProcessHeap () returned 0x630000 [0061.762] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.762] GetProcessHeap () returned 0x630000 [0061.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.763] GetProcessHeap () returned 0x630000 [0061.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.763] GetProcessHeap () returned 0x630000 [0061.763] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e4f0 [0061.763] GetProcessHeap () returned 0x630000 [0061.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ceb0 | out: hHeap=0x630000) returned 1 [0061.763] GetProcessHeap () returned 0x630000 [0061.763] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0061.763] GetProcessHeap () returned 0x630000 [0061.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0061.763] GetProcessHeap () returned 0x630000 [0061.763] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.763] GetProcessHeap () returned 0x630000 [0061.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.763] GetProcessHeap () returned 0x630000 [0061.763] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.763] GetProcessHeap () returned 0x630000 [0061.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.763] GetProcessHeap () returned 0x630000 [0061.763] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.763] GetProcessHeap () returned 0x630000 [0061.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.763] GetProcessHeap () returned 0x630000 [0061.763] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.763] GetProcessHeap () returned 0x630000 [0061.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.763] GetProcessHeap () returned 0x630000 [0061.763] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.763] GetProcessHeap () returned 0x630000 [0061.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.763] GetProcessHeap () returned 0x630000 [0061.763] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.763] GetProcessHeap () returned 0x630000 [0061.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.763] GetProcessHeap () returned 0x630000 [0061.763] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.763] GetProcessHeap () returned 0x630000 [0061.764] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.764] GetProcessHeap () returned 0x630000 [0061.764] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.764] GetProcessHeap () returned 0x630000 [0061.764] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.764] GetProcessHeap () returned 0x630000 [0061.764] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.764] GetProcessHeap () returned 0x630000 [0061.764] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.764] GetProcessHeap () returned 0x630000 [0061.764] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.764] GetProcessHeap () returned 0x630000 [0061.764] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.764] GetProcessHeap () returned 0x630000 [0061.764] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.764] GetProcessHeap () returned 0x630000 [0061.764] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.764] GetProcessHeap () returned 0x630000 [0061.764] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.764] GetProcessHeap () returned 0x630000 [0061.764] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.764] GetProcessHeap () returned 0x630000 [0061.764] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.764] GetProcessHeap () returned 0x630000 [0061.764] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.764] GetProcessHeap () returned 0x630000 [0061.764] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.764] GetProcessHeap () returned 0x630000 [0061.764] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.764] GetProcessHeap () returned 0x630000 [0061.764] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.764] GetProcessHeap () returned 0x630000 [0061.764] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.764] GetProcessHeap () returned 0x630000 [0061.764] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.764] GetProcessHeap () returned 0x630000 [0061.764] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.765] GetProcessHeap () returned 0x630000 [0061.765] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.765] GetProcessHeap () returned 0x630000 [0061.765] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.765] GetProcessHeap () returned 0x630000 [0061.765] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.765] GetProcessHeap () returned 0x630000 [0061.765] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.765] GetProcessHeap () returned 0x630000 [0061.765] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.765] GetProcessHeap () returned 0x630000 [0061.765] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.765] GetProcessHeap () returned 0x630000 [0061.765] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.765] GetProcessHeap () returned 0x630000 [0061.765] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.765] GetProcessHeap () returned 0x630000 [0061.765] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.765] GetProcessHeap () returned 0x630000 [0061.765] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.765] GetProcessHeap () returned 0x630000 [0061.765] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.765] GetProcessHeap () returned 0x630000 [0061.765] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.765] GetProcessHeap () returned 0x630000 [0061.765] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.765] GetProcessHeap () returned 0x630000 [0061.765] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.765] GetProcessHeap () returned 0x630000 [0061.765] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.765] GetProcessHeap () returned 0x630000 [0061.765] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.765] GetProcessHeap () returned 0x630000 [0061.765] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0061.765] GetProcessHeap () returned 0x630000 [0061.765] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0061.765] GetProcessHeap () returned 0x630000 [0061.765] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.766] GetProcessHeap () returned 0x630000 [0061.766] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.766] GetProcessHeap () returned 0x630000 [0061.766] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.766] GetProcessHeap () returned 0x630000 [0061.766] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.766] GetProcessHeap () returned 0x630000 [0061.766] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.766] GetProcessHeap () returned 0x630000 [0061.766] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.766] GetProcessHeap () returned 0x630000 [0061.766] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.766] GetProcessHeap () returned 0x630000 [0061.766] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.766] GetProcessHeap () returned 0x630000 [0061.766] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.766] GetProcessHeap () returned 0x630000 [0061.766] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.766] GetProcessHeap () returned 0x630000 [0061.766] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.766] GetProcessHeap () returned 0x630000 [0061.766] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.766] GetProcessHeap () returned 0x630000 [0061.766] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.766] GetProcessHeap () returned 0x630000 [0061.766] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.766] GetProcessHeap () returned 0x630000 [0061.766] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.766] GetProcessHeap () returned 0x630000 [0061.766] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.766] GetProcessHeap () returned 0x630000 [0061.766] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.766] GetProcessHeap () returned 0x630000 [0061.766] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.766] GetProcessHeap () returned 0x630000 [0061.766] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.766] GetProcessHeap () returned 0x630000 [0061.767] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.767] GetProcessHeap () returned 0x630000 [0061.767] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.767] GetProcessHeap () returned 0x630000 [0061.767] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.767] GetProcessHeap () returned 0x630000 [0061.767] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.767] GetProcessHeap () returned 0x630000 [0061.767] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.767] GetProcessHeap () returned 0x630000 [0061.767] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.767] GetProcessHeap () returned 0x630000 [0061.767] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.767] GetProcessHeap () returned 0x630000 [0061.767] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.767] GetProcessHeap () returned 0x630000 [0061.767] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.767] GetProcessHeap () returned 0x630000 [0061.767] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.767] GetProcessHeap () returned 0x630000 [0061.767] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.767] GetProcessHeap () returned 0x630000 [0061.767] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.767] GetProcessHeap () returned 0x630000 [0061.767] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.767] GetProcessHeap () returned 0x630000 [0061.767] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0061.767] GetProcessHeap () returned 0x630000 [0061.767] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0061.767] GetProcessHeap () returned 0x630000 [0061.767] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0061.767] GetProcessHeap () returned 0x630000 [0061.767] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0061.767] GetProcessHeap () returned 0x630000 [0061.767] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0061.768] GetProcessHeap () returned 0x630000 [0061.768] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0061.768] GetProcessHeap () returned 0x630000 [0061.768] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0061.768] GetProcessHeap () returned 0x630000 [0061.768] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0061.768] GetProcessHeap () returned 0x630000 [0061.768] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0061.768] GetProcessHeap () returned 0x630000 [0061.768] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.768] GetProcessHeap () returned 0x630000 [0061.768] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0061.768] WriteFile (in: hFile=0x230, lpBuffer=0x6590f0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6590f0*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0061.772] GetProcessHeap () returned 0x630000 [0061.772] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6590f0, Size=0x30) returned 0x6590f0 [0061.772] GetProcessHeap () returned 0x630000 [0061.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0061.772] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.772] GetProcessHeap () returned 0x630000 [0061.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xdec0) returned 0x671bf0 [0061.774] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0xdec0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0xdec0, lpOverlapped=0x0) returned 1 [0061.775] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.775] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0xdec0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0xdec0, lpOverlapped=0x0) returned 1 [0061.776] GetProcessHeap () returned 0x630000 [0061.776] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0061.776] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.776] WriteFile (in: hFile=0x230, lpBuffer=0x6590f0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6590f0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0061.777] CloseHandle (hObject=0x230) returned 1 [0061.780] GetProcessHeap () returned 0x630000 [0061.780] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0061.780] GetProcessHeap () returned 0x630000 [0061.780] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655aa8 | out: hHeap=0x630000) returned 1 [0061.780] GetProcessHeap () returned 0x630000 [0061.780] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0061.780] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\vF1d8ev.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\vF1d8ev.mp3") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\vF1d8ev.mp3" [0061.780] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\vF1d8ev.mp3", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\vF1d8ev.mp3.happythreechoose") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\vF1d8ev.mp3.happythreechoose" [0061.780] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\vF1d8ev.mp3" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\vf1d8ev.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\vF1d8ev.mp3.happythreechoose" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\vf1d8ev.mp3.happythreechoose"), dwFlags=0x1) returned 1 [0061.781] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\vF1d8ev.mp3" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-") returned 1 [0061.781] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\") returned="" [0061.781] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\Decryption INFO.html" [0061.781] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\decryption info.html")) returned 0x20 [0061.781] GetProcessHeap () returned 0x630000 [0061.781] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0061.781] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaae0a740, ftCreationTime.dwHighDateTime=0x1d5ce9b, ftLastAccessTime.dwLowDateTime=0x67460090, ftLastAccessTime.dwHighDateTime=0x1d5d6a0, ftLastWriteTime.dwLowDateTime=0x67460090, ftLastWriteTime.dwHighDateTime=0x1d5d6a0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XKYlfaQ", cAlternateFileName="")) returned 1 [0061.781] lstrcmpiW (lpString1="XKYlfaQ", lpString2=".") returned 1 [0061.781] lstrcmpiW (lpString1="XKYlfaQ", lpString2="..") returned 1 [0061.781] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\", lpString2="XKYlfaQ" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ" [0061.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XKYlfaQ", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0061.781] GetProcessHeap () returned 0x630000 [0061.781] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a258 [0061.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="XKYlfaQ", cchWideChar=-1, lpMultiByteStr=0x65a258, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="XKYlfaQ", lpUsedDefaultChar=0x0) returned 8 [0061.781] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XKYlfaQ", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 3 [0061.781] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XKYlfaQ", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0061.781] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XKYlfaQ", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0061.781] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XKYlfaQ", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 3 [0061.781] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XKYlfaQ", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 3 [0061.781] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XKYlfaQ", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0061.781] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XKYlfaQ", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0061.781] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XKYlfaQ", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 3 [0061.781] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XKYlfaQ", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 3 [0061.781] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XKYlfaQ", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 3 [0061.781] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XKYlfaQ", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 3 [0061.781] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XKYlfaQ", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 3 [0061.781] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XKYlfaQ", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 3 [0061.781] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XKYlfaQ", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 3 [0061.781] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XKYlfaQ", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 3 [0061.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XKYlfaQ", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 3 [0061.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XKYlfaQ", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 3 [0061.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XKYlfaQ", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 3 [0061.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XKYlfaQ", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0061.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XKYlfaQ", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0061.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XKYlfaQ", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0061.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XKYlfaQ", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0061.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XKYlfaQ", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0061.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XKYlfaQ", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0061.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XKYlfaQ", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 3 [0061.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XKYlfaQ", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 3 [0061.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XKYlfaQ", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0061.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XKYlfaQ", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0061.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XKYlfaQ", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 3 [0061.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XKYlfaQ", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 3 [0061.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XKYlfaQ", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 3 [0061.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XKYlfaQ", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0061.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XKYlfaQ", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0061.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XKYlfaQ", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0061.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XKYlfaQ", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0061.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XKYlfaQ", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0061.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XKYlfaQ", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0061.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XKYlfaQ", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0061.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XKYlfaQ", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0061.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XKYlfaQ", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0061.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XKYlfaQ", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0061.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XKYlfaQ", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 3 [0061.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="XKYlfaQ", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0061.782] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\" [0061.782] GetProcessHeap () returned 0x630000 [0061.782] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a278 [0061.782] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\") returned 43 [0061.782] GetProcessHeap () returned 0x630000 [0061.782] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x58) returned 0x653a50 [0061.783] lstrcpyW (in: lpString1=0x653a50, lpString2="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\" [0061.783] GetProcessHeap () returned 0x630000 [0061.783] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.783] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0519810, ftCreationTime.dwHighDateTime=0x1d5d11e, ftLastAccessTime.dwLowDateTime=0x177c8bc0, ftLastAccessTime.dwHighDateTime=0x1d5d1bd, ftLastWriteTime.dwLowDateTime=0x177c8bc0, ftLastWriteTime.dwHighDateTime=0x1d5d1bd, nFileSizeHigh=0x0, nFileSizeLow=0x267c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zaWZ2Dhah9hHaN1g.wav", cAlternateFileName="ZAWZ2D~1.WAV")) returned 1 [0061.783] lstrcmpiW (lpString1="zaWZ2Dhah9hHaN1g.wav", lpString2=".") returned 1 [0061.783] lstrcmpiW (lpString1="zaWZ2Dhah9hHaN1g.wav", lpString2="..") returned 1 [0061.783] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\", lpString2="zaWZ2Dhah9hHaN1g.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\zaWZ2Dhah9hHaN1g.wav") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\zaWZ2Dhah9hHaN1g.wav" [0061.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="zaWZ2Dhah9hHaN1g.wav", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0061.783] GetProcessHeap () returned 0x630000 [0061.783] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x15) returned 0x645d18 [0061.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="zaWZ2Dhah9hHaN1g.wav", cchWideChar=-1, lpMultiByteStr=0x645d18, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zaWZ2Dhah9hHaN1g.wav", lpUsedDefaultChar=0x0) returned 21 [0061.783] lstrlenA (lpString="zaWZ2Dhah9hHaN1g.wav") returned 20 [0061.783] lstrlenA (lpString=".happythreechoose") returned 17 [0061.783] lstrlenA (lpString=".happythreechoose") returned 17 [0061.783] lstrlenA (lpString="zaWZ2Dhah9hHaN1g.wav") returned 20 [0061.783] lstrcmpiA (lpString1="Z2Dhah9hHaN1g.wav", lpString2=".happythreechoose") returned 1 [0061.783] lstrcmpiW (lpString1="zaWZ2Dhah9hHaN1g.wav", lpString2="Decryption INFO.html") returned 1 [0061.783] lstrcmpiW (lpString1="zaWZ2Dhah9hHaN1g.wav", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0061.783] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0061.783] lstrcmpiW (lpString1="zaWZ2Dhah9hHaN1g.wav", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0061.783] GetProcessHeap () returned 0x630000 [0061.783] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0061.783] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\zaWZ2Dhah9hHaN1g.wav" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\zawz2dhah9hhan1g.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0061.783] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=9852) returned 1 [0061.783] GetProcessHeap () returned 0x630000 [0061.783] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655b20 [0061.783] GetProcessHeap () returned 0x630000 [0061.783] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0061.783] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\zaWZ2Dhah9hHaN1g.wav") returned 55 [0061.783] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.784] GetProcessHeap () returned 0x630000 [0061.784] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0061.784] GetProcessHeap () returned 0x630000 [0061.784] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x659128 [0061.784] lstrlenA (lpString="rsa_encrypt") returned 11 [0061.784] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0061.784] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0061.784] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0061.784] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0061.784] GetProcessHeap () returned 0x630000 [0061.784] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0061.784] lstrlenA (lpString="010001") returned 6 [0061.784] GetProcessHeap () returned 0x630000 [0061.784] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2b8 [0061.785] GetProcessHeap () returned 0x630000 [0061.785] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.785] GetProcessHeap () returned 0x630000 [0061.785] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e190 [0061.785] GetProcessHeap () returned 0x630000 [0061.785] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.785] GetProcessHeap () returned 0x630000 [0061.785] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ec40 [0061.785] GetProcessHeap () returned 0x630000 [0061.785] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657210 [0061.785] GetProcessHeap () returned 0x630000 [0061.785] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a318 [0061.785] GetProcessHeap () returned 0x630000 [0061.785] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0061.785] GetProcessHeap () returned 0x630000 [0061.785] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.785] GetProcessHeap () returned 0x630000 [0061.785] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0061.785] GetProcessHeap () returned 0x630000 [0061.785] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.785] GetProcessHeap () returned 0x630000 [0061.785] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x6570f8 [0061.785] GetProcessHeap () returned 0x630000 [0061.785] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.785] GetProcessHeap () returned 0x630000 [0061.785] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0061.785] GetProcessHeap () returned 0x630000 [0061.785] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea90 [0061.785] GetProcessHeap () returned 0x630000 [0061.785] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.785] GetProcessHeap () returned 0x630000 [0061.785] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0061.785] GetProcessHeap () returned 0x630000 [0061.785] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea90 | out: hHeap=0x630000) returned 1 [0061.785] GetProcessHeap () returned 0x630000 [0061.785] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.785] GetProcessHeap () returned 0x630000 [0061.785] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0061.786] GetProcessHeap () returned 0x630000 [0061.786] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.786] GetProcessHeap () returned 0x630000 [0061.786] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.786] GetProcessHeap () returned 0x630000 [0061.786] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.786] GetProcessHeap () returned 0x630000 [0061.786] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.786] GetProcessHeap () returned 0x630000 [0061.786] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e340 [0061.786] GetProcessHeap () returned 0x630000 [0061.786] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0061.786] GetProcessHeap () returned 0x630000 [0061.786] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0061.786] GetProcessHeap () returned 0x630000 [0061.786] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0061.786] GetProcessHeap () returned 0x630000 [0061.786] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0061.786] GetProcessHeap () returned 0x630000 [0061.786] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0061.786] GetProcessHeap () returned 0x630000 [0061.786] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.786] GetProcessHeap () returned 0x630000 [0061.786] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.786] GetProcessHeap () returned 0x630000 [0061.786] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.786] GetProcessHeap () returned 0x630000 [0061.786] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.786] GetProcessHeap () returned 0x630000 [0061.786] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.786] GetProcessHeap () returned 0x630000 [0061.786] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.786] GetProcessHeap () returned 0x630000 [0061.786] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.786] GetProcessHeap () returned 0x630000 [0061.786] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.786] GetProcessHeap () returned 0x630000 [0061.787] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.787] GetProcessHeap () returned 0x630000 [0061.787] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.787] GetProcessHeap () returned 0x630000 [0061.787] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.787] GetProcessHeap () returned 0x630000 [0061.787] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.787] GetProcessHeap () returned 0x630000 [0061.787] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.787] GetProcessHeap () returned 0x630000 [0061.787] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.787] GetProcessHeap () returned 0x630000 [0061.787] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.787] GetProcessHeap () returned 0x630000 [0061.787] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.787] GetProcessHeap () returned 0x630000 [0061.787] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.787] GetProcessHeap () returned 0x630000 [0061.787] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.787] GetProcessHeap () returned 0x630000 [0061.787] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.787] GetProcessHeap () returned 0x630000 [0061.787] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.787] GetProcessHeap () returned 0x630000 [0061.787] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.787] GetProcessHeap () returned 0x630000 [0061.787] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.787] GetProcessHeap () returned 0x630000 [0061.787] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.787] GetProcessHeap () returned 0x630000 [0061.787] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.787] GetProcessHeap () returned 0x630000 [0061.787] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.787] GetProcessHeap () returned 0x630000 [0061.787] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.787] GetProcessHeap () returned 0x630000 [0061.787] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.788] GetProcessHeap () returned 0x630000 [0061.788] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.788] GetProcessHeap () returned 0x630000 [0061.788] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.788] GetProcessHeap () returned 0x630000 [0061.788] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.788] GetProcessHeap () returned 0x630000 [0061.788] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.788] GetProcessHeap () returned 0x630000 [0061.788] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.788] GetProcessHeap () returned 0x630000 [0061.788] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.788] GetProcessHeap () returned 0x630000 [0061.788] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.788] GetProcessHeap () returned 0x630000 [0061.788] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.788] GetProcessHeap () returned 0x630000 [0061.788] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.788] GetProcessHeap () returned 0x630000 [0061.788] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.788] GetProcessHeap () returned 0x630000 [0061.788] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.788] GetProcessHeap () returned 0x630000 [0061.788] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.788] GetProcessHeap () returned 0x630000 [0061.788] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.788] GetProcessHeap () returned 0x630000 [0061.788] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.788] GetProcessHeap () returned 0x630000 [0061.788] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.788] GetProcessHeap () returned 0x630000 [0061.788] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.788] GetProcessHeap () returned 0x630000 [0061.788] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.788] GetProcessHeap () returned 0x630000 [0061.788] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.789] GetProcessHeap () returned 0x630000 [0061.789] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.789] GetProcessHeap () returned 0x630000 [0061.789] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.789] GetProcessHeap () returned 0x630000 [0061.789] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.789] GetProcessHeap () returned 0x630000 [0061.789] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.789] GetProcessHeap () returned 0x630000 [0061.789] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.789] GetProcessHeap () returned 0x630000 [0061.789] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.789] GetProcessHeap () returned 0x630000 [0061.789] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.789] GetProcessHeap () returned 0x630000 [0061.789] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.789] GetProcessHeap () returned 0x630000 [0061.789] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.789] GetProcessHeap () returned 0x630000 [0061.789] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.789] GetProcessHeap () returned 0x630000 [0061.789] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.789] GetProcessHeap () returned 0x630000 [0061.789] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.789] GetProcessHeap () returned 0x630000 [0061.790] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.790] GetProcessHeap () returned 0x630000 [0061.790] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.790] GetProcessHeap () returned 0x630000 [0061.790] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.790] GetProcessHeap () returned 0x630000 [0061.790] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.790] GetProcessHeap () returned 0x630000 [0061.790] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.790] GetProcessHeap () returned 0x630000 [0061.790] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.790] GetProcessHeap () returned 0x630000 [0061.790] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.790] GetProcessHeap () returned 0x630000 [0061.790] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.790] GetProcessHeap () returned 0x630000 [0061.790] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.790] GetProcessHeap () returned 0x630000 [0061.790] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.790] GetProcessHeap () returned 0x630000 [0061.790] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.790] GetProcessHeap () returned 0x630000 [0061.790] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.790] GetProcessHeap () returned 0x630000 [0061.790] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.790] GetProcessHeap () returned 0x630000 [0061.790] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.790] GetProcessHeap () returned 0x630000 [0061.790] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.790] GetProcessHeap () returned 0x630000 [0061.790] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.790] GetProcessHeap () returned 0x630000 [0061.790] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.790] GetProcessHeap () returned 0x630000 [0061.790] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.790] GetProcessHeap () returned 0x630000 [0061.790] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.791] GetProcessHeap () returned 0x630000 [0061.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.791] GetProcessHeap () returned 0x630000 [0061.791] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.791] GetProcessHeap () returned 0x630000 [0061.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.791] GetProcessHeap () returned 0x630000 [0061.791] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.791] GetProcessHeap () returned 0x630000 [0061.791] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0061.791] GetProcessHeap () returned 0x630000 [0061.791] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0061.791] GetProcessHeap () returned 0x630000 [0061.791] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0061.791] GetProcessHeap () returned 0x630000 [0061.791] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0061.791] GetProcessHeap () returned 0x630000 [0061.791] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0061.791] GetProcessHeap () returned 0x630000 [0061.791] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ec40 | out: hHeap=0x630000) returned 1 [0061.791] GetProcessHeap () returned 0x630000 [0061.791] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0061.791] GetProcessHeap () returned 0x630000 [0061.791] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0061.791] GetProcessHeap () returned 0x630000 [0061.791] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0061.791] GetProcessHeap () returned 0x630000 [0061.791] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.791] GetProcessHeap () returned 0x630000 [0061.791] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0061.791] WriteFile (in: hFile=0x230, lpBuffer=0x659128*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659128*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0061.793] GetProcessHeap () returned 0x630000 [0061.793] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659128, Size=0x30) returned 0x659128 [0061.793] GetProcessHeap () returned 0x630000 [0061.793] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0061.793] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.793] GetProcessHeap () returned 0x630000 [0061.793] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x267c) returned 0x671bf0 [0061.793] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0x267c, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0x267c, lpOverlapped=0x0) returned 1 [0061.793] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.793] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x267c, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0x267c, lpOverlapped=0x0) returned 1 [0061.794] GetProcessHeap () returned 0x630000 [0061.794] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0061.794] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.795] WriteFile (in: hFile=0x230, lpBuffer=0x659128*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659128*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0061.795] CloseHandle (hObject=0x230) returned 1 [0061.797] GetProcessHeap () returned 0x630000 [0061.797] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0061.797] GetProcessHeap () returned 0x630000 [0061.797] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655b20 | out: hHeap=0x630000) returned 1 [0061.797] GetProcessHeap () returned 0x630000 [0061.797] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0061.797] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\zaWZ2Dhah9hHaN1g.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\zaWZ2Dhah9hHaN1g.wav") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\zaWZ2Dhah9hHaN1g.wav" [0061.797] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\zaWZ2Dhah9hHaN1g.wav", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\zaWZ2Dhah9hHaN1g.wav.happythreechoose") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\zaWZ2Dhah9hHaN1g.wav.happythreechoose" [0061.797] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\zaWZ2Dhah9hHaN1g.wav" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\zawz2dhah9hhan1g.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\zaWZ2Dhah9hHaN1g.wav.happythreechoose" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\zawz2dhah9hhan1g.wav.happythreechoose"), dwFlags=0x1) returned 1 [0061.798] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\zaWZ2Dhah9hHaN1g.wav" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-") returned 1 [0061.798] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\") returned="" [0061.798] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\Decryption INFO.html" [0061.798] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\decryption info.html")) returned 0x20 [0061.798] GetProcessHeap () returned 0x630000 [0061.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645d18 | out: hHeap=0x630000) returned 1 [0061.798] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0519810, ftCreationTime.dwHighDateTime=0x1d5d11e, ftLastAccessTime.dwLowDateTime=0x177c8bc0, ftLastAccessTime.dwHighDateTime=0x1d5d1bd, ftLastWriteTime.dwLowDateTime=0x177c8bc0, ftLastWriteTime.dwHighDateTime=0x1d5d1bd, nFileSizeHigh=0x0, nFileSizeLow=0x267c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zaWZ2Dhah9hHaN1g.wav", cAlternateFileName="ZAWZ2D~1.WAV")) returned 0 [0061.798] FindClose (in: hFindFile=0x648890 | out: hFindFile=0x648890) returned 1 [0061.798] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\" [0061.798] GetProcessHeap () returned 0x630000 [0061.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653a50 | out: hHeap=0x630000) returned 1 [0061.798] GetProcessHeap () returned 0x630000 [0061.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.798] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\") returned 43 [0061.798] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\*") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\*" [0061.798] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaae0a740, ftCreationTime.dwHighDateTime=0x1d5ce9b, ftLastAccessTime.dwLowDateTime=0x67460090, ftLastAccessTime.dwHighDateTime=0x1d5d6a0, ftLastWriteTime.dwLowDateTime=0x67460090, ftLastWriteTime.dwHighDateTime=0x1d5d6a0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648890 [0061.799] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0061.799] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaae0a740, ftCreationTime.dwHighDateTime=0x1d5ce9b, ftLastAccessTime.dwLowDateTime=0x67460090, ftLastAccessTime.dwHighDateTime=0x1d5d6a0, ftLastWriteTime.dwLowDateTime=0x67460090, ftLastWriteTime.dwHighDateTime=0x1d5d6a0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.799] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0061.799] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0061.799] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d22290, ftCreationTime.dwHighDateTime=0x1d5d7a3, ftLastAccessTime.dwLowDateTime=0x8c511ae0, ftLastAccessTime.dwHighDateTime=0x1d5d787, ftLastWriteTime.dwLowDateTime=0x8c511ae0, ftLastWriteTime.dwHighDateTime=0x1d5d787, nFileSizeHigh=0x0, nFileSizeLow=0x159f4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="49mlypQr.m4a", cAlternateFileName="")) returned 1 [0061.799] lstrcmpiW (lpString1="49mlypQr.m4a", lpString2=".") returned 1 [0061.799] lstrcmpiW (lpString1="49mlypQr.m4a", lpString2="..") returned 1 [0061.799] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\", lpString2="49mlypQr.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\49mlypQr.m4a") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\49mlypQr.m4a" [0061.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="49mlypQr.m4a", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0061.799] GetProcessHeap () returned 0x630000 [0061.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd) returned 0x64c9f0 [0061.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="49mlypQr.m4a", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="49mlypQr.m4a", lpUsedDefaultChar=0x0) returned 13 [0061.799] lstrlenA (lpString="49mlypQr.m4a") returned 12 [0061.799] lstrlenA (lpString=".happythreechoose") returned 17 [0061.799] lstrcmpiW (lpString1="49mlypQr.m4a", lpString2="Decryption INFO.html") returned -1 [0061.799] lstrcmpiW (lpString1="49mlypQr.m4a", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned -1 [0061.799] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0061.799] lstrcmpiW (lpString1="49mlypQr.m4a", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0061.799] GetProcessHeap () returned 0x630000 [0061.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0061.799] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\49mlypQr.m4a" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\49mlypqr.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0061.799] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=88564) returned 1 [0061.799] GetProcessHeap () returned 0x630000 [0061.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655670 [0061.799] GetProcessHeap () returned 0x630000 [0061.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0061.800] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\49mlypQr.m4a") returned 55 [0061.800] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.800] GetProcessHeap () returned 0x630000 [0061.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0061.800] GetProcessHeap () returned 0x630000 [0061.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38c) returned 0x659160 [0061.800] lstrlenA (lpString="rsa_encrypt") returned 11 [0061.800] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0061.800] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0061.800] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0061.800] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0061.800] GetProcessHeap () returned 0x630000 [0061.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0061.800] lstrlenA (lpString="010001") returned 6 [0061.800] GetProcessHeap () returned 0x630000 [0061.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a318 [0061.801] GetProcessHeap () returned 0x630000 [0061.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.801] GetProcessHeap () returned 0x630000 [0061.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e970 [0061.801] GetProcessHeap () returned 0x630000 [0061.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.801] GetProcessHeap () returned 0x630000 [0061.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea00 [0061.801] GetProcessHeap () returned 0x630000 [0061.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656fe0 [0061.801] GetProcessHeap () returned 0x630000 [0061.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0061.801] GetProcessHeap () returned 0x630000 [0061.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0061.801] GetProcessHeap () returned 0x630000 [0061.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.801] GetProcessHeap () returned 0x630000 [0061.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0061.801] GetProcessHeap () returned 0x630000 [0061.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.801] GetProcessHeap () returned 0x630000 [0061.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656db0 [0061.801] GetProcessHeap () returned 0x630000 [0061.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.801] GetProcessHeap () returned 0x630000 [0061.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0061.801] GetProcessHeap () returned 0x630000 [0061.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0061.801] GetProcessHeap () returned 0x630000 [0061.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.801] GetProcessHeap () returned 0x630000 [0061.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0061.801] GetProcessHeap () returned 0x630000 [0061.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0061.801] GetProcessHeap () returned 0x630000 [0061.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.802] GetProcessHeap () returned 0x630000 [0061.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cfb8 [0061.802] GetProcessHeap () returned 0x630000 [0061.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.802] GetProcessHeap () returned 0x630000 [0061.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.802] GetProcessHeap () returned 0x630000 [0061.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.802] GetProcessHeap () returned 0x630000 [0061.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.802] GetProcessHeap () returned 0x630000 [0061.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e8e0 [0061.802] GetProcessHeap () returned 0x630000 [0061.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cfb8 | out: hHeap=0x630000) returned 1 [0061.802] GetProcessHeap () returned 0x630000 [0061.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0061.802] GetProcessHeap () returned 0x630000 [0061.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0061.802] GetProcessHeap () returned 0x630000 [0061.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.802] GetProcessHeap () returned 0x630000 [0061.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.802] GetProcessHeap () returned 0x630000 [0061.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.802] GetProcessHeap () returned 0x630000 [0061.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.802] GetProcessHeap () returned 0x630000 [0061.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.802] GetProcessHeap () returned 0x630000 [0061.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.802] GetProcessHeap () returned 0x630000 [0061.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.802] GetProcessHeap () returned 0x630000 [0061.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.802] GetProcessHeap () returned 0x630000 [0061.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.803] GetProcessHeap () returned 0x630000 [0061.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.803] GetProcessHeap () returned 0x630000 [0061.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.803] GetProcessHeap () returned 0x630000 [0061.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.803] GetProcessHeap () returned 0x630000 [0061.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.803] GetProcessHeap () returned 0x630000 [0061.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.803] GetProcessHeap () returned 0x630000 [0061.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.803] GetProcessHeap () returned 0x630000 [0061.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.803] GetProcessHeap () returned 0x630000 [0061.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.803] GetProcessHeap () returned 0x630000 [0061.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.803] GetProcessHeap () returned 0x630000 [0061.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.803] GetProcessHeap () returned 0x630000 [0061.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.803] GetProcessHeap () returned 0x630000 [0061.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.803] GetProcessHeap () returned 0x630000 [0061.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.803] GetProcessHeap () returned 0x630000 [0061.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.803] GetProcessHeap () returned 0x630000 [0061.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.803] GetProcessHeap () returned 0x630000 [0061.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0061.803] GetProcessHeap () returned 0x630000 [0061.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0061.803] GetProcessHeap () returned 0x630000 [0061.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.804] GetProcessHeap () returned 0x630000 [0061.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.804] GetProcessHeap () returned 0x630000 [0061.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.804] GetProcessHeap () returned 0x630000 [0061.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.804] GetProcessHeap () returned 0x630000 [0061.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.804] GetProcessHeap () returned 0x630000 [0061.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.804] GetProcessHeap () returned 0x630000 [0061.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.804] GetProcessHeap () returned 0x630000 [0061.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.804] GetProcessHeap () returned 0x630000 [0061.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.804] GetProcessHeap () returned 0x630000 [0061.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.804] GetProcessHeap () returned 0x630000 [0061.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.804] GetProcessHeap () returned 0x630000 [0061.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.804] GetProcessHeap () returned 0x630000 [0061.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.804] GetProcessHeap () returned 0x630000 [0061.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.804] GetProcessHeap () returned 0x630000 [0061.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.804] GetProcessHeap () returned 0x630000 [0061.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.804] GetProcessHeap () returned 0x630000 [0061.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.804] GetProcessHeap () returned 0x630000 [0061.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.805] GetProcessHeap () returned 0x630000 [0061.805] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.805] GetProcessHeap () returned 0x630000 [0061.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.805] GetProcessHeap () returned 0x630000 [0061.805] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.805] GetProcessHeap () returned 0x630000 [0061.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.805] GetProcessHeap () returned 0x630000 [0061.805] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.805] GetProcessHeap () returned 0x630000 [0061.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.805] GetProcessHeap () returned 0x630000 [0061.805] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.805] GetProcessHeap () returned 0x630000 [0061.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.805] GetProcessHeap () returned 0x630000 [0061.805] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.805] GetProcessHeap () returned 0x630000 [0061.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.805] GetProcessHeap () returned 0x630000 [0061.805] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.805] GetProcessHeap () returned 0x630000 [0061.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.805] GetProcessHeap () returned 0x630000 [0061.805] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.805] GetProcessHeap () returned 0x630000 [0061.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.805] GetProcessHeap () returned 0x630000 [0061.805] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.805] GetProcessHeap () returned 0x630000 [0061.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.805] GetProcessHeap () returned 0x630000 [0061.805] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.805] GetProcessHeap () returned 0x630000 [0061.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.805] GetProcessHeap () returned 0x630000 [0061.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.806] GetProcessHeap () returned 0x630000 [0061.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.806] GetProcessHeap () returned 0x630000 [0061.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.806] GetProcessHeap () returned 0x630000 [0061.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.806] GetProcessHeap () returned 0x630000 [0061.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.806] GetProcessHeap () returned 0x630000 [0061.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.806] GetProcessHeap () returned 0x630000 [0061.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.806] GetProcessHeap () returned 0x630000 [0061.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.806] GetProcessHeap () returned 0x630000 [0061.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.806] GetProcessHeap () returned 0x630000 [0061.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.806] GetProcessHeap () returned 0x630000 [0061.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.806] GetProcessHeap () returned 0x630000 [0061.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.806] GetProcessHeap () returned 0x630000 [0061.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.806] GetProcessHeap () returned 0x630000 [0061.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.806] GetProcessHeap () returned 0x630000 [0061.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.806] GetProcessHeap () returned 0x630000 [0061.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.806] GetProcessHeap () returned 0x630000 [0061.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0061.806] GetProcessHeap () returned 0x630000 [0061.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.806] GetProcessHeap () returned 0x630000 [0061.807] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.807] GetProcessHeap () returned 0x630000 [0061.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.807] GetProcessHeap () returned 0x630000 [0061.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0061.807] GetProcessHeap () returned 0x630000 [0061.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0061.807] GetProcessHeap () returned 0x630000 [0061.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0061.807] GetProcessHeap () returned 0x630000 [0061.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0061.807] GetProcessHeap () returned 0x630000 [0061.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0061.807] GetProcessHeap () returned 0x630000 [0061.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0061.807] GetProcessHeap () returned 0x630000 [0061.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0061.807] GetProcessHeap () returned 0x630000 [0061.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0061.807] GetProcessHeap () returned 0x630000 [0061.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0061.807] GetProcessHeap () returned 0x630000 [0061.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.807] GetProcessHeap () returned 0x630000 [0061.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0061.807] WriteFile (in: hFile=0x230, lpBuffer=0x659160*, nNumberOfBytesToWrite=0x38c, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659160*, lpNumberOfBytesWritten=0x243d864*=0x38c, lpOverlapped=0x0) returned 1 [0061.809] GetProcessHeap () returned 0x630000 [0061.809] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659160, Size=0x30) returned 0x659160 [0061.809] GetProcessHeap () returned 0x630000 [0061.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0061.809] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.809] GetProcessHeap () returned 0x630000 [0061.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x15a00) returned 0x671bf0 [0061.810] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0x15a00, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0x15a00, lpOverlapped=0x0) returned 1 [0061.811] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.811] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x15a00, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0x15a00, lpOverlapped=0x0) returned 1 [0061.812] GetProcessHeap () returned 0x630000 [0061.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0061.812] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.813] WriteFile (in: hFile=0x230, lpBuffer=0x659160*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659160*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0061.813] CloseHandle (hObject=0x230) returned 1 [0061.816] GetProcessHeap () returned 0x630000 [0061.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0061.816] GetProcessHeap () returned 0x630000 [0061.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655670 | out: hHeap=0x630000) returned 1 [0061.816] GetProcessHeap () returned 0x630000 [0061.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0061.816] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\49mlypQr.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\49mlypQr.m4a") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\49mlypQr.m4a" [0061.816] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\49mlypQr.m4a", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\49mlypQr.m4a.happythreechoose") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\49mlypQr.m4a.happythreechoose" [0061.816] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\49mlypQr.m4a" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\49mlypqr.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\49mlypQr.m4a.happythreechoose" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\49mlypqr.m4a.happythreechoose"), dwFlags=0x1) returned 1 [0061.817] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\49mlypQr.m4a" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ") returned 1 [0061.817] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\") returned="" [0061.817] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Decryption INFO.html" [0061.817] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\decryption info.html")) returned 0xffffffff [0061.817] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0061.818] GetProcessHeap () returned 0x630000 [0061.818] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655850 [0061.818] GetProcessHeap () returned 0x630000 [0061.818] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0061.825] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.826] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.826] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.826] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.826] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.826] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.826] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.826] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.826] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.827] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.827] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.827] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.827] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.827] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.827] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.827] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.827] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.827] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.827] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.827] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.827] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.828] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.828] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.828] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.828] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.828] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.828] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.828] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.828] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.828] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.828] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.828] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.828] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.828] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.829] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.829] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.829] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.831] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.831] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.831] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.831] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.831] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.832] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.832] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.832] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.832] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.832] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.832] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.832] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.832] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.832] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.832] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.832] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.832] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.832] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.833] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.833] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.833] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.833] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.833] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.833] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.833] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.833] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.833] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.833] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.833] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.833] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.833] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.834] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.834] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.834] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.834] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.834] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.834] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.834] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.834] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.834] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.834] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.834] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.834] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.834] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.834] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.835] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.835] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.835] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.835] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.835] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.835] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.835] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.835] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.835] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.835] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.835] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.835] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.835] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.836] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.836] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.836] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.836] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.836] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.837] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.837] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.837] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.837] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.837] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.837] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.837] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.837] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.837] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.837] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.837] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.837] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.837] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.837] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.838] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.838] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.838] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.838] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.838] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.838] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.838] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.838] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.838] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.838] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.838] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.838] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.838] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.838] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.839] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.839] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.839] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.839] GetProcessHeap () returned 0x630000 [0061.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655850 | out: hHeap=0x630000) returned 1 [0061.839] GetProcessHeap () returned 0x630000 [0061.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0061.839] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0061.839] GetProcessHeap () returned 0x630000 [0061.839] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655a30 [0061.839] GetProcessHeap () returned 0x630000 [0061.839] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0061.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.847] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.847] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.847] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.847] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.847] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.847] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.847] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.847] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.847] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.847] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.847] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.847] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.847] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.848] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.848] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.848] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.848] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.848] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.848] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.848] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.848] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.848] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.848] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.848] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.848] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.848] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.848] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.849] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.849] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.849] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.849] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.849] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.849] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.849] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.849] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.849] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.849] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.849] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.849] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.849] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.849] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.850] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.850] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.850] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.850] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.850] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.850] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.850] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.850] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.850] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.850] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.850] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.850] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.850] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.850] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.851] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.851] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.851] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.851] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.851] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.851] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.851] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.851] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.851] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.851] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.910] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.910] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.910] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.910] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.910] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.911] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.911] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.911] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.911] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.911] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.911] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.911] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.911] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.911] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.911] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.911] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.911] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.911] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.912] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.912] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.912] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.912] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.912] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.912] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.912] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.912] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.912] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.912] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.912] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.912] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.912] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.912] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.913] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.913] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.913] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.913] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.913] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.913] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.913] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.913] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.913] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.913] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.913] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.913] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.913] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0061.915] GetProcessHeap () returned 0x630000 [0061.915] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655a30 | out: hHeap=0x630000) returned 1 [0061.915] GetProcessHeap () returned 0x630000 [0061.915] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0061.915] CloseHandle (hObject=0x230) returned 1 [0061.915] GetProcessHeap () returned 0x630000 [0061.915] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0061.915] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a71e0, ftCreationTime.dwHighDateTime=0x1d5cd1b, ftLastAccessTime.dwLowDateTime=0x6e4fcb60, ftLastAccessTime.dwHighDateTime=0x1d5d3a7, ftLastWriteTime.dwLowDateTime=0x6e4fcb60, ftLastWriteTime.dwHighDateTime=0x1d5d3a7, nFileSizeHigh=0x0, nFileSizeLow=0x168e2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8bxt2DL9E2y2.mp3", cAlternateFileName="8BXT2D~1.MP3")) returned 1 [0061.915] lstrcmpiW (lpString1="8bxt2DL9E2y2.mp3", lpString2=".") returned 1 [0061.915] lstrcmpiW (lpString1="8bxt2DL9E2y2.mp3", lpString2="..") returned 1 [0061.915] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\", lpString2="8bxt2DL9E2y2.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\8bxt2DL9E2y2.mp3") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\8bxt2DL9E2y2.mp3" [0061.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="8bxt2DL9E2y2.mp3", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0061.915] GetProcessHeap () returned 0x630000 [0061.915] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11) returned 0x645f98 [0061.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="8bxt2DL9E2y2.mp3", cchWideChar=-1, lpMultiByteStr=0x645f98, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8bxt2DL9E2y2.mp3", lpUsedDefaultChar=0x0) returned 17 [0061.915] lstrlenA (lpString="8bxt2DL9E2y2.mp3") returned 16 [0061.915] lstrlenA (lpString=".happythreechoose") returned 17 [0061.915] lstrcmpiW (lpString1="8bxt2DL9E2y2.mp3", lpString2="Decryption INFO.html") returned -1 [0061.916] lstrcmpiW (lpString1="8bxt2DL9E2y2.mp3", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0061.916] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0061.916] lstrcmpiW (lpString1="8bxt2DL9E2y2.mp3", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0061.916] GetProcessHeap () returned 0x630000 [0061.916] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0061.916] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\8bxt2DL9E2y2.mp3" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\8bxt2dl9e2y2.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0061.916] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=92386) returned 1 [0061.916] GetProcessHeap () returned 0x630000 [0061.916] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655418 [0061.916] GetProcessHeap () returned 0x630000 [0061.916] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0061.916] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\8bxt2DL9E2y2.mp3") returned 59 [0061.916] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.916] GetProcessHeap () returned 0x630000 [0061.916] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0061.916] GetProcessHeap () returned 0x630000 [0061.916] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x659198 [0061.916] lstrlenA (lpString="rsa_encrypt") returned 11 [0061.916] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0061.917] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0061.917] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0061.917] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0061.917] GetProcessHeap () returned 0x630000 [0061.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0061.917] lstrlenA (lpString="010001") returned 6 [0061.917] GetProcessHeap () returned 0x630000 [0061.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0061.917] GetProcessHeap () returned 0x630000 [0061.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.917] GetProcessHeap () returned 0x630000 [0061.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dfe0 [0061.917] GetProcessHeap () returned 0x630000 [0061.917] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.917] GetProcessHeap () returned 0x630000 [0061.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e730 [0061.917] GetProcessHeap () returned 0x630000 [0061.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656db0 [0061.917] GetProcessHeap () returned 0x630000 [0061.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0061.917] GetProcessHeap () returned 0x630000 [0061.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0061.917] GetProcessHeap () returned 0x630000 [0061.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.918] GetProcessHeap () returned 0x630000 [0061.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0061.918] GetProcessHeap () returned 0x630000 [0061.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.918] GetProcessHeap () returned 0x630000 [0061.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656ec8 [0061.918] GetProcessHeap () returned 0x630000 [0061.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.918] GetProcessHeap () returned 0x630000 [0061.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0061.918] GetProcessHeap () returned 0x630000 [0061.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e3d0 [0061.918] GetProcessHeap () returned 0x630000 [0061.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.918] GetProcessHeap () returned 0x630000 [0061.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0061.918] GetProcessHeap () returned 0x630000 [0061.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0061.918] GetProcessHeap () returned 0x630000 [0061.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.918] GetProcessHeap () returned 0x630000 [0061.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0061.918] GetProcessHeap () returned 0x630000 [0061.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.918] GetProcessHeap () returned 0x630000 [0061.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.918] GetProcessHeap () returned 0x630000 [0061.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.918] GetProcessHeap () returned 0x630000 [0061.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.918] GetProcessHeap () returned 0x630000 [0061.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e970 [0061.918] GetProcessHeap () returned 0x630000 [0061.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0061.918] GetProcessHeap () returned 0x630000 [0061.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0061.918] GetProcessHeap () returned 0x630000 [0061.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0061.919] GetProcessHeap () returned 0x630000 [0061.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.919] GetProcessHeap () returned 0x630000 [0061.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.919] GetProcessHeap () returned 0x630000 [0061.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.919] GetProcessHeap () returned 0x630000 [0061.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.919] GetProcessHeap () returned 0x630000 [0061.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.919] GetProcessHeap () returned 0x630000 [0061.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.919] GetProcessHeap () returned 0x630000 [0061.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.919] GetProcessHeap () returned 0x630000 [0061.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.919] GetProcessHeap () returned 0x630000 [0061.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.919] GetProcessHeap () returned 0x630000 [0061.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.919] GetProcessHeap () returned 0x630000 [0061.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.919] GetProcessHeap () returned 0x630000 [0061.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.919] GetProcessHeap () returned 0x630000 [0061.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.919] GetProcessHeap () returned 0x630000 [0061.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.919] GetProcessHeap () returned 0x630000 [0061.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.919] GetProcessHeap () returned 0x630000 [0061.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.919] GetProcessHeap () returned 0x630000 [0061.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.919] GetProcessHeap () returned 0x630000 [0061.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.920] GetProcessHeap () returned 0x630000 [0061.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.920] GetProcessHeap () returned 0x630000 [0061.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.920] GetProcessHeap () returned 0x630000 [0061.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.920] GetProcessHeap () returned 0x630000 [0061.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.920] GetProcessHeap () returned 0x630000 [0061.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.920] GetProcessHeap () returned 0x630000 [0061.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.920] GetProcessHeap () returned 0x630000 [0061.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.920] GetProcessHeap () returned 0x630000 [0061.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.920] GetProcessHeap () returned 0x630000 [0061.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.920] GetProcessHeap () returned 0x630000 [0061.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.920] GetProcessHeap () returned 0x630000 [0061.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.920] GetProcessHeap () returned 0x630000 [0061.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.920] GetProcessHeap () returned 0x630000 [0061.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.920] GetProcessHeap () returned 0x630000 [0061.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.920] GetProcessHeap () returned 0x630000 [0061.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.920] GetProcessHeap () returned 0x630000 [0061.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.920] GetProcessHeap () returned 0x630000 [0061.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.920] GetProcessHeap () returned 0x630000 [0061.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.920] GetProcessHeap () returned 0x630000 [0061.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.921] GetProcessHeap () returned 0x630000 [0061.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.921] GetProcessHeap () returned 0x630000 [0061.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.921] GetProcessHeap () returned 0x630000 [0061.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.921] GetProcessHeap () returned 0x630000 [0061.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.921] GetProcessHeap () returned 0x630000 [0061.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.921] GetProcessHeap () returned 0x630000 [0061.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.921] GetProcessHeap () returned 0x630000 [0061.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.921] GetProcessHeap () returned 0x630000 [0061.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.921] GetProcessHeap () returned 0x630000 [0061.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.921] GetProcessHeap () returned 0x630000 [0061.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.921] GetProcessHeap () returned 0x630000 [0061.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.921] GetProcessHeap () returned 0x630000 [0061.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.921] GetProcessHeap () returned 0x630000 [0061.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.921] GetProcessHeap () returned 0x630000 [0061.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.921] GetProcessHeap () returned 0x630000 [0061.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.921] GetProcessHeap () returned 0x630000 [0061.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.921] GetProcessHeap () returned 0x630000 [0061.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.921] GetProcessHeap () returned 0x630000 [0061.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.921] GetProcessHeap () returned 0x630000 [0061.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.922] GetProcessHeap () returned 0x630000 [0061.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.922] GetProcessHeap () returned 0x630000 [0061.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.922] GetProcessHeap () returned 0x630000 [0061.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.922] GetProcessHeap () returned 0x630000 [0061.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.922] GetProcessHeap () returned 0x630000 [0061.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.922] GetProcessHeap () returned 0x630000 [0061.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.922] GetProcessHeap () returned 0x630000 [0061.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.922] GetProcessHeap () returned 0x630000 [0061.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.922] GetProcessHeap () returned 0x630000 [0061.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.922] GetProcessHeap () returned 0x630000 [0061.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.922] GetProcessHeap () returned 0x630000 [0061.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.922] GetProcessHeap () returned 0x630000 [0061.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.922] GetProcessHeap () returned 0x630000 [0061.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.922] GetProcessHeap () returned 0x630000 [0061.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.922] GetProcessHeap () returned 0x630000 [0061.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.922] GetProcessHeap () returned 0x630000 [0061.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.922] GetProcessHeap () returned 0x630000 [0061.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.922] GetProcessHeap () returned 0x630000 [0061.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.923] GetProcessHeap () returned 0x630000 [0061.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.923] GetProcessHeap () returned 0x630000 [0061.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.923] GetProcessHeap () returned 0x630000 [0061.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.923] GetProcessHeap () returned 0x630000 [0061.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.923] GetProcessHeap () returned 0x630000 [0061.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.923] GetProcessHeap () returned 0x630000 [0061.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.923] GetProcessHeap () returned 0x630000 [0061.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.923] GetProcessHeap () returned 0x630000 [0061.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.923] GetProcessHeap () returned 0x630000 [0061.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0061.923] GetProcessHeap () returned 0x630000 [0061.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0061.923] GetProcessHeap () returned 0x630000 [0061.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0061.923] GetProcessHeap () returned 0x630000 [0061.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0061.923] GetProcessHeap () returned 0x630000 [0061.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0061.923] GetProcessHeap () returned 0x630000 [0061.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0061.923] GetProcessHeap () returned 0x630000 [0061.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0061.923] GetProcessHeap () returned 0x630000 [0061.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0061.923] GetProcessHeap () returned 0x630000 [0061.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0061.923] GetProcessHeap () returned 0x630000 [0061.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.924] GetProcessHeap () returned 0x630000 [0061.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0061.924] WriteFile (in: hFile=0x230, lpBuffer=0x659198*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659198*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0061.927] GetProcessHeap () returned 0x630000 [0061.927] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659198, Size=0x30) returned 0x659198 [0061.927] GetProcessHeap () returned 0x630000 [0061.927] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0061.927] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.927] GetProcessHeap () returned 0x630000 [0061.927] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x168e2) returned 0x671bf0 [0061.927] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0x168e2, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0x168e2, lpOverlapped=0x0) returned 1 [0061.928] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.928] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x168e2, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0x168e2, lpOverlapped=0x0) returned 1 [0061.929] GetProcessHeap () returned 0x630000 [0061.929] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0061.930] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.930] WriteFile (in: hFile=0x230, lpBuffer=0x659198*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659198*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0061.930] CloseHandle (hObject=0x230) returned 1 [0061.933] GetProcessHeap () returned 0x630000 [0061.933] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0061.933] GetProcessHeap () returned 0x630000 [0061.933] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655418 | out: hHeap=0x630000) returned 1 [0061.933] GetProcessHeap () returned 0x630000 [0061.933] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0061.934] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\8bxt2DL9E2y2.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\8bxt2DL9E2y2.mp3") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\8bxt2DL9E2y2.mp3" [0061.934] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\8bxt2DL9E2y2.mp3", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\8bxt2DL9E2y2.mp3.happythreechoose") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\8bxt2DL9E2y2.mp3.happythreechoose" [0061.934] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\8bxt2DL9E2y2.mp3" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\8bxt2dl9e2y2.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\8bxt2DL9E2y2.mp3.happythreechoose" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\8bxt2dl9e2y2.mp3.happythreechoose"), dwFlags=0x1) returned 1 [0061.934] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\8bxt2DL9E2y2.mp3" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ") returned 1 [0061.934] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\") returned="" [0061.934] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Decryption INFO.html" [0061.934] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\decryption info.html")) returned 0x20 [0061.934] GetProcessHeap () returned 0x630000 [0061.934] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645f98 | out: hHeap=0x630000) returned 1 [0061.934] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15f35ca0, ftCreationTime.dwHighDateTime=0x1d5c85a, ftLastAccessTime.dwLowDateTime=0x3b030810, ftLastAccessTime.dwHighDateTime=0x1d5d287, ftLastWriteTime.dwLowDateTime=0x3b030810, ftLastWriteTime.dwHighDateTime=0x1d5d287, nFileSizeHigh=0x0, nFileSizeLow=0x14cca, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9GG-gkrGgGpt1O.wav", cAlternateFileName="9GG-GK~1.WAV")) returned 1 [0061.935] lstrcmpiW (lpString1="9GG-gkrGgGpt1O.wav", lpString2=".") returned 1 [0061.935] lstrcmpiW (lpString1="9GG-gkrGgGpt1O.wav", lpString2="..") returned 1 [0061.935] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\", lpString2="9GG-gkrGgGpt1O.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\9GG-gkrGgGpt1O.wav") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\9GG-gkrGgGpt1O.wav" [0061.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="9GG-gkrGgGpt1O.wav", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0061.935] GetProcessHeap () returned 0x630000 [0061.935] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x13) returned 0x645eb8 [0061.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="9GG-gkrGgGpt1O.wav", cchWideChar=-1, lpMultiByteStr=0x645eb8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9GG-gkrGgGpt1O.wav", lpUsedDefaultChar=0x0) returned 19 [0061.935] lstrlenA (lpString="9GG-gkrGgGpt1O.wav") returned 18 [0061.935] lstrlenA (lpString=".happythreechoose") returned 17 [0061.935] lstrlenA (lpString=".happythreechoose") returned 17 [0061.935] lstrlenA (lpString="9GG-gkrGgGpt1O.wav") returned 18 [0061.935] lstrcmpiA (lpString1="GG-gkrGgGpt1O.wav", lpString2=".happythreechoose") returned 1 [0061.935] lstrcmpiW (lpString1="9GG-gkrGgGpt1O.wav", lpString2="Decryption INFO.html") returned -1 [0061.935] lstrcmpiW (lpString1="9GG-gkrGgGpt1O.wav", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0061.935] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0061.935] lstrcmpiW (lpString1="9GG-gkrGgGpt1O.wav", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0061.935] GetProcessHeap () returned 0x630000 [0061.935] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651ec0 [0061.935] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\9GG-gkrGgGpt1O.wav" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\9gg-gkrgggpt1o.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0061.935] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=85194) returned 1 [0061.935] GetProcessHeap () returned 0x630000 [0061.935] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6556e8 [0061.935] GetProcessHeap () returned 0x630000 [0061.935] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0061.935] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\9GG-gkrGgGpt1O.wav") returned 61 [0061.935] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.935] GetProcessHeap () returned 0x630000 [0061.935] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0061.935] GetProcessHeap () returned 0x630000 [0061.936] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x386) returned 0x6591d0 [0061.936] lstrlenA (lpString="rsa_encrypt") returned 11 [0061.936] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0061.936] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0061.936] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0061.936] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0061.936] GetProcessHeap () returned 0x630000 [0061.936] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0061.936] lstrlenA (lpString="010001") returned 6 [0061.936] GetProcessHeap () returned 0x630000 [0061.936] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0061.936] GetProcessHeap () returned 0x630000 [0061.936] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.936] GetProcessHeap () returned 0x630000 [0061.936] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea90 [0061.936] GetProcessHeap () returned 0x630000 [0061.936] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.937] GetProcessHeap () returned 0x630000 [0061.937] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e3d0 [0061.937] GetProcessHeap () returned 0x630000 [0061.937] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657440 [0061.937] GetProcessHeap () returned 0x630000 [0061.937] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a318 [0061.937] GetProcessHeap () returned 0x630000 [0061.937] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0061.937] GetProcessHeap () returned 0x630000 [0061.937] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.937] GetProcessHeap () returned 0x630000 [0061.937] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0061.937] GetProcessHeap () returned 0x630000 [0061.937] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.937] GetProcessHeap () returned 0x630000 [0061.937] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657210 [0061.937] GetProcessHeap () returned 0x630000 [0061.937] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.937] GetProcessHeap () returned 0x630000 [0061.937] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0061.937] GetProcessHeap () returned 0x630000 [0061.937] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ecd0 [0061.937] GetProcessHeap () returned 0x630000 [0061.937] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.937] GetProcessHeap () returned 0x630000 [0061.937] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0061.937] GetProcessHeap () returned 0x630000 [0061.937] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ecd0 | out: hHeap=0x630000) returned 1 [0061.937] GetProcessHeap () returned 0x630000 [0061.937] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.937] GetProcessHeap () returned 0x630000 [0061.937] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0061.937] GetProcessHeap () returned 0x630000 [0061.937] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.937] GetProcessHeap () returned 0x630000 [0061.937] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.937] GetProcessHeap () returned 0x630000 [0061.937] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.937] GetProcessHeap () returned 0x630000 [0061.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.938] GetProcessHeap () returned 0x630000 [0061.938] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e190 [0061.938] GetProcessHeap () returned 0x630000 [0061.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0061.938] GetProcessHeap () returned 0x630000 [0061.938] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0061.938] GetProcessHeap () returned 0x630000 [0061.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0061.938] GetProcessHeap () returned 0x630000 [0061.938] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.938] GetProcessHeap () returned 0x630000 [0061.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.938] GetProcessHeap () returned 0x630000 [0061.938] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.938] GetProcessHeap () returned 0x630000 [0061.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.938] GetProcessHeap () returned 0x630000 [0061.938] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.938] GetProcessHeap () returned 0x630000 [0061.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.938] GetProcessHeap () returned 0x630000 [0061.938] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.938] GetProcessHeap () returned 0x630000 [0061.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.938] GetProcessHeap () returned 0x630000 [0061.938] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.938] GetProcessHeap () returned 0x630000 [0061.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.938] GetProcessHeap () returned 0x630000 [0061.938] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.938] GetProcessHeap () returned 0x630000 [0061.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.938] GetProcessHeap () returned 0x630000 [0061.938] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.938] GetProcessHeap () returned 0x630000 [0061.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.939] GetProcessHeap () returned 0x630000 [0061.939] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.939] GetProcessHeap () returned 0x630000 [0061.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.939] GetProcessHeap () returned 0x630000 [0061.939] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.939] GetProcessHeap () returned 0x630000 [0061.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.939] GetProcessHeap () returned 0x630000 [0061.939] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.939] GetProcessHeap () returned 0x630000 [0061.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.939] GetProcessHeap () returned 0x630000 [0061.939] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.939] GetProcessHeap () returned 0x630000 [0061.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.939] GetProcessHeap () returned 0x630000 [0061.939] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.939] GetProcessHeap () returned 0x630000 [0061.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.939] GetProcessHeap () returned 0x630000 [0061.939] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.939] GetProcessHeap () returned 0x630000 [0061.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.939] GetProcessHeap () returned 0x630000 [0061.939] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.939] GetProcessHeap () returned 0x630000 [0061.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.939] GetProcessHeap () returned 0x630000 [0061.939] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.939] GetProcessHeap () returned 0x630000 [0061.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.939] GetProcessHeap () returned 0x630000 [0061.939] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.939] GetProcessHeap () returned 0x630000 [0061.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.939] GetProcessHeap () returned 0x630000 [0061.940] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.940] GetProcessHeap () returned 0x630000 [0061.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.940] GetProcessHeap () returned 0x630000 [0061.940] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.940] GetProcessHeap () returned 0x630000 [0061.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.940] GetProcessHeap () returned 0x630000 [0061.940] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.940] GetProcessHeap () returned 0x630000 [0061.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.940] GetProcessHeap () returned 0x630000 [0061.940] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.940] GetProcessHeap () returned 0x630000 [0061.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.940] GetProcessHeap () returned 0x630000 [0061.940] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.940] GetProcessHeap () returned 0x630000 [0061.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.940] GetProcessHeap () returned 0x630000 [0061.940] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.940] GetProcessHeap () returned 0x630000 [0061.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.940] GetProcessHeap () returned 0x630000 [0061.940] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.940] GetProcessHeap () returned 0x630000 [0061.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.940] GetProcessHeap () returned 0x630000 [0061.940] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.940] GetProcessHeap () returned 0x630000 [0061.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.940] GetProcessHeap () returned 0x630000 [0061.940] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.940] GetProcessHeap () returned 0x630000 [0061.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.940] GetProcessHeap () returned 0x630000 [0061.940] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.941] GetProcessHeap () returned 0x630000 [0061.941] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.941] GetProcessHeap () returned 0x630000 [0061.941] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.941] GetProcessHeap () returned 0x630000 [0061.941] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.941] GetProcessHeap () returned 0x630000 [0061.941] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.941] GetProcessHeap () returned 0x630000 [0061.941] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.941] GetProcessHeap () returned 0x630000 [0061.941] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.941] GetProcessHeap () returned 0x630000 [0061.941] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.941] GetProcessHeap () returned 0x630000 [0061.941] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0061.941] GetProcessHeap () returned 0x630000 [0061.941] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0061.941] GetProcessHeap () returned 0x630000 [0061.941] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.941] GetProcessHeap () returned 0x630000 [0061.941] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.941] GetProcessHeap () returned 0x630000 [0061.941] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.941] GetProcessHeap () returned 0x630000 [0061.941] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.941] GetProcessHeap () returned 0x630000 [0061.941] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.941] GetProcessHeap () returned 0x630000 [0061.941] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.941] GetProcessHeap () returned 0x630000 [0061.941] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.941] GetProcessHeap () returned 0x630000 [0061.941] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.941] GetProcessHeap () returned 0x630000 [0061.941] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.941] GetProcessHeap () returned 0x630000 [0061.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.942] GetProcessHeap () returned 0x630000 [0061.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.942] GetProcessHeap () returned 0x630000 [0061.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.942] GetProcessHeap () returned 0x630000 [0061.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.942] GetProcessHeap () returned 0x630000 [0061.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.942] GetProcessHeap () returned 0x630000 [0061.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.942] GetProcessHeap () returned 0x630000 [0061.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.942] GetProcessHeap () returned 0x630000 [0061.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.942] GetProcessHeap () returned 0x630000 [0061.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.942] GetProcessHeap () returned 0x630000 [0061.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.942] GetProcessHeap () returned 0x630000 [0061.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.942] GetProcessHeap () returned 0x630000 [0061.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.942] GetProcessHeap () returned 0x630000 [0061.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.942] GetProcessHeap () returned 0x630000 [0061.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0061.942] GetProcessHeap () returned 0x630000 [0061.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0061.942] GetProcessHeap () returned 0x630000 [0061.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0061.942] GetProcessHeap () returned 0x630000 [0061.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0061.942] GetProcessHeap () returned 0x630000 [0061.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0061.942] GetProcessHeap () returned 0x630000 [0061.943] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0061.943] GetProcessHeap () returned 0x630000 [0061.943] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0061.943] GetProcessHeap () returned 0x630000 [0061.943] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea90 | out: hHeap=0x630000) returned 1 [0061.943] GetProcessHeap () returned 0x630000 [0061.943] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0061.943] GetProcessHeap () returned 0x630000 [0061.943] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.943] GetProcessHeap () returned 0x630000 [0061.943] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0061.943] WriteFile (in: hFile=0x230, lpBuffer=0x6591d0*, nNumberOfBytesToWrite=0x386, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6591d0*, lpNumberOfBytesWritten=0x243d864*=0x386, lpOverlapped=0x0) returned 1 [0061.950] GetProcessHeap () returned 0x630000 [0061.950] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6591d0, Size=0x30) returned 0x6591d0 [0061.950] GetProcessHeap () returned 0x630000 [0061.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0061.950] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.950] GetProcessHeap () returned 0x630000 [0061.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14cd0) returned 0x671bf0 [0061.950] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0x14cd0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0x14cd0, lpOverlapped=0x0) returned 1 [0061.951] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0061.951] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x14cd0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0x14cd0, lpOverlapped=0x0) returned 1 [0061.955] GetProcessHeap () returned 0x630000 [0061.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0061.957] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.957] WriteFile (in: hFile=0x230, lpBuffer=0x6591d0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6591d0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0061.957] CloseHandle (hObject=0x230) returned 1 [0061.966] GetProcessHeap () returned 0x630000 [0061.966] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651ec0 | out: hHeap=0x630000) returned 1 [0061.966] GetProcessHeap () returned 0x630000 [0061.966] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6556e8 | out: hHeap=0x630000) returned 1 [0061.966] GetProcessHeap () returned 0x630000 [0061.966] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0061.966] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\9GG-gkrGgGpt1O.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\9GG-gkrGgGpt1O.wav") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\9GG-gkrGgGpt1O.wav" [0061.966] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\9GG-gkrGgGpt1O.wav", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\9GG-gkrGgGpt1O.wav.happythreechoose") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\9GG-gkrGgGpt1O.wav.happythreechoose" [0061.966] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\9GG-gkrGgGpt1O.wav" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\9gg-gkrgggpt1o.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\9GG-gkrGgGpt1O.wav.happythreechoose" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\9gg-gkrgggpt1o.wav.happythreechoose"), dwFlags=0x1) returned 1 [0061.967] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\9GG-gkrGgGpt1O.wav" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ") returned 1 [0061.967] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\") returned="" [0061.967] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Decryption INFO.html" [0061.967] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\decryption info.html")) returned 0x20 [0061.967] GetProcessHeap () returned 0x630000 [0061.967] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645eb8 | out: hHeap=0x630000) returned 1 [0061.967] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42521fc0, ftCreationTime.dwHighDateTime=0x1d5d07f, ftLastAccessTime.dwLowDateTime=0xef1680, ftLastAccessTime.dwHighDateTime=0x1d5cfa5, ftLastWriteTime.dwLowDateTime=0xef1680, ftLastWriteTime.dwHighDateTime=0x1d5cfa5, nFileSizeHigh=0x0, nFileSizeLow=0x13f7d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9y2 lNdwtrKndUdr.m4a", cAlternateFileName="9Y2LND~1.M4A")) returned 1 [0061.967] lstrcmpiW (lpString1="9y2 lNdwtrKndUdr.m4a", lpString2=".") returned 1 [0061.967] lstrcmpiW (lpString1="9y2 lNdwtrKndUdr.m4a", lpString2="..") returned 1 [0061.967] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\", lpString2="9y2 lNdwtrKndUdr.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\9y2 lNdwtrKndUdr.m4a") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\9y2 lNdwtrKndUdr.m4a" [0061.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="9y2 lNdwtrKndUdr.m4a", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0061.967] GetProcessHeap () returned 0x630000 [0061.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x15) returned 0x645e58 [0061.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="9y2 lNdwtrKndUdr.m4a", cchWideChar=-1, lpMultiByteStr=0x645e58, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9y2 lNdwtrKndUdr.m4a", lpUsedDefaultChar=0x0) returned 21 [0061.967] lstrlenA (lpString="9y2 lNdwtrKndUdr.m4a") returned 20 [0061.967] lstrlenA (lpString=".happythreechoose") returned 17 [0061.967] lstrlenA (lpString=".happythreechoose") returned 17 [0061.967] lstrlenA (lpString="9y2 lNdwtrKndUdr.m4a") returned 20 [0061.967] lstrcmpiA (lpString1=" lNdwtrKndUdr.m4a", lpString2=".happythreechoose") returned -1 [0061.967] lstrcmpiW (lpString1="9y2 lNdwtrKndUdr.m4a", lpString2="Decryption INFO.html") returned -1 [0061.968] lstrcmpiW (lpString1="9y2 lNdwtrKndUdr.m4a", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0061.968] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0061.968] lstrcmpiW (lpString1="9y2 lNdwtrKndUdr.m4a", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0061.968] GetProcessHeap () returned 0x630000 [0061.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0061.968] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\9y2 lNdwtrKndUdr.m4a" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\9y2 lndwtrkndudr.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0061.968] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=81789) returned 1 [0061.968] GetProcessHeap () returned 0x630000 [0061.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655a30 [0061.968] GetProcessHeap () returned 0x630000 [0061.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0061.968] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\9y2 lNdwtrKndUdr.m4a") returned 63 [0061.968] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0061.968] GetProcessHeap () returned 0x630000 [0061.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0061.968] GetProcessHeap () returned 0x630000 [0061.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x659208 [0061.968] lstrlenA (lpString="rsa_encrypt") returned 11 [0061.968] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0061.969] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0061.969] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0061.969] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0061.969] GetProcessHeap () returned 0x630000 [0061.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0061.969] lstrlenA (lpString="010001") returned 6 [0061.969] GetProcessHeap () returned 0x630000 [0061.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0061.969] GetProcessHeap () returned 0x630000 [0061.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.969] GetProcessHeap () returned 0x630000 [0061.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e7c0 [0061.969] GetProcessHeap () returned 0x630000 [0061.969] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.969] GetProcessHeap () returned 0x630000 [0061.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0061.969] GetProcessHeap () returned 0x630000 [0061.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656950 [0061.969] GetProcessHeap () returned 0x630000 [0061.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a318 [0061.969] GetProcessHeap () returned 0x630000 [0061.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0061.969] GetProcessHeap () returned 0x630000 [0061.969] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.969] GetProcessHeap () returned 0x630000 [0061.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0061.969] GetProcessHeap () returned 0x630000 [0061.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0061.970] GetProcessHeap () returned 0x630000 [0061.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656db0 [0061.970] GetProcessHeap () returned 0x630000 [0061.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.970] GetProcessHeap () returned 0x630000 [0061.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0061.970] GetProcessHeap () returned 0x630000 [0061.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0061.970] GetProcessHeap () returned 0x630000 [0061.970] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0061.970] GetProcessHeap () returned 0x630000 [0061.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0061.970] GetProcessHeap () returned 0x630000 [0061.970] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0061.970] GetProcessHeap () returned 0x630000 [0061.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.970] GetProcessHeap () returned 0x630000 [0061.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0061.970] GetProcessHeap () returned 0x630000 [0061.970] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.970] GetProcessHeap () returned 0x630000 [0061.970] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.970] GetProcessHeap () returned 0x630000 [0061.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.970] GetProcessHeap () returned 0x630000 [0061.970] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.970] GetProcessHeap () returned 0x630000 [0061.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e190 [0061.970] GetProcessHeap () returned 0x630000 [0061.970] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0061.970] GetProcessHeap () returned 0x630000 [0061.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0061.970] GetProcessHeap () returned 0x630000 [0061.970] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0061.970] GetProcessHeap () returned 0x630000 [0061.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.970] GetProcessHeap () returned 0x630000 [0061.970] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.971] GetProcessHeap () returned 0x630000 [0061.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.971] GetProcessHeap () returned 0x630000 [0061.971] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.971] GetProcessHeap () returned 0x630000 [0061.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.971] GetProcessHeap () returned 0x630000 [0061.971] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.971] GetProcessHeap () returned 0x630000 [0061.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.971] GetProcessHeap () returned 0x630000 [0061.971] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.971] GetProcessHeap () returned 0x630000 [0061.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0061.971] GetProcessHeap () returned 0x630000 [0061.971] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0061.971] GetProcessHeap () returned 0x630000 [0061.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.971] GetProcessHeap () returned 0x630000 [0061.971] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.971] GetProcessHeap () returned 0x630000 [0061.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.971] GetProcessHeap () returned 0x630000 [0061.971] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.971] GetProcessHeap () returned 0x630000 [0061.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.971] GetProcessHeap () returned 0x630000 [0061.971] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.971] GetProcessHeap () returned 0x630000 [0061.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.971] GetProcessHeap () returned 0x630000 [0061.971] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.971] GetProcessHeap () returned 0x630000 [0061.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.971] GetProcessHeap () returned 0x630000 [0061.971] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.971] GetProcessHeap () returned 0x630000 [0061.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.971] GetProcessHeap () returned 0x630000 [0061.972] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.972] GetProcessHeap () returned 0x630000 [0061.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.972] GetProcessHeap () returned 0x630000 [0061.972] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.972] GetProcessHeap () returned 0x630000 [0061.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.972] GetProcessHeap () returned 0x630000 [0061.972] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.972] GetProcessHeap () returned 0x630000 [0061.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0061.972] GetProcessHeap () returned 0x630000 [0061.972] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0061.972] GetProcessHeap () returned 0x630000 [0061.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.972] GetProcessHeap () returned 0x630000 [0061.972] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.972] GetProcessHeap () returned 0x630000 [0061.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.972] GetProcessHeap () returned 0x630000 [0061.972] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.972] GetProcessHeap () returned 0x630000 [0061.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.972] GetProcessHeap () returned 0x630000 [0061.972] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.972] GetProcessHeap () returned 0x630000 [0061.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.972] GetProcessHeap () returned 0x630000 [0061.972] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.972] GetProcessHeap () returned 0x630000 [0061.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.972] GetProcessHeap () returned 0x630000 [0061.972] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.972] GetProcessHeap () returned 0x630000 [0061.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.972] GetProcessHeap () returned 0x630000 [0061.972] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.973] GetProcessHeap () returned 0x630000 [0061.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.973] GetProcessHeap () returned 0x630000 [0061.973] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.973] GetProcessHeap () returned 0x630000 [0061.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.973] GetProcessHeap () returned 0x630000 [0061.973] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.973] GetProcessHeap () returned 0x630000 [0061.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.973] GetProcessHeap () returned 0x630000 [0061.973] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.973] GetProcessHeap () returned 0x630000 [0061.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.973] GetProcessHeap () returned 0x630000 [0061.973] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.973] GetProcessHeap () returned 0x630000 [0061.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.973] GetProcessHeap () returned 0x630000 [0061.973] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.973] GetProcessHeap () returned 0x630000 [0061.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.973] GetProcessHeap () returned 0x630000 [0061.973] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.973] GetProcessHeap () returned 0x630000 [0061.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.973] GetProcessHeap () returned 0x630000 [0061.973] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.973] GetProcessHeap () returned 0x630000 [0061.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.973] GetProcessHeap () returned 0x630000 [0061.973] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.973] GetProcessHeap () returned 0x630000 [0061.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.973] GetProcessHeap () returned 0x630000 [0061.973] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.973] GetProcessHeap () returned 0x630000 [0061.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.974] GetProcessHeap () returned 0x630000 [0061.974] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.974] GetProcessHeap () returned 0x630000 [0061.974] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.974] GetProcessHeap () returned 0x630000 [0061.974] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.974] GetProcessHeap () returned 0x630000 [0061.974] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.974] GetProcessHeap () returned 0x630000 [0061.974] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.974] GetProcessHeap () returned 0x630000 [0061.974] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.974] GetProcessHeap () returned 0x630000 [0061.974] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.974] GetProcessHeap () returned 0x630000 [0061.974] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.974] GetProcessHeap () returned 0x630000 [0061.974] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.974] GetProcessHeap () returned 0x630000 [0061.974] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.974] GetProcessHeap () returned 0x630000 [0061.974] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.974] GetProcessHeap () returned 0x630000 [0061.974] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.974] GetProcessHeap () returned 0x630000 [0061.974] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.974] GetProcessHeap () returned 0x630000 [0061.974] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.974] GetProcessHeap () returned 0x630000 [0061.974] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.974] GetProcessHeap () returned 0x630000 [0061.974] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0061.974] GetProcessHeap () returned 0x630000 [0061.974] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0061.974] GetProcessHeap () returned 0x630000 [0061.974] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0061.974] GetProcessHeap () returned 0x630000 [0061.974] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0061.975] GetProcessHeap () returned 0x630000 [0061.975] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0061.975] GetProcessHeap () returned 0x630000 [0061.975] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0061.975] GetProcessHeap () returned 0x630000 [0061.975] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0061.975] GetProcessHeap () returned 0x630000 [0061.975] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0061.975] GetProcessHeap () returned 0x630000 [0061.975] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0061.975] GetProcessHeap () returned 0x630000 [0061.975] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0061.975] GetProcessHeap () returned 0x630000 [0061.975] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0061.975] GetProcessHeap () returned 0x630000 [0061.975] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0061.975] GetProcessHeap () returned 0x630000 [0061.975] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0061.975] GetProcessHeap () returned 0x630000 [0061.975] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0061.975] GetProcessHeap () returned 0x630000 [0061.975] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0061.975] GetProcessHeap () returned 0x630000 [0061.975] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e7c0 | out: hHeap=0x630000) returned 1 [0061.975] GetProcessHeap () returned 0x630000 [0061.975] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0061.975] GetProcessHeap () returned 0x630000 [0061.975] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0061.975] GetProcessHeap () returned 0x630000 [0061.975] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0061.975] WriteFile (in: hFile=0x230, lpBuffer=0x659208*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659208*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0062.059] GetProcessHeap () returned 0x630000 [0062.059] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659208, Size=0x30) returned 0x659208 [0062.059] GetProcessHeap () returned 0x630000 [0062.059] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0062.059] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0062.059] GetProcessHeap () returned 0x630000 [0062.059] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x13f7d) returned 0x671bf0 [0062.061] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0x13f7d, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0x13f7d, lpOverlapped=0x0) returned 1 [0062.062] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0062.062] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x13f7d, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0x13f7d, lpOverlapped=0x0) returned 1 [0062.064] GetProcessHeap () returned 0x630000 [0062.064] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0062.065] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0062.065] WriteFile (in: hFile=0x230, lpBuffer=0x659208*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659208*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0062.066] CloseHandle (hObject=0x230) returned 1 [0062.069] GetProcessHeap () returned 0x630000 [0062.069] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0062.069] GetProcessHeap () returned 0x630000 [0062.069] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655a30 | out: hHeap=0x630000) returned 1 [0062.069] GetProcessHeap () returned 0x630000 [0062.069] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0062.069] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\9y2 lNdwtrKndUdr.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\9y2 lNdwtrKndUdr.m4a") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\9y2 lNdwtrKndUdr.m4a" [0062.069] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\9y2 lNdwtrKndUdr.m4a", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\9y2 lNdwtrKndUdr.m4a.happythreechoose") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\9y2 lNdwtrKndUdr.m4a.happythreechoose" [0062.069] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\9y2 lNdwtrKndUdr.m4a" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\9y2 lndwtrkndudr.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\9y2 lNdwtrKndUdr.m4a.happythreechoose" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\9y2 lndwtrkndudr.m4a.happythreechoose"), dwFlags=0x1) returned 1 [0062.071] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\9y2 lNdwtrKndUdr.m4a" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ") returned 1 [0062.071] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\") returned="" [0062.071] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Decryption INFO.html" [0062.071] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\decryption info.html")) returned 0x20 [0062.071] GetProcessHeap () returned 0x630000 [0062.071] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645e58 | out: hHeap=0x630000) returned 1 [0062.071] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe94dfcf0, ftCreationTime.dwHighDateTime=0x1d5cc50, ftLastAccessTime.dwLowDateTime=0x3edcfbf0, ftLastAccessTime.dwHighDateTime=0x1d5cbfa, ftLastWriteTime.dwLowDateTime=0x3edcfbf0, ftLastWriteTime.dwHighDateTime=0x1d5cbfa, nFileSizeHigh=0x0, nFileSizeLow=0xb297, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="b50kcKwk0tsa.mp3", cAlternateFileName="B50KCK~1.MP3")) returned 1 [0062.071] lstrcmpiW (lpString1="b50kcKwk0tsa.mp3", lpString2=".") returned 1 [0062.071] lstrcmpiW (lpString1="b50kcKwk0tsa.mp3", lpString2="..") returned 1 [0062.071] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\", lpString2="b50kcKwk0tsa.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\b50kcKwk0tsa.mp3") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\b50kcKwk0tsa.mp3" [0062.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b50kcKwk0tsa.mp3", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0062.071] GetProcessHeap () returned 0x630000 [0062.071] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11) returned 0x645c58 [0062.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b50kcKwk0tsa.mp3", cchWideChar=-1, lpMultiByteStr=0x645c58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b50kcKwk0tsa.mp3", lpUsedDefaultChar=0x0) returned 17 [0062.071] lstrlenA (lpString="b50kcKwk0tsa.mp3") returned 16 [0062.071] lstrlenA (lpString=".happythreechoose") returned 17 [0062.071] lstrcmpiW (lpString1="b50kcKwk0tsa.mp3", lpString2="Decryption INFO.html") returned -1 [0062.071] lstrcmpiW (lpString1="b50kcKwk0tsa.mp3", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0062.071] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0062.072] lstrcmpiW (lpString1="b50kcKwk0tsa.mp3", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0062.072] GetProcessHeap () returned 0x630000 [0062.072] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x652000 [0062.072] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\b50kcKwk0tsa.mp3" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\b50kckwk0tsa.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0062.072] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=45719) returned 1 [0062.072] GetProcessHeap () returned 0x630000 [0062.072] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655508 [0062.072] GetProcessHeap () returned 0x630000 [0062.072] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0062.072] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\b50kcKwk0tsa.mp3") returned 59 [0062.072] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0062.072] GetProcessHeap () returned 0x630000 [0062.072] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0062.072] GetProcessHeap () returned 0x630000 [0062.072] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x659240 [0062.072] lstrlenA (lpString="rsa_encrypt") returned 11 [0062.072] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0062.073] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0062.073] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0062.073] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0062.073] GetProcessHeap () returned 0x630000 [0062.073] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0062.073] lstrlenA (lpString="010001") returned 6 [0062.073] GetProcessHeap () returned 0x630000 [0062.073] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0062.073] GetProcessHeap () returned 0x630000 [0062.073] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0062.073] GetProcessHeap () returned 0x630000 [0062.073] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e7c0 [0062.073] GetProcessHeap () returned 0x630000 [0062.073] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0062.073] GetProcessHeap () returned 0x630000 [0062.073] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dfe0 [0062.073] GetProcessHeap () returned 0x630000 [0062.073] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657328 [0062.073] GetProcessHeap () returned 0x630000 [0062.073] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0062.073] GetProcessHeap () returned 0x630000 [0062.073] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0062.073] GetProcessHeap () returned 0x630000 [0062.073] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.073] GetProcessHeap () returned 0x630000 [0062.073] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0062.073] GetProcessHeap () returned 0x630000 [0062.073] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0062.073] GetProcessHeap () returned 0x630000 [0062.073] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656950 [0062.074] GetProcessHeap () returned 0x630000 [0062.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.074] GetProcessHeap () returned 0x630000 [0062.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0062.074] GetProcessHeap () returned 0x630000 [0062.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65eb20 [0062.074] GetProcessHeap () returned 0x630000 [0062.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0062.074] GetProcessHeap () returned 0x630000 [0062.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0062.074] GetProcessHeap () returned 0x630000 [0062.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0062.074] GetProcessHeap () returned 0x630000 [0062.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.074] GetProcessHeap () returned 0x630000 [0062.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0062.074] GetProcessHeap () returned 0x630000 [0062.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.074] GetProcessHeap () returned 0x630000 [0062.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.074] GetProcessHeap () returned 0x630000 [0062.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.074] GetProcessHeap () returned 0x630000 [0062.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.074] GetProcessHeap () returned 0x630000 [0062.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65eb20 [0062.074] GetProcessHeap () returned 0x630000 [0062.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0062.074] GetProcessHeap () returned 0x630000 [0062.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0062.074] GetProcessHeap () returned 0x630000 [0062.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0062.074] GetProcessHeap () returned 0x630000 [0062.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.074] GetProcessHeap () returned 0x630000 [0062.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.074] GetProcessHeap () returned 0x630000 [0062.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.075] GetProcessHeap () returned 0x630000 [0062.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.075] GetProcessHeap () returned 0x630000 [0062.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.075] GetProcessHeap () returned 0x630000 [0062.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.075] GetProcessHeap () returned 0x630000 [0062.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.075] GetProcessHeap () returned 0x630000 [0062.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.075] GetProcessHeap () returned 0x630000 [0062.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.075] GetProcessHeap () returned 0x630000 [0062.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.075] GetProcessHeap () returned 0x630000 [0062.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.075] GetProcessHeap () returned 0x630000 [0062.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.075] GetProcessHeap () returned 0x630000 [0062.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.075] GetProcessHeap () returned 0x630000 [0062.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.075] GetProcessHeap () returned 0x630000 [0062.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.075] GetProcessHeap () returned 0x630000 [0062.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.075] GetProcessHeap () returned 0x630000 [0062.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.075] GetProcessHeap () returned 0x630000 [0062.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.075] GetProcessHeap () returned 0x630000 [0062.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.075] GetProcessHeap () returned 0x630000 [0062.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.075] GetProcessHeap () returned 0x630000 [0062.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.076] GetProcessHeap () returned 0x630000 [0062.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.076] GetProcessHeap () returned 0x630000 [0062.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.076] GetProcessHeap () returned 0x630000 [0062.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.076] GetProcessHeap () returned 0x630000 [0062.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.076] GetProcessHeap () returned 0x630000 [0062.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.076] GetProcessHeap () returned 0x630000 [0062.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.076] GetProcessHeap () returned 0x630000 [0062.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.076] GetProcessHeap () returned 0x630000 [0062.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.076] GetProcessHeap () returned 0x630000 [0062.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.076] GetProcessHeap () returned 0x630000 [0062.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.076] GetProcessHeap () returned 0x630000 [0062.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.076] GetProcessHeap () returned 0x630000 [0062.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.076] GetProcessHeap () returned 0x630000 [0062.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.076] GetProcessHeap () returned 0x630000 [0062.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.076] GetProcessHeap () returned 0x630000 [0062.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.076] GetProcessHeap () returned 0x630000 [0062.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.076] GetProcessHeap () returned 0x630000 [0062.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.076] GetProcessHeap () returned 0x630000 [0062.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.076] GetProcessHeap () returned 0x630000 [0062.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.077] GetProcessHeap () returned 0x630000 [0062.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.077] GetProcessHeap () returned 0x630000 [0062.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.077] GetProcessHeap () returned 0x630000 [0062.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.077] GetProcessHeap () returned 0x630000 [0062.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.077] GetProcessHeap () returned 0x630000 [0062.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.077] GetProcessHeap () returned 0x630000 [0062.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.077] GetProcessHeap () returned 0x630000 [0062.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.077] GetProcessHeap () returned 0x630000 [0062.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.077] GetProcessHeap () returned 0x630000 [0062.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0062.077] GetProcessHeap () returned 0x630000 [0062.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0062.077] GetProcessHeap () returned 0x630000 [0062.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.077] GetProcessHeap () returned 0x630000 [0062.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.077] GetProcessHeap () returned 0x630000 [0062.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.077] GetProcessHeap () returned 0x630000 [0062.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.077] GetProcessHeap () returned 0x630000 [0062.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.077] GetProcessHeap () returned 0x630000 [0062.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.077] GetProcessHeap () returned 0x630000 [0062.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.077] GetProcessHeap () returned 0x630000 [0062.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.077] GetProcessHeap () returned 0x630000 [0062.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0062.078] GetProcessHeap () returned 0x630000 [0062.078] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0062.078] GetProcessHeap () returned 0x630000 [0062.078] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.078] GetProcessHeap () returned 0x630000 [0062.078] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.078] GetProcessHeap () returned 0x630000 [0062.078] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.078] GetProcessHeap () returned 0x630000 [0062.078] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.078] GetProcessHeap () returned 0x630000 [0062.078] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.078] GetProcessHeap () returned 0x630000 [0062.078] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.078] GetProcessHeap () returned 0x630000 [0062.078] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.078] GetProcessHeap () returned 0x630000 [0062.078] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.078] GetProcessHeap () returned 0x630000 [0062.078] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.078] GetProcessHeap () returned 0x630000 [0062.078] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.078] GetProcessHeap () returned 0x630000 [0062.078] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.078] GetProcessHeap () returned 0x630000 [0062.078] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.078] GetProcessHeap () returned 0x630000 [0062.078] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.078] GetProcessHeap () returned 0x630000 [0062.078] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.078] GetProcessHeap () returned 0x630000 [0062.078] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.078] GetProcessHeap () returned 0x630000 [0062.078] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.078] GetProcessHeap () returned 0x630000 [0062.078] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.078] GetProcessHeap () returned 0x630000 [0062.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.079] GetProcessHeap () returned 0x630000 [0062.079] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.079] GetProcessHeap () returned 0x630000 [0062.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.079] GetProcessHeap () returned 0x630000 [0062.079] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.079] GetProcessHeap () returned 0x630000 [0062.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.079] GetProcessHeap () returned 0x630000 [0062.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0062.079] GetProcessHeap () returned 0x630000 [0062.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0062.079] GetProcessHeap () returned 0x630000 [0062.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0062.079] GetProcessHeap () returned 0x630000 [0062.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0062.079] GetProcessHeap () returned 0x630000 [0062.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0062.079] GetProcessHeap () returned 0x630000 [0062.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0062.079] GetProcessHeap () returned 0x630000 [0062.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0062.079] GetProcessHeap () returned 0x630000 [0062.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e7c0 | out: hHeap=0x630000) returned 1 [0062.079] GetProcessHeap () returned 0x630000 [0062.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0062.079] GetProcessHeap () returned 0x630000 [0062.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.079] GetProcessHeap () returned 0x630000 [0062.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0062.079] WriteFile (in: hFile=0x230, lpBuffer=0x659240*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659240*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0062.112] GetProcessHeap () returned 0x630000 [0062.112] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659240, Size=0x30) returned 0x659240 [0062.112] GetProcessHeap () returned 0x630000 [0062.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0062.112] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0062.112] GetProcessHeap () returned 0x630000 [0062.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb297) returned 0x671bf0 [0062.114] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0xb297, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0xb297, lpOverlapped=0x0) returned 1 [0062.115] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0062.115] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0xb297, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0xb297, lpOverlapped=0x0) returned 1 [0062.116] GetProcessHeap () returned 0x630000 [0062.116] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0062.116] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0062.116] WriteFile (in: hFile=0x230, lpBuffer=0x659240*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659240*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0062.117] CloseHandle (hObject=0x230) returned 1 [0062.119] GetProcessHeap () returned 0x630000 [0062.119] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x652000 | out: hHeap=0x630000) returned 1 [0062.119] GetProcessHeap () returned 0x630000 [0062.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655508 | out: hHeap=0x630000) returned 1 [0062.120] GetProcessHeap () returned 0x630000 [0062.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0062.120] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\b50kcKwk0tsa.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\b50kcKwk0tsa.mp3") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\b50kcKwk0tsa.mp3" [0062.120] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\b50kcKwk0tsa.mp3", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\b50kcKwk0tsa.mp3.happythreechoose") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\b50kcKwk0tsa.mp3.happythreechoose" [0062.120] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\b50kcKwk0tsa.mp3" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\b50kckwk0tsa.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\b50kcKwk0tsa.mp3.happythreechoose" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\b50kckwk0tsa.mp3.happythreechoose"), dwFlags=0x1) returned 1 [0062.120] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\b50kcKwk0tsa.mp3" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ") returned 1 [0062.120] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\") returned="" [0062.120] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Decryption INFO.html" [0062.120] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\decryption info.html")) returned 0x20 [0062.121] GetProcessHeap () returned 0x630000 [0062.121] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645c58 | out: hHeap=0x630000) returned 1 [0062.121] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2b91680, ftCreationTime.dwHighDateTime=0x1d5d76b, ftLastAccessTime.dwLowDateTime=0xa78fdb30, ftLastAccessTime.dwHighDateTime=0x1d5c8e0, ftLastWriteTime.dwLowDateTime=0xa78fdb30, ftLastWriteTime.dwHighDateTime=0x1d5c8e0, nFileSizeHigh=0x0, nFileSizeLow=0x130d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="CJp9TPmHl-ra8o5Bv.m4a", cAlternateFileName="CJP9TP~1.M4A")) returned 1 [0062.121] lstrcmpiW (lpString1="CJp9TPmHl-ra8o5Bv.m4a", lpString2=".") returned 1 [0062.121] lstrcmpiW (lpString1="CJp9TPmHl-ra8o5Bv.m4a", lpString2="..") returned 1 [0062.121] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\", lpString2="CJp9TPmHl-ra8o5Bv.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\CJp9TPmHl-ra8o5Bv.m4a") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\CJp9TPmHl-ra8o5Bv.m4a" [0062.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CJp9TPmHl-ra8o5Bv.m4a", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0062.121] GetProcessHeap () returned 0x630000 [0062.121] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x645e98 [0062.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CJp9TPmHl-ra8o5Bv.m4a", cchWideChar=-1, lpMultiByteStr=0x645e98, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CJp9TPmHl-ra8o5Bv.m4a", lpUsedDefaultChar=0x0) returned 22 [0062.121] lstrlenA (lpString="CJp9TPmHl-ra8o5Bv.m4a") returned 21 [0062.121] lstrlenA (lpString=".happythreechoose") returned 17 [0062.121] lstrlenA (lpString=".happythreechoose") returned 17 [0062.121] lstrlenA (lpString="CJp9TPmHl-ra8o5Bv.m4a") returned 21 [0062.121] lstrcmpiA (lpString1="TPmHl-ra8o5Bv.m4a", lpString2=".happythreechoose") returned 1 [0062.121] lstrcmpiW (lpString1="CJp9TPmHl-ra8o5Bv.m4a", lpString2="Decryption INFO.html") returned -1 [0062.121] lstrcmpiW (lpString1="CJp9TPmHl-ra8o5Bv.m4a", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0062.121] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0062.121] lstrcmpiW (lpString1="CJp9TPmHl-ra8o5Bv.m4a", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0062.121] GetProcessHeap () returned 0x630000 [0062.121] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0062.121] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\CJp9TPmHl-ra8o5Bv.m4a" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\cjp9tpmhl-ra8o5bv.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0062.121] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=78039) returned 1 [0062.121] GetProcessHeap () returned 0x630000 [0062.121] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655a30 [0062.121] GetProcessHeap () returned 0x630000 [0062.121] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0062.121] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\CJp9TPmHl-ra8o5Bv.m4a") returned 64 [0062.121] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0062.122] GetProcessHeap () returned 0x630000 [0062.122] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0062.122] GetProcessHeap () returned 0x630000 [0062.122] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x659278 [0062.122] lstrlenA (lpString="rsa_encrypt") returned 11 [0062.122] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0062.122] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0062.122] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0062.122] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0062.122] GetProcessHeap () returned 0x630000 [0062.122] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0062.122] lstrlenA (lpString="010001") returned 6 [0062.122] GetProcessHeap () returned 0x630000 [0062.122] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0062.123] GetProcessHeap () returned 0x630000 [0062.123] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0062.123] GetProcessHeap () returned 0x630000 [0062.123] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0062.123] GetProcessHeap () returned 0x630000 [0062.123] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0062.123] GetProcessHeap () returned 0x630000 [0062.123] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65df50 [0062.123] GetProcessHeap () returned 0x630000 [0062.123] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656950 [0062.123] GetProcessHeap () returned 0x630000 [0062.123] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0062.123] GetProcessHeap () returned 0x630000 [0062.123] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0062.123] GetProcessHeap () returned 0x630000 [0062.123] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.123] GetProcessHeap () returned 0x630000 [0062.123] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0062.123] GetProcessHeap () returned 0x630000 [0062.123] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0062.123] GetProcessHeap () returned 0x630000 [0062.123] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x6570f8 [0062.123] GetProcessHeap () returned 0x630000 [0062.123] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.123] GetProcessHeap () returned 0x630000 [0062.123] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0062.123] GetProcessHeap () returned 0x630000 [0062.123] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e3d0 [0062.123] GetProcessHeap () returned 0x630000 [0062.123] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0062.123] GetProcessHeap () returned 0x630000 [0062.123] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0062.123] GetProcessHeap () returned 0x630000 [0062.123] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0062.123] GetProcessHeap () returned 0x630000 [0062.123] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.123] GetProcessHeap () returned 0x630000 [0062.124] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0062.124] GetProcessHeap () returned 0x630000 [0062.124] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.124] GetProcessHeap () returned 0x630000 [0062.124] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.124] GetProcessHeap () returned 0x630000 [0062.124] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.124] GetProcessHeap () returned 0x630000 [0062.124] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.124] GetProcessHeap () returned 0x630000 [0062.124] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65eb20 [0062.124] GetProcessHeap () returned 0x630000 [0062.124] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0062.124] GetProcessHeap () returned 0x630000 [0062.124] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0062.124] GetProcessHeap () returned 0x630000 [0062.124] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0062.124] GetProcessHeap () returned 0x630000 [0062.124] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.124] GetProcessHeap () returned 0x630000 [0062.124] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.124] GetProcessHeap () returned 0x630000 [0062.124] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.124] GetProcessHeap () returned 0x630000 [0062.124] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.124] GetProcessHeap () returned 0x630000 [0062.124] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.124] GetProcessHeap () returned 0x630000 [0062.124] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.124] GetProcessHeap () returned 0x630000 [0062.124] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.124] GetProcessHeap () returned 0x630000 [0062.124] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.124] GetProcessHeap () returned 0x630000 [0062.124] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.124] GetProcessHeap () returned 0x630000 [0062.124] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.124] GetProcessHeap () returned 0x630000 [0062.124] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.125] GetProcessHeap () returned 0x630000 [0062.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.125] GetProcessHeap () returned 0x630000 [0062.125] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.125] GetProcessHeap () returned 0x630000 [0062.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.125] GetProcessHeap () returned 0x630000 [0062.125] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.125] GetProcessHeap () returned 0x630000 [0062.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.125] GetProcessHeap () returned 0x630000 [0062.125] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.125] GetProcessHeap () returned 0x630000 [0062.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.125] GetProcessHeap () returned 0x630000 [0062.125] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.125] GetProcessHeap () returned 0x630000 [0062.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.125] GetProcessHeap () returned 0x630000 [0062.125] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.125] GetProcessHeap () returned 0x630000 [0062.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.125] GetProcessHeap () returned 0x630000 [0062.125] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.125] GetProcessHeap () returned 0x630000 [0062.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.125] GetProcessHeap () returned 0x630000 [0062.125] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.125] GetProcessHeap () returned 0x630000 [0062.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.125] GetProcessHeap () returned 0x630000 [0062.125] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.125] GetProcessHeap () returned 0x630000 [0062.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.125] GetProcessHeap () returned 0x630000 [0062.125] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.126] GetProcessHeap () returned 0x630000 [0062.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.126] GetProcessHeap () returned 0x630000 [0062.126] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.126] GetProcessHeap () returned 0x630000 [0062.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.126] GetProcessHeap () returned 0x630000 [0062.126] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.126] GetProcessHeap () returned 0x630000 [0062.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.126] GetProcessHeap () returned 0x630000 [0062.126] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.126] GetProcessHeap () returned 0x630000 [0062.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.126] GetProcessHeap () returned 0x630000 [0062.126] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.126] GetProcessHeap () returned 0x630000 [0062.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.126] GetProcessHeap () returned 0x630000 [0062.126] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.126] GetProcessHeap () returned 0x630000 [0062.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.126] GetProcessHeap () returned 0x630000 [0062.126] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.126] GetProcessHeap () returned 0x630000 [0062.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.126] GetProcessHeap () returned 0x630000 [0062.126] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.126] GetProcessHeap () returned 0x630000 [0062.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.126] GetProcessHeap () returned 0x630000 [0062.126] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.126] GetProcessHeap () returned 0x630000 [0062.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.126] GetProcessHeap () returned 0x630000 [0062.126] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.126] GetProcessHeap () returned 0x630000 [0062.127] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.127] GetProcessHeap () returned 0x630000 [0062.127] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.127] GetProcessHeap () returned 0x630000 [0062.127] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.127] GetProcessHeap () returned 0x630000 [0062.127] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.127] GetProcessHeap () returned 0x630000 [0062.127] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.127] GetProcessHeap () returned 0x630000 [0062.127] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.127] GetProcessHeap () returned 0x630000 [0062.127] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.127] GetProcessHeap () returned 0x630000 [0062.127] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.127] GetProcessHeap () returned 0x630000 [0062.127] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.127] GetProcessHeap () returned 0x630000 [0062.127] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.127] GetProcessHeap () returned 0x630000 [0062.127] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.127] GetProcessHeap () returned 0x630000 [0062.127] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.127] GetProcessHeap () returned 0x630000 [0062.127] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.127] GetProcessHeap () returned 0x630000 [0062.127] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.127] GetProcessHeap () returned 0x630000 [0062.127] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.127] GetProcessHeap () returned 0x630000 [0062.127] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.127] GetProcessHeap () returned 0x630000 [0062.127] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.128] GetProcessHeap () returned 0x630000 [0062.128] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.128] GetProcessHeap () returned 0x630000 [0062.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.128] GetProcessHeap () returned 0x630000 [0062.128] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.128] GetProcessHeap () returned 0x630000 [0062.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.128] GetProcessHeap () returned 0x630000 [0062.128] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.128] GetProcessHeap () returned 0x630000 [0062.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.128] GetProcessHeap () returned 0x630000 [0062.128] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.128] GetProcessHeap () returned 0x630000 [0062.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.128] GetProcessHeap () returned 0x630000 [0062.128] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.128] GetProcessHeap () returned 0x630000 [0062.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.129] GetProcessHeap () returned 0x630000 [0062.129] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.129] GetProcessHeap () returned 0x630000 [0062.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.129] GetProcessHeap () returned 0x630000 [0062.129] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.129] GetProcessHeap () returned 0x630000 [0062.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.129] GetProcessHeap () returned 0x630000 [0062.129] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.129] GetProcessHeap () returned 0x630000 [0062.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.129] GetProcessHeap () returned 0x630000 [0062.129] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.129] GetProcessHeap () returned 0x630000 [0062.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.129] GetProcessHeap () returned 0x630000 [0062.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0062.129] GetProcessHeap () returned 0x630000 [0062.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0062.129] GetProcessHeap () returned 0x630000 [0062.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0062.129] GetProcessHeap () returned 0x630000 [0062.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0062.129] GetProcessHeap () returned 0x630000 [0062.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0062.129] GetProcessHeap () returned 0x630000 [0062.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0062.129] GetProcessHeap () returned 0x630000 [0062.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0062.129] GetProcessHeap () returned 0x630000 [0062.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0062.129] GetProcessHeap () returned 0x630000 [0062.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0062.129] GetProcessHeap () returned 0x630000 [0062.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.129] GetProcessHeap () returned 0x630000 [0062.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0062.130] WriteFile (in: hFile=0x230, lpBuffer=0x659278*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659278*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0062.151] GetProcessHeap () returned 0x630000 [0062.151] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659278, Size=0x30) returned 0x659278 [0062.151] GetProcessHeap () returned 0x630000 [0062.151] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0062.151] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0062.151] GetProcessHeap () returned 0x630000 [0062.151] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x130d7) returned 0x671bf0 [0062.152] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0x130d7, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0x130d7, lpOverlapped=0x0) returned 1 [0062.153] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0062.153] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x130d7, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0x130d7, lpOverlapped=0x0) returned 1 [0062.155] GetProcessHeap () returned 0x630000 [0062.155] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0062.156] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0062.156] WriteFile (in: hFile=0x230, lpBuffer=0x659278*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659278*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0062.158] CloseHandle (hObject=0x230) returned 1 [0062.161] GetProcessHeap () returned 0x630000 [0062.161] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0062.161] GetProcessHeap () returned 0x630000 [0062.161] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655a30 | out: hHeap=0x630000) returned 1 [0062.161] GetProcessHeap () returned 0x630000 [0062.161] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0062.161] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\CJp9TPmHl-ra8o5Bv.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\CJp9TPmHl-ra8o5Bv.m4a") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\CJp9TPmHl-ra8o5Bv.m4a" [0062.162] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\CJp9TPmHl-ra8o5Bv.m4a", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\CJp9TPmHl-ra8o5Bv.m4a.happythreechoose") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\CJp9TPmHl-ra8o5Bv.m4a.happythreechoose" [0062.162] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\CJp9TPmHl-ra8o5Bv.m4a" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\cjp9tpmhl-ra8o5bv.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\CJp9TPmHl-ra8o5Bv.m4a.happythreechoose" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\cjp9tpmhl-ra8o5bv.m4a.happythreechoose"), dwFlags=0x1) returned 1 [0062.162] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\CJp9TPmHl-ra8o5Bv.m4a" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ") returned 1 [0062.162] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\") returned="" [0062.162] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Decryption INFO.html" [0062.162] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\decryption info.html")) returned 0x20 [0062.162] GetProcessHeap () returned 0x630000 [0062.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645e98 | out: hHeap=0x630000) returned 1 [0062.162] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef789aa0, ftCreationTime.dwHighDateTime=0x1d5cea2, ftLastAccessTime.dwLowDateTime=0x82c3cbe0, ftLastAccessTime.dwHighDateTime=0x1d5cf2f, ftLastWriteTime.dwLowDateTime=0x82c3cbe0, ftLastWriteTime.dwHighDateTime=0x1d5cf2f, nFileSizeHigh=0x0, nFileSizeLow=0x6bd5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="igajY.wav", cAlternateFileName="")) returned 1 [0062.163] lstrcmpiW (lpString1="igajY.wav", lpString2=".") returned 1 [0062.163] lstrcmpiW (lpString1="igajY.wav", lpString2="..") returned 1 [0062.163] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\", lpString2="igajY.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\igajY.wav") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\igajY.wav" [0062.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="igajY.wav", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0062.163] GetProcessHeap () returned 0x630000 [0062.163] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x64c9f0 [0062.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="igajY.wav", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="igajY.wav", lpUsedDefaultChar=0x0) returned 10 [0062.163] lstrlenA (lpString="igajY.wav") returned 9 [0062.163] lstrlenA (lpString=".happythreechoose") returned 17 [0062.163] lstrcmpiW (lpString1="igajY.wav", lpString2="Decryption INFO.html") returned 1 [0062.163] lstrcmpiW (lpString1="igajY.wav", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0062.163] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0062.163] lstrcmpiW (lpString1="igajY.wav", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0062.163] GetProcessHeap () returned 0x630000 [0062.163] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0062.163] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\igajY.wav" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\igajy.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0062.163] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=27605) returned 1 [0062.163] GetProcessHeap () returned 0x630000 [0062.163] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6556e8 [0062.163] GetProcessHeap () returned 0x630000 [0062.163] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0062.163] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\igajY.wav") returned 52 [0062.163] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0062.163] GetProcessHeap () returned 0x630000 [0062.163] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0062.163] GetProcessHeap () returned 0x630000 [0062.163] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x6592b0 [0062.163] lstrlenA (lpString="rsa_encrypt") returned 11 [0062.164] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0062.167] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0062.167] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0062.167] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0062.167] GetProcessHeap () returned 0x630000 [0062.167] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0062.167] lstrlenA (lpString="010001") returned 6 [0062.167] GetProcessHeap () returned 0x630000 [0062.167] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0062.167] GetProcessHeap () returned 0x630000 [0062.167] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0062.168] GetProcessHeap () returned 0x630000 [0062.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e190 [0062.168] GetProcessHeap () returned 0x630000 [0062.168] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0062.168] GetProcessHeap () returned 0x630000 [0062.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e580 [0062.168] GetProcessHeap () returned 0x630000 [0062.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656b80 [0062.168] GetProcessHeap () returned 0x630000 [0062.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a318 [0062.168] GetProcessHeap () returned 0x630000 [0062.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0062.168] GetProcessHeap () returned 0x630000 [0062.168] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.168] GetProcessHeap () returned 0x630000 [0062.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0062.168] GetProcessHeap () returned 0x630000 [0062.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0062.168] GetProcessHeap () returned 0x630000 [0062.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657210 [0062.168] GetProcessHeap () returned 0x630000 [0062.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.168] GetProcessHeap () returned 0x630000 [0062.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0062.168] GetProcessHeap () returned 0x630000 [0062.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0062.168] GetProcessHeap () returned 0x630000 [0062.168] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0062.168] GetProcessHeap () returned 0x630000 [0062.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0062.168] GetProcessHeap () returned 0x630000 [0062.168] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0062.168] GetProcessHeap () returned 0x630000 [0062.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.168] GetProcessHeap () returned 0x630000 [0062.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cd60 [0062.168] GetProcessHeap () returned 0x630000 [0062.168] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.168] GetProcessHeap () returned 0x630000 [0062.168] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.168] GetProcessHeap () returned 0x630000 [0062.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.169] GetProcessHeap () returned 0x630000 [0062.169] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.169] GetProcessHeap () returned 0x630000 [0062.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65de30 [0062.169] GetProcessHeap () returned 0x630000 [0062.169] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cd60 | out: hHeap=0x630000) returned 1 [0062.169] GetProcessHeap () returned 0x630000 [0062.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0062.169] GetProcessHeap () returned 0x630000 [0062.169] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0062.169] GetProcessHeap () returned 0x630000 [0062.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.169] GetProcessHeap () returned 0x630000 [0062.169] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.169] GetProcessHeap () returned 0x630000 [0062.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.169] GetProcessHeap () returned 0x630000 [0062.169] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.169] GetProcessHeap () returned 0x630000 [0062.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.169] GetProcessHeap () returned 0x630000 [0062.169] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.169] GetProcessHeap () returned 0x630000 [0062.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.169] GetProcessHeap () returned 0x630000 [0062.169] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.169] GetProcessHeap () returned 0x630000 [0062.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.169] GetProcessHeap () returned 0x630000 [0062.169] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.169] GetProcessHeap () returned 0x630000 [0062.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.169] GetProcessHeap () returned 0x630000 [0062.169] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.169] GetProcessHeap () returned 0x630000 [0062.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.169] GetProcessHeap () returned 0x630000 [0062.169] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.170] GetProcessHeap () returned 0x630000 [0062.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.170] GetProcessHeap () returned 0x630000 [0062.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.170] GetProcessHeap () returned 0x630000 [0062.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.170] GetProcessHeap () returned 0x630000 [0062.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.170] GetProcessHeap () returned 0x630000 [0062.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.170] GetProcessHeap () returned 0x630000 [0062.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.170] GetProcessHeap () returned 0x630000 [0062.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.170] GetProcessHeap () returned 0x630000 [0062.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.170] GetProcessHeap () returned 0x630000 [0062.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.170] GetProcessHeap () returned 0x630000 [0062.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.170] GetProcessHeap () returned 0x630000 [0062.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.170] GetProcessHeap () returned 0x630000 [0062.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.170] GetProcessHeap () returned 0x630000 [0062.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.170] GetProcessHeap () returned 0x630000 [0062.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.170] GetProcessHeap () returned 0x630000 [0062.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.170] GetProcessHeap () returned 0x630000 [0062.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.170] GetProcessHeap () returned 0x630000 [0062.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.170] GetProcessHeap () returned 0x630000 [0062.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.170] GetProcessHeap () returned 0x630000 [0062.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.171] GetProcessHeap () returned 0x630000 [0062.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.171] GetProcessHeap () returned 0x630000 [0062.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.171] GetProcessHeap () returned 0x630000 [0062.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.171] GetProcessHeap () returned 0x630000 [0062.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.171] GetProcessHeap () returned 0x630000 [0062.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.171] GetProcessHeap () returned 0x630000 [0062.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.171] GetProcessHeap () returned 0x630000 [0062.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.171] GetProcessHeap () returned 0x630000 [0062.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.171] GetProcessHeap () returned 0x630000 [0062.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.171] GetProcessHeap () returned 0x630000 [0062.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.171] GetProcessHeap () returned 0x630000 [0062.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.171] GetProcessHeap () returned 0x630000 [0062.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.171] GetProcessHeap () returned 0x630000 [0062.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.171] GetProcessHeap () returned 0x630000 [0062.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.171] GetProcessHeap () returned 0x630000 [0062.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.171] GetProcessHeap () returned 0x630000 [0062.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.171] GetProcessHeap () returned 0x630000 [0062.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.171] GetProcessHeap () returned 0x630000 [0062.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.171] GetProcessHeap () returned 0x630000 [0062.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.172] GetProcessHeap () returned 0x630000 [0062.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.172] GetProcessHeap () returned 0x630000 [0062.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.172] GetProcessHeap () returned 0x630000 [0062.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.172] GetProcessHeap () returned 0x630000 [0062.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.172] GetProcessHeap () returned 0x630000 [0062.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.172] GetProcessHeap () returned 0x630000 [0062.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.172] GetProcessHeap () returned 0x630000 [0062.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.172] GetProcessHeap () returned 0x630000 [0062.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.172] GetProcessHeap () returned 0x630000 [0062.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.172] GetProcessHeap () returned 0x630000 [0062.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.172] GetProcessHeap () returned 0x630000 [0062.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.172] GetProcessHeap () returned 0x630000 [0062.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.172] GetProcessHeap () returned 0x630000 [0062.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.172] GetProcessHeap () returned 0x630000 [0062.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.172] GetProcessHeap () returned 0x630000 [0062.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.172] GetProcessHeap () returned 0x630000 [0062.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.172] GetProcessHeap () returned 0x630000 [0062.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.172] GetProcessHeap () returned 0x630000 [0062.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.172] GetProcessHeap () returned 0x630000 [0062.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.173] GetProcessHeap () returned 0x630000 [0062.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.173] GetProcessHeap () returned 0x630000 [0062.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.173] GetProcessHeap () returned 0x630000 [0062.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.173] GetProcessHeap () returned 0x630000 [0062.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.173] GetProcessHeap () returned 0x630000 [0062.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.173] GetProcessHeap () returned 0x630000 [0062.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.173] GetProcessHeap () returned 0x630000 [0062.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.173] GetProcessHeap () returned 0x630000 [0062.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.173] GetProcessHeap () returned 0x630000 [0062.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.173] GetProcessHeap () returned 0x630000 [0062.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.173] GetProcessHeap () returned 0x630000 [0062.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.173] GetProcessHeap () returned 0x630000 [0062.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0062.173] GetProcessHeap () returned 0x630000 [0062.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0062.173] GetProcessHeap () returned 0x630000 [0062.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0062.173] GetProcessHeap () returned 0x630000 [0062.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0062.173] GetProcessHeap () returned 0x630000 [0062.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0062.173] GetProcessHeap () returned 0x630000 [0062.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0062.173] GetProcessHeap () returned 0x630000 [0062.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0062.173] GetProcessHeap () returned 0x630000 [0062.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0062.174] GetProcessHeap () returned 0x630000 [0062.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0062.174] GetProcessHeap () returned 0x630000 [0062.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.174] GetProcessHeap () returned 0x630000 [0062.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0062.174] WriteFile (in: hFile=0x230, lpBuffer=0x6592b0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6592b0*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0062.194] GetProcessHeap () returned 0x630000 [0062.194] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6592b0, Size=0x30) returned 0x6592b0 [0062.194] GetProcessHeap () returned 0x630000 [0062.194] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0062.194] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0062.194] GetProcessHeap () returned 0x630000 [0062.195] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6bd5) returned 0x671bf0 [0062.196] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0x6bd5, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0x6bd5, lpOverlapped=0x0) returned 1 [0062.197] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0062.197] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x6bd5, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0x6bd5, lpOverlapped=0x0) returned 1 [0062.198] GetProcessHeap () returned 0x630000 [0062.198] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0062.198] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0062.198] WriteFile (in: hFile=0x230, lpBuffer=0x6592b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6592b0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0062.199] CloseHandle (hObject=0x230) returned 1 [0062.201] GetProcessHeap () returned 0x630000 [0062.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0062.201] GetProcessHeap () returned 0x630000 [0062.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6556e8 | out: hHeap=0x630000) returned 1 [0062.201] GetProcessHeap () returned 0x630000 [0062.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0062.201] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\igajY.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\igajY.wav") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\igajY.wav" [0062.201] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\igajY.wav", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\igajY.wav.happythreechoose") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\igajY.wav.happythreechoose" [0062.201] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\igajY.wav" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\igajy.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\igajY.wav.happythreechoose" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\igajy.wav.happythreechoose"), dwFlags=0x1) returned 1 [0062.202] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\igajY.wav" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ") returned 1 [0062.202] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\") returned="" [0062.202] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Decryption INFO.html" [0062.202] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\decryption info.html")) returned 0x20 [0062.202] GetProcessHeap () returned 0x630000 [0062.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0062.202] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x578530f0, ftCreationTime.dwHighDateTime=0x1d5d02d, ftLastAccessTime.dwLowDateTime=0xa6792b80, ftLastAccessTime.dwHighDateTime=0x1d5d2da, ftLastWriteTime.dwLowDateTime=0xa6792b80, ftLastWriteTime.dwHighDateTime=0x1d5d2da, nFileSizeHigh=0x0, nFileSizeLow=0x9ff1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="iIGS.wav", cAlternateFileName="")) returned 1 [0062.202] lstrcmpiW (lpString1="iIGS.wav", lpString2=".") returned 1 [0062.202] lstrcmpiW (lpString1="iIGS.wav", lpString2="..") returned 1 [0062.202] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\", lpString2="iIGS.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\iIGS.wav") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\iIGS.wav" [0062.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iIGS.wav", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0062.202] GetProcessHeap () returned 0x630000 [0062.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9) returned 0x64c9f0 [0062.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iIGS.wav", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iIGS.wav", lpUsedDefaultChar=0x0) returned 9 [0062.202] lstrlenA (lpString="iIGS.wav") returned 8 [0062.202] lstrlenA (lpString=".happythreechoose") returned 17 [0062.202] lstrcmpiW (lpString1="iIGS.wav", lpString2="Decryption INFO.html") returned 1 [0062.202] lstrcmpiW (lpString1="iIGS.wav", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0062.202] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0062.202] lstrcmpiW (lpString1="iIGS.wav", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0062.202] GetProcessHeap () returned 0x630000 [0062.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0062.202] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\iIGS.wav" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\iigs.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0062.203] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=40945) returned 1 [0062.203] GetProcessHeap () returned 0x630000 [0062.203] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655508 [0062.203] GetProcessHeap () returned 0x630000 [0062.203] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0062.203] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\iIGS.wav") returned 51 [0062.203] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0062.203] GetProcessHeap () returned 0x630000 [0062.203] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0062.203] GetProcessHeap () returned 0x630000 [0062.203] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38f) returned 0x6592e8 [0062.203] lstrlenA (lpString="rsa_encrypt") returned 11 [0062.203] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0062.204] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0062.204] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0062.204] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0062.204] GetProcessHeap () returned 0x630000 [0062.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0062.204] lstrlenA (lpString="010001") returned 6 [0062.204] GetProcessHeap () returned 0x630000 [0062.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2b8 [0062.204] GetProcessHeap () returned 0x630000 [0062.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0062.204] GetProcessHeap () returned 0x630000 [0062.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e340 [0062.204] GetProcessHeap () returned 0x630000 [0062.204] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0062.204] GetProcessHeap () returned 0x630000 [0062.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea00 [0062.204] GetProcessHeap () returned 0x630000 [0062.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x6570f8 [0062.204] GetProcessHeap () returned 0x630000 [0062.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a318 [0062.204] GetProcessHeap () returned 0x630000 [0062.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0062.205] GetProcessHeap () returned 0x630000 [0062.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.205] GetProcessHeap () returned 0x630000 [0062.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0062.205] GetProcessHeap () returned 0x630000 [0062.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0062.205] GetProcessHeap () returned 0x630000 [0062.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657440 [0062.205] GetProcessHeap () returned 0x630000 [0062.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.205] GetProcessHeap () returned 0x630000 [0062.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0062.205] GetProcessHeap () returned 0x630000 [0062.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e4f0 [0062.205] GetProcessHeap () returned 0x630000 [0062.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0062.205] GetProcessHeap () returned 0x630000 [0062.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0062.205] GetProcessHeap () returned 0x630000 [0062.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0062.205] GetProcessHeap () returned 0x630000 [0062.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.205] GetProcessHeap () returned 0x630000 [0062.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65ce38 [0062.205] GetProcessHeap () returned 0x630000 [0062.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.205] GetProcessHeap () returned 0x630000 [0062.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.205] GetProcessHeap () returned 0x630000 [0062.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.205] GetProcessHeap () returned 0x630000 [0062.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.205] GetProcessHeap () returned 0x630000 [0062.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65de30 [0062.205] GetProcessHeap () returned 0x630000 [0062.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ce38 | out: hHeap=0x630000) returned 1 [0062.205] GetProcessHeap () returned 0x630000 [0062.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0062.205] GetProcessHeap () returned 0x630000 [0062.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0062.206] GetProcessHeap () returned 0x630000 [0062.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.206] GetProcessHeap () returned 0x630000 [0062.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.206] GetProcessHeap () returned 0x630000 [0062.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.206] GetProcessHeap () returned 0x630000 [0062.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.206] GetProcessHeap () returned 0x630000 [0062.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.206] GetProcessHeap () returned 0x630000 [0062.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.206] GetProcessHeap () returned 0x630000 [0062.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.206] GetProcessHeap () returned 0x630000 [0062.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.206] GetProcessHeap () returned 0x630000 [0062.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.206] GetProcessHeap () returned 0x630000 [0062.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.206] GetProcessHeap () returned 0x630000 [0062.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.206] GetProcessHeap () returned 0x630000 [0062.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.206] GetProcessHeap () returned 0x630000 [0062.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.206] GetProcessHeap () returned 0x630000 [0062.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.206] GetProcessHeap () returned 0x630000 [0062.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.206] GetProcessHeap () returned 0x630000 [0062.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.206] GetProcessHeap () returned 0x630000 [0062.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.206] GetProcessHeap () returned 0x630000 [0062.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.206] GetProcessHeap () returned 0x630000 [0062.207] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.207] GetProcessHeap () returned 0x630000 [0062.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.207] GetProcessHeap () returned 0x630000 [0062.207] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.207] GetProcessHeap () returned 0x630000 [0062.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.207] GetProcessHeap () returned 0x630000 [0062.207] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.207] GetProcessHeap () returned 0x630000 [0062.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.207] GetProcessHeap () returned 0x630000 [0062.207] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.207] GetProcessHeap () returned 0x630000 [0062.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.207] GetProcessHeap () returned 0x630000 [0062.207] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.207] GetProcessHeap () returned 0x630000 [0062.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.207] GetProcessHeap () returned 0x630000 [0062.207] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.207] GetProcessHeap () returned 0x630000 [0062.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.207] GetProcessHeap () returned 0x630000 [0062.207] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.207] GetProcessHeap () returned 0x630000 [0062.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.207] GetProcessHeap () returned 0x630000 [0062.207] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.207] GetProcessHeap () returned 0x630000 [0062.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.207] GetProcessHeap () returned 0x630000 [0062.207] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.207] GetProcessHeap () returned 0x630000 [0062.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.207] GetProcessHeap () returned 0x630000 [0062.207] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.208] GetProcessHeap () returned 0x630000 [0062.208] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.208] GetProcessHeap () returned 0x630000 [0062.208] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.208] GetProcessHeap () returned 0x630000 [0062.208] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.208] GetProcessHeap () returned 0x630000 [0062.208] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.208] GetProcessHeap () returned 0x630000 [0062.208] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.208] GetProcessHeap () returned 0x630000 [0062.208] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.208] GetProcessHeap () returned 0x630000 [0062.208] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.208] GetProcessHeap () returned 0x630000 [0062.208] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.208] GetProcessHeap () returned 0x630000 [0062.208] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.208] GetProcessHeap () returned 0x630000 [0062.208] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.208] GetProcessHeap () returned 0x630000 [0062.208] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.208] GetProcessHeap () returned 0x630000 [0062.208] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.208] GetProcessHeap () returned 0x630000 [0062.208] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.208] GetProcessHeap () returned 0x630000 [0062.208] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.208] GetProcessHeap () returned 0x630000 [0062.208] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.208] GetProcessHeap () returned 0x630000 [0062.208] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.208] GetProcessHeap () returned 0x630000 [0062.208] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.208] GetProcessHeap () returned 0x630000 [0062.208] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.208] GetProcessHeap () returned 0x630000 [0062.208] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.209] GetProcessHeap () returned 0x630000 [0062.209] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.209] GetProcessHeap () returned 0x630000 [0062.209] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.209] GetProcessHeap () returned 0x630000 [0062.209] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.209] GetProcessHeap () returned 0x630000 [0062.209] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.209] GetProcessHeap () returned 0x630000 [0062.209] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.209] GetProcessHeap () returned 0x630000 [0062.209] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.209] GetProcessHeap () returned 0x630000 [0062.209] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.209] GetProcessHeap () returned 0x630000 [0062.209] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.209] GetProcessHeap () returned 0x630000 [0062.209] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.209] GetProcessHeap () returned 0x630000 [0062.209] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.209] GetProcessHeap () returned 0x630000 [0062.209] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.209] GetProcessHeap () returned 0x630000 [0062.209] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.209] GetProcessHeap () returned 0x630000 [0062.209] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.209] GetProcessHeap () returned 0x630000 [0062.209] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.209] GetProcessHeap () returned 0x630000 [0062.209] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.209] GetProcessHeap () returned 0x630000 [0062.209] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.209] GetProcessHeap () returned 0x630000 [0062.209] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.209] GetProcessHeap () returned 0x630000 [0062.209] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.209] GetProcessHeap () returned 0x630000 [0062.209] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.210] GetProcessHeap () returned 0x630000 [0062.210] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.210] GetProcessHeap () returned 0x630000 [0062.210] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.210] GetProcessHeap () returned 0x630000 [0062.210] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.210] GetProcessHeap () returned 0x630000 [0062.210] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.210] GetProcessHeap () returned 0x630000 [0062.210] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.210] GetProcessHeap () returned 0x630000 [0062.210] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.210] GetProcessHeap () returned 0x630000 [0062.210] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.210] GetProcessHeap () returned 0x630000 [0062.210] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0062.210] GetProcessHeap () returned 0x630000 [0062.210] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0062.210] GetProcessHeap () returned 0x630000 [0062.210] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0062.210] GetProcessHeap () returned 0x630000 [0062.210] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0062.210] GetProcessHeap () returned 0x630000 [0062.210] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0062.210] GetProcessHeap () returned 0x630000 [0062.210] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0062.210] GetProcessHeap () returned 0x630000 [0062.210] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0062.210] GetProcessHeap () returned 0x630000 [0062.210] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0062.210] GetProcessHeap () returned 0x630000 [0062.210] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0062.210] GetProcessHeap () returned 0x630000 [0062.210] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.210] GetProcessHeap () returned 0x630000 [0062.210] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0062.210] WriteFile (in: hFile=0x230, lpBuffer=0x6592e8*, nNumberOfBytesToWrite=0x38f, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6592e8*, lpNumberOfBytesWritten=0x243d864*=0x38f, lpOverlapped=0x0) returned 1 [0062.290] GetProcessHeap () returned 0x630000 [0062.290] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6592e8, Size=0x30) returned 0x6592e8 [0062.290] GetProcessHeap () returned 0x630000 [0062.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0062.290] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0062.290] GetProcessHeap () returned 0x630000 [0062.290] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa000) returned 0x671bf0 [0062.290] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0xa000, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0xa000, lpOverlapped=0x0) returned 1 [0062.291] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0062.291] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0xa000, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0xa000, lpOverlapped=0x0) returned 1 [0062.304] GetProcessHeap () returned 0x630000 [0062.304] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0062.306] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0062.306] WriteFile (in: hFile=0x230, lpBuffer=0x6592e8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6592e8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0062.312] CloseHandle (hObject=0x230) returned 1 [0062.314] GetProcessHeap () returned 0x630000 [0062.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0062.314] GetProcessHeap () returned 0x630000 [0062.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655508 | out: hHeap=0x630000) returned 1 [0062.314] GetProcessHeap () returned 0x630000 [0062.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0062.314] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\iIGS.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\iIGS.wav") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\iIGS.wav" [0062.314] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\iIGS.wav", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\iIGS.wav.happythreechoose") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\iIGS.wav.happythreechoose" [0062.314] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\iIGS.wav" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\iigs.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\iIGS.wav.happythreechoose" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\iigs.wav.happythreechoose"), dwFlags=0x1) returned 1 [0062.315] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\iIGS.wav" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ") returned 1 [0062.315] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\") returned="" [0062.315] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Decryption INFO.html" [0062.315] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\decryption info.html")) returned 0x20 [0062.315] GetProcessHeap () returned 0x630000 [0062.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0062.315] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5669720, ftCreationTime.dwHighDateTime=0x1d5d30e, ftLastAccessTime.dwLowDateTime=0x89853bb0, ftLastAccessTime.dwHighDateTime=0x1d5d11b, ftLastWriteTime.dwLowDateTime=0x89853bb0, ftLastWriteTime.dwHighDateTime=0x1d5d11b, nFileSizeHigh=0x0, nFileSizeLow=0x9d53, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="j87XXHMhfLqpcGSi.m4a", cAlternateFileName="J87XXH~1.M4A")) returned 1 [0062.315] lstrcmpiW (lpString1="j87XXHMhfLqpcGSi.m4a", lpString2=".") returned 1 [0062.315] lstrcmpiW (lpString1="j87XXHMhfLqpcGSi.m4a", lpString2="..") returned 1 [0062.315] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\", lpString2="j87XXHMhfLqpcGSi.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\j87XXHMhfLqpcGSi.m4a") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\j87XXHMhfLqpcGSi.m4a" [0062.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="j87XXHMhfLqpcGSi.m4a", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0062.315] GetProcessHeap () returned 0x630000 [0062.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x15) returned 0x645e98 [0062.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="j87XXHMhfLqpcGSi.m4a", cchWideChar=-1, lpMultiByteStr=0x645e98, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="j87XXHMhfLqpcGSi.m4a", lpUsedDefaultChar=0x0) returned 21 [0062.315] lstrlenA (lpString="j87XXHMhfLqpcGSi.m4a") returned 20 [0062.315] lstrlenA (lpString=".happythreechoose") returned 17 [0062.315] lstrlenA (lpString=".happythreechoose") returned 17 [0062.315] lstrlenA (lpString="j87XXHMhfLqpcGSi.m4a") returned 20 [0062.315] lstrcmpiA (lpString1="XXHMhfLqpcGSi.m4a", lpString2=".happythreechoose") returned 1 [0062.316] lstrcmpiW (lpString1="j87XXHMhfLqpcGSi.m4a", lpString2="Decryption INFO.html") returned 1 [0062.316] lstrcmpiW (lpString1="j87XXHMhfLqpcGSi.m4a", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0062.316] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0062.316] lstrcmpiW (lpString1="j87XXHMhfLqpcGSi.m4a", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0062.316] GetProcessHeap () returned 0x630000 [0062.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0062.316] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\j87XXHMhfLqpcGSi.m4a" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\j87xxhmhflqpcgsi.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0062.316] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=40275) returned 1 [0062.316] GetProcessHeap () returned 0x630000 [0062.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655850 [0062.316] GetProcessHeap () returned 0x630000 [0062.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0062.316] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\j87XXHMhfLqpcGSi.m4a") returned 63 [0062.316] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0062.316] GetProcessHeap () returned 0x630000 [0062.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0062.316] GetProcessHeap () returned 0x630000 [0062.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38d) returned 0x659320 [0062.316] lstrlenA (lpString="rsa_encrypt") returned 11 [0062.316] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0062.317] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0062.317] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0062.317] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0062.317] GetProcessHeap () returned 0x630000 [0062.317] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0062.317] lstrlenA (lpString="010001") returned 6 [0062.317] GetProcessHeap () returned 0x630000 [0062.317] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0062.317] GetProcessHeap () returned 0x630000 [0062.317] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0062.317] GetProcessHeap () returned 0x630000 [0062.317] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ecd0 [0062.317] GetProcessHeap () returned 0x630000 [0062.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0062.317] GetProcessHeap () returned 0x630000 [0062.317] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65df50 [0062.317] GetProcessHeap () returned 0x630000 [0062.317] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656db0 [0062.317] GetProcessHeap () returned 0x630000 [0062.317] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a318 [0062.317] GetProcessHeap () returned 0x630000 [0062.317] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0062.317] GetProcessHeap () returned 0x630000 [0062.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.317] GetProcessHeap () returned 0x630000 [0062.317] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0062.317] GetProcessHeap () returned 0x630000 [0062.318] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0062.318] GetProcessHeap () returned 0x630000 [0062.318] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656ec8 [0062.318] GetProcessHeap () returned 0x630000 [0062.318] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.318] GetProcessHeap () returned 0x630000 [0062.318] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0062.318] GetProcessHeap () returned 0x630000 [0062.318] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e340 [0062.318] GetProcessHeap () returned 0x630000 [0062.318] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0062.318] GetProcessHeap () returned 0x630000 [0062.318] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0062.318] GetProcessHeap () returned 0x630000 [0062.318] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0062.318] GetProcessHeap () returned 0x630000 [0062.318] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.318] GetProcessHeap () returned 0x630000 [0062.318] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0062.318] GetProcessHeap () returned 0x630000 [0062.318] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.318] GetProcessHeap () returned 0x630000 [0062.318] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.318] GetProcessHeap () returned 0x630000 [0062.318] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.318] GetProcessHeap () returned 0x630000 [0062.318] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.318] GetProcessHeap () returned 0x630000 [0062.318] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ea00 [0062.318] GetProcessHeap () returned 0x630000 [0062.318] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0062.318] GetProcessHeap () returned 0x630000 [0062.318] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0062.318] GetProcessHeap () returned 0x630000 [0062.318] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0062.318] GetProcessHeap () returned 0x630000 [0062.318] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.318] GetProcessHeap () returned 0x630000 [0062.318] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.319] GetProcessHeap () returned 0x630000 [0062.319] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.319] GetProcessHeap () returned 0x630000 [0062.319] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.319] GetProcessHeap () returned 0x630000 [0062.319] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.319] GetProcessHeap () returned 0x630000 [0062.319] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.319] GetProcessHeap () returned 0x630000 [0062.319] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.319] GetProcessHeap () returned 0x630000 [0062.319] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.319] GetProcessHeap () returned 0x630000 [0062.319] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.319] GetProcessHeap () returned 0x630000 [0062.319] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.319] GetProcessHeap () returned 0x630000 [0062.319] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.319] GetProcessHeap () returned 0x630000 [0062.319] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.319] GetProcessHeap () returned 0x630000 [0062.319] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.319] GetProcessHeap () returned 0x630000 [0062.319] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.319] GetProcessHeap () returned 0x630000 [0062.319] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.319] GetProcessHeap () returned 0x630000 [0062.319] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.319] GetProcessHeap () returned 0x630000 [0062.319] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.319] GetProcessHeap () returned 0x630000 [0062.319] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.319] GetProcessHeap () returned 0x630000 [0062.319] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.319] GetProcessHeap () returned 0x630000 [0062.319] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.320] GetProcessHeap () returned 0x630000 [0062.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.320] GetProcessHeap () returned 0x630000 [0062.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.320] GetProcessHeap () returned 0x630000 [0062.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.320] GetProcessHeap () returned 0x630000 [0062.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.320] GetProcessHeap () returned 0x630000 [0062.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.320] GetProcessHeap () returned 0x630000 [0062.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.320] GetProcessHeap () returned 0x630000 [0062.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.320] GetProcessHeap () returned 0x630000 [0062.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.320] GetProcessHeap () returned 0x630000 [0062.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.320] GetProcessHeap () returned 0x630000 [0062.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.320] GetProcessHeap () returned 0x630000 [0062.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.320] GetProcessHeap () returned 0x630000 [0062.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.320] GetProcessHeap () returned 0x630000 [0062.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.320] GetProcessHeap () returned 0x630000 [0062.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.320] GetProcessHeap () returned 0x630000 [0062.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.320] GetProcessHeap () returned 0x630000 [0062.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.320] GetProcessHeap () returned 0x630000 [0062.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.320] GetProcessHeap () returned 0x630000 [0062.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.321] GetProcessHeap () returned 0x630000 [0062.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.321] GetProcessHeap () returned 0x630000 [0062.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.321] GetProcessHeap () returned 0x630000 [0062.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.321] GetProcessHeap () returned 0x630000 [0062.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.321] GetProcessHeap () returned 0x630000 [0062.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.321] GetProcessHeap () returned 0x630000 [0062.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.321] GetProcessHeap () returned 0x630000 [0062.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.321] GetProcessHeap () returned 0x630000 [0062.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.321] GetProcessHeap () returned 0x630000 [0062.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.321] GetProcessHeap () returned 0x630000 [0062.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.321] GetProcessHeap () returned 0x630000 [0062.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.321] GetProcessHeap () returned 0x630000 [0062.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.321] GetProcessHeap () returned 0x630000 [0062.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.321] GetProcessHeap () returned 0x630000 [0062.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.321] GetProcessHeap () returned 0x630000 [0062.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.321] GetProcessHeap () returned 0x630000 [0062.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.321] GetProcessHeap () returned 0x630000 [0062.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0062.321] GetProcessHeap () returned 0x630000 [0062.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0062.322] GetProcessHeap () returned 0x630000 [0062.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.322] GetProcessHeap () returned 0x630000 [0062.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.322] GetProcessHeap () returned 0x630000 [0062.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.322] GetProcessHeap () returned 0x630000 [0062.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.322] GetProcessHeap () returned 0x630000 [0062.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.322] GetProcessHeap () returned 0x630000 [0062.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.322] GetProcessHeap () returned 0x630000 [0062.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.322] GetProcessHeap () returned 0x630000 [0062.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.322] GetProcessHeap () returned 0x630000 [0062.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.322] GetProcessHeap () returned 0x630000 [0062.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.322] GetProcessHeap () returned 0x630000 [0062.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.322] GetProcessHeap () returned 0x630000 [0062.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.322] GetProcessHeap () returned 0x630000 [0062.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.322] GetProcessHeap () returned 0x630000 [0062.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.322] GetProcessHeap () returned 0x630000 [0062.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.322] GetProcessHeap () returned 0x630000 [0062.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.322] GetProcessHeap () returned 0x630000 [0062.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0062.322] GetProcessHeap () returned 0x630000 [0062.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0062.323] GetProcessHeap () returned 0x630000 [0062.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.323] GetProcessHeap () returned 0x630000 [0062.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.323] GetProcessHeap () returned 0x630000 [0062.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.323] GetProcessHeap () returned 0x630000 [0062.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.323] GetProcessHeap () returned 0x630000 [0062.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.323] GetProcessHeap () returned 0x630000 [0062.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.323] GetProcessHeap () returned 0x630000 [0062.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.323] GetProcessHeap () returned 0x630000 [0062.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.323] GetProcessHeap () returned 0x630000 [0062.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0062.323] GetProcessHeap () returned 0x630000 [0062.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0062.323] GetProcessHeap () returned 0x630000 [0062.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0062.323] GetProcessHeap () returned 0x630000 [0062.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0062.323] GetProcessHeap () returned 0x630000 [0062.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0062.323] GetProcessHeap () returned 0x630000 [0062.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0062.323] GetProcessHeap () returned 0x630000 [0062.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0062.323] GetProcessHeap () returned 0x630000 [0062.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ecd0 | out: hHeap=0x630000) returned 1 [0062.323] GetProcessHeap () returned 0x630000 [0062.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0062.323] GetProcessHeap () returned 0x630000 [0062.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.324] GetProcessHeap () returned 0x630000 [0062.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0062.324] WriteFile (in: hFile=0x230, lpBuffer=0x659320*, nNumberOfBytesToWrite=0x38d, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659320*, lpNumberOfBytesWritten=0x243d864*=0x38d, lpOverlapped=0x0) returned 1 [0062.344] GetProcessHeap () returned 0x630000 [0062.344] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659320, Size=0x30) returned 0x659320 [0062.344] GetProcessHeap () returned 0x630000 [0062.344] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0062.344] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0062.344] GetProcessHeap () returned 0x630000 [0062.344] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9d60) returned 0x671bf0 [0062.346] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0x9d60, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0x9d60, lpOverlapped=0x0) returned 1 [0062.346] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0062.346] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x9d60, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0x9d60, lpOverlapped=0x0) returned 1 [0062.349] GetProcessHeap () returned 0x630000 [0062.349] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0062.349] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0062.349] WriteFile (in: hFile=0x230, lpBuffer=0x659320*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659320*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0062.350] CloseHandle (hObject=0x230) returned 1 [0062.352] GetProcessHeap () returned 0x630000 [0062.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0062.353] GetProcessHeap () returned 0x630000 [0062.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655850 | out: hHeap=0x630000) returned 1 [0062.353] GetProcessHeap () returned 0x630000 [0062.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0062.353] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\j87XXHMhfLqpcGSi.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\j87XXHMhfLqpcGSi.m4a") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\j87XXHMhfLqpcGSi.m4a" [0062.353] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\j87XXHMhfLqpcGSi.m4a", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\j87XXHMhfLqpcGSi.m4a.happythreechoose") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\j87XXHMhfLqpcGSi.m4a.happythreechoose" [0062.353] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\j87XXHMhfLqpcGSi.m4a" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\j87xxhmhflqpcgsi.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\j87XXHMhfLqpcGSi.m4a.happythreechoose" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\j87xxhmhflqpcgsi.m4a.happythreechoose"), dwFlags=0x1) returned 1 [0062.353] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\j87XXHMhfLqpcGSi.m4a" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ") returned 1 [0062.353] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\") returned="" [0062.353] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Decryption INFO.html" [0062.353] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\decryption info.html")) returned 0x20 [0062.354] GetProcessHeap () returned 0x630000 [0062.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645e98 | out: hHeap=0x630000) returned 1 [0062.354] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ef2b370, ftCreationTime.dwHighDateTime=0x1d5d497, ftLastAccessTime.dwLowDateTime=0x437e830, ftLastAccessTime.dwHighDateTime=0x1d5d4f0, ftLastWriteTime.dwLowDateTime=0x437e830, ftLastWriteTime.dwHighDateTime=0x1d5d4f0, nFileSizeHigh=0x0, nFileSizeLow=0xfa1e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PlORB6-3k5Z.wav", cAlternateFileName="PLORB6~1.WAV")) returned 1 [0062.354] lstrcmpiW (lpString1="PlORB6-3k5Z.wav", lpString2=".") returned 1 [0062.354] lstrcmpiW (lpString1="PlORB6-3k5Z.wav", lpString2="..") returned 1 [0062.354] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\", lpString2="PlORB6-3k5Z.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\PlORB6-3k5Z.wav") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\PlORB6-3k5Z.wav" [0062.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PlORB6-3k5Z.wav", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0062.354] GetProcessHeap () returned 0x630000 [0062.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x64ca20 [0062.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PlORB6-3k5Z.wav", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PlORB6-3k5Z.wav", lpUsedDefaultChar=0x0) returned 16 [0062.354] lstrlenA (lpString="PlORB6-3k5Z.wav") returned 15 [0062.354] lstrlenA (lpString=".happythreechoose") returned 17 [0062.354] lstrcmpiW (lpString1="PlORB6-3k5Z.wav", lpString2="Decryption INFO.html") returned 1 [0062.354] lstrcmpiW (lpString1="PlORB6-3k5Z.wav", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0062.354] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0062.354] lstrcmpiW (lpString1="PlORB6-3k5Z.wav", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0062.354] GetProcessHeap () returned 0x630000 [0062.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0062.354] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\PlORB6-3k5Z.wav" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\plorb6-3k5z.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0062.354] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=64030) returned 1 [0062.354] GetProcessHeap () returned 0x630000 [0062.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6558c8 [0062.354] GetProcessHeap () returned 0x630000 [0062.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0062.354] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\PlORB6-3k5Z.wav") returned 58 [0062.354] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0062.355] GetProcessHeap () returned 0x630000 [0062.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0062.355] GetProcessHeap () returned 0x630000 [0062.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x659358 [0062.355] lstrlenA (lpString="rsa_encrypt") returned 11 [0062.355] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0062.355] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0062.355] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0062.355] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0062.355] GetProcessHeap () returned 0x630000 [0062.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0062.355] lstrlenA (lpString="010001") returned 6 [0062.355] GetProcessHeap () returned 0x630000 [0062.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a348 [0062.355] GetProcessHeap () returned 0x630000 [0062.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0062.356] GetProcessHeap () returned 0x630000 [0062.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e970 [0062.356] GetProcessHeap () returned 0x630000 [0062.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0062.356] GetProcessHeap () returned 0x630000 [0062.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea00 [0062.356] GetProcessHeap () returned 0x630000 [0062.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657440 [0062.356] GetProcessHeap () returned 0x630000 [0062.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0062.356] GetProcessHeap () returned 0x630000 [0062.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0062.356] GetProcessHeap () returned 0x630000 [0062.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.356] GetProcessHeap () returned 0x630000 [0062.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0062.356] GetProcessHeap () returned 0x630000 [0062.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0062.356] GetProcessHeap () returned 0x630000 [0062.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656c98 [0062.356] GetProcessHeap () returned 0x630000 [0062.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.356] GetProcessHeap () returned 0x630000 [0062.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0062.356] GetProcessHeap () returned 0x630000 [0062.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0062.356] GetProcessHeap () returned 0x630000 [0062.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0062.356] GetProcessHeap () returned 0x630000 [0062.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0062.356] GetProcessHeap () returned 0x630000 [0062.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0062.356] GetProcessHeap () returned 0x630000 [0062.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.356] GetProcessHeap () returned 0x630000 [0062.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cfb8 [0062.356] GetProcessHeap () returned 0x630000 [0062.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.357] GetProcessHeap () returned 0x630000 [0062.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.357] GetProcessHeap () returned 0x630000 [0062.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.357] GetProcessHeap () returned 0x630000 [0062.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.357] GetProcessHeap () returned 0x630000 [0062.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e2b0 [0062.357] GetProcessHeap () returned 0x630000 [0062.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cfb8 | out: hHeap=0x630000) returned 1 [0062.357] GetProcessHeap () returned 0x630000 [0062.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0062.357] GetProcessHeap () returned 0x630000 [0062.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e2b0 | out: hHeap=0x630000) returned 1 [0062.357] GetProcessHeap () returned 0x630000 [0062.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.357] GetProcessHeap () returned 0x630000 [0062.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.357] GetProcessHeap () returned 0x630000 [0062.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.357] GetProcessHeap () returned 0x630000 [0062.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.357] GetProcessHeap () returned 0x630000 [0062.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.357] GetProcessHeap () returned 0x630000 [0062.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.357] GetProcessHeap () returned 0x630000 [0062.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.357] GetProcessHeap () returned 0x630000 [0062.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.357] GetProcessHeap () returned 0x630000 [0062.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.357] GetProcessHeap () returned 0x630000 [0062.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.357] GetProcessHeap () returned 0x630000 [0062.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.357] GetProcessHeap () returned 0x630000 [0062.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.358] GetProcessHeap () returned 0x630000 [0062.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.358] GetProcessHeap () returned 0x630000 [0062.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.358] GetProcessHeap () returned 0x630000 [0062.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.358] GetProcessHeap () returned 0x630000 [0062.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.358] GetProcessHeap () returned 0x630000 [0062.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.358] GetProcessHeap () returned 0x630000 [0062.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.358] GetProcessHeap () returned 0x630000 [0062.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.358] GetProcessHeap () returned 0x630000 [0062.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.358] GetProcessHeap () returned 0x630000 [0062.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.358] GetProcessHeap () returned 0x630000 [0062.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.358] GetProcessHeap () returned 0x630000 [0062.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.359] GetProcessHeap () returned 0x630000 [0062.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.359] GetProcessHeap () returned 0x630000 [0062.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.359] GetProcessHeap () returned 0x630000 [0062.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.359] GetProcessHeap () returned 0x630000 [0062.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.359] GetProcessHeap () returned 0x630000 [0062.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.359] GetProcessHeap () returned 0x630000 [0062.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.359] GetProcessHeap () returned 0x630000 [0062.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.359] GetProcessHeap () returned 0x630000 [0062.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.359] GetProcessHeap () returned 0x630000 [0062.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.359] GetProcessHeap () returned 0x630000 [0062.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.359] GetProcessHeap () returned 0x630000 [0062.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.359] GetProcessHeap () returned 0x630000 [0062.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.359] GetProcessHeap () returned 0x630000 [0062.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.359] GetProcessHeap () returned 0x630000 [0062.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.359] GetProcessHeap () returned 0x630000 [0062.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.359] GetProcessHeap () returned 0x630000 [0062.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.359] GetProcessHeap () returned 0x630000 [0062.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.359] GetProcessHeap () returned 0x630000 [0062.360] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.360] GetProcessHeap () returned 0x630000 [0062.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.360] GetProcessHeap () returned 0x630000 [0062.360] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.360] GetProcessHeap () returned 0x630000 [0062.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.360] GetProcessHeap () returned 0x630000 [0062.360] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.360] GetProcessHeap () returned 0x630000 [0062.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.360] GetProcessHeap () returned 0x630000 [0062.360] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.360] GetProcessHeap () returned 0x630000 [0062.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.360] GetProcessHeap () returned 0x630000 [0062.360] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.360] GetProcessHeap () returned 0x630000 [0062.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.360] GetProcessHeap () returned 0x630000 [0062.360] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.360] GetProcessHeap () returned 0x630000 [0062.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.360] GetProcessHeap () returned 0x630000 [0062.360] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.360] GetProcessHeap () returned 0x630000 [0062.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.360] GetProcessHeap () returned 0x630000 [0062.360] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.360] GetProcessHeap () returned 0x630000 [0062.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.360] GetProcessHeap () returned 0x630000 [0062.360] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.360] GetProcessHeap () returned 0x630000 [0062.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.360] GetProcessHeap () returned 0x630000 [0062.360] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.361] GetProcessHeap () returned 0x630000 [0062.361] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.361] GetProcessHeap () returned 0x630000 [0062.361] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.361] GetProcessHeap () returned 0x630000 [0062.361] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.361] GetProcessHeap () returned 0x630000 [0062.361] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.361] GetProcessHeap () returned 0x630000 [0062.361] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.361] GetProcessHeap () returned 0x630000 [0062.361] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.361] GetProcessHeap () returned 0x630000 [0062.361] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.361] GetProcessHeap () returned 0x630000 [0062.361] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.361] GetProcessHeap () returned 0x630000 [0062.361] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.361] GetProcessHeap () returned 0x630000 [0062.361] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.361] GetProcessHeap () returned 0x630000 [0062.361] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.361] GetProcessHeap () returned 0x630000 [0062.361] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.361] GetProcessHeap () returned 0x630000 [0062.361] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.361] GetProcessHeap () returned 0x630000 [0062.361] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.361] GetProcessHeap () returned 0x630000 [0062.361] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.361] GetProcessHeap () returned 0x630000 [0062.361] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.361] GetProcessHeap () returned 0x630000 [0062.361] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.361] GetProcessHeap () returned 0x630000 [0062.362] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.362] GetProcessHeap () returned 0x630000 [0062.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.362] GetProcessHeap () returned 0x630000 [0062.362] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.362] GetProcessHeap () returned 0x630000 [0062.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.362] GetProcessHeap () returned 0x630000 [0062.362] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.362] GetProcessHeap () returned 0x630000 [0062.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.362] GetProcessHeap () returned 0x630000 [0062.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0062.362] GetProcessHeap () returned 0x630000 [0062.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0062.362] GetProcessHeap () returned 0x630000 [0062.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0062.362] GetProcessHeap () returned 0x630000 [0062.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0062.362] GetProcessHeap () returned 0x630000 [0062.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0062.362] GetProcessHeap () returned 0x630000 [0062.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0062.362] GetProcessHeap () returned 0x630000 [0062.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0062.362] GetProcessHeap () returned 0x630000 [0062.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0062.362] GetProcessHeap () returned 0x630000 [0062.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0062.362] GetProcessHeap () returned 0x630000 [0062.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0062.362] GetProcessHeap () returned 0x630000 [0062.362] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0062.362] WriteFile (in: hFile=0x230, lpBuffer=0x659358*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659358*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0062.450] GetProcessHeap () returned 0x630000 [0062.450] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659358, Size=0x30) returned 0x659358 [0062.450] GetProcessHeap () returned 0x630000 [0062.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0062.450] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0062.450] GetProcessHeap () returned 0x630000 [0062.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfa1e) returned 0x671bf0 [0062.451] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0xfa1e, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0xfa1e, lpOverlapped=0x0) returned 1 [0062.452] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0062.452] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0xfa1e, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0xfa1e, lpOverlapped=0x0) returned 1 [0062.454] GetProcessHeap () returned 0x630000 [0062.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0062.456] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0062.456] WriteFile (in: hFile=0x230, lpBuffer=0x659358*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659358*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0062.457] CloseHandle (hObject=0x230) returned 1 [0062.459] GetProcessHeap () returned 0x630000 [0062.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0062.459] GetProcessHeap () returned 0x630000 [0062.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6558c8 | out: hHeap=0x630000) returned 1 [0062.459] GetProcessHeap () returned 0x630000 [0062.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0062.459] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\PlORB6-3k5Z.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\PlORB6-3k5Z.wav") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\PlORB6-3k5Z.wav" [0062.459] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\PlORB6-3k5Z.wav", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\PlORB6-3k5Z.wav.happythreechoose") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\PlORB6-3k5Z.wav.happythreechoose" [0062.459] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\PlORB6-3k5Z.wav" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\plorb6-3k5z.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\PlORB6-3k5Z.wav.happythreechoose" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\plorb6-3k5z.wav.happythreechoose"), dwFlags=0x1) returned 1 [0062.460] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\PlORB6-3k5Z.wav" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ") returned 1 [0062.460] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\") returned="" [0062.460] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Decryption INFO.html" [0062.460] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\decryption info.html")) returned 0x20 [0062.460] GetProcessHeap () returned 0x630000 [0062.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0062.460] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d0fc040, ftCreationTime.dwHighDateTime=0x1d5d4b1, ftLastAccessTime.dwLowDateTime=0x3c21a620, ftLastAccessTime.dwHighDateTime=0x1d5d5b6, ftLastWriteTime.dwLowDateTime=0x3c21a620, ftLastWriteTime.dwHighDateTime=0x1d5d5b6, nFileSizeHigh=0x0, nFileSizeLow=0xf661, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Q7cibe.m4a", cAlternateFileName="")) returned 1 [0062.460] lstrcmpiW (lpString1="Q7cibe.m4a", lpString2=".") returned 1 [0062.460] lstrcmpiW (lpString1="Q7cibe.m4a", lpString2="..") returned 1 [0062.460] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\", lpString2="Q7cibe.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Q7cibe.m4a") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Q7cibe.m4a" [0062.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Q7cibe.m4a", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0062.460] GetProcessHeap () returned 0x630000 [0062.461] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb) returned 0x64c9f0 [0062.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Q7cibe.m4a", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Q7cibe.m4a", lpUsedDefaultChar=0x0) returned 11 [0062.464] lstrlenA (lpString="Q7cibe.m4a") returned 10 [0062.464] lstrlenA (lpString=".happythreechoose") returned 17 [0062.464] lstrcmpiW (lpString1="Q7cibe.m4a", lpString2="Decryption INFO.html") returned 1 [0062.464] lstrcmpiW (lpString1="Q7cibe.m4a", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0062.464] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0062.464] lstrcmpiW (lpString1="Q7cibe.m4a", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0062.464] GetProcessHeap () returned 0x630000 [0062.464] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0062.464] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Q7cibe.m4a" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\q7cibe.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0062.464] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=63073) returned 1 [0062.464] GetProcessHeap () returned 0x630000 [0062.464] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655490 [0062.464] GetProcessHeap () returned 0x630000 [0062.464] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0062.464] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Q7cibe.m4a") returned 53 [0062.464] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0062.464] GetProcessHeap () returned 0x630000 [0062.464] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0062.465] GetProcessHeap () returned 0x630000 [0062.465] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x659390 [0062.465] lstrlenA (lpString="rsa_encrypt") returned 11 [0062.465] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0062.465] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0062.465] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0062.465] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0062.465] GetProcessHeap () returned 0x630000 [0062.465] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0062.465] lstrlenA (lpString="010001") returned 6 [0062.465] GetProcessHeap () returned 0x630000 [0062.465] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0062.465] GetProcessHeap () returned 0x630000 [0062.465] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0062.465] GetProcessHeap () returned 0x630000 [0062.465] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e340 [0062.466] GetProcessHeap () returned 0x630000 [0062.466] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0062.466] GetProcessHeap () returned 0x630000 [0062.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ebb0 [0062.466] GetProcessHeap () returned 0x630000 [0062.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656c98 [0062.466] GetProcessHeap () returned 0x630000 [0062.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0062.466] GetProcessHeap () returned 0x630000 [0062.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0062.466] GetProcessHeap () returned 0x630000 [0062.466] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.466] GetProcessHeap () returned 0x630000 [0062.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0062.466] GetProcessHeap () returned 0x630000 [0062.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0062.466] GetProcessHeap () returned 0x630000 [0062.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656b80 [0062.466] GetProcessHeap () returned 0x630000 [0062.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.466] GetProcessHeap () returned 0x630000 [0062.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0062.466] GetProcessHeap () returned 0x630000 [0062.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea90 [0062.466] GetProcessHeap () returned 0x630000 [0062.466] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0062.466] GetProcessHeap () returned 0x630000 [0062.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0062.466] GetProcessHeap () returned 0x630000 [0062.466] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea90 | out: hHeap=0x630000) returned 1 [0062.466] GetProcessHeap () returned 0x630000 [0062.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0062.466] GetProcessHeap () returned 0x630000 [0062.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65d0f0 [0062.466] GetProcessHeap () returned 0x630000 [0062.466] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.466] GetProcessHeap () returned 0x630000 [0062.466] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0062.467] GetProcessHeap () returned 0x630000 [0062.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.467] GetProcessHeap () returned 0x630000 [0062.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.467] GetProcessHeap () returned 0x630000 [0062.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e190 [0062.467] GetProcessHeap () returned 0x630000 [0062.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65d0f0 | out: hHeap=0x630000) returned 1 [0062.467] GetProcessHeap () returned 0x630000 [0062.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0062.467] GetProcessHeap () returned 0x630000 [0062.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0062.467] GetProcessHeap () returned 0x630000 [0062.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.467] GetProcessHeap () returned 0x630000 [0062.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.467] GetProcessHeap () returned 0x630000 [0062.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.467] GetProcessHeap () returned 0x630000 [0062.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.467] GetProcessHeap () returned 0x630000 [0062.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.467] GetProcessHeap () returned 0x630000 [0062.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.467] GetProcessHeap () returned 0x630000 [0062.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.467] GetProcessHeap () returned 0x630000 [0062.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.467] GetProcessHeap () returned 0x630000 [0062.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.467] GetProcessHeap () returned 0x630000 [0062.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.467] GetProcessHeap () returned 0x630000 [0062.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.468] GetProcessHeap () returned 0x630000 [0062.468] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.468] GetProcessHeap () returned 0x630000 [0062.468] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.468] GetProcessHeap () returned 0x630000 [0062.468] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.468] GetProcessHeap () returned 0x630000 [0062.468] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.468] GetProcessHeap () returned 0x630000 [0062.468] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.468] GetProcessHeap () returned 0x630000 [0062.468] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.468] GetProcessHeap () returned 0x630000 [0062.468] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.468] GetProcessHeap () returned 0x630000 [0062.468] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.468] GetProcessHeap () returned 0x630000 [0062.468] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.468] GetProcessHeap () returned 0x630000 [0062.468] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.468] GetProcessHeap () returned 0x630000 [0062.468] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.468] GetProcessHeap () returned 0x630000 [0062.468] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.468] GetProcessHeap () returned 0x630000 [0062.468] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.468] GetProcessHeap () returned 0x630000 [0062.468] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.468] GetProcessHeap () returned 0x630000 [0062.468] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.468] GetProcessHeap () returned 0x630000 [0062.468] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.468] GetProcessHeap () returned 0x630000 [0062.468] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.468] GetProcessHeap () returned 0x630000 [0062.468] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.469] GetProcessHeap () returned 0x630000 [0062.469] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.469] GetProcessHeap () returned 0x630000 [0062.469] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0062.469] GetProcessHeap () returned 0x630000 [0062.469] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0062.469] GetProcessHeap () returned 0x630000 [0062.469] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.469] GetProcessHeap () returned 0x630000 [0062.469] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.469] GetProcessHeap () returned 0x630000 [0062.469] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.469] GetProcessHeap () returned 0x630000 [0062.469] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.469] GetProcessHeap () returned 0x630000 [0062.469] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.469] GetProcessHeap () returned 0x630000 [0062.469] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.469] GetProcessHeap () returned 0x630000 [0062.469] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.469] GetProcessHeap () returned 0x630000 [0062.469] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.469] GetProcessHeap () returned 0x630000 [0062.469] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.469] GetProcessHeap () returned 0x630000 [0062.469] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.469] GetProcessHeap () returned 0x630000 [0062.469] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.469] GetProcessHeap () returned 0x630000 [0062.469] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.469] GetProcessHeap () returned 0x630000 [0062.469] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.469] GetProcessHeap () returned 0x630000 [0062.469] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.469] GetProcessHeap () returned 0x630000 [0062.469] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.469] GetProcessHeap () returned 0x630000 [0062.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.470] GetProcessHeap () returned 0x630000 [0062.470] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.470] GetProcessHeap () returned 0x630000 [0062.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.470] GetProcessHeap () returned 0x630000 [0062.470] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.470] GetProcessHeap () returned 0x630000 [0062.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.470] GetProcessHeap () returned 0x630000 [0062.470] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.470] GetProcessHeap () returned 0x630000 [0062.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.470] GetProcessHeap () returned 0x630000 [0062.470] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.470] GetProcessHeap () returned 0x630000 [0062.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.470] GetProcessHeap () returned 0x630000 [0062.470] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.470] GetProcessHeap () returned 0x630000 [0062.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.470] GetProcessHeap () returned 0x630000 [0062.470] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.470] GetProcessHeap () returned 0x630000 [0062.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.470] GetProcessHeap () returned 0x630000 [0062.470] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.470] GetProcessHeap () returned 0x630000 [0062.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.470] GetProcessHeap () returned 0x630000 [0062.470] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.470] GetProcessHeap () returned 0x630000 [0062.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.473] GetProcessHeap () returned 0x630000 [0062.473] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.474] GetProcessHeap () returned 0x630000 [0062.474] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.474] GetProcessHeap () returned 0x630000 [0062.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.474] GetProcessHeap () returned 0x630000 [0062.474] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.474] GetProcessHeap () returned 0x630000 [0062.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.474] GetProcessHeap () returned 0x630000 [0062.474] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.474] GetProcessHeap () returned 0x630000 [0062.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.474] GetProcessHeap () returned 0x630000 [0062.474] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.474] GetProcessHeap () returned 0x630000 [0062.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.474] GetProcessHeap () returned 0x630000 [0062.474] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.474] GetProcessHeap () returned 0x630000 [0062.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.474] GetProcessHeap () returned 0x630000 [0062.474] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.474] GetProcessHeap () returned 0x630000 [0062.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.474] GetProcessHeap () returned 0x630000 [0062.474] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.474] GetProcessHeap () returned 0x630000 [0062.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.474] GetProcessHeap () returned 0x630000 [0062.474] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.474] GetProcessHeap () returned 0x630000 [0062.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.474] GetProcessHeap () returned 0x630000 [0062.474] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.474] GetProcessHeap () returned 0x630000 [0062.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0062.475] GetProcessHeap () returned 0x630000 [0062.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0062.475] GetProcessHeap () returned 0x630000 [0062.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0062.475] GetProcessHeap () returned 0x630000 [0062.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0062.475] GetProcessHeap () returned 0x630000 [0062.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0062.475] GetProcessHeap () returned 0x630000 [0062.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0062.475] GetProcessHeap () returned 0x630000 [0062.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0062.475] GetProcessHeap () returned 0x630000 [0062.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0062.475] GetProcessHeap () returned 0x630000 [0062.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0062.475] GetProcessHeap () returned 0x630000 [0062.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.475] GetProcessHeap () returned 0x630000 [0062.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0062.475] WriteFile (in: hFile=0x230, lpBuffer=0x659390*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659390*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0062.482] GetProcessHeap () returned 0x630000 [0062.482] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659390, Size=0x30) returned 0x659390 [0062.482] GetProcessHeap () returned 0x630000 [0062.482] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0062.482] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0062.482] GetProcessHeap () returned 0x630000 [0062.482] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf661) returned 0x671bf0 [0062.484] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0xf661, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0xf661, lpOverlapped=0x0) returned 1 [0062.484] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0062.485] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0xf661, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0xf661, lpOverlapped=0x0) returned 1 [0062.486] GetProcessHeap () returned 0x630000 [0062.486] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0062.486] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0062.486] WriteFile (in: hFile=0x230, lpBuffer=0x659390*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659390*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0062.487] CloseHandle (hObject=0x230) returned 1 [0062.490] GetProcessHeap () returned 0x630000 [0062.490] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0062.490] GetProcessHeap () returned 0x630000 [0062.490] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655490 | out: hHeap=0x630000) returned 1 [0062.490] GetProcessHeap () returned 0x630000 [0062.490] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0062.490] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Q7cibe.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Q7cibe.m4a") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Q7cibe.m4a" [0062.490] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Q7cibe.m4a", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Q7cibe.m4a.happythreechoose") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Q7cibe.m4a.happythreechoose" [0062.490] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Q7cibe.m4a" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\q7cibe.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Q7cibe.m4a.happythreechoose" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\q7cibe.m4a.happythreechoose"), dwFlags=0x1) returned 1 [0062.490] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Q7cibe.m4a" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ") returned 1 [0062.490] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\") returned="" [0062.491] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Decryption INFO.html" [0062.491] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\decryption info.html")) returned 0x20 [0062.491] GetProcessHeap () returned 0x630000 [0062.491] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0062.491] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59827810, ftCreationTime.dwHighDateTime=0x1d5c84c, ftLastAccessTime.dwLowDateTime=0xeab27560, ftLastAccessTime.dwHighDateTime=0x1d5d076, ftLastWriteTime.dwLowDateTime=0xeab27560, ftLastWriteTime.dwHighDateTime=0x1d5d076, nFileSizeHigh=0x0, nFileSizeLow=0x42e1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WegKKDl.m4a", cAlternateFileName="")) returned 1 [0062.491] lstrcmpiW (lpString1="WegKKDl.m4a", lpString2=".") returned 1 [0062.491] lstrcmpiW (lpString1="WegKKDl.m4a", lpString2="..") returned 1 [0062.491] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\", lpString2="WegKKDl.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\WegKKDl.m4a") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\WegKKDl.m4a" [0062.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WegKKDl.m4a", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0062.491] GetProcessHeap () returned 0x630000 [0062.491] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0062.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WegKKDl.m4a", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WegKKDl.m4a", lpUsedDefaultChar=0x0) returned 12 [0062.491] lstrlenA (lpString="WegKKDl.m4a") returned 11 [0062.491] lstrlenA (lpString=".happythreechoose") returned 17 [0062.491] lstrcmpiW (lpString1="WegKKDl.m4a", lpString2="Decryption INFO.html") returned 1 [0062.491] lstrcmpiW (lpString1="WegKKDl.m4a", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0062.491] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0062.491] lstrcmpiW (lpString1="WegKKDl.m4a", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0062.491] GetProcessHeap () returned 0x630000 [0062.491] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0062.491] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\WegKKDl.m4a" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\wegkkdl.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0062.491] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=17121) returned 1 [0062.491] GetProcessHeap () returned 0x630000 [0062.491] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655b20 [0062.491] GetProcessHeap () returned 0x630000 [0062.491] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0062.491] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\WegKKDl.m4a") returned 54 [0062.492] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0062.492] GetProcessHeap () returned 0x630000 [0062.492] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0062.492] GetProcessHeap () returned 0x630000 [0062.492] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38f) returned 0x6593c8 [0062.492] lstrlenA (lpString="rsa_encrypt") returned 11 [0062.492] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0062.494] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0062.494] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0062.494] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0062.494] GetProcessHeap () returned 0x630000 [0062.494] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0062.494] lstrlenA (lpString="010001") returned 6 [0062.494] GetProcessHeap () returned 0x630000 [0062.494] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a318 [0062.494] GetProcessHeap () returned 0x630000 [0062.494] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0062.494] GetProcessHeap () returned 0x630000 [0062.494] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0062.495] GetProcessHeap () returned 0x630000 [0062.495] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0062.495] GetProcessHeap () returned 0x630000 [0062.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e2b0 [0062.495] GetProcessHeap () returned 0x630000 [0062.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656c98 [0062.495] GetProcessHeap () returned 0x630000 [0062.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0062.495] GetProcessHeap () returned 0x630000 [0062.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0062.495] GetProcessHeap () returned 0x630000 [0062.495] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.495] GetProcessHeap () returned 0x630000 [0062.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0062.495] GetProcessHeap () returned 0x630000 [0062.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0062.495] GetProcessHeap () returned 0x630000 [0062.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656db0 [0062.495] GetProcessHeap () returned 0x630000 [0062.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.495] GetProcessHeap () returned 0x630000 [0062.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0062.495] GetProcessHeap () returned 0x630000 [0062.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ec40 [0062.495] GetProcessHeap () returned 0x630000 [0062.495] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0062.495] GetProcessHeap () returned 0x630000 [0062.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0062.495] GetProcessHeap () returned 0x630000 [0062.495] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ec40 | out: hHeap=0x630000) returned 1 [0062.495] GetProcessHeap () returned 0x630000 [0062.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.495] GetProcessHeap () returned 0x630000 [0062.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65ce38 [0062.495] GetProcessHeap () returned 0x630000 [0062.495] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.495] GetProcessHeap () returned 0x630000 [0062.495] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.495] GetProcessHeap () returned 0x630000 [0062.496] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.496] GetProcessHeap () returned 0x630000 [0062.496] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.496] GetProcessHeap () returned 0x630000 [0062.496] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e970 [0062.496] GetProcessHeap () returned 0x630000 [0062.496] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ce38 | out: hHeap=0x630000) returned 1 [0062.496] GetProcessHeap () returned 0x630000 [0062.496] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0062.496] GetProcessHeap () returned 0x630000 [0062.496] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0062.496] GetProcessHeap () returned 0x630000 [0062.496] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.496] GetProcessHeap () returned 0x630000 [0062.496] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.496] GetProcessHeap () returned 0x630000 [0062.496] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.496] GetProcessHeap () returned 0x630000 [0062.496] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.496] GetProcessHeap () returned 0x630000 [0062.496] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.496] GetProcessHeap () returned 0x630000 [0062.496] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.496] GetProcessHeap () returned 0x630000 [0062.496] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.496] GetProcessHeap () returned 0x630000 [0062.496] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.496] GetProcessHeap () returned 0x630000 [0062.496] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.496] GetProcessHeap () returned 0x630000 [0062.496] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.496] GetProcessHeap () returned 0x630000 [0062.496] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.496] GetProcessHeap () returned 0x630000 [0062.496] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.496] GetProcessHeap () returned 0x630000 [0062.496] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.496] GetProcessHeap () returned 0x630000 [0062.496] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.497] GetProcessHeap () returned 0x630000 [0062.497] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.497] GetProcessHeap () returned 0x630000 [0062.497] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.497] GetProcessHeap () returned 0x630000 [0062.497] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.497] GetProcessHeap () returned 0x630000 [0062.497] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.497] GetProcessHeap () returned 0x630000 [0062.497] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.497] GetProcessHeap () returned 0x630000 [0062.497] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.497] GetProcessHeap () returned 0x630000 [0062.497] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.497] GetProcessHeap () returned 0x630000 [0062.497] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.497] GetProcessHeap () returned 0x630000 [0062.497] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.497] GetProcessHeap () returned 0x630000 [0062.497] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.497] GetProcessHeap () returned 0x630000 [0062.497] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.497] GetProcessHeap () returned 0x630000 [0062.497] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.497] GetProcessHeap () returned 0x630000 [0062.497] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.497] GetProcessHeap () returned 0x630000 [0062.497] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.497] GetProcessHeap () returned 0x630000 [0062.497] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.497] GetProcessHeap () returned 0x630000 [0062.497] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.497] GetProcessHeap () returned 0x630000 [0062.497] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.497] GetProcessHeap () returned 0x630000 [0062.497] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.497] GetProcessHeap () returned 0x630000 [0062.498] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0062.498] GetProcessHeap () returned 0x630000 [0062.498] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0062.498] GetProcessHeap () returned 0x630000 [0062.498] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.498] GetProcessHeap () returned 0x630000 [0062.498] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.498] GetProcessHeap () returned 0x630000 [0062.498] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.498] GetProcessHeap () returned 0x630000 [0062.498] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.498] GetProcessHeap () returned 0x630000 [0062.498] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.498] GetProcessHeap () returned 0x630000 [0062.498] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.498] GetProcessHeap () returned 0x630000 [0062.498] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.498] GetProcessHeap () returned 0x630000 [0062.498] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.498] GetProcessHeap () returned 0x630000 [0062.498] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.498] GetProcessHeap () returned 0x630000 [0062.498] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.498] GetProcessHeap () returned 0x630000 [0062.498] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.498] GetProcessHeap () returned 0x630000 [0062.498] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.498] GetProcessHeap () returned 0x630000 [0062.498] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.498] GetProcessHeap () returned 0x630000 [0062.498] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.498] GetProcessHeap () returned 0x630000 [0062.498] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.498] GetProcessHeap () returned 0x630000 [0062.499] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.499] GetProcessHeap () returned 0x630000 [0062.499] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0062.499] GetProcessHeap () returned 0x630000 [0062.499] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0062.499] GetProcessHeap () returned 0x630000 [0062.499] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.499] GetProcessHeap () returned 0x630000 [0062.499] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.499] GetProcessHeap () returned 0x630000 [0062.499] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.499] GetProcessHeap () returned 0x630000 [0062.499] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.499] GetProcessHeap () returned 0x630000 [0062.499] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.499] GetProcessHeap () returned 0x630000 [0062.499] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.499] GetProcessHeap () returned 0x630000 [0062.499] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.499] GetProcessHeap () returned 0x630000 [0062.499] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.499] GetProcessHeap () returned 0x630000 [0062.499] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.499] GetProcessHeap () returned 0x630000 [0062.499] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.499] GetProcessHeap () returned 0x630000 [0062.499] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.499] GetProcessHeap () returned 0x630000 [0062.499] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.499] GetProcessHeap () returned 0x630000 [0062.499] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.499] GetProcessHeap () returned 0x630000 [0062.499] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.499] GetProcessHeap () returned 0x630000 [0062.500] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.500] GetProcessHeap () returned 0x630000 [0062.500] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.500] GetProcessHeap () returned 0x630000 [0062.500] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.500] GetProcessHeap () returned 0x630000 [0062.500] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.500] GetProcessHeap () returned 0x630000 [0062.500] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.500] GetProcessHeap () returned 0x630000 [0062.500] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.500] GetProcessHeap () returned 0x630000 [0062.500] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.500] GetProcessHeap () returned 0x630000 [0062.500] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.500] GetProcessHeap () returned 0x630000 [0062.500] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.500] GetProcessHeap () returned 0x630000 [0062.500] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.500] GetProcessHeap () returned 0x630000 [0062.500] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.500] GetProcessHeap () returned 0x630000 [0062.500] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.500] GetProcessHeap () returned 0x630000 [0062.500] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0062.500] GetProcessHeap () returned 0x630000 [0062.500] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.500] GetProcessHeap () returned 0x630000 [0062.500] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.500] GetProcessHeap () returned 0x630000 [0062.500] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.500] GetProcessHeap () returned 0x630000 [0062.500] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0062.501] GetProcessHeap () returned 0x630000 [0062.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0062.501] GetProcessHeap () returned 0x630000 [0062.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0062.501] GetProcessHeap () returned 0x630000 [0062.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0062.501] GetProcessHeap () returned 0x630000 [0062.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0062.501] GetProcessHeap () returned 0x630000 [0062.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e2b0 | out: hHeap=0x630000) returned 1 [0062.501] GetProcessHeap () returned 0x630000 [0062.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0062.501] GetProcessHeap () returned 0x630000 [0062.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0062.501] GetProcessHeap () returned 0x630000 [0062.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0062.501] GetProcessHeap () returned 0x630000 [0062.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.501] GetProcessHeap () returned 0x630000 [0062.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0062.501] WriteFile (in: hFile=0x230, lpBuffer=0x6593c8*, nNumberOfBytesToWrite=0x38f, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6593c8*, lpNumberOfBytesWritten=0x243d864*=0x38f, lpOverlapped=0x0) returned 1 [0062.825] GetProcessHeap () returned 0x630000 [0062.825] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6593c8, Size=0x30) returned 0x6593c8 [0062.825] GetProcessHeap () returned 0x630000 [0062.825] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0062.825] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0062.825] GetProcessHeap () returned 0x630000 [0062.825] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x42f0) returned 0x671bf0 [0062.825] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0x42f0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0x42f0, lpOverlapped=0x0) returned 1 [0062.826] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0062.826] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x42f0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0x42f0, lpOverlapped=0x0) returned 1 [0062.827] GetProcessHeap () returned 0x630000 [0062.827] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0062.827] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0062.827] WriteFile (in: hFile=0x230, lpBuffer=0x6593c8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6593c8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0062.830] CloseHandle (hObject=0x230) returned 1 [0062.832] GetProcessHeap () returned 0x630000 [0062.832] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0062.832] GetProcessHeap () returned 0x630000 [0062.832] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655b20 | out: hHeap=0x630000) returned 1 [0062.832] GetProcessHeap () returned 0x630000 [0062.832] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0062.832] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\WegKKDl.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\WegKKDl.m4a") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\WegKKDl.m4a" [0062.832] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\WegKKDl.m4a", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\WegKKDl.m4a.happythreechoose") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\WegKKDl.m4a.happythreechoose" [0062.832] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\WegKKDl.m4a" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\wegkkdl.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\WegKKDl.m4a.happythreechoose" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\wegkkdl.m4a.happythreechoose"), dwFlags=0x1) returned 1 [0062.833] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\WegKKDl.m4a" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ") returned 1 [0062.833] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\") returned="" [0062.833] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Decryption INFO.html" [0062.833] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\XKYlfaQ\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\xkylfaq\\decryption info.html")) returned 0x20 [0062.833] GetProcessHeap () returned 0x630000 [0062.833] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0062.833] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59827810, ftCreationTime.dwHighDateTime=0x1d5c84c, ftLastAccessTime.dwLowDateTime=0xeab27560, ftLastAccessTime.dwHighDateTime=0x1d5d076, ftLastWriteTime.dwLowDateTime=0xeab27560, ftLastWriteTime.dwHighDateTime=0x1d5d076, nFileSizeHigh=0x0, nFileSizeLow=0x42e1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WegKKDl.m4a", cAlternateFileName="")) returned 0 [0062.833] FindClose (in: hFindFile=0x648890 | out: hFindFile=0x648890) returned 1 [0062.833] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\" [0062.833] GetProcessHeap () returned 0x630000 [0062.833] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6548e0 | out: hHeap=0x630000) returned 1 [0062.833] GetProcessHeap () returned 0x630000 [0062.833] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0062.833] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\") returned 48 [0062.833] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\*") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\*" [0062.833] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd286e140, ftCreationTime.dwHighDateTime=0x1d5d3d4, ftLastAccessTime.dwLowDateTime=0x34c3360, ftLastAccessTime.dwHighDateTime=0x1d5d787, ftLastWriteTime.dwLowDateTime=0x34c3360, ftLastWriteTime.dwHighDateTime=0x1d5d787, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648890 [0062.834] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0062.834] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd286e140, ftCreationTime.dwHighDateTime=0x1d5d3d4, ftLastAccessTime.dwLowDateTime=0x34c3360, ftLastAccessTime.dwHighDateTime=0x1d5d787, ftLastWriteTime.dwLowDateTime=0x34c3360, ftLastWriteTime.dwHighDateTime=0x1d5d787, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.834] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0062.834] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0062.834] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2faa8570, ftCreationTime.dwHighDateTime=0x1d5d434, ftLastAccessTime.dwLowDateTime=0xf3aa6650, ftLastAccessTime.dwHighDateTime=0x1d5cd56, ftLastWriteTime.dwLowDateTime=0xf3aa6650, ftLastWriteTime.dwHighDateTime=0x1d5cd56, nFileSizeHigh=0x0, nFileSizeLow=0x1d86, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="77VxXfy4Fmq.m4a", cAlternateFileName="77VXXF~1.M4A")) returned 1 [0062.834] lstrcmpiW (lpString1="77VxXfy4Fmq.m4a", lpString2=".") returned 1 [0062.834] lstrcmpiW (lpString1="77VxXfy4Fmq.m4a", lpString2="..") returned 1 [0062.834] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\", lpString2="77VxXfy4Fmq.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\77VxXfy4Fmq.m4a") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\77VxXfy4Fmq.m4a" [0062.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="77VxXfy4Fmq.m4a", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0062.834] GetProcessHeap () returned 0x630000 [0062.834] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x64c9f0 [0062.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="77VxXfy4Fmq.m4a", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="77VxXfy4Fmq.m4a", lpUsedDefaultChar=0x0) returned 16 [0062.834] lstrlenA (lpString="77VxXfy4Fmq.m4a") returned 15 [0062.834] lstrlenA (lpString=".happythreechoose") returned 17 [0062.834] lstrcmpiW (lpString1="77VxXfy4Fmq.m4a", lpString2="Decryption INFO.html") returned -1 [0062.834] lstrcmpiW (lpString1="77VxXfy4Fmq.m4a", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0062.834] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0062.834] lstrcmpiW (lpString1="77VxXfy4Fmq.m4a", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0062.834] GetProcessHeap () returned 0x630000 [0062.834] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0062.834] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\77VxXfy4Fmq.m4a" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\tixsjbll wo2\\77vxxfy4fmq.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0062.834] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=7558) returned 1 [0062.834] GetProcessHeap () returned 0x630000 [0062.834] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655580 [0062.834] GetProcessHeap () returned 0x630000 [0062.834] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0062.834] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\77VxXfy4Fmq.m4a") returned 63 [0062.834] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0062.835] GetProcessHeap () returned 0x630000 [0062.835] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0062.835] GetProcessHeap () returned 0x630000 [0062.835] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38a) returned 0x659400 [0062.835] lstrlenA (lpString="rsa_encrypt") returned 11 [0062.835] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0062.835] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0062.835] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0062.835] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0062.835] GetProcessHeap () returned 0x630000 [0062.835] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0062.835] lstrlenA (lpString="010001") returned 6 [0062.835] GetProcessHeap () returned 0x630000 [0062.835] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0062.836] GetProcessHeap () returned 0x630000 [0062.836] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0062.836] GetProcessHeap () returned 0x630000 [0062.836] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0062.836] GetProcessHeap () returned 0x630000 [0062.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0062.840] GetProcessHeap () returned 0x630000 [0062.840] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e3d0 [0062.840] GetProcessHeap () returned 0x630000 [0062.840] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656ec8 [0062.840] GetProcessHeap () returned 0x630000 [0062.840] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2b8 [0062.840] GetProcessHeap () returned 0x630000 [0062.840] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0062.840] GetProcessHeap () returned 0x630000 [0062.840] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.840] GetProcessHeap () returned 0x630000 [0062.840] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0062.840] GetProcessHeap () returned 0x630000 [0062.840] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0062.840] GetProcessHeap () returned 0x630000 [0062.840] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657210 [0062.840] GetProcessHeap () returned 0x630000 [0062.840] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.840] GetProcessHeap () returned 0x630000 [0062.840] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0062.840] GetProcessHeap () returned 0x630000 [0062.840] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e460 [0062.840] GetProcessHeap () returned 0x630000 [0062.840] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0062.840] GetProcessHeap () returned 0x630000 [0062.840] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0062.840] GetProcessHeap () returned 0x630000 [0062.840] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e460 | out: hHeap=0x630000) returned 1 [0062.840] GetProcessHeap () returned 0x630000 [0062.840] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.840] GetProcessHeap () returned 0x630000 [0062.840] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65ce68 [0062.840] GetProcessHeap () returned 0x630000 [0062.840] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.840] GetProcessHeap () returned 0x630000 [0062.840] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.840] GetProcessHeap () returned 0x630000 [0062.840] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.840] GetProcessHeap () returned 0x630000 [0062.841] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.841] GetProcessHeap () returned 0x630000 [0062.841] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e4f0 [0062.841] GetProcessHeap () returned 0x630000 [0062.841] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ce68 | out: hHeap=0x630000) returned 1 [0062.841] GetProcessHeap () returned 0x630000 [0062.841] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0062.841] GetProcessHeap () returned 0x630000 [0062.841] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0062.841] GetProcessHeap () returned 0x630000 [0062.841] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.841] GetProcessHeap () returned 0x630000 [0062.841] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.841] GetProcessHeap () returned 0x630000 [0062.841] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.841] GetProcessHeap () returned 0x630000 [0062.841] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.841] GetProcessHeap () returned 0x630000 [0062.841] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0062.841] GetProcessHeap () returned 0x630000 [0062.841] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0062.841] GetProcessHeap () returned 0x630000 [0062.841] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.841] GetProcessHeap () returned 0x630000 [0062.841] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.841] GetProcessHeap () returned 0x630000 [0062.841] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0062.841] GetProcessHeap () returned 0x630000 [0062.841] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0062.841] GetProcessHeap () returned 0x630000 [0062.841] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.841] GetProcessHeap () returned 0x630000 [0062.841] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.841] GetProcessHeap () returned 0x630000 [0062.841] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.841] GetProcessHeap () returned 0x630000 [0062.841] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.841] GetProcessHeap () returned 0x630000 [0062.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.842] GetProcessHeap () returned 0x630000 [0062.842] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.842] GetProcessHeap () returned 0x630000 [0062.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0062.842] GetProcessHeap () returned 0x630000 [0062.842] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0062.842] GetProcessHeap () returned 0x630000 [0062.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.842] GetProcessHeap () returned 0x630000 [0062.842] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.842] GetProcessHeap () returned 0x630000 [0062.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.842] GetProcessHeap () returned 0x630000 [0062.842] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.842] GetProcessHeap () returned 0x630000 [0062.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0062.842] GetProcessHeap () returned 0x630000 [0062.842] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0062.842] GetProcessHeap () returned 0x630000 [0062.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0062.842] GetProcessHeap () returned 0x630000 [0062.842] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0062.842] GetProcessHeap () returned 0x630000 [0062.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.842] GetProcessHeap () returned 0x630000 [0062.842] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.842] GetProcessHeap () returned 0x630000 [0062.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.842] GetProcessHeap () returned 0x630000 [0062.842] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.842] GetProcessHeap () returned 0x630000 [0062.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.842] GetProcessHeap () returned 0x630000 [0062.842] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.842] GetProcessHeap () returned 0x630000 [0062.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.843] GetProcessHeap () returned 0x630000 [0062.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.843] GetProcessHeap () returned 0x630000 [0062.843] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.843] GetProcessHeap () returned 0x630000 [0062.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.843] GetProcessHeap () returned 0x630000 [0062.843] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0062.843] GetProcessHeap () returned 0x630000 [0062.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0062.843] GetProcessHeap () returned 0x630000 [0062.843] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.843] GetProcessHeap () returned 0x630000 [0062.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.843] GetProcessHeap () returned 0x630000 [0062.843] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.843] GetProcessHeap () returned 0x630000 [0062.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.843] GetProcessHeap () returned 0x630000 [0062.843] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.843] GetProcessHeap () returned 0x630000 [0062.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.843] GetProcessHeap () returned 0x630000 [0062.843] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.843] GetProcessHeap () returned 0x630000 [0062.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.843] GetProcessHeap () returned 0x630000 [0062.843] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0062.843] GetProcessHeap () returned 0x630000 [0062.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0062.843] GetProcessHeap () returned 0x630000 [0062.843] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0062.843] GetProcessHeap () returned 0x630000 [0062.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0062.843] GetProcessHeap () returned 0x630000 [0062.843] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0062.843] GetProcessHeap () returned 0x630000 [0062.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0062.844] GetProcessHeap () returned 0x630000 [0062.844] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.844] GetProcessHeap () returned 0x630000 [0062.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.844] GetProcessHeap () returned 0x630000 [0062.844] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.844] GetProcessHeap () returned 0x630000 [0062.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.844] GetProcessHeap () returned 0x630000 [0062.844] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.844] GetProcessHeap () returned 0x630000 [0062.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.844] GetProcessHeap () returned 0x630000 [0062.844] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.844] GetProcessHeap () returned 0x630000 [0062.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.844] GetProcessHeap () returned 0x630000 [0062.844] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.844] GetProcessHeap () returned 0x630000 [0062.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.844] GetProcessHeap () returned 0x630000 [0062.844] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.844] GetProcessHeap () returned 0x630000 [0062.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.844] GetProcessHeap () returned 0x630000 [0062.844] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0062.844] GetProcessHeap () returned 0x630000 [0062.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0062.844] GetProcessHeap () returned 0x630000 [0062.844] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0062.844] GetProcessHeap () returned 0x630000 [0062.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0062.845] GetProcessHeap () returned 0x630000 [0062.845] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.845] GetProcessHeap () returned 0x630000 [0062.845] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.845] GetProcessHeap () returned 0x630000 [0062.845] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.845] GetProcessHeap () returned 0x630000 [0062.845] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.845] GetProcessHeap () returned 0x630000 [0062.845] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0062.845] GetProcessHeap () returned 0x630000 [0062.845] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0062.845] GetProcessHeap () returned 0x630000 [0062.845] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.845] GetProcessHeap () returned 0x630000 [0062.845] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.845] GetProcessHeap () returned 0x630000 [0062.845] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.845] GetProcessHeap () returned 0x630000 [0062.845] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.845] GetProcessHeap () returned 0x630000 [0062.845] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0062.845] GetProcessHeap () returned 0x630000 [0062.845] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0062.845] GetProcessHeap () returned 0x630000 [0062.845] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0062.845] GetProcessHeap () returned 0x630000 [0062.845] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0062.845] GetProcessHeap () returned 0x630000 [0062.845] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0062.845] GetProcessHeap () returned 0x630000 [0062.846] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0062.846] GetProcessHeap () returned 0x630000 [0062.846] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0062.846] GetProcessHeap () returned 0x630000 [0062.846] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0062.846] GetProcessHeap () returned 0x630000 [0062.846] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0062.846] GetProcessHeap () returned 0x630000 [0062.846] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0062.846] GetProcessHeap () returned 0x630000 [0062.846] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0062.846] GetProcessHeap () returned 0x630000 [0062.846] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0062.846] GetProcessHeap () returned 0x630000 [0062.846] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0062.846] GetProcessHeap () returned 0x630000 [0062.846] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0062.846] GetProcessHeap () returned 0x630000 [0062.846] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0062.846] WriteFile (in: hFile=0x230, lpBuffer=0x659400*, nNumberOfBytesToWrite=0x38a, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659400*, lpNumberOfBytesWritten=0x243d864*=0x38a, lpOverlapped=0x0) returned 1 [0062.849] GetProcessHeap () returned 0x630000 [0062.849] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659400, Size=0x30) returned 0x659400 [0062.849] GetProcessHeap () returned 0x630000 [0062.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0062.850] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0062.850] GetProcessHeap () returned 0x630000 [0062.850] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1d90) returned 0x671bf0 [0062.850] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0x1d90, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0x1d90, lpOverlapped=0x0) returned 1 [0062.850] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0062.850] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0x1d90, lpOverlapped=0x0) returned 1 [0062.855] GetProcessHeap () returned 0x630000 [0062.855] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0062.855] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0062.856] WriteFile (in: hFile=0x230, lpBuffer=0x659400*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659400*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0062.857] CloseHandle (hObject=0x230) returned 1 [0062.858] GetProcessHeap () returned 0x630000 [0062.858] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0062.858] GetProcessHeap () returned 0x630000 [0062.858] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655580 | out: hHeap=0x630000) returned 1 [0062.858] GetProcessHeap () returned 0x630000 [0062.858] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0062.858] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\77VxXfy4Fmq.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\77VxXfy4Fmq.m4a") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\77VxXfy4Fmq.m4a" [0062.858] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\77VxXfy4Fmq.m4a", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\77VxXfy4Fmq.m4a.happythreechoose") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\77VxXfy4Fmq.m4a.happythreechoose" [0062.858] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\77VxXfy4Fmq.m4a" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\tixsjbll wo2\\77vxxfy4fmq.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\77VxXfy4Fmq.m4a.happythreechoose" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\tixsjbll wo2\\77vxxfy4fmq.m4a.happythreechoose"), dwFlags=0x1) returned 1 [0062.860] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\77VxXfy4Fmq.m4a" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2") returned 1 [0062.860] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\") returned="" [0062.860] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\Decryption INFO.html" [0062.860] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\tixsjbll wo2\\decryption info.html")) returned 0xffffffff [0062.860] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\tixsjbll wo2\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0062.860] GetProcessHeap () returned 0x630000 [0062.860] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655760 [0062.860] GetProcessHeap () returned 0x630000 [0062.860] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0062.871] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.872] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.872] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.872] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.872] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.872] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.873] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.873] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.873] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.873] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.873] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.873] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.873] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.873] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.873] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.873] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.873] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.873] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.874] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.874] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.874] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.874] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.874] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.874] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.874] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.874] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.874] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.874] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.874] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.874] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.874] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.875] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.875] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.875] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.875] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.875] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.875] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.876] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.876] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.876] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.876] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.876] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.876] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.876] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.876] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.877] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.878] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.879] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.880] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.881] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.881] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.881] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.881] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.881] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.881] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.881] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.881] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.881] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.881] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.881] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.881] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.881] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.881] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.882] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.882] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.882] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.882] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.882] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.882] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.882] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.882] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.882] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.882] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.882] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.882] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.882] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.885] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.885] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.885] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.885] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.885] GetProcessHeap () returned 0x630000 [0062.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655760 | out: hHeap=0x630000) returned 1 [0062.885] GetProcessHeap () returned 0x630000 [0062.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0062.885] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0062.885] GetProcessHeap () returned 0x630000 [0062.885] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655418 [0062.885] GetProcessHeap () returned 0x630000 [0062.885] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0062.892] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.892] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.892] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.892] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.892] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.892] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.892] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.893] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.893] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.893] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.893] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.893] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.893] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.893] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.893] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.893] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.893] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.893] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.893] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.893] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.894] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.894] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.894] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.894] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.894] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.894] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.894] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.894] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.894] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.894] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.894] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.894] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.894] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.894] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.895] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.895] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.895] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.895] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.895] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.895] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.895] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.895] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.895] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.895] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.895] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.895] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.895] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.896] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.896] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.896] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.896] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.896] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.896] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.896] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.896] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.896] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.896] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.896] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.896] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.896] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.896] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.897] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.897] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.897] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.897] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.897] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.897] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.897] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.897] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.897] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.897] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.897] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.897] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.897] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.897] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.898] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.898] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.898] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.898] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.898] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.898] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0062.898] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.136] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.136] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.137] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.137] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.137] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.137] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.137] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.137] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.137] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.137] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.137] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.137] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.137] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.137] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.137] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.138] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.138] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.138] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.138] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.138] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.138] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.138] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.138] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.138] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.138] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.138] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.138] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.138] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.139] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.139] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.139] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.139] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.139] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.139] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.139] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.139] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.140] GetProcessHeap () returned 0x630000 [0063.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655418 | out: hHeap=0x630000) returned 1 [0063.140] GetProcessHeap () returned 0x630000 [0063.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0063.140] CloseHandle (hObject=0x230) returned 1 [0063.251] GetProcessHeap () returned 0x630000 [0063.251] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0063.251] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c307f90, ftCreationTime.dwHighDateTime=0x1d5d0e8, ftLastAccessTime.dwLowDateTime=0xafea3a90, ftLastAccessTime.dwHighDateTime=0x1d5c797, ftLastWriteTime.dwLowDateTime=0xafea3a90, ftLastWriteTime.dwHighDateTime=0x1d5c797, nFileSizeHigh=0x0, nFileSizeLow=0xccb9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="94i7trk2kHdzvrBAW0.mp3", cAlternateFileName="94I7TR~1.MP3")) returned 1 [0063.251] lstrcmpiW (lpString1="94i7trk2kHdzvrBAW0.mp3", lpString2=".") returned 1 [0063.251] lstrcmpiW (lpString1="94i7trk2kHdzvrBAW0.mp3", lpString2="..") returned 1 [0063.251] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\", lpString2="94i7trk2kHdzvrBAW0.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\94i7trk2kHdzvrBAW0.mp3") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\94i7trk2kHdzvrBAW0.mp3" [0063.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="94i7trk2kHdzvrBAW0.mp3", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0063.251] GetProcessHeap () returned 0x630000 [0063.251] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x17) returned 0x645c78 [0063.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="94i7trk2kHdzvrBAW0.mp3", cchWideChar=-1, lpMultiByteStr=0x645c78, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="94i7trk2kHdzvrBAW0.mp3", lpUsedDefaultChar=0x0) returned 23 [0063.252] lstrlenA (lpString="94i7trk2kHdzvrBAW0.mp3") returned 22 [0063.252] lstrlenA (lpString=".happythreechoose") returned 17 [0063.252] lstrlenA (lpString=".happythreechoose") returned 17 [0063.252] lstrlenA (lpString="94i7trk2kHdzvrBAW0.mp3") returned 22 [0063.252] lstrcmpiA (lpString1="rk2kHdzvrBAW0.mp3", lpString2=".happythreechoose") returned 1 [0063.252] lstrcmpiW (lpString1="94i7trk2kHdzvrBAW0.mp3", lpString2="Decryption INFO.html") returned -1 [0063.252] lstrcmpiW (lpString1="94i7trk2kHdzvrBAW0.mp3", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0063.252] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0063.252] lstrcmpiW (lpString1="94i7trk2kHdzvrBAW0.mp3", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0063.252] GetProcessHeap () returned 0x630000 [0063.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0063.252] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\94i7trk2kHdzvrBAW0.mp3" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\tixsjbll wo2\\94i7trk2khdzvrbaw0.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0063.252] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=52409) returned 1 [0063.252] GetProcessHeap () returned 0x630000 [0063.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6555f8 [0063.252] GetProcessHeap () returned 0x630000 [0063.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0063.252] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\94i7trk2kHdzvrBAW0.mp3") returned 70 [0063.252] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0063.252] GetProcessHeap () returned 0x630000 [0063.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0063.252] GetProcessHeap () returned 0x630000 [0063.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x387) returned 0x659438 [0063.253] lstrlenA (lpString="rsa_encrypt") returned 11 [0063.253] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0063.253] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0063.253] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0063.253] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0063.253] GetProcessHeap () returned 0x630000 [0063.253] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0063.253] lstrlenA (lpString="010001") returned 6 [0063.253] GetProcessHeap () returned 0x630000 [0063.253] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a318 [0063.253] GetProcessHeap () returned 0x630000 [0063.253] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0063.253] GetProcessHeap () returned 0x630000 [0063.253] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e7c0 [0063.253] GetProcessHeap () returned 0x630000 [0063.253] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0063.253] GetProcessHeap () returned 0x630000 [0063.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ebb0 [0063.254] GetProcessHeap () returned 0x630000 [0063.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656fe0 [0063.254] GetProcessHeap () returned 0x630000 [0063.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0063.254] GetProcessHeap () returned 0x630000 [0063.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0063.254] GetProcessHeap () returned 0x630000 [0063.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.254] GetProcessHeap () returned 0x630000 [0063.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0063.254] GetProcessHeap () returned 0x630000 [0063.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0063.254] GetProcessHeap () returned 0x630000 [0063.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657670 [0063.254] GetProcessHeap () returned 0x630000 [0063.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0063.254] GetProcessHeap () returned 0x630000 [0063.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0063.254] GetProcessHeap () returned 0x630000 [0063.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e100 [0063.254] GetProcessHeap () returned 0x630000 [0063.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0063.254] GetProcessHeap () returned 0x630000 [0063.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0063.254] GetProcessHeap () returned 0x630000 [0063.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0063.254] GetProcessHeap () returned 0x630000 [0063.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.254] GetProcessHeap () returned 0x630000 [0063.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0063.254] GetProcessHeap () returned 0x630000 [0063.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0063.254] GetProcessHeap () returned 0x630000 [0063.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.254] GetProcessHeap () returned 0x630000 [0063.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.254] GetProcessHeap () returned 0x630000 [0063.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.255] GetProcessHeap () returned 0x630000 [0063.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65df50 [0063.255] GetProcessHeap () returned 0x630000 [0063.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0063.255] GetProcessHeap () returned 0x630000 [0063.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0063.255] GetProcessHeap () returned 0x630000 [0063.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0063.255] GetProcessHeap () returned 0x630000 [0063.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.255] GetProcessHeap () returned 0x630000 [0063.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.255] GetProcessHeap () returned 0x630000 [0063.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.255] GetProcessHeap () returned 0x630000 [0063.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.255] GetProcessHeap () returned 0x630000 [0063.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.255] GetProcessHeap () returned 0x630000 [0063.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.255] GetProcessHeap () returned 0x630000 [0063.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.255] GetProcessHeap () returned 0x630000 [0063.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.255] GetProcessHeap () returned 0x630000 [0063.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.255] GetProcessHeap () returned 0x630000 [0063.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.255] GetProcessHeap () returned 0x630000 [0063.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0063.255] GetProcessHeap () returned 0x630000 [0063.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0063.255] GetProcessHeap () returned 0x630000 [0063.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0063.255] GetProcessHeap () returned 0x630000 [0063.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0063.256] GetProcessHeap () returned 0x630000 [0063.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0063.256] GetProcessHeap () returned 0x630000 [0063.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0063.256] GetProcessHeap () returned 0x630000 [0063.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0063.256] GetProcessHeap () returned 0x630000 [0063.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0063.256] GetProcessHeap () returned 0x630000 [0063.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0063.256] GetProcessHeap () returned 0x630000 [0063.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0063.256] GetProcessHeap () returned 0x630000 [0063.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0063.256] GetProcessHeap () returned 0x630000 [0063.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0063.256] GetProcessHeap () returned 0x630000 [0063.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.256] GetProcessHeap () returned 0x630000 [0063.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.256] GetProcessHeap () returned 0x630000 [0063.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.256] GetProcessHeap () returned 0x630000 [0063.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.256] GetProcessHeap () returned 0x630000 [0063.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0063.256] GetProcessHeap () returned 0x630000 [0063.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0063.256] GetProcessHeap () returned 0x630000 [0063.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.256] GetProcessHeap () returned 0x630000 [0063.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.256] GetProcessHeap () returned 0x630000 [0063.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0063.256] GetProcessHeap () returned 0x630000 [0063.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0063.256] GetProcessHeap () returned 0x630000 [0063.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0063.257] GetProcessHeap () returned 0x630000 [0063.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0063.257] GetProcessHeap () returned 0x630000 [0063.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0063.257] GetProcessHeap () returned 0x630000 [0063.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0063.257] GetProcessHeap () returned 0x630000 [0063.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.257] GetProcessHeap () returned 0x630000 [0063.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.257] GetProcessHeap () returned 0x630000 [0063.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0063.257] GetProcessHeap () returned 0x630000 [0063.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0063.257] GetProcessHeap () returned 0x630000 [0063.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.257] GetProcessHeap () returned 0x630000 [0063.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.257] GetProcessHeap () returned 0x630000 [0063.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0063.257] GetProcessHeap () returned 0x630000 [0063.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0063.257] GetProcessHeap () returned 0x630000 [0063.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.257] GetProcessHeap () returned 0x630000 [0063.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.257] GetProcessHeap () returned 0x630000 [0063.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.257] GetProcessHeap () returned 0x630000 [0063.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.257] GetProcessHeap () returned 0x630000 [0063.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0063.257] GetProcessHeap () returned 0x630000 [0063.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0063.258] GetProcessHeap () returned 0x630000 [0063.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0063.258] GetProcessHeap () returned 0x630000 [0063.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0063.258] GetProcessHeap () returned 0x630000 [0063.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.258] GetProcessHeap () returned 0x630000 [0063.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.258] GetProcessHeap () returned 0x630000 [0063.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.258] GetProcessHeap () returned 0x630000 [0063.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.258] GetProcessHeap () returned 0x630000 [0063.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.258] GetProcessHeap () returned 0x630000 [0063.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.258] GetProcessHeap () returned 0x630000 [0063.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.258] GetProcessHeap () returned 0x630000 [0063.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.258] GetProcessHeap () returned 0x630000 [0063.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0063.258] GetProcessHeap () returned 0x630000 [0063.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0063.258] GetProcessHeap () returned 0x630000 [0063.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.258] GetProcessHeap () returned 0x630000 [0063.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.258] GetProcessHeap () returned 0x630000 [0063.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0063.258] GetProcessHeap () returned 0x630000 [0063.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0063.258] GetProcessHeap () returned 0x630000 [0063.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0063.258] GetProcessHeap () returned 0x630000 [0063.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0063.259] GetProcessHeap () returned 0x630000 [0063.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.259] GetProcessHeap () returned 0x630000 [0063.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.259] GetProcessHeap () returned 0x630000 [0063.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.259] GetProcessHeap () returned 0x630000 [0063.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.259] GetProcessHeap () returned 0x630000 [0063.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.259] GetProcessHeap () returned 0x630000 [0063.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.259] GetProcessHeap () returned 0x630000 [0063.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.259] GetProcessHeap () returned 0x630000 [0063.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.259] GetProcessHeap () returned 0x630000 [0063.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0063.259] GetProcessHeap () returned 0x630000 [0063.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0063.259] GetProcessHeap () returned 0x630000 [0063.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0063.259] GetProcessHeap () returned 0x630000 [0063.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0063.259] GetProcessHeap () returned 0x630000 [0063.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0063.259] GetProcessHeap () returned 0x630000 [0063.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0063.259] GetProcessHeap () returned 0x630000 [0063.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0063.259] GetProcessHeap () returned 0x630000 [0063.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0063.259] GetProcessHeap () returned 0x630000 [0063.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0063.259] GetProcessHeap () returned 0x630000 [0063.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0063.260] GetProcessHeap () returned 0x630000 [0063.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0063.260] GetProcessHeap () returned 0x630000 [0063.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0063.260] GetProcessHeap () returned 0x630000 [0063.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0063.260] GetProcessHeap () returned 0x630000 [0063.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e7c0 | out: hHeap=0x630000) returned 1 [0063.260] GetProcessHeap () returned 0x630000 [0063.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0063.260] GetProcessHeap () returned 0x630000 [0063.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.260] GetProcessHeap () returned 0x630000 [0063.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0063.260] WriteFile (in: hFile=0x230, lpBuffer=0x659438*, nNumberOfBytesToWrite=0x387, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659438*, lpNumberOfBytesWritten=0x243d864*=0x387, lpOverlapped=0x0) returned 1 [0063.262] GetProcessHeap () returned 0x630000 [0063.262] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659438, Size=0x30) returned 0x659438 [0063.262] GetProcessHeap () returned 0x630000 [0063.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0063.262] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0063.262] GetProcessHeap () returned 0x630000 [0063.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xccc0) returned 0x671bf0 [0063.262] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0xccc0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0xccc0, lpOverlapped=0x0) returned 1 [0063.263] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0063.263] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0xccc0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0xccc0, lpOverlapped=0x0) returned 1 [0063.270] GetProcessHeap () returned 0x630000 [0063.270] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0063.272] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0063.272] WriteFile (in: hFile=0x230, lpBuffer=0x659438*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659438*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0063.273] CloseHandle (hObject=0x230) returned 1 [0063.280] GetProcessHeap () returned 0x630000 [0063.280] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0063.280] GetProcessHeap () returned 0x630000 [0063.280] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6555f8 | out: hHeap=0x630000) returned 1 [0063.280] GetProcessHeap () returned 0x630000 [0063.280] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0063.280] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\94i7trk2kHdzvrBAW0.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\94i7trk2kHdzvrBAW0.mp3") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\94i7trk2kHdzvrBAW0.mp3" [0063.280] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\94i7trk2kHdzvrBAW0.mp3", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\94i7trk2kHdzvrBAW0.mp3.happythreechoose") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\94i7trk2kHdzvrBAW0.mp3.happythreechoose" [0063.280] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\94i7trk2kHdzvrBAW0.mp3" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\tixsjbll wo2\\94i7trk2khdzvrbaw0.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\94i7trk2kHdzvrBAW0.mp3.happythreechoose" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\tixsjbll wo2\\94i7trk2khdzvrbaw0.mp3.happythreechoose"), dwFlags=0x1) returned 1 [0063.281] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\94i7trk2kHdzvrBAW0.mp3" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2") returned 1 [0063.281] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\") returned="" [0063.281] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\Decryption INFO.html" [0063.281] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\tixsjbll wo2\\decryption info.html")) returned 0x20 [0063.281] GetProcessHeap () returned 0x630000 [0063.281] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645c78 | out: hHeap=0x630000) returned 1 [0063.281] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65adf940, ftCreationTime.dwHighDateTime=0x1d5cf3e, ftLastAccessTime.dwLowDateTime=0x90ff7300, ftLastAccessTime.dwHighDateTime=0x1d5d2ed, ftLastWriteTime.dwLowDateTime=0x90ff7300, ftLastWriteTime.dwHighDateTime=0x1d5d2ed, nFileSizeHigh=0x0, nFileSizeLow=0x13125, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BJh05YZFlMm.mp3", cAlternateFileName="BJH05Y~1.MP3")) returned 1 [0063.281] lstrcmpiW (lpString1="BJh05YZFlMm.mp3", lpString2=".") returned 1 [0063.281] lstrcmpiW (lpString1="BJh05YZFlMm.mp3", lpString2="..") returned 1 [0063.281] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\", lpString2="BJh05YZFlMm.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\BJh05YZFlMm.mp3") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\BJh05YZFlMm.mp3" [0063.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BJh05YZFlMm.mp3", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0063.281] GetProcessHeap () returned 0x630000 [0063.281] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x64ca20 [0063.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BJh05YZFlMm.mp3", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BJh05YZFlMm.mp3", lpUsedDefaultChar=0x0) returned 16 [0063.281] lstrlenA (lpString="BJh05YZFlMm.mp3") returned 15 [0063.281] lstrlenA (lpString=".happythreechoose") returned 17 [0063.282] lstrcmpiW (lpString1="BJh05YZFlMm.mp3", lpString2="Decryption INFO.html") returned -1 [0063.282] lstrcmpiW (lpString1="BJh05YZFlMm.mp3", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0063.282] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0063.282] lstrcmpiW (lpString1="BJh05YZFlMm.mp3", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0063.282] GetProcessHeap () returned 0x630000 [0063.282] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0063.282] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\BJh05YZFlMm.mp3" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\tixsjbll wo2\\bjh05yzflmm.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0063.282] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=78117) returned 1 [0063.282] GetProcessHeap () returned 0x630000 [0063.282] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6557d8 [0063.282] GetProcessHeap () returned 0x630000 [0063.282] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0063.282] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\BJh05YZFlMm.mp3") returned 63 [0063.282] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0063.282] GetProcessHeap () returned 0x630000 [0063.282] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0063.282] GetProcessHeap () returned 0x630000 [0063.282] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x659470 [0063.282] lstrlenA (lpString="rsa_encrypt") returned 11 [0063.282] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0063.283] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0063.283] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0063.283] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0063.283] GetProcessHeap () returned 0x630000 [0063.283] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0063.283] lstrlenA (lpString="010001") returned 6 [0063.283] GetProcessHeap () returned 0x630000 [0063.283] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2b8 [0063.283] GetProcessHeap () returned 0x630000 [0063.283] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0063.283] GetProcessHeap () returned 0x630000 [0063.283] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e2b0 [0063.283] GetProcessHeap () returned 0x630000 [0063.283] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0063.283] GetProcessHeap () returned 0x630000 [0063.283] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e340 [0063.283] GetProcessHeap () returned 0x630000 [0063.283] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656a68 [0063.283] GetProcessHeap () returned 0x630000 [0063.283] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a348 [0063.283] GetProcessHeap () returned 0x630000 [0063.283] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0063.283] GetProcessHeap () returned 0x630000 [0063.283] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0063.283] GetProcessHeap () returned 0x630000 [0063.283] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0063.284] GetProcessHeap () returned 0x630000 [0063.284] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0063.284] GetProcessHeap () returned 0x630000 [0063.284] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656fe0 [0063.284] GetProcessHeap () returned 0x630000 [0063.284] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0063.284] GetProcessHeap () returned 0x630000 [0063.284] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0063.284] GetProcessHeap () returned 0x630000 [0063.284] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dfe0 [0063.284] GetProcessHeap () returned 0x630000 [0063.284] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0063.284] GetProcessHeap () returned 0x630000 [0063.284] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0063.284] GetProcessHeap () returned 0x630000 [0063.284] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0063.284] GetProcessHeap () returned 0x630000 [0063.284] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.284] GetProcessHeap () returned 0x630000 [0063.284] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65d078 [0063.284] GetProcessHeap () returned 0x630000 [0063.284] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0063.284] GetProcessHeap () returned 0x630000 [0063.284] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.284] GetProcessHeap () returned 0x630000 [0063.284] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.284] GetProcessHeap () returned 0x630000 [0063.284] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.284] GetProcessHeap () returned 0x630000 [0063.284] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e190 [0063.284] GetProcessHeap () returned 0x630000 [0063.284] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65d078 | out: hHeap=0x630000) returned 1 [0063.284] GetProcessHeap () returned 0x630000 [0063.284] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0063.284] GetProcessHeap () returned 0x630000 [0063.284] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0063.284] GetProcessHeap () returned 0x630000 [0063.284] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.284] GetProcessHeap () returned 0x630000 [0063.284] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.285] GetProcessHeap () returned 0x630000 [0063.285] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.285] GetProcessHeap () returned 0x630000 [0063.285] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.285] GetProcessHeap () returned 0x630000 [0063.285] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0063.285] GetProcessHeap () returned 0x630000 [0063.285] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0063.285] GetProcessHeap () returned 0x630000 [0063.285] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.285] GetProcessHeap () returned 0x630000 [0063.285] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.285] GetProcessHeap () returned 0x630000 [0063.285] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.285] GetProcessHeap () returned 0x630000 [0063.285] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.285] GetProcessHeap () returned 0x630000 [0063.285] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.285] GetProcessHeap () returned 0x630000 [0063.285] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.285] GetProcessHeap () returned 0x630000 [0063.285] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.285] GetProcessHeap () returned 0x630000 [0063.285] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.285] GetProcessHeap () returned 0x630000 [0063.285] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.285] GetProcessHeap () returned 0x630000 [0063.285] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.285] GetProcessHeap () returned 0x630000 [0063.285] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.285] GetProcessHeap () returned 0x630000 [0063.285] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.285] GetProcessHeap () returned 0x630000 [0063.285] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.285] GetProcessHeap () returned 0x630000 [0063.285] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.285] GetProcessHeap () returned 0x630000 [0063.285] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0063.286] GetProcessHeap () returned 0x630000 [0063.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0063.286] GetProcessHeap () returned 0x630000 [0063.286] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.286] GetProcessHeap () returned 0x630000 [0063.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.286] GetProcessHeap () returned 0x630000 [0063.286] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.286] GetProcessHeap () returned 0x630000 [0063.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.286] GetProcessHeap () returned 0x630000 [0063.286] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0063.286] GetProcessHeap () returned 0x630000 [0063.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0063.286] GetProcessHeap () returned 0x630000 [0063.286] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0063.286] GetProcessHeap () returned 0x630000 [0063.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0063.286] GetProcessHeap () returned 0x630000 [0063.286] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.286] GetProcessHeap () returned 0x630000 [0063.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.286] GetProcessHeap () returned 0x630000 [0063.286] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.286] GetProcessHeap () returned 0x630000 [0063.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.286] GetProcessHeap () returned 0x630000 [0063.286] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.286] GetProcessHeap () returned 0x630000 [0063.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.286] GetProcessHeap () returned 0x630000 [0063.286] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.286] GetProcessHeap () returned 0x630000 [0063.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.286] GetProcessHeap () returned 0x630000 [0063.286] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.287] GetProcessHeap () returned 0x630000 [0063.287] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.287] GetProcessHeap () returned 0x630000 [0063.287] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.287] GetProcessHeap () returned 0x630000 [0063.287] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.287] GetProcessHeap () returned 0x630000 [0063.287] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0063.287] GetProcessHeap () returned 0x630000 [0063.287] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0063.287] GetProcessHeap () returned 0x630000 [0063.287] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.287] GetProcessHeap () returned 0x630000 [0063.287] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.287] GetProcessHeap () returned 0x630000 [0063.287] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.287] GetProcessHeap () returned 0x630000 [0063.287] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.287] GetProcessHeap () returned 0x630000 [0063.287] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.287] GetProcessHeap () returned 0x630000 [0063.287] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.287] GetProcessHeap () returned 0x630000 [0063.287] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.287] GetProcessHeap () returned 0x630000 [0063.287] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.287] GetProcessHeap () returned 0x630000 [0063.287] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.287] GetProcessHeap () returned 0x630000 [0063.287] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.287] GetProcessHeap () returned 0x630000 [0063.287] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.287] GetProcessHeap () returned 0x630000 [0063.287] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.287] GetProcessHeap () returned 0x630000 [0063.287] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.287] GetProcessHeap () returned 0x630000 [0063.287] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.288] GetProcessHeap () returned 0x630000 [0063.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.288] GetProcessHeap () returned 0x630000 [0063.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.288] GetProcessHeap () returned 0x630000 [0063.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.288] GetProcessHeap () returned 0x630000 [0063.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.288] GetProcessHeap () returned 0x630000 [0063.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.288] GetProcessHeap () returned 0x630000 [0063.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.288] GetProcessHeap () returned 0x630000 [0063.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.288] GetProcessHeap () returned 0x630000 [0063.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.288] GetProcessHeap () returned 0x630000 [0063.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.288] GetProcessHeap () returned 0x630000 [0063.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.288] GetProcessHeap () returned 0x630000 [0063.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0063.288] GetProcessHeap () returned 0x630000 [0063.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0063.288] GetProcessHeap () returned 0x630000 [0063.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.288] GetProcessHeap () returned 0x630000 [0063.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.288] GetProcessHeap () returned 0x630000 [0063.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0063.288] GetProcessHeap () returned 0x630000 [0063.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0063.288] GetProcessHeap () returned 0x630000 [0063.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.288] GetProcessHeap () returned 0x630000 [0063.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.288] GetProcessHeap () returned 0x630000 [0063.289] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.289] GetProcessHeap () returned 0x630000 [0063.289] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.289] GetProcessHeap () returned 0x630000 [0063.289] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.289] GetProcessHeap () returned 0x630000 [0063.289] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.289] GetProcessHeap () returned 0x630000 [0063.289] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.289] GetProcessHeap () returned 0x630000 [0063.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.293] GetProcessHeap () returned 0x630000 [0063.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0063.293] GetProcessHeap () returned 0x630000 [0063.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0063.293] GetProcessHeap () returned 0x630000 [0063.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0063.293] GetProcessHeap () returned 0x630000 [0063.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0063.293] GetProcessHeap () returned 0x630000 [0063.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0063.293] GetProcessHeap () returned 0x630000 [0063.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0063.293] GetProcessHeap () returned 0x630000 [0063.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0063.293] GetProcessHeap () returned 0x630000 [0063.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e2b0 | out: hHeap=0x630000) returned 1 [0063.293] GetProcessHeap () returned 0x630000 [0063.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0063.293] GetProcessHeap () returned 0x630000 [0063.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0063.293] GetProcessHeap () returned 0x630000 [0063.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0063.293] WriteFile (in: hFile=0x230, lpBuffer=0x659470*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659470*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0063.299] GetProcessHeap () returned 0x630000 [0063.299] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659470, Size=0x30) returned 0x659470 [0063.299] GetProcessHeap () returned 0x630000 [0063.299] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0063.299] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0063.299] GetProcessHeap () returned 0x630000 [0063.299] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x13125) returned 0x671bf0 [0063.301] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0x13125, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0x13125, lpOverlapped=0x0) returned 1 [0063.302] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0063.302] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x13125, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0x13125, lpOverlapped=0x0) returned 1 [0063.304] GetProcessHeap () returned 0x630000 [0063.304] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0063.304] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0063.304] WriteFile (in: hFile=0x230, lpBuffer=0x659470*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659470*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0063.305] CloseHandle (hObject=0x230) returned 1 [0063.307] GetProcessHeap () returned 0x630000 [0063.307] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0063.307] GetProcessHeap () returned 0x630000 [0063.307] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6557d8 | out: hHeap=0x630000) returned 1 [0063.307] GetProcessHeap () returned 0x630000 [0063.307] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0063.308] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\BJh05YZFlMm.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\BJh05YZFlMm.mp3") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\BJh05YZFlMm.mp3" [0063.308] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\BJh05YZFlMm.mp3", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\BJh05YZFlMm.mp3.happythreechoose") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\BJh05YZFlMm.mp3.happythreechoose" [0063.308] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\BJh05YZFlMm.mp3" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\tixsjbll wo2\\bjh05yzflmm.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\BJh05YZFlMm.mp3.happythreechoose" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\tixsjbll wo2\\bjh05yzflmm.mp3.happythreechoose"), dwFlags=0x1) returned 1 [0063.308] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\BJh05YZFlMm.mp3" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2") returned 1 [0063.308] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\") returned="" [0063.308] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\Decryption INFO.html" [0063.308] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\tixsjbll wo2\\decryption info.html")) returned 0x20 [0063.308] GetProcessHeap () returned 0x630000 [0063.308] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0063.308] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc73102e0, ftCreationTime.dwHighDateTime=0x1d5d2b1, ftLastAccessTime.dwLowDateTime=0xe175ce0, ftLastAccessTime.dwHighDateTime=0x1d5d708, ftLastWriteTime.dwLowDateTime=0xe175ce0, ftLastWriteTime.dwHighDateTime=0x1d5d708, nFileSizeHigh=0x0, nFileSizeLow=0x12711, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RzU X.wav", cAlternateFileName="RZUX~1.WAV")) returned 1 [0063.309] lstrcmpiW (lpString1="RzU X.wav", lpString2=".") returned 1 [0063.309] lstrcmpiW (lpString1="RzU X.wav", lpString2="..") returned 1 [0063.309] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\", lpString2="RzU X.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\RzU X.wav") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\RzU X.wav" [0063.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RzU X.wav", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0063.309] GetProcessHeap () returned 0x630000 [0063.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x64c9f0 [0063.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RzU X.wav", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RzU X.wav", lpUsedDefaultChar=0x0) returned 10 [0063.309] lstrlenA (lpString="RzU X.wav") returned 9 [0063.309] lstrlenA (lpString=".happythreechoose") returned 17 [0063.309] lstrcmpiW (lpString1="RzU X.wav", lpString2="Decryption INFO.html") returned 1 [0063.309] lstrcmpiW (lpString1="RzU X.wav", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0063.309] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0063.309] lstrcmpiW (lpString1="RzU X.wav", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0063.309] GetProcessHeap () returned 0x630000 [0063.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0063.309] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\RzU X.wav" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\tixsjbll wo2\\rzu x.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0063.309] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=75537) returned 1 [0063.309] GetProcessHeap () returned 0x630000 [0063.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655418 [0063.309] GetProcessHeap () returned 0x630000 [0063.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0063.309] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\RzU X.wav") returned 57 [0063.309] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0063.309] GetProcessHeap () returned 0x630000 [0063.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0063.309] GetProcessHeap () returned 0x630000 [0063.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x6594a8 [0063.309] lstrlenA (lpString="rsa_encrypt") returned 11 [0063.310] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0063.310] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0063.310] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0063.310] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0063.310] GetProcessHeap () returned 0x630000 [0063.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0063.310] lstrlenA (lpString="010001") returned 6 [0063.310] GetProcessHeap () returned 0x630000 [0063.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0063.310] GetProcessHeap () returned 0x630000 [0063.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0063.310] GetProcessHeap () returned 0x630000 [0063.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e100 [0063.310] GetProcessHeap () returned 0x630000 [0063.310] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0063.310] GetProcessHeap () returned 0x630000 [0063.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e730 [0063.311] GetProcessHeap () returned 0x630000 [0063.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657558 [0063.311] GetProcessHeap () returned 0x630000 [0063.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a318 [0063.311] GetProcessHeap () returned 0x630000 [0063.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0063.311] GetProcessHeap () returned 0x630000 [0063.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.311] GetProcessHeap () returned 0x630000 [0063.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0063.311] GetProcessHeap () returned 0x630000 [0063.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0063.311] GetProcessHeap () returned 0x630000 [0063.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657210 [0063.311] GetProcessHeap () returned 0x630000 [0063.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.311] GetProcessHeap () returned 0x630000 [0063.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0063.311] GetProcessHeap () returned 0x630000 [0063.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea90 [0063.311] GetProcessHeap () returned 0x630000 [0063.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0063.311] GetProcessHeap () returned 0x630000 [0063.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0063.311] GetProcessHeap () returned 0x630000 [0063.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea90 | out: hHeap=0x630000) returned 1 [0063.311] GetProcessHeap () returned 0x630000 [0063.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.311] GetProcessHeap () returned 0x630000 [0063.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cf40 [0063.311] GetProcessHeap () returned 0x630000 [0063.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.311] GetProcessHeap () returned 0x630000 [0063.311] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.311] GetProcessHeap () returned 0x630000 [0063.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.311] GetProcessHeap () returned 0x630000 [0063.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.312] GetProcessHeap () returned 0x630000 [0063.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65de30 [0063.312] GetProcessHeap () returned 0x630000 [0063.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cf40 | out: hHeap=0x630000) returned 1 [0063.312] GetProcessHeap () returned 0x630000 [0063.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0063.312] GetProcessHeap () returned 0x630000 [0063.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0063.312] GetProcessHeap () returned 0x630000 [0063.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.312] GetProcessHeap () returned 0x630000 [0063.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.312] GetProcessHeap () returned 0x630000 [0063.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.312] GetProcessHeap () returned 0x630000 [0063.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.312] GetProcessHeap () returned 0x630000 [0063.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.312] GetProcessHeap () returned 0x630000 [0063.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.312] GetProcessHeap () returned 0x630000 [0063.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.312] GetProcessHeap () returned 0x630000 [0063.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.312] GetProcessHeap () returned 0x630000 [0063.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.312] GetProcessHeap () returned 0x630000 [0063.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.312] GetProcessHeap () returned 0x630000 [0063.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.312] GetProcessHeap () returned 0x630000 [0063.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.312] GetProcessHeap () returned 0x630000 [0063.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.312] GetProcessHeap () returned 0x630000 [0063.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.312] GetProcessHeap () returned 0x630000 [0063.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0063.313] GetProcessHeap () returned 0x630000 [0063.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0063.313] GetProcessHeap () returned 0x630000 [0063.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.313] GetProcessHeap () returned 0x630000 [0063.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.313] GetProcessHeap () returned 0x630000 [0063.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0063.313] GetProcessHeap () returned 0x630000 [0063.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0063.313] GetProcessHeap () returned 0x630000 [0063.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.313] GetProcessHeap () returned 0x630000 [0063.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.313] GetProcessHeap () returned 0x630000 [0063.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.313] GetProcessHeap () returned 0x630000 [0063.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.313] GetProcessHeap () returned 0x630000 [0063.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.313] GetProcessHeap () returned 0x630000 [0063.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.313] GetProcessHeap () returned 0x630000 [0063.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0063.313] GetProcessHeap () returned 0x630000 [0063.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0063.313] GetProcessHeap () returned 0x630000 [0063.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.313] GetProcessHeap () returned 0x630000 [0063.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.313] GetProcessHeap () returned 0x630000 [0063.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.313] GetProcessHeap () returned 0x630000 [0063.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.313] GetProcessHeap () returned 0x630000 [0063.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.313] GetProcessHeap () returned 0x630000 [0063.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.314] GetProcessHeap () returned 0x630000 [0063.314] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.314] GetProcessHeap () returned 0x630000 [0063.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.314] GetProcessHeap () returned 0x630000 [0063.314] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0063.314] GetProcessHeap () returned 0x630000 [0063.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0063.314] GetProcessHeap () returned 0x630000 [0063.314] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.314] GetProcessHeap () returned 0x630000 [0063.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.314] GetProcessHeap () returned 0x630000 [0063.314] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.314] GetProcessHeap () returned 0x630000 [0063.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.314] GetProcessHeap () returned 0x630000 [0063.314] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.314] GetProcessHeap () returned 0x630000 [0063.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.314] GetProcessHeap () returned 0x630000 [0063.314] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.314] GetProcessHeap () returned 0x630000 [0063.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.314] GetProcessHeap () returned 0x630000 [0063.314] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.314] GetProcessHeap () returned 0x630000 [0063.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.314] GetProcessHeap () returned 0x630000 [0063.314] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0063.314] GetProcessHeap () returned 0x630000 [0063.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0063.314] GetProcessHeap () returned 0x630000 [0063.314] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.314] GetProcessHeap () returned 0x630000 [0063.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.315] GetProcessHeap () returned 0x630000 [0063.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.315] GetProcessHeap () returned 0x630000 [0063.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.315] GetProcessHeap () returned 0x630000 [0063.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0063.315] GetProcessHeap () returned 0x630000 [0063.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0063.315] GetProcessHeap () returned 0x630000 [0063.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.315] GetProcessHeap () returned 0x630000 [0063.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.315] GetProcessHeap () returned 0x630000 [0063.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.315] GetProcessHeap () returned 0x630000 [0063.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.315] GetProcessHeap () returned 0x630000 [0063.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.315] GetProcessHeap () returned 0x630000 [0063.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.315] GetProcessHeap () returned 0x630000 [0063.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.315] GetProcessHeap () returned 0x630000 [0063.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.315] GetProcessHeap () returned 0x630000 [0063.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.315] GetProcessHeap () returned 0x630000 [0063.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.315] GetProcessHeap () returned 0x630000 [0063.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0063.315] GetProcessHeap () returned 0x630000 [0063.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0063.315] GetProcessHeap () returned 0x630000 [0063.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.315] GetProcessHeap () returned 0x630000 [0063.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.315] GetProcessHeap () returned 0x630000 [0063.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.316] GetProcessHeap () returned 0x630000 [0063.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.316] GetProcessHeap () returned 0x630000 [0063.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0063.316] GetProcessHeap () returned 0x630000 [0063.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0063.316] GetProcessHeap () returned 0x630000 [0063.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.316] GetProcessHeap () returned 0x630000 [0063.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.316] GetProcessHeap () returned 0x630000 [0063.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.316] GetProcessHeap () returned 0x630000 [0063.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.316] GetProcessHeap () returned 0x630000 [0063.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0063.316] GetProcessHeap () returned 0x630000 [0063.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0063.316] GetProcessHeap () returned 0x630000 [0063.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.316] GetProcessHeap () returned 0x630000 [0063.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.316] GetProcessHeap () returned 0x630000 [0063.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0063.316] GetProcessHeap () returned 0x630000 [0063.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0063.316] GetProcessHeap () returned 0x630000 [0063.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0063.316] GetProcessHeap () returned 0x630000 [0063.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0063.316] GetProcessHeap () returned 0x630000 [0063.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0063.316] GetProcessHeap () returned 0x630000 [0063.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0063.316] GetProcessHeap () returned 0x630000 [0063.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0063.317] GetProcessHeap () returned 0x630000 [0063.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0063.317] GetProcessHeap () returned 0x630000 [0063.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0063.317] GetProcessHeap () returned 0x630000 [0063.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0063.317] GetProcessHeap () returned 0x630000 [0063.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0063.317] WriteFile (in: hFile=0x230, lpBuffer=0x6594a8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6594a8*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0063.405] GetProcessHeap () returned 0x630000 [0063.405] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6594a8, Size=0x30) returned 0x6594a8 [0063.405] GetProcessHeap () returned 0x630000 [0063.405] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0063.405] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0063.405] GetProcessHeap () returned 0x630000 [0063.405] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12711) returned 0x671bf0 [0063.405] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0x12711, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0x12711, lpOverlapped=0x0) returned 1 [0063.406] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0063.406] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x12711, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0x12711, lpOverlapped=0x0) returned 1 [0063.408] GetProcessHeap () returned 0x630000 [0063.408] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0063.409] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0063.409] WriteFile (in: hFile=0x230, lpBuffer=0x6594a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6594a8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0063.410] CloseHandle (hObject=0x230) returned 1 [0063.413] GetProcessHeap () returned 0x630000 [0063.413] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0063.413] GetProcessHeap () returned 0x630000 [0063.413] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655418 | out: hHeap=0x630000) returned 1 [0063.413] GetProcessHeap () returned 0x630000 [0063.413] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0063.413] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\RzU X.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\RzU X.wav") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\RzU X.wav" [0063.413] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\RzU X.wav", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\RzU X.wav.happythreechoose") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\RzU X.wav.happythreechoose" [0063.413] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\RzU X.wav" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\tixsjbll wo2\\rzu x.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\RzU X.wav.happythreechoose" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\tixsjbll wo2\\rzu x.wav.happythreechoose"), dwFlags=0x1) returned 1 [0063.414] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\RzU X.wav" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2") returned 1 [0063.414] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\") returned="" [0063.414] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\Decryption INFO.html" [0063.414] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\tixsjbll wo2\\decryption info.html")) returned 0x20 [0063.414] GetProcessHeap () returned 0x630000 [0063.414] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0063.414] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76f5eca0, ftCreationTime.dwHighDateTime=0x1d5c951, ftLastAccessTime.dwLowDateTime=0x3a6205c0, ftLastAccessTime.dwHighDateTime=0x1d5d28a, ftLastWriteTime.dwLowDateTime=0x3a6205c0, ftLastWriteTime.dwHighDateTime=0x1d5d28a, nFileSizeHigh=0x0, nFileSizeLow=0x16813, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SPCpDMAkEfgXj.wav", cAlternateFileName="SPCPDM~1.WAV")) returned 1 [0063.414] lstrcmpiW (lpString1="SPCpDMAkEfgXj.wav", lpString2=".") returned 1 [0063.414] lstrcmpiW (lpString1="SPCpDMAkEfgXj.wav", lpString2="..") returned 1 [0063.414] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\", lpString2="SPCpDMAkEfgXj.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\SPCpDMAkEfgXj.wav") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\SPCpDMAkEfgXj.wav" [0063.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SPCpDMAkEfgXj.wav", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0063.415] GetProcessHeap () returned 0x630000 [0063.415] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x645c78 [0063.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SPCpDMAkEfgXj.wav", cchWideChar=-1, lpMultiByteStr=0x645c78, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SPCpDMAkEfgXj.wav", lpUsedDefaultChar=0x0) returned 18 [0063.415] lstrlenA (lpString="SPCpDMAkEfgXj.wav") returned 17 [0063.415] lstrlenA (lpString=".happythreechoose") returned 17 [0063.415] lstrlenA (lpString=".happythreechoose") returned 17 [0063.415] lstrlenA (lpString="SPCpDMAkEfgXj.wav") returned 17 [0063.415] lstrcmpiA (lpString1="SPCpDMAkEfgXj.wav", lpString2=".happythreechoose") returned 1 [0063.415] lstrcmpiW (lpString1="SPCpDMAkEfgXj.wav", lpString2="Decryption INFO.html") returned 1 [0063.415] lstrcmpiW (lpString1="SPCpDMAkEfgXj.wav", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0063.415] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0063.415] lstrcmpiW (lpString1="SPCpDMAkEfgXj.wav", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0063.415] GetProcessHeap () returned 0x630000 [0063.415] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0063.415] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\SPCpDMAkEfgXj.wav" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\tixsjbll wo2\\spcpdmakefgxj.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0063.415] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=92179) returned 1 [0063.415] GetProcessHeap () returned 0x630000 [0063.415] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6555f8 [0063.415] GetProcessHeap () returned 0x630000 [0063.415] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0063.415] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\SPCpDMAkEfgXj.wav") returned 65 [0063.415] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0063.415] GetProcessHeap () returned 0x630000 [0063.415] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0063.415] GetProcessHeap () returned 0x630000 [0063.415] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x6594e0 [0063.416] lstrlenA (lpString="rsa_encrypt") returned 11 [0063.416] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0063.416] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0063.416] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0063.416] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0063.416] GetProcessHeap () returned 0x630000 [0063.416] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0063.416] lstrlenA (lpString="010001") returned 6 [0063.416] GetProcessHeap () returned 0x630000 [0063.416] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2b8 [0063.416] GetProcessHeap () returned 0x630000 [0063.416] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0063.416] GetProcessHeap () returned 0x630000 [0063.416] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e580 [0063.416] GetProcessHeap () returned 0x630000 [0063.416] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0063.416] GetProcessHeap () returned 0x630000 [0063.416] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea00 [0063.417] GetProcessHeap () returned 0x630000 [0063.417] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656fe0 [0063.417] GetProcessHeap () returned 0x630000 [0063.417] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0063.417] GetProcessHeap () returned 0x630000 [0063.417] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0063.417] GetProcessHeap () returned 0x630000 [0063.417] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.417] GetProcessHeap () returned 0x630000 [0063.417] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0063.417] GetProcessHeap () returned 0x630000 [0063.417] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0063.417] GetProcessHeap () returned 0x630000 [0063.417] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657558 [0063.417] GetProcessHeap () returned 0x630000 [0063.417] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.417] GetProcessHeap () returned 0x630000 [0063.417] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0063.417] GetProcessHeap () returned 0x630000 [0063.417] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e8e0 [0063.417] GetProcessHeap () returned 0x630000 [0063.417] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0063.417] GetProcessHeap () returned 0x630000 [0063.417] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0063.417] GetProcessHeap () returned 0x630000 [0063.417] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0063.417] GetProcessHeap () returned 0x630000 [0063.417] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.417] GetProcessHeap () returned 0x630000 [0063.417] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0063.417] GetProcessHeap () returned 0x630000 [0063.417] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.417] GetProcessHeap () returned 0x630000 [0063.417] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.417] GetProcessHeap () returned 0x630000 [0063.417] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.417] GetProcessHeap () returned 0x630000 [0063.417] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.417] GetProcessHeap () returned 0x630000 [0063.417] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e850 [0063.418] GetProcessHeap () returned 0x630000 [0063.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0063.418] GetProcessHeap () returned 0x630000 [0063.418] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0063.418] GetProcessHeap () returned 0x630000 [0063.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0063.418] GetProcessHeap () returned 0x630000 [0063.418] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.418] GetProcessHeap () returned 0x630000 [0063.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.418] GetProcessHeap () returned 0x630000 [0063.418] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.418] GetProcessHeap () returned 0x630000 [0063.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.418] GetProcessHeap () returned 0x630000 [0063.418] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.418] GetProcessHeap () returned 0x630000 [0063.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.418] GetProcessHeap () returned 0x630000 [0063.418] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.418] GetProcessHeap () returned 0x630000 [0063.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.418] GetProcessHeap () returned 0x630000 [0063.418] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.418] GetProcessHeap () returned 0x630000 [0063.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.418] GetProcessHeap () returned 0x630000 [0063.418] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.418] GetProcessHeap () returned 0x630000 [0063.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.418] GetProcessHeap () returned 0x630000 [0063.418] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.418] GetProcessHeap () returned 0x630000 [0063.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.418] GetProcessHeap () returned 0x630000 [0063.418] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.418] GetProcessHeap () returned 0x630000 [0063.419] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.419] GetProcessHeap () returned 0x630000 [0063.419] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.419] GetProcessHeap () returned 0x630000 [0063.419] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.419] GetProcessHeap () returned 0x630000 [0063.419] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.419] GetProcessHeap () returned 0x630000 [0063.419] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.419] GetProcessHeap () returned 0x630000 [0063.419] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0063.419] GetProcessHeap () returned 0x630000 [0063.419] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0063.419] GetProcessHeap () returned 0x630000 [0063.419] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.419] GetProcessHeap () returned 0x630000 [0063.419] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.419] GetProcessHeap () returned 0x630000 [0063.419] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.419] GetProcessHeap () returned 0x630000 [0063.419] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.419] GetProcessHeap () returned 0x630000 [0063.419] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.419] GetProcessHeap () returned 0x630000 [0063.419] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.419] GetProcessHeap () returned 0x630000 [0063.419] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.419] GetProcessHeap () returned 0x630000 [0063.419] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.419] GetProcessHeap () returned 0x630000 [0063.419] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.419] GetProcessHeap () returned 0x630000 [0063.419] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.419] GetProcessHeap () returned 0x630000 [0063.419] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.419] GetProcessHeap () returned 0x630000 [0063.419] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.420] GetProcessHeap () returned 0x630000 [0063.420] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.420] GetProcessHeap () returned 0x630000 [0063.420] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.420] GetProcessHeap () returned 0x630000 [0063.420] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.420] GetProcessHeap () returned 0x630000 [0063.420] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.420] GetProcessHeap () returned 0x630000 [0063.420] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0063.420] GetProcessHeap () returned 0x630000 [0063.420] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0063.420] GetProcessHeap () returned 0x630000 [0063.420] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.420] GetProcessHeap () returned 0x630000 [0063.420] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.420] GetProcessHeap () returned 0x630000 [0063.420] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0063.420] GetProcessHeap () returned 0x630000 [0063.420] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0063.420] GetProcessHeap () returned 0x630000 [0063.420] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.420] GetProcessHeap () returned 0x630000 [0063.420] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.420] GetProcessHeap () returned 0x630000 [0063.420] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0063.420] GetProcessHeap () returned 0x630000 [0063.420] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0063.420] GetProcessHeap () returned 0x630000 [0063.420] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0063.420] GetProcessHeap () returned 0x630000 [0063.420] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0063.420] GetProcessHeap () returned 0x630000 [0063.420] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.420] GetProcessHeap () returned 0x630000 [0063.420] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.420] GetProcessHeap () returned 0x630000 [0063.421] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.421] GetProcessHeap () returned 0x630000 [0063.421] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.421] GetProcessHeap () returned 0x630000 [0063.421] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.421] GetProcessHeap () returned 0x630000 [0063.421] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.421] GetProcessHeap () returned 0x630000 [0063.421] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0063.421] GetProcessHeap () returned 0x630000 [0063.421] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0063.421] GetProcessHeap () returned 0x630000 [0063.421] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.421] GetProcessHeap () returned 0x630000 [0063.421] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.421] GetProcessHeap () returned 0x630000 [0063.421] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.421] GetProcessHeap () returned 0x630000 [0063.421] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.421] GetProcessHeap () returned 0x630000 [0063.421] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.421] GetProcessHeap () returned 0x630000 [0063.421] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.421] GetProcessHeap () returned 0x630000 [0063.421] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.421] GetProcessHeap () returned 0x630000 [0063.421] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.421] GetProcessHeap () returned 0x630000 [0063.421] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.421] GetProcessHeap () returned 0x630000 [0063.421] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.421] GetProcessHeap () returned 0x630000 [0063.421] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0063.421] GetProcessHeap () returned 0x630000 [0063.421] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0063.421] GetProcessHeap () returned 0x630000 [0063.421] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.422] GetProcessHeap () returned 0x630000 [0063.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.422] GetProcessHeap () returned 0x630000 [0063.422] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0063.422] GetProcessHeap () returned 0x630000 [0063.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0063.422] GetProcessHeap () returned 0x630000 [0063.422] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.422] GetProcessHeap () returned 0x630000 [0063.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.422] GetProcessHeap () returned 0x630000 [0063.422] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.422] GetProcessHeap () returned 0x630000 [0063.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.422] GetProcessHeap () returned 0x630000 [0063.422] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.422] GetProcessHeap () returned 0x630000 [0063.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.422] GetProcessHeap () returned 0x630000 [0063.422] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0063.422] GetProcessHeap () returned 0x630000 [0063.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0063.422] GetProcessHeap () returned 0x630000 [0063.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0063.422] GetProcessHeap () returned 0x630000 [0063.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0063.422] GetProcessHeap () returned 0x630000 [0063.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0063.422] GetProcessHeap () returned 0x630000 [0063.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0063.422] GetProcessHeap () returned 0x630000 [0063.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0063.422] GetProcessHeap () returned 0x630000 [0063.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0063.422] GetProcessHeap () returned 0x630000 [0063.423] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0063.423] GetProcessHeap () returned 0x630000 [0063.423] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0063.423] GetProcessHeap () returned 0x630000 [0063.423] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0063.423] GetProcessHeap () returned 0x630000 [0063.423] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0063.423] GetProcessHeap () returned 0x630000 [0063.423] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0063.423] WriteFile (in: hFile=0x230, lpBuffer=0x6594e0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6594e0*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0063.425] GetProcessHeap () returned 0x630000 [0063.425] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6594e0, Size=0x30) returned 0x6594e0 [0063.425] GetProcessHeap () returned 0x630000 [0063.425] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0063.425] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0063.425] GetProcessHeap () returned 0x630000 [0063.425] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16813) returned 0x671bf0 [0063.428] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0x16813, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0x16813, lpOverlapped=0x0) returned 1 [0063.429] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0063.429] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x16813, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0x16813, lpOverlapped=0x0) returned 1 [0063.471] GetProcessHeap () returned 0x630000 [0063.471] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0063.471] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0063.471] WriteFile (in: hFile=0x230, lpBuffer=0x6594e0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6594e0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0063.472] CloseHandle (hObject=0x230) returned 1 [0063.475] GetProcessHeap () returned 0x630000 [0063.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0063.476] GetProcessHeap () returned 0x630000 [0063.476] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6555f8 | out: hHeap=0x630000) returned 1 [0063.476] GetProcessHeap () returned 0x630000 [0063.476] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0063.476] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\SPCpDMAkEfgXj.wav" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\SPCpDMAkEfgXj.wav") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\SPCpDMAkEfgXj.wav" [0063.476] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\SPCpDMAkEfgXj.wav", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\SPCpDMAkEfgXj.wav.happythreechoose") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\SPCpDMAkEfgXj.wav.happythreechoose" [0063.476] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\SPCpDMAkEfgXj.wav" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\tixsjbll wo2\\spcpdmakefgxj.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\SPCpDMAkEfgXj.wav.happythreechoose" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\tixsjbll wo2\\spcpdmakefgxj.wav.happythreechoose"), dwFlags=0x1) returned 1 [0063.477] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\SPCpDMAkEfgXj.wav" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2") returned 1 [0063.477] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2" | out: pszPath="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\") returned="" [0063.477] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\Decryption INFO.html" [0063.477] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\d1_GTf7p7iJ-\\tIxsJBLL WO2\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\music\\d1_gtf7p7ij-\\tixsjbll wo2\\decryption info.html")) returned 0x20 [0063.477] GetProcessHeap () returned 0x630000 [0063.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645c78 | out: hHeap=0x630000) returned 1 [0063.477] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76f5eca0, ftCreationTime.dwHighDateTime=0x1d5c951, ftLastAccessTime.dwLowDateTime=0x3a6205c0, ftLastAccessTime.dwHighDateTime=0x1d5d28a, ftLastWriteTime.dwLowDateTime=0x3a6205c0, ftLastWriteTime.dwHighDateTime=0x1d5d28a, nFileSizeHigh=0x0, nFileSizeLow=0x16813, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SPCpDMAkEfgXj.wav", cAlternateFileName="SPCPDM~1.WAV")) returned 0 [0063.477] FindClose (in: hFindFile=0x648890 | out: hFindFile=0x648890) returned 1 [0063.477] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\Local Settings\\" | out: lpString1="C:\\Users\\FD1HVy\\Local Settings\\") returned="C:\\Users\\FD1HVy\\Local Settings\\" [0063.477] GetProcessHeap () returned 0x630000 [0063.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x641f20 | out: hHeap=0x630000) returned 1 [0063.477] GetProcessHeap () returned 0x630000 [0063.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0063.477] lstrlenW (lpString="C:\\Users\\FD1HVy\\Local Settings\\") returned 31 [0063.477] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Local Settings\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Local Settings\\*") returned="C:\\Users\\FD1HVy\\Local Settings\\*" [0063.477] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Local Settings\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76f5eca0, ftCreationTime.dwHighDateTime=0x1d5c951, ftLastAccessTime.dwLowDateTime=0x3a6205c0, ftLastAccessTime.dwHighDateTime=0x1d5d28a, ftLastWriteTime.dwLowDateTime=0x3a6205c0, ftLastWriteTime.dwHighDateTime=0x1d5d28a, nFileSizeHigh=0x0, nFileSizeLow=0x16813, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SPCpDMAkEfgXj.wav", cAlternateFileName="SPCPDM~1.WAV")) returned 0xffffffff [0063.478] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\Links\\" | out: lpString1="C:\\Users\\FD1HVy\\Links\\") returned="C:\\Users\\FD1HVy\\Links\\" [0063.478] GetProcessHeap () returned 0x630000 [0063.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x652748 | out: hHeap=0x630000) returned 1 [0063.478] GetProcessHeap () returned 0x630000 [0063.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0063.478] lstrlenW (lpString="C:\\Users\\FD1HVy\\Links\\") returned 22 [0063.478] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Links\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Links\\*") returned="C:\\Users\\FD1HVy\\Links\\*" [0063.478] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Links\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648b10 [0063.478] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0063.478] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.478] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0063.478] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0063.478] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xcee4480b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0063.478] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0063.478] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0063.478] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Links\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Links\\desktop.ini") returned="C:\\Users\\FD1HVy\\Links\\desktop.ini" [0063.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0063.478] GetProcessHeap () returned 0x630000 [0063.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64ca20 [0063.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0063.478] lstrlenA (lpString="desktop.ini") returned 11 [0063.479] lstrlenA (lpString=".happythreechoose") returned 17 [0063.479] lstrcmpiW (lpString1="desktop.ini", lpString2="Decryption INFO.html") returned 1 [0063.479] lstrcmpiW (lpString1="desktop.ini", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0063.479] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0063.479] lstrcmpiW (lpString1="desktop.ini", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0063.479] GetProcessHeap () returned 0x630000 [0063.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0063.479] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\links\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0063.479] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=504) returned 1 [0063.479] GetProcessHeap () returned 0x630000 [0063.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655580 [0063.479] GetProcessHeap () returned 0x630000 [0063.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0063.479] lstrlenW (lpString="C:\\Users\\FD1HVy\\Links\\desktop.ini") returned 33 [0063.479] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0063.479] GetProcessHeap () returned 0x630000 [0063.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0063.479] GetProcessHeap () returned 0x630000 [0063.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x388) returned 0x659518 [0063.480] lstrlenA (lpString="rsa_encrypt") returned 11 [0063.480] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0063.480] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0063.480] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0063.480] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0063.480] GetProcessHeap () returned 0x630000 [0063.480] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0063.480] lstrlenA (lpString="010001") returned 6 [0063.480] GetProcessHeap () returned 0x630000 [0063.480] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0063.480] GetProcessHeap () returned 0x630000 [0063.480] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0063.480] GetProcessHeap () returned 0x630000 [0063.480] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e8e0 [0063.481] GetProcessHeap () returned 0x630000 [0063.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0063.481] GetProcessHeap () returned 0x630000 [0063.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0063.481] GetProcessHeap () returned 0x630000 [0063.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657440 [0063.481] GetProcessHeap () returned 0x630000 [0063.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0063.481] GetProcessHeap () returned 0x630000 [0063.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0063.481] GetProcessHeap () returned 0x630000 [0063.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.481] GetProcessHeap () returned 0x630000 [0063.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0063.481] GetProcessHeap () returned 0x630000 [0063.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0063.481] GetProcessHeap () returned 0x630000 [0063.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657558 [0063.481] GetProcessHeap () returned 0x630000 [0063.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.481] GetProcessHeap () returned 0x630000 [0063.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0063.481] GetProcessHeap () returned 0x630000 [0063.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65eb20 [0063.481] GetProcessHeap () returned 0x630000 [0063.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0063.481] GetProcessHeap () returned 0x630000 [0063.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0063.481] GetProcessHeap () returned 0x630000 [0063.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0063.481] GetProcessHeap () returned 0x630000 [0063.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.481] GetProcessHeap () returned 0x630000 [0063.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cdd8 [0063.481] GetProcessHeap () returned 0x630000 [0063.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.481] GetProcessHeap () returned 0x630000 [0063.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.481] GetProcessHeap () returned 0x630000 [0063.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.482] GetProcessHeap () returned 0x630000 [0063.482] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.482] GetProcessHeap () returned 0x630000 [0063.482] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ecd0 [0063.482] GetProcessHeap () returned 0x630000 [0063.482] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cdd8 | out: hHeap=0x630000) returned 1 [0063.482] GetProcessHeap () returned 0x630000 [0063.482] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0063.482] GetProcessHeap () returned 0x630000 [0063.482] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ecd0 | out: hHeap=0x630000) returned 1 [0063.482] GetProcessHeap () returned 0x630000 [0063.482] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.482] GetProcessHeap () returned 0x630000 [0063.482] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.482] GetProcessHeap () returned 0x630000 [0063.482] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.482] GetProcessHeap () returned 0x630000 [0063.482] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.482] GetProcessHeap () returned 0x630000 [0063.482] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.482] GetProcessHeap () returned 0x630000 [0063.482] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.482] GetProcessHeap () returned 0x630000 [0063.482] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.482] GetProcessHeap () returned 0x630000 [0063.482] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.482] GetProcessHeap () returned 0x630000 [0063.482] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.482] GetProcessHeap () returned 0x630000 [0063.482] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.482] GetProcessHeap () returned 0x630000 [0063.482] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.482] GetProcessHeap () returned 0x630000 [0063.482] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.482] GetProcessHeap () returned 0x630000 [0063.482] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.483] GetProcessHeap () returned 0x630000 [0063.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.483] GetProcessHeap () returned 0x630000 [0063.483] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0063.483] GetProcessHeap () returned 0x630000 [0063.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0063.483] GetProcessHeap () returned 0x630000 [0063.483] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.483] GetProcessHeap () returned 0x630000 [0063.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.483] GetProcessHeap () returned 0x630000 [0063.483] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.483] GetProcessHeap () returned 0x630000 [0063.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.483] GetProcessHeap () returned 0x630000 [0063.483] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.483] GetProcessHeap () returned 0x630000 [0063.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.483] GetProcessHeap () returned 0x630000 [0063.483] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0063.483] GetProcessHeap () returned 0x630000 [0063.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0063.483] GetProcessHeap () returned 0x630000 [0063.483] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.483] GetProcessHeap () returned 0x630000 [0063.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.483] GetProcessHeap () returned 0x630000 [0063.483] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.483] GetProcessHeap () returned 0x630000 [0063.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.483] GetProcessHeap () returned 0x630000 [0063.483] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0063.483] GetProcessHeap () returned 0x630000 [0063.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0063.483] GetProcessHeap () returned 0x630000 [0063.483] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.483] GetProcessHeap () returned 0x630000 [0063.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.484] GetProcessHeap () returned 0x630000 [0063.484] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0063.484] GetProcessHeap () returned 0x630000 [0063.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0063.484] GetProcessHeap () returned 0x630000 [0063.484] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.484] GetProcessHeap () returned 0x630000 [0063.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.484] GetProcessHeap () returned 0x630000 [0063.484] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.484] GetProcessHeap () returned 0x630000 [0063.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.484] GetProcessHeap () returned 0x630000 [0063.484] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0063.484] GetProcessHeap () returned 0x630000 [0063.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0063.484] GetProcessHeap () returned 0x630000 [0063.484] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0063.484] GetProcessHeap () returned 0x630000 [0063.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0063.484] GetProcessHeap () returned 0x630000 [0063.484] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.484] GetProcessHeap () returned 0x630000 [0063.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.484] GetProcessHeap () returned 0x630000 [0063.484] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.484] GetProcessHeap () returned 0x630000 [0063.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.484] GetProcessHeap () returned 0x630000 [0063.484] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.484] GetProcessHeap () returned 0x630000 [0063.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.484] GetProcessHeap () returned 0x630000 [0063.484] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0063.484] GetProcessHeap () returned 0x630000 [0063.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0063.484] GetProcessHeap () returned 0x630000 [0063.485] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0063.485] GetProcessHeap () returned 0x630000 [0063.485] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0063.485] GetProcessHeap () returned 0x630000 [0063.485] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0063.485] GetProcessHeap () returned 0x630000 [0063.485] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0063.485] GetProcessHeap () returned 0x630000 [0063.485] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.485] GetProcessHeap () returned 0x630000 [0063.485] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.485] GetProcessHeap () returned 0x630000 [0063.485] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.485] GetProcessHeap () returned 0x630000 [0063.485] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.485] GetProcessHeap () returned 0x630000 [0063.485] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.485] GetProcessHeap () returned 0x630000 [0063.485] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.485] GetProcessHeap () returned 0x630000 [0063.485] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0063.485] GetProcessHeap () returned 0x630000 [0063.485] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0063.485] GetProcessHeap () returned 0x630000 [0063.485] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.485] GetProcessHeap () returned 0x630000 [0063.485] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.485] GetProcessHeap () returned 0x630000 [0063.485] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.485] GetProcessHeap () returned 0x630000 [0063.485] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.485] GetProcessHeap () returned 0x630000 [0063.485] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0063.485] GetProcessHeap () returned 0x630000 [0063.485] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0063.485] GetProcessHeap () returned 0x630000 [0063.485] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0063.485] GetProcessHeap () returned 0x630000 [0063.485] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0063.486] GetProcessHeap () returned 0x630000 [0063.486] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0063.486] GetProcessHeap () returned 0x630000 [0063.486] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0063.486] GetProcessHeap () returned 0x630000 [0063.486] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.486] GetProcessHeap () returned 0x630000 [0063.486] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.486] GetProcessHeap () returned 0x630000 [0063.486] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.486] GetProcessHeap () returned 0x630000 [0063.486] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.486] GetProcessHeap () returned 0x630000 [0063.486] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0063.486] GetProcessHeap () returned 0x630000 [0063.486] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0063.486] GetProcessHeap () returned 0x630000 [0063.486] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0063.486] GetProcessHeap () returned 0x630000 [0063.486] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0063.486] GetProcessHeap () returned 0x630000 [0063.486] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.486] GetProcessHeap () returned 0x630000 [0063.486] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.486] GetProcessHeap () returned 0x630000 [0063.486] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0063.486] GetProcessHeap () returned 0x630000 [0063.486] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0063.486] GetProcessHeap () returned 0x630000 [0063.486] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0063.486] GetProcessHeap () returned 0x630000 [0063.486] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0063.486] GetProcessHeap () returned 0x630000 [0063.486] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0063.486] GetProcessHeap () returned 0x630000 [0063.487] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0063.487] GetProcessHeap () returned 0x630000 [0063.487] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0063.487] GetProcessHeap () returned 0x630000 [0063.487] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0063.487] GetProcessHeap () returned 0x630000 [0063.487] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0063.487] GetProcessHeap () returned 0x630000 [0063.487] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0063.487] GetProcessHeap () returned 0x630000 [0063.487] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0063.487] WriteFile (in: hFile=0x230, lpBuffer=0x659518*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659518*, lpNumberOfBytesWritten=0x243d864*=0x388, lpOverlapped=0x0) returned 1 [0063.491] GetProcessHeap () returned 0x630000 [0063.491] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659518, Size=0x30) returned 0x659518 [0063.491] GetProcessHeap () returned 0x630000 [0063.491] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0063.491] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0063.491] GetProcessHeap () returned 0x630000 [0063.491] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0063.491] ReadFile (in: hFile=0x230, lpBuffer=0x64cc78, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x64cc78*, lpNumberOfBytesRead=0x243d7e8*=0x200, lpOverlapped=0x0) returned 1 [0063.491] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0063.491] WriteFile (in: hFile=0x230, lpBuffer=0x64cc78*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x64cc78*, lpNumberOfBytesWritten=0x243d7e4*=0x200, lpOverlapped=0x0) returned 1 [0063.492] GetProcessHeap () returned 0x630000 [0063.492] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0063.492] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0063.492] WriteFile (in: hFile=0x230, lpBuffer=0x659518*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659518*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0063.493] CloseHandle (hObject=0x230) returned 1 [0063.494] GetProcessHeap () returned 0x630000 [0063.494] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0063.494] GetProcessHeap () returned 0x630000 [0063.494] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655580 | out: hHeap=0x630000) returned 1 [0063.494] GetProcessHeap () returned 0x630000 [0063.494] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0063.494] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Links\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Links\\desktop.ini") returned="C:\\Users\\FD1HVy\\Links\\desktop.ini" [0063.494] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Links\\desktop.ini", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Links\\desktop.ini.happythreechoose") returned="C:\\Users\\FD1HVy\\Links\\desktop.ini.happythreechoose" [0063.495] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Links\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\links\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Links\\desktop.ini.happythreechoose" (normalized: "c:\\users\\fd1hvy\\links\\desktop.ini.happythreechoose"), dwFlags=0x1) returned 1 [0063.495] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Links\\desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\Links") returned 1 [0063.495] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Links" | out: pszPath="C:\\Users\\FD1HVy\\Links\\") returned="" [0063.495] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Links\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Links\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Links\\Decryption INFO.html" [0063.495] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Links\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\links\\decryption info.html")) returned 0xffffffff [0063.495] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\links\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0063.502] GetProcessHeap () returned 0x630000 [0063.502] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655a30 [0063.502] GetProcessHeap () returned 0x630000 [0063.502] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0063.510] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.511] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.511] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.511] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.511] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.511] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.511] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.511] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.511] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.511] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.511] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.517] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.517] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.517] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.517] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.517] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.517] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.517] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.517] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.517] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.518] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.518] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.518] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.518] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.518] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.518] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.518] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.518] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.518] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.518] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.518] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.518] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.518] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.518] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.518] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.519] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.519] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.519] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.519] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.519] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.519] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.519] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.519] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.519] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.519] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.519] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.519] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.520] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.520] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.520] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.520] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.520] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.520] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.520] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.520] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.520] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.520] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.520] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.520] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.520] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.520] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.520] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.521] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.521] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.521] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.521] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.521] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.521] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.521] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.521] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.521] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.521] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.521] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.521] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.521] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.521] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.521] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.523] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.523] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.523] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.523] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.523] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.523] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.523] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.523] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.523] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.523] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.523] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.523] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.524] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.524] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.524] GetProcessHeap () returned 0x630000 [0063.524] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655a30 | out: hHeap=0x630000) returned 1 [0063.524] GetProcessHeap () returned 0x630000 [0063.524] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0063.524] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0063.524] GetProcessHeap () returned 0x630000 [0063.524] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655a30 [0063.524] GetProcessHeap () returned 0x630000 [0063.524] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0063.531] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.531] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.531] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.531] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.531] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.531] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.531] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.531] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.531] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.531] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.531] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.532] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.532] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.532] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.532] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.532] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.532] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.532] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.532] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.532] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.532] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.532] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.532] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.532] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.532] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.532] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.533] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.533] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.533] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.533] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.533] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.533] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.533] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.533] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.533] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.533] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.533] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.533] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.533] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.533] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.533] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.534] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.534] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.534] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.534] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.534] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.534] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.534] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.534] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.534] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.534] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.534] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.534] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.534] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.534] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.534] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.535] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.535] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.535] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.535] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.535] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.535] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.535] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.535] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.535] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.535] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.535] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.535] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.535] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.535] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.536] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.536] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.536] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.536] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.536] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.536] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.536] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.536] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.536] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.536] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.536] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.536] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.536] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.537] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.537] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.537] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.537] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.537] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.537] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.537] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.537] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.537] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.537] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.537] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.537] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.537] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.537] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.537] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.538] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.538] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.538] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.538] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.538] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.538] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.538] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.538] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.538] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.538] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.538] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.538] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.538] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.538] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.539] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.539] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.539] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.539] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.569] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.569] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0063.570] GetProcessHeap () returned 0x630000 [0063.570] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655a30 | out: hHeap=0x630000) returned 1 [0063.570] GetProcessHeap () returned 0x630000 [0063.570] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0063.570] CloseHandle (hObject=0x230) returned 1 [0063.571] GetProcessHeap () returned 0x630000 [0063.571] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0063.571] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4428f2bb, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4428f2bb, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce90d59d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0063.571] lstrcmpiW (lpString1="Desktop.lnk", lpString2=".") returned 1 [0063.571] lstrcmpiW (lpString1="Desktop.lnk", lpString2="..") returned 1 [0063.571] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Links\\", lpString2="Desktop.lnk" | out: lpString1="C:\\Users\\FD1HVy\\Links\\Desktop.lnk") returned="C:\\Users\\FD1HVy\\Links\\Desktop.lnk" [0063.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Desktop.lnk", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0063.571] GetProcessHeap () returned 0x630000 [0063.571] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0063.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Desktop.lnk", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Desktop.lnk", lpUsedDefaultChar=0x0) returned 12 [0063.571] lstrlenA (lpString="Desktop.lnk") returned 11 [0063.571] lstrlenA (lpString=".happythreechoose") returned 17 [0063.571] lstrcmpiW (lpString1="Desktop.lnk", lpString2="Decryption INFO.html") returned 1 [0063.571] lstrcmpiW (lpString1="Desktop.lnk", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0063.571] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0063.571] lstrcmpiW (lpString1="Desktop.lnk", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0063.571] GetProcessHeap () returned 0x630000 [0063.571] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x652000 [0063.571] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0063.572] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=501) returned 1 [0063.572] GetProcessHeap () returned 0x630000 [0063.572] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655418 [0063.572] GetProcessHeap () returned 0x630000 [0063.572] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0063.572] lstrlenW (lpString="C:\\Users\\FD1HVy\\Links\\Desktop.lnk") returned 33 [0063.572] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0063.572] GetProcessHeap () returned 0x630000 [0063.572] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0063.572] GetProcessHeap () returned 0x630000 [0063.572] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38b) returned 0x659550 [0063.572] lstrlenA (lpString="rsa_encrypt") returned 11 [0063.572] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0063.573] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0063.573] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0063.573] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0063.573] GetProcessHeap () returned 0x630000 [0063.573] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0063.573] lstrlenA (lpString="010001") returned 6 [0063.573] GetProcessHeap () returned 0x630000 [0063.573] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a348 [0063.573] GetProcessHeap () returned 0x630000 [0063.573] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0063.573] GetProcessHeap () returned 0x630000 [0063.573] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e6a0 [0063.573] GetProcessHeap () returned 0x630000 [0063.573] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0063.573] GetProcessHeap () returned 0x630000 [0063.573] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e850 [0063.573] GetProcessHeap () returned 0x630000 [0063.573] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656950 [0063.573] GetProcessHeap () returned 0x630000 [0063.573] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0063.573] GetProcessHeap () returned 0x630000 [0063.573] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0063.573] GetProcessHeap () returned 0x630000 [0063.573] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.573] GetProcessHeap () returned 0x630000 [0063.573] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0063.573] GetProcessHeap () returned 0x630000 [0063.573] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0063.573] GetProcessHeap () returned 0x630000 [0063.573] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657788 [0063.573] GetProcessHeap () returned 0x630000 [0063.573] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.573] GetProcessHeap () returned 0x630000 [0063.573] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0063.573] GetProcessHeap () returned 0x630000 [0063.573] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e190 [0063.573] GetProcessHeap () returned 0x630000 [0063.574] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0063.574] GetProcessHeap () returned 0x630000 [0063.574] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0063.574] GetProcessHeap () returned 0x630000 [0063.574] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0063.574] GetProcessHeap () returned 0x630000 [0063.574] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0063.574] GetProcessHeap () returned 0x630000 [0063.574] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cfe8 [0063.574] GetProcessHeap () returned 0x630000 [0063.574] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.574] GetProcessHeap () returned 0x630000 [0063.574] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0063.574] GetProcessHeap () returned 0x630000 [0063.574] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0063.574] GetProcessHeap () returned 0x630000 [0063.574] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0063.574] GetProcessHeap () returned 0x630000 [0063.574] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ea90 [0063.574] GetProcessHeap () returned 0x630000 [0063.574] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cfe8 | out: hHeap=0x630000) returned 1 [0063.574] GetProcessHeap () returned 0x630000 [0063.574] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0063.574] GetProcessHeap () returned 0x630000 [0063.574] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea90 | out: hHeap=0x630000) returned 1 [0063.574] GetProcessHeap () returned 0x630000 [0063.574] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.574] GetProcessHeap () returned 0x630000 [0063.574] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.574] GetProcessHeap () returned 0x630000 [0063.574] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.574] GetProcessHeap () returned 0x630000 [0063.574] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.574] GetProcessHeap () returned 0x630000 [0063.574] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.574] GetProcessHeap () returned 0x630000 [0063.574] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.574] GetProcessHeap () returned 0x630000 [0063.574] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.575] GetProcessHeap () returned 0x630000 [0063.575] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.575] GetProcessHeap () returned 0x630000 [0063.575] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.575] GetProcessHeap () returned 0x630000 [0063.575] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.575] GetProcessHeap () returned 0x630000 [0063.575] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.575] GetProcessHeap () returned 0x630000 [0063.575] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.575] GetProcessHeap () returned 0x630000 [0063.575] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.575] GetProcessHeap () returned 0x630000 [0063.575] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.575] GetProcessHeap () returned 0x630000 [0063.575] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.575] GetProcessHeap () returned 0x630000 [0063.575] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.575] GetProcessHeap () returned 0x630000 [0063.575] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.575] GetProcessHeap () returned 0x630000 [0063.575] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.575] GetProcessHeap () returned 0x630000 [0063.575] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.575] GetProcessHeap () returned 0x630000 [0063.575] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.575] GetProcessHeap () returned 0x630000 [0063.575] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0063.575] GetProcessHeap () returned 0x630000 [0063.575] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0063.575] GetProcessHeap () returned 0x630000 [0063.575] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.575] GetProcessHeap () returned 0x630000 [0063.575] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.575] GetProcessHeap () returned 0x630000 [0063.575] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0063.576] GetProcessHeap () returned 0x630000 [0063.576] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0063.576] GetProcessHeap () returned 0x630000 [0063.576] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.576] GetProcessHeap () returned 0x630000 [0063.576] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.576] GetProcessHeap () returned 0x630000 [0063.576] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0063.576] GetProcessHeap () returned 0x630000 [0063.576] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0063.576] GetProcessHeap () returned 0x630000 [0063.576] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0063.576] GetProcessHeap () returned 0x630000 [0063.576] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0063.576] GetProcessHeap () returned 0x630000 [0063.576] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.576] GetProcessHeap () returned 0x630000 [0063.576] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.576] GetProcessHeap () returned 0x630000 [0063.576] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.576] GetProcessHeap () returned 0x630000 [0063.576] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.576] GetProcessHeap () returned 0x630000 [0063.576] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.576] GetProcessHeap () returned 0x630000 [0063.576] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.576] GetProcessHeap () returned 0x630000 [0063.576] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.576] GetProcessHeap () returned 0x630000 [0063.576] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.576] GetProcessHeap () returned 0x630000 [0063.576] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.576] GetProcessHeap () returned 0x630000 [0063.576] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.576] GetProcessHeap () returned 0x630000 [0063.576] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0063.576] GetProcessHeap () returned 0x630000 [0063.577] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0063.577] GetProcessHeap () returned 0x630000 [0063.577] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.577] GetProcessHeap () returned 0x630000 [0063.577] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.577] GetProcessHeap () returned 0x630000 [0063.577] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0063.577] GetProcessHeap () returned 0x630000 [0063.577] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0063.577] GetProcessHeap () returned 0x630000 [0063.577] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0063.577] GetProcessHeap () returned 0x630000 [0063.577] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0063.577] GetProcessHeap () returned 0x630000 [0063.577] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0063.577] GetProcessHeap () returned 0x630000 [0063.577] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0063.577] GetProcessHeap () returned 0x630000 [0063.577] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.577] GetProcessHeap () returned 0x630000 [0063.577] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.577] GetProcessHeap () returned 0x630000 [0063.577] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.577] GetProcessHeap () returned 0x630000 [0063.577] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.577] GetProcessHeap () returned 0x630000 [0063.577] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.577] GetProcessHeap () returned 0x630000 [0063.577] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.577] GetProcessHeap () returned 0x630000 [0063.577] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.577] GetProcessHeap () returned 0x630000 [0063.577] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.577] GetProcessHeap () returned 0x630000 [0063.577] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.577] GetProcessHeap () returned 0x630000 [0063.577] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.577] GetProcessHeap () returned 0x630000 [0063.577] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.578] GetProcessHeap () returned 0x630000 [0063.578] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.578] GetProcessHeap () returned 0x630000 [0063.578] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0063.578] GetProcessHeap () returned 0x630000 [0063.578] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0063.578] GetProcessHeap () returned 0x630000 [0063.578] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.578] GetProcessHeap () returned 0x630000 [0063.578] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.578] GetProcessHeap () returned 0x630000 [0063.578] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.578] GetProcessHeap () returned 0x630000 [0063.578] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.578] GetProcessHeap () returned 0x630000 [0063.578] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.578] GetProcessHeap () returned 0x630000 [0063.578] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.578] GetProcessHeap () returned 0x630000 [0063.578] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.578] GetProcessHeap () returned 0x630000 [0063.578] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.578] GetProcessHeap () returned 0x630000 [0063.578] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0063.578] GetProcessHeap () returned 0x630000 [0063.578] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0063.578] GetProcessHeap () returned 0x630000 [0063.578] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.578] GetProcessHeap () returned 0x630000 [0063.578] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.578] GetProcessHeap () returned 0x630000 [0063.578] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.578] GetProcessHeap () returned 0x630000 [0063.578] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.578] GetProcessHeap () returned 0x630000 [0063.578] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0063.578] GetProcessHeap () returned 0x630000 [0063.578] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0063.578] GetProcessHeap () returned 0x630000 [0063.579] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0063.579] GetProcessHeap () returned 0x630000 [0063.579] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0063.579] GetProcessHeap () returned 0x630000 [0063.579] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0063.579] GetProcessHeap () returned 0x630000 [0063.579] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0063.579] GetProcessHeap () returned 0x630000 [0063.579] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0063.579] GetProcessHeap () returned 0x630000 [0063.579] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0063.579] GetProcessHeap () returned 0x630000 [0063.579] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0063.579] GetProcessHeap () returned 0x630000 [0063.579] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e6a0 | out: hHeap=0x630000) returned 1 [0063.579] GetProcessHeap () returned 0x630000 [0063.579] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0063.579] GetProcessHeap () returned 0x630000 [0063.579] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0063.579] GetProcessHeap () returned 0x630000 [0063.579] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0063.579] WriteFile (in: hFile=0x230, lpBuffer=0x659550*, nNumberOfBytesToWrite=0x38b, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659550*, lpNumberOfBytesWritten=0x243d864*=0x38b, lpOverlapped=0x0) returned 1 [0063.591] GetProcessHeap () returned 0x630000 [0063.591] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659550, Size=0x30) returned 0x659550 [0063.591] GetProcessHeap () returned 0x630000 [0063.591] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0063.591] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0063.591] GetProcessHeap () returned 0x630000 [0063.591] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0063.591] ReadFile (in: hFile=0x230, lpBuffer=0x64cc78, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x64cc78*, lpNumberOfBytesRead=0x243d7e8*=0x200, lpOverlapped=0x0) returned 1 [0063.591] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0063.591] WriteFile (in: hFile=0x230, lpBuffer=0x64cc78*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x64cc78*, lpNumberOfBytesWritten=0x243d7e4*=0x200, lpOverlapped=0x0) returned 1 [0063.592] GetProcessHeap () returned 0x630000 [0063.592] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0063.592] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0063.593] WriteFile (in: hFile=0x230, lpBuffer=0x659550*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659550*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0063.593] CloseHandle (hObject=0x230) returned 1 [0063.595] GetProcessHeap () returned 0x630000 [0063.595] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x652000 | out: hHeap=0x630000) returned 1 [0063.595] GetProcessHeap () returned 0x630000 [0063.595] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655418 | out: hHeap=0x630000) returned 1 [0063.595] GetProcessHeap () returned 0x630000 [0063.595] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0063.595] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Links\\Desktop.lnk" | out: lpString1="C:\\Users\\FD1HVy\\Links\\Desktop.lnk") returned="C:\\Users\\FD1HVy\\Links\\Desktop.lnk" [0063.595] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Links\\Desktop.lnk", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Links\\Desktop.lnk.happythreechoose") returned="C:\\Users\\FD1HVy\\Links\\Desktop.lnk.happythreechoose" [0063.595] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\Links\\Desktop.lnk.happythreechoose" (normalized: "c:\\users\\fd1hvy\\links\\desktop.lnk.happythreechoose"), dwFlags=0x1) returned 1 [0063.596] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Links\\Desktop.lnk" | out: pszPath="C:\\Users\\FD1HVy\\Links") returned 1 [0063.596] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Links" | out: pszPath="C:\\Users\\FD1HVy\\Links\\") returned="" [0063.596] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Links\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Links\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Links\\Decryption INFO.html" [0063.596] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Links\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\links\\decryption info.html")) returned 0x20 [0063.596] GetProcessHeap () returned 0x630000 [0063.596] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0063.596] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x442b54f3, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x442b54f3, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xcec7abde, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x3ae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0063.596] lstrcmpiW (lpString1="Downloads.lnk", lpString2=".") returned 1 [0063.596] lstrcmpiW (lpString1="Downloads.lnk", lpString2="..") returned 1 [0063.596] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Links\\", lpString2="Downloads.lnk" | out: lpString1="C:\\Users\\FD1HVy\\Links\\Downloads.lnk") returned="C:\\Users\\FD1HVy\\Links\\Downloads.lnk" [0063.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Downloads.lnk", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0063.596] GetProcessHeap () returned 0x630000 [0063.596] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x64c9f0 [0063.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Downloads.lnk", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Downloads.lnk", lpUsedDefaultChar=0x0) returned 14 [0063.596] lstrlenA (lpString="Downloads.lnk") returned 13 [0063.596] lstrlenA (lpString=".happythreechoose") returned 17 [0063.596] lstrcmpiW (lpString1="Downloads.lnk", lpString2="Decryption INFO.html") returned 1 [0063.596] lstrcmpiW (lpString1="Downloads.lnk", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0063.596] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0063.596] lstrcmpiW (lpString1="Downloads.lnk", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0063.596] GetProcessHeap () returned 0x630000 [0063.596] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0063.596] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0063.596] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=942) returned 1 [0063.596] GetProcessHeap () returned 0x630000 [0063.597] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655580 [0063.597] GetProcessHeap () returned 0x630000 [0063.597] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0063.597] lstrlenW (lpString="C:\\Users\\FD1HVy\\Links\\Downloads.lnk") returned 35 [0063.597] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0063.597] GetProcessHeap () returned 0x630000 [0063.597] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0063.597] GetProcessHeap () returned 0x630000 [0063.597] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x382) returned 0x659588 [0063.597] lstrlenA (lpString="rsa_encrypt") returned 11 [0063.597] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0063.597] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0063.597] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0063.597] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0063.597] GetProcessHeap () returned 0x630000 [0063.597] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0063.597] lstrlenA (lpString="010001") returned 6 [0063.598] GetProcessHeap () returned 0x630000 [0063.598] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a318 [0063.598] GetProcessHeap () returned 0x630000 [0063.598] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0063.598] GetProcessHeap () returned 0x630000 [0063.598] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e7c0 [0063.598] GetProcessHeap () returned 0x630000 [0063.598] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0063.598] GetProcessHeap () returned 0x630000 [0063.598] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e730 [0063.598] GetProcessHeap () returned 0x630000 [0063.598] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656950 [0063.598] GetProcessHeap () returned 0x630000 [0063.598] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a328 [0063.598] GetProcessHeap () returned 0x630000 [0063.598] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0063.598] GetProcessHeap () returned 0x630000 [0063.598] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0063.598] GetProcessHeap () returned 0x630000 [0063.598] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0063.598] GetProcessHeap () returned 0x630000 [0063.598] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0063.598] GetProcessHeap () returned 0x630000 [0063.598] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x6570f8 [0063.598] GetProcessHeap () returned 0x630000 [0063.598] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0063.598] GetProcessHeap () returned 0x630000 [0063.598] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0063.598] GetProcessHeap () returned 0x630000 [0063.598] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e6a0 [0063.598] GetProcessHeap () returned 0x630000 [0063.598] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0063.598] GetProcessHeap () returned 0x630000 [0063.598] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0063.598] GetProcessHeap () returned 0x630000 [0063.598] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e6a0 | out: hHeap=0x630000) returned 1 [0063.598] GetProcessHeap () returned 0x630000 [0063.599] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0063.599] GetProcessHeap () returned 0x630000 [0063.599] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65ce80 [0063.599] GetProcessHeap () returned 0x630000 [0063.599] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0063.599] GetProcessHeap () returned 0x630000 [0063.599] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0063.599] GetProcessHeap () returned 0x630000 [0063.599] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.599] GetProcessHeap () returned 0x630000 [0063.599] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.599] GetProcessHeap () returned 0x630000 [0063.599] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e220 [0063.599] GetProcessHeap () returned 0x630000 [0063.599] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ce80 | out: hHeap=0x630000) returned 1 [0063.599] GetProcessHeap () returned 0x630000 [0063.599] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0063.599] GetProcessHeap () returned 0x630000 [0063.599] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0063.599] GetProcessHeap () returned 0x630000 [0063.599] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.599] GetProcessHeap () returned 0x630000 [0063.599] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.599] GetProcessHeap () returned 0x630000 [0063.599] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0063.599] GetProcessHeap () returned 0x630000 [0063.599] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0063.599] GetProcessHeap () returned 0x630000 [0063.599] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0063.599] GetProcessHeap () returned 0x630000 [0063.599] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0063.599] GetProcessHeap () returned 0x630000 [0063.599] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.599] GetProcessHeap () returned 0x630000 [0063.599] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.599] GetProcessHeap () returned 0x630000 [0063.599] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0063.599] GetProcessHeap () returned 0x630000 [0063.600] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0063.600] GetProcessHeap () returned 0x630000 [0063.600] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0063.600] GetProcessHeap () returned 0x630000 [0063.600] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0063.600] GetProcessHeap () returned 0x630000 [0063.600] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.600] GetProcessHeap () returned 0x630000 [0063.600] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.600] GetProcessHeap () returned 0x630000 [0063.600] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.600] GetProcessHeap () returned 0x630000 [0063.600] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.600] GetProcessHeap () returned 0x630000 [0063.600] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0063.600] GetProcessHeap () returned 0x630000 [0063.600] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0063.600] GetProcessHeap () returned 0x630000 [0063.600] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0063.600] GetProcessHeap () returned 0x630000 [0063.600] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0063.600] GetProcessHeap () returned 0x630000 [0063.600] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0063.600] GetProcessHeap () returned 0x630000 [0063.600] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0063.600] GetProcessHeap () returned 0x630000 [0063.600] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.600] GetProcessHeap () returned 0x630000 [0063.600] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.600] GetProcessHeap () returned 0x630000 [0063.600] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0063.600] GetProcessHeap () returned 0x630000 [0063.600] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0063.600] GetProcessHeap () returned 0x630000 [0063.600] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.600] GetProcessHeap () returned 0x630000 [0063.600] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.601] GetProcessHeap () returned 0x630000 [0063.601] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0063.601] GetProcessHeap () returned 0x630000 [0063.601] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0063.601] GetProcessHeap () returned 0x630000 [0063.601] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.601] GetProcessHeap () returned 0x630000 [0063.601] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.601] GetProcessHeap () returned 0x630000 [0063.601] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0063.601] GetProcessHeap () returned 0x630000 [0063.601] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0063.601] GetProcessHeap () returned 0x630000 [0063.601] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.601] GetProcessHeap () returned 0x630000 [0063.601] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.601] GetProcessHeap () returned 0x630000 [0063.601] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.601] GetProcessHeap () returned 0x630000 [0063.601] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.601] GetProcessHeap () returned 0x630000 [0063.601] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.601] GetProcessHeap () returned 0x630000 [0063.601] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.601] GetProcessHeap () returned 0x630000 [0063.601] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.601] GetProcessHeap () returned 0x630000 [0063.601] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.601] GetProcessHeap () returned 0x630000 [0063.604] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.604] GetProcessHeap () returned 0x630000 [0063.604] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.604] GetProcessHeap () returned 0x630000 [0063.604] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0063.604] GetProcessHeap () returned 0x630000 [0063.604] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0063.604] GetProcessHeap () returned 0x630000 [0063.604] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0063.604] GetProcessHeap () returned 0x630000 [0063.604] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0063.604] GetProcessHeap () returned 0x630000 [0063.604] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0063.604] GetProcessHeap () returned 0x630000 [0063.604] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0063.604] GetProcessHeap () returned 0x630000 [0063.604] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.604] GetProcessHeap () returned 0x630000 [0063.604] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.604] GetProcessHeap () returned 0x630000 [0063.604] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0063.604] GetProcessHeap () returned 0x630000 [0063.604] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0063.604] GetProcessHeap () returned 0x630000 [0063.604] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0063.605] GetProcessHeap () returned 0x630000 [0063.605] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0063.605] GetProcessHeap () returned 0x630000 [0063.605] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0063.605] GetProcessHeap () returned 0x630000 [0063.605] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0063.605] GetProcessHeap () returned 0x630000 [0063.605] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0063.605] GetProcessHeap () returned 0x630000 [0063.605] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0063.605] GetProcessHeap () returned 0x630000 [0063.605] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.605] GetProcessHeap () returned 0x630000 [0063.605] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.605] GetProcessHeap () returned 0x630000 [0063.605] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.605] GetProcessHeap () returned 0x630000 [0063.605] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.605] GetProcessHeap () returned 0x630000 [0063.605] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0063.605] GetProcessHeap () returned 0x630000 [0063.605] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0063.605] GetProcessHeap () returned 0x630000 [0063.605] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0063.605] GetProcessHeap () returned 0x630000 [0063.605] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0063.605] GetProcessHeap () returned 0x630000 [0063.605] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.605] GetProcessHeap () returned 0x630000 [0063.605] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.605] GetProcessHeap () returned 0x630000 [0063.605] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0063.605] GetProcessHeap () returned 0x630000 [0063.605] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0063.605] GetProcessHeap () returned 0x630000 [0063.605] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.605] GetProcessHeap () returned 0x630000 [0063.605] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.605] GetProcessHeap () returned 0x630000 [0063.606] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0063.606] GetProcessHeap () returned 0x630000 [0063.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0063.606] GetProcessHeap () returned 0x630000 [0063.606] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.606] GetProcessHeap () returned 0x630000 [0063.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.606] GetProcessHeap () returned 0x630000 [0063.606] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.606] GetProcessHeap () returned 0x630000 [0063.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.606] GetProcessHeap () returned 0x630000 [0063.606] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.606] GetProcessHeap () returned 0x630000 [0063.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.606] GetProcessHeap () returned 0x630000 [0063.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0063.606] GetProcessHeap () returned 0x630000 [0063.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0063.606] GetProcessHeap () returned 0x630000 [0063.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0063.606] GetProcessHeap () returned 0x630000 [0063.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0063.606] GetProcessHeap () returned 0x630000 [0063.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0063.606] GetProcessHeap () returned 0x630000 [0063.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0063.606] GetProcessHeap () returned 0x630000 [0063.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0063.606] GetProcessHeap () returned 0x630000 [0063.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e7c0 | out: hHeap=0x630000) returned 1 [0063.606] GetProcessHeap () returned 0x630000 [0063.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0063.606] GetProcessHeap () returned 0x630000 [0063.606] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.606] GetProcessHeap () returned 0x630000 [0063.607] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0063.607] WriteFile (in: hFile=0x230, lpBuffer=0x659588*, nNumberOfBytesToWrite=0x382, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659588*, lpNumberOfBytesWritten=0x243d864*=0x382, lpOverlapped=0x0) returned 1 [0063.722] GetProcessHeap () returned 0x630000 [0063.722] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659588, Size=0x30) returned 0x659588 [0063.722] GetProcessHeap () returned 0x630000 [0063.722] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0063.722] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0063.722] GetProcessHeap () returned 0x630000 [0063.722] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3b0) returned 0x6595c0 [0063.722] ReadFile (in: hFile=0x230, lpBuffer=0x6595c0, nNumberOfBytesToRead=0x3b0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x6595c0*, lpNumberOfBytesRead=0x243d7e8*=0x3b0, lpOverlapped=0x0) returned 1 [0063.722] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0063.723] WriteFile (in: hFile=0x230, lpBuffer=0x6595c0*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x6595c0*, lpNumberOfBytesWritten=0x243d7e4*=0x3b0, lpOverlapped=0x0) returned 1 [0063.724] GetProcessHeap () returned 0x630000 [0063.724] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6595c0 | out: hHeap=0x630000) returned 1 [0063.724] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0063.724] WriteFile (in: hFile=0x230, lpBuffer=0x659588*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659588*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0063.725] CloseHandle (hObject=0x230) returned 1 [0063.726] GetProcessHeap () returned 0x630000 [0063.726] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0063.726] GetProcessHeap () returned 0x630000 [0063.727] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655580 | out: hHeap=0x630000) returned 1 [0063.727] GetProcessHeap () returned 0x630000 [0063.727] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0063.727] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Links\\Downloads.lnk" | out: lpString1="C:\\Users\\FD1HVy\\Links\\Downloads.lnk") returned="C:\\Users\\FD1HVy\\Links\\Downloads.lnk" [0063.727] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Links\\Downloads.lnk", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Links\\Downloads.lnk.happythreechoose") returned="C:\\Users\\FD1HVy\\Links\\Downloads.lnk.happythreechoose" [0063.727] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\Links\\Downloads.lnk.happythreechoose" (normalized: "c:\\users\\fd1hvy\\links\\downloads.lnk.happythreechoose"), dwFlags=0x1) returned 1 [0063.727] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Links\\Downloads.lnk" | out: pszPath="C:\\Users\\FD1HVy\\Links") returned 1 [0063.727] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Links" | out: pszPath="C:\\Users\\FD1HVy\\Links\\") returned="" [0063.727] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Links\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Links\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Links\\Decryption INFO.html" [0063.727] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Links\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\links\\decryption info.html")) returned 0x20 [0063.727] GetProcessHeap () returned 0x630000 [0063.728] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0063.728] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3190fb5, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x94664823, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OneDrive.lnk", cAlternateFileName="")) returned 1 [0063.728] lstrcmpiW (lpString1="OneDrive.lnk", lpString2=".") returned 1 [0063.728] lstrcmpiW (lpString1="OneDrive.lnk", lpString2="..") returned 1 [0063.728] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Links\\", lpString2="OneDrive.lnk" | out: lpString1="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk") returned="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" [0063.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="OneDrive.lnk", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.728] GetProcessHeap () returned 0x630000 [0063.728] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd) returned 0x64c9f0 [0063.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="OneDrive.lnk", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OneDrive.lnk", lpUsedDefaultChar=0x0) returned 13 [0063.728] lstrlenA (lpString="OneDrive.lnk") returned 12 [0063.728] lstrlenA (lpString=".happythreechoose") returned 17 [0063.728] lstrcmpiW (lpString1="OneDrive.lnk", lpString2="Decryption INFO.html") returned 1 [0063.728] lstrcmpiW (lpString1="OneDrive.lnk", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0063.728] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0063.728] lstrcmpiW (lpString1="OneDrive.lnk", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0063.728] GetProcessHeap () returned 0x630000 [0063.728] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0063.728] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0063.728] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=1338) returned 1 [0063.728] GetProcessHeap () returned 0x630000 [0063.728] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655508 [0063.728] GetProcessHeap () returned 0x630000 [0063.728] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0063.728] lstrlenW (lpString="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk") returned 34 [0063.728] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0063.729] GetProcessHeap () returned 0x630000 [0063.729] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0063.729] GetProcessHeap () returned 0x630000 [0063.729] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x386) returned 0x6595c0 [0063.729] lstrlenA (lpString="rsa_encrypt") returned 11 [0063.729] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0063.729] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0063.729] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0063.729] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0063.729] GetProcessHeap () returned 0x630000 [0063.729] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0063.729] lstrlenA (lpString="010001") returned 6 [0063.729] GetProcessHeap () returned 0x630000 [0063.729] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2b8 [0063.730] GetProcessHeap () returned 0x630000 [0063.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0063.730] GetProcessHeap () returned 0x630000 [0063.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e4f0 [0063.730] GetProcessHeap () returned 0x630000 [0063.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0063.730] GetProcessHeap () returned 0x630000 [0063.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65eb20 [0063.730] GetProcessHeap () returned 0x630000 [0063.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657440 [0063.730] GetProcessHeap () returned 0x630000 [0063.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0063.730] GetProcessHeap () returned 0x630000 [0063.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0063.730] GetProcessHeap () returned 0x630000 [0063.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.730] GetProcessHeap () returned 0x630000 [0063.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0063.730] GetProcessHeap () returned 0x630000 [0063.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0063.730] GetProcessHeap () returned 0x630000 [0063.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x6570f8 [0063.730] GetProcessHeap () returned 0x630000 [0063.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0063.730] GetProcessHeap () returned 0x630000 [0063.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0063.730] GetProcessHeap () returned 0x630000 [0063.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65df50 [0063.730] GetProcessHeap () returned 0x630000 [0063.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0063.730] GetProcessHeap () returned 0x630000 [0063.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0063.730] GetProcessHeap () returned 0x630000 [0063.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0063.730] GetProcessHeap () returned 0x630000 [0063.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.730] GetProcessHeap () returned 0x630000 [0063.731] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cd30 [0063.731] GetProcessHeap () returned 0x630000 [0063.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0063.731] GetProcessHeap () returned 0x630000 [0063.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.731] GetProcessHeap () returned 0x630000 [0063.731] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.731] GetProcessHeap () returned 0x630000 [0063.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.731] GetProcessHeap () returned 0x630000 [0063.731] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e610 [0063.731] GetProcessHeap () returned 0x630000 [0063.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cd30 | out: hHeap=0x630000) returned 1 [0063.731] GetProcessHeap () returned 0x630000 [0063.731] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0063.731] GetProcessHeap () returned 0x630000 [0063.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0063.731] GetProcessHeap () returned 0x630000 [0063.731] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.731] GetProcessHeap () returned 0x630000 [0063.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.731] GetProcessHeap () returned 0x630000 [0063.731] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.731] GetProcessHeap () returned 0x630000 [0063.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.731] GetProcessHeap () returned 0x630000 [0063.731] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.731] GetProcessHeap () returned 0x630000 [0063.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.731] GetProcessHeap () returned 0x630000 [0063.731] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0063.731] GetProcessHeap () returned 0x630000 [0063.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0063.731] GetProcessHeap () returned 0x630000 [0063.731] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0063.731] GetProcessHeap () returned 0x630000 [0063.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0063.732] GetProcessHeap () returned 0x630000 [0063.732] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0063.732] GetProcessHeap () returned 0x630000 [0063.732] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0063.732] GetProcessHeap () returned 0x630000 [0063.732] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.732] GetProcessHeap () returned 0x630000 [0063.732] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.732] GetProcessHeap () returned 0x630000 [0063.732] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.732] GetProcessHeap () returned 0x630000 [0063.732] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.732] GetProcessHeap () returned 0x630000 [0063.732] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.732] GetProcessHeap () returned 0x630000 [0063.732] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.732] GetProcessHeap () returned 0x630000 [0063.732] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.732] GetProcessHeap () returned 0x630000 [0063.732] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.732] GetProcessHeap () returned 0x630000 [0063.732] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.732] GetProcessHeap () returned 0x630000 [0063.732] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.732] GetProcessHeap () returned 0x630000 [0063.732] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0063.732] GetProcessHeap () returned 0x630000 [0063.732] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0063.732] GetProcessHeap () returned 0x630000 [0063.732] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.732] GetProcessHeap () returned 0x630000 [0063.732] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.732] GetProcessHeap () returned 0x630000 [0063.732] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.732] GetProcessHeap () returned 0x630000 [0063.733] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.733] GetProcessHeap () returned 0x630000 [0063.733] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.733] GetProcessHeap () returned 0x630000 [0063.733] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.733] GetProcessHeap () returned 0x630000 [0063.733] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.733] GetProcessHeap () returned 0x630000 [0063.733] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.733] GetProcessHeap () returned 0x630000 [0063.733] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.733] GetProcessHeap () returned 0x630000 [0063.733] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.733] GetProcessHeap () returned 0x630000 [0063.733] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.733] GetProcessHeap () returned 0x630000 [0063.733] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.733] GetProcessHeap () returned 0x630000 [0063.733] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.733] GetProcessHeap () returned 0x630000 [0063.733] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.733] GetProcessHeap () returned 0x630000 [0063.733] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.733] GetProcessHeap () returned 0x630000 [0063.733] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.733] GetProcessHeap () returned 0x630000 [0063.733] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0063.733] GetProcessHeap () returned 0x630000 [0063.733] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0063.733] GetProcessHeap () returned 0x630000 [0063.733] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.733] GetProcessHeap () returned 0x630000 [0063.733] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.733] GetProcessHeap () returned 0x630000 [0063.733] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0063.734] GetProcessHeap () returned 0x630000 [0063.734] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0063.734] GetProcessHeap () returned 0x630000 [0063.734] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.734] GetProcessHeap () returned 0x630000 [0063.734] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.734] GetProcessHeap () returned 0x630000 [0063.734] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.734] GetProcessHeap () returned 0x630000 [0063.734] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.734] GetProcessHeap () returned 0x630000 [0063.734] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.734] GetProcessHeap () returned 0x630000 [0063.734] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.734] GetProcessHeap () returned 0x630000 [0063.734] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0063.734] GetProcessHeap () returned 0x630000 [0063.734] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0063.734] GetProcessHeap () returned 0x630000 [0063.734] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.734] GetProcessHeap () returned 0x630000 [0063.734] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.734] GetProcessHeap () returned 0x630000 [0063.734] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.734] GetProcessHeap () returned 0x630000 [0063.734] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.734] GetProcessHeap () returned 0x630000 [0063.734] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.734] GetProcessHeap () returned 0x630000 [0063.734] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.734] GetProcessHeap () returned 0x630000 [0063.734] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.734] GetProcessHeap () returned 0x630000 [0063.734] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.734] GetProcessHeap () returned 0x630000 [0063.734] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0063.735] GetProcessHeap () returned 0x630000 [0063.735] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0063.735] GetProcessHeap () returned 0x630000 [0063.735] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.735] GetProcessHeap () returned 0x630000 [0063.735] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.735] GetProcessHeap () returned 0x630000 [0063.735] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.735] GetProcessHeap () returned 0x630000 [0063.735] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.735] GetProcessHeap () returned 0x630000 [0063.735] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0063.735] GetProcessHeap () returned 0x630000 [0063.735] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0063.735] GetProcessHeap () returned 0x630000 [0063.735] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.735] GetProcessHeap () returned 0x630000 [0063.735] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.735] GetProcessHeap () returned 0x630000 [0063.735] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.735] GetProcessHeap () returned 0x630000 [0063.735] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.735] GetProcessHeap () returned 0x630000 [0063.735] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0063.735] GetProcessHeap () returned 0x630000 [0063.735] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0063.735] GetProcessHeap () returned 0x630000 [0063.735] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0063.735] GetProcessHeap () returned 0x630000 [0063.736] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0063.736] GetProcessHeap () returned 0x630000 [0063.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0063.736] GetProcessHeap () returned 0x630000 [0063.736] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0063.736] GetProcessHeap () returned 0x630000 [0063.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0063.736] GetProcessHeap () returned 0x630000 [0063.736] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0063.736] GetProcessHeap () returned 0x630000 [0063.736] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0063.736] GetProcessHeap () returned 0x630000 [0063.736] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0063.736] GetProcessHeap () returned 0x630000 [0063.736] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0063.736] GetProcessHeap () returned 0x630000 [0063.736] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0063.736] GetProcessHeap () returned 0x630000 [0063.736] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0063.736] GetProcessHeap () returned 0x630000 [0063.736] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0063.736] GetProcessHeap () returned 0x630000 [0063.736] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0063.736] GetProcessHeap () returned 0x630000 [0063.736] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0063.736] GetProcessHeap () returned 0x630000 [0063.736] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0063.736] GetProcessHeap () returned 0x630000 [0063.736] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0063.736] GetProcessHeap () returned 0x630000 [0063.736] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0063.736] WriteFile (in: hFile=0x230, lpBuffer=0x6595c0*, nNumberOfBytesToWrite=0x386, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6595c0*, lpNumberOfBytesWritten=0x243d864*=0x386, lpOverlapped=0x0) returned 1 [0064.380] GetProcessHeap () returned 0x630000 [0064.380] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6595c0, Size=0x30) returned 0x6595c0 [0064.380] GetProcessHeap () returned 0x630000 [0064.380] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0064.380] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0064.380] GetProcessHeap () returned 0x630000 [0064.380] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x540) returned 0x6595f8 [0064.380] ReadFile (in: hFile=0x230, lpBuffer=0x6595f8, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x6595f8*, lpNumberOfBytesRead=0x243d7e8*=0x540, lpOverlapped=0x0) returned 1 [0064.380] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0064.380] WriteFile (in: hFile=0x230, lpBuffer=0x6595f8*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x6595f8*, lpNumberOfBytesWritten=0x243d7e4*=0x540, lpOverlapped=0x0) returned 1 [0064.381] GetProcessHeap () returned 0x630000 [0064.381] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6595f8 | out: hHeap=0x630000) returned 1 [0064.381] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0064.381] WriteFile (in: hFile=0x230, lpBuffer=0x6595c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6595c0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0064.382] CloseHandle (hObject=0x230) returned 1 [0064.384] GetProcessHeap () returned 0x630000 [0064.384] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0064.384] GetProcessHeap () returned 0x630000 [0064.384] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655508 | out: hHeap=0x630000) returned 1 [0064.384] GetProcessHeap () returned 0x630000 [0064.384] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0064.384] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" | out: lpString1="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk") returned="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" [0064.384] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk.happythreechoose") returned="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk.happythreechoose" [0064.384] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk.happythreechoose" (normalized: "c:\\users\\fd1hvy\\links\\onedrive.lnk.happythreechoose"), dwFlags=0x1) returned 1 [0064.385] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Links\\OneDrive.lnk" | out: pszPath="C:\\Users\\FD1HVy\\Links") returned 1 [0064.385] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Links" | out: pszPath="C:\\Users\\FD1HVy\\Links\\") returned="" [0064.385] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Links\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Links\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Links\\Decryption INFO.html" [0064.385] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Links\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\links\\decryption info.html")) returned 0x20 [0064.385] GetProcessHeap () returned 0x630000 [0064.385] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0064.385] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3190fb5, ftCreationTime.dwHighDateTime=0x1d327b5, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x94664823, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OneDrive.lnk", cAlternateFileName="")) returned 0 [0064.385] FindClose (in: hFindFile=0x648b10 | out: hFindFile=0x648b10) returned 1 [0064.385] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\Favorites\\" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\") returned="C:\\Users\\FD1HVy\\Favorites\\" [0064.385] GetProcessHeap () returned 0x630000 [0064.385] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x648850 | out: hHeap=0x630000) returned 1 [0064.385] GetProcessHeap () returned 0x630000 [0064.385] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.385] lstrlenW (lpString="C:\\Users\\FD1HVy\\Favorites\\") returned 26 [0064.385] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Favorites\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\*") returned="C:\\Users\\FD1HVy\\Favorites\\*" [0064.385] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648850 [0064.385] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0064.385] FindNextFileW (in: hFindFile=0x648850, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.386] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0064.386] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0064.386] FindNextFileW (in: hFindFile=0x648850, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43598c8e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43b9f870, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x43b9f870, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Bing.url", cAlternateFileName="")) returned 1 [0064.386] lstrcmpiW (lpString1="Bing.url", lpString2=".") returned 1 [0064.386] lstrcmpiW (lpString1="Bing.url", lpString2="..") returned 1 [0064.386] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Favorites\\", lpString2="Bing.url" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\Bing.url") returned="C:\\Users\\FD1HVy\\Favorites\\Bing.url" [0064.386] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Bing.url", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0064.386] GetProcessHeap () returned 0x630000 [0064.386] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9) returned 0x64c9f0 [0064.386] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Bing.url", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Bing.url", lpUsedDefaultChar=0x0) returned 9 [0064.386] lstrlenA (lpString="Bing.url") returned 8 [0064.386] lstrlenA (lpString=".happythreechoose") returned 17 [0064.386] lstrcmpiW (lpString1="Bing.url", lpString2="Decryption INFO.html") returned -1 [0064.386] lstrcmpiW (lpString1="Bing.url", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0064.386] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0064.386] lstrcmpiW (lpString1="Bing.url", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0064.386] GetProcessHeap () returned 0x630000 [0064.386] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0064.386] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0064.387] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=208) returned 1 [0064.387] GetProcessHeap () returned 0x630000 [0064.387] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655490 [0064.387] GetProcessHeap () returned 0x630000 [0064.387] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0064.387] lstrlenW (lpString="C:\\Users\\FD1HVy\\Favorites\\Bing.url") returned 34 [0064.387] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0064.387] GetProcessHeap () returned 0x630000 [0064.388] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0064.388] GetProcessHeap () returned 0x630000 [0064.388] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x6595f8 [0064.388] lstrlenA (lpString="rsa_encrypt") returned 11 [0064.388] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0064.388] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0064.388] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0064.388] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0064.388] GetProcessHeap () returned 0x630000 [0064.388] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0064.388] lstrlenA (lpString="010001") returned 6 [0064.388] GetProcessHeap () returned 0x630000 [0064.388] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0064.388] GetProcessHeap () returned 0x630000 [0064.388] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0064.389] GetProcessHeap () returned 0x630000 [0064.389] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e340 [0064.389] GetProcessHeap () returned 0x630000 [0064.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0064.389] GetProcessHeap () returned 0x630000 [0064.389] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea00 [0064.389] GetProcessHeap () returned 0x630000 [0064.389] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656c98 [0064.389] GetProcessHeap () returned 0x630000 [0064.389] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2b8 [0064.389] GetProcessHeap () returned 0x630000 [0064.389] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0064.389] GetProcessHeap () returned 0x630000 [0064.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0064.389] GetProcessHeap () returned 0x630000 [0064.389] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0064.389] GetProcessHeap () returned 0x630000 [0064.389] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0064.389] GetProcessHeap () returned 0x630000 [0064.389] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656fe0 [0064.389] GetProcessHeap () returned 0x630000 [0064.389] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.389] GetProcessHeap () returned 0x630000 [0064.389] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0064.389] GetProcessHeap () returned 0x630000 [0064.389] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e850 [0064.389] GetProcessHeap () returned 0x630000 [0064.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0064.389] GetProcessHeap () returned 0x630000 [0064.389] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0064.389] GetProcessHeap () returned 0x630000 [0064.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0064.389] GetProcessHeap () returned 0x630000 [0064.389] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0064.389] GetProcessHeap () returned 0x630000 [0064.389] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65d048 [0064.389] GetProcessHeap () returned 0x630000 [0064.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.389] GetProcessHeap () returned 0x630000 [0064.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0064.390] GetProcessHeap () returned 0x630000 [0064.390] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0064.390] GetProcessHeap () returned 0x630000 [0064.390] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0064.390] GetProcessHeap () returned 0x630000 [0064.390] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65dfe0 [0064.390] GetProcessHeap () returned 0x630000 [0064.390] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65d048 | out: hHeap=0x630000) returned 1 [0064.390] GetProcessHeap () returned 0x630000 [0064.390] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0064.390] GetProcessHeap () returned 0x630000 [0064.390] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0064.390] GetProcessHeap () returned 0x630000 [0064.390] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.390] GetProcessHeap () returned 0x630000 [0064.390] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.390] GetProcessHeap () returned 0x630000 [0064.390] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0064.390] GetProcessHeap () returned 0x630000 [0064.390] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0064.390] GetProcessHeap () returned 0x630000 [0064.390] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0064.390] GetProcessHeap () returned 0x630000 [0064.390] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0064.390] GetProcessHeap () returned 0x630000 [0064.391] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0064.391] GetProcessHeap () returned 0x630000 [0064.391] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0064.391] GetProcessHeap () returned 0x630000 [0064.391] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.391] GetProcessHeap () returned 0x630000 [0064.391] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.391] GetProcessHeap () returned 0x630000 [0064.391] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0064.391] GetProcessHeap () returned 0x630000 [0064.391] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0064.391] GetProcessHeap () returned 0x630000 [0064.391] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.391] GetProcessHeap () returned 0x630000 [0064.391] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.391] GetProcessHeap () returned 0x630000 [0064.391] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0064.391] GetProcessHeap () returned 0x630000 [0064.391] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0064.391] GetProcessHeap () returned 0x630000 [0064.391] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0064.391] GetProcessHeap () returned 0x630000 [0064.391] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0064.391] GetProcessHeap () returned 0x630000 [0064.391] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0064.391] GetProcessHeap () returned 0x630000 [0064.391] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0064.391] GetProcessHeap () returned 0x630000 [0064.391] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0064.391] GetProcessHeap () returned 0x630000 [0064.391] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0064.391] GetProcessHeap () returned 0x630000 [0064.391] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.391] GetProcessHeap () returned 0x630000 [0064.391] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.391] GetProcessHeap () returned 0x630000 [0064.391] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0064.392] GetProcessHeap () returned 0x630000 [0064.392] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0064.392] GetProcessHeap () returned 0x630000 [0064.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.392] GetProcessHeap () returned 0x630000 [0064.392] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.392] GetProcessHeap () returned 0x630000 [0064.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0064.392] GetProcessHeap () returned 0x630000 [0064.392] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0064.392] GetProcessHeap () returned 0x630000 [0064.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.392] GetProcessHeap () returned 0x630000 [0064.392] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.392] GetProcessHeap () returned 0x630000 [0064.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0064.392] GetProcessHeap () returned 0x630000 [0064.392] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0064.392] GetProcessHeap () returned 0x630000 [0064.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.392] GetProcessHeap () returned 0x630000 [0064.392] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.392] GetProcessHeap () returned 0x630000 [0064.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0064.392] GetProcessHeap () returned 0x630000 [0064.392] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0064.392] GetProcessHeap () returned 0x630000 [0064.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.392] GetProcessHeap () returned 0x630000 [0064.392] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.392] GetProcessHeap () returned 0x630000 [0064.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0064.392] GetProcessHeap () returned 0x630000 [0064.392] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0064.392] GetProcessHeap () returned 0x630000 [0064.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0064.392] GetProcessHeap () returned 0x630000 [0064.392] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0064.393] GetProcessHeap () returned 0x630000 [0064.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0064.393] GetProcessHeap () returned 0x630000 [0064.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0064.393] GetProcessHeap () returned 0x630000 [0064.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0064.393] GetProcessHeap () returned 0x630000 [0064.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0064.393] GetProcessHeap () returned 0x630000 [0064.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.393] GetProcessHeap () returned 0x630000 [0064.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.393] GetProcessHeap () returned 0x630000 [0064.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0064.393] GetProcessHeap () returned 0x630000 [0064.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0064.393] GetProcessHeap () returned 0x630000 [0064.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0064.393] GetProcessHeap () returned 0x630000 [0064.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0064.393] GetProcessHeap () returned 0x630000 [0064.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0064.393] GetProcessHeap () returned 0x630000 [0064.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0064.393] GetProcessHeap () returned 0x630000 [0064.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.393] GetProcessHeap () returned 0x630000 [0064.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.393] GetProcessHeap () returned 0x630000 [0064.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0064.393] GetProcessHeap () returned 0x630000 [0064.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0064.393] GetProcessHeap () returned 0x630000 [0064.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0064.393] GetProcessHeap () returned 0x630000 [0064.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0064.393] GetProcessHeap () returned 0x630000 [0064.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0064.393] GetProcessHeap () returned 0x630000 [0064.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0064.394] GetProcessHeap () returned 0x630000 [0064.394] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0064.394] GetProcessHeap () returned 0x630000 [0064.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0064.394] GetProcessHeap () returned 0x630000 [0064.394] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0064.394] GetProcessHeap () returned 0x630000 [0064.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0064.394] GetProcessHeap () returned 0x630000 [0064.394] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.394] GetProcessHeap () returned 0x630000 [0064.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.394] GetProcessHeap () returned 0x630000 [0064.394] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.394] GetProcessHeap () returned 0x630000 [0064.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.394] GetProcessHeap () returned 0x630000 [0064.394] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0064.394] GetProcessHeap () returned 0x630000 [0064.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0064.394] GetProcessHeap () returned 0x630000 [0064.394] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0064.394] GetProcessHeap () returned 0x630000 [0064.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0064.394] GetProcessHeap () returned 0x630000 [0064.394] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0064.394] GetProcessHeap () returned 0x630000 [0064.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0064.394] GetProcessHeap () returned 0x630000 [0064.394] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.394] GetProcessHeap () returned 0x630000 [0064.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.394] GetProcessHeap () returned 0x630000 [0064.394] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0064.394] GetProcessHeap () returned 0x630000 [0064.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0064.395] GetProcessHeap () returned 0x630000 [0064.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0064.395] GetProcessHeap () returned 0x630000 [0064.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0064.395] GetProcessHeap () returned 0x630000 [0064.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0064.395] GetProcessHeap () returned 0x630000 [0064.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0064.395] GetProcessHeap () returned 0x630000 [0064.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0064.395] GetProcessHeap () returned 0x630000 [0064.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0064.395] GetProcessHeap () returned 0x630000 [0064.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0064.395] GetProcessHeap () returned 0x630000 [0064.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0064.395] GetProcessHeap () returned 0x630000 [0064.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0064.395] GetProcessHeap () returned 0x630000 [0064.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0064.395] GetProcessHeap () returned 0x630000 [0064.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0064.395] WriteFile (in: hFile=0x230, lpBuffer=0x6595f8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6595f8*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0064.403] GetProcessHeap () returned 0x630000 [0064.403] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6595f8, Size=0x30) returned 0x6595f8 [0064.403] GetProcessHeap () returned 0x630000 [0064.403] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0064.403] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0064.403] GetProcessHeap () returned 0x630000 [0064.403] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd0) returned 0x6491c0 [0064.403] ReadFile (in: hFile=0x230, lpBuffer=0x6491c0, nNumberOfBytesToRead=0xd0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x6491c0*, lpNumberOfBytesRead=0x243d7e8*=0xd0, lpOverlapped=0x0) returned 1 [0064.403] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0064.403] WriteFile (in: hFile=0x230, lpBuffer=0x6491c0*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x6491c0*, lpNumberOfBytesWritten=0x243d7e4*=0xd0, lpOverlapped=0x0) returned 1 [0064.404] GetProcessHeap () returned 0x630000 [0064.404] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6491c0 | out: hHeap=0x630000) returned 1 [0064.404] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0064.404] WriteFile (in: hFile=0x230, lpBuffer=0x6595f8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6595f8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0064.405] CloseHandle (hObject=0x230) returned 1 [0064.406] GetProcessHeap () returned 0x630000 [0064.407] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0064.407] GetProcessHeap () returned 0x630000 [0064.407] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655490 | out: hHeap=0x630000) returned 1 [0064.407] GetProcessHeap () returned 0x630000 [0064.407] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0064.407] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Favorites\\Bing.url" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\Bing.url") returned="C:\\Users\\FD1HVy\\Favorites\\Bing.url" [0064.407] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Favorites\\Bing.url", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\Bing.url.happythreechoose") returned="C:\\Users\\FD1HVy\\Favorites\\Bing.url.happythreechoose" [0064.407] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url"), lpNewFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url.happythreechoose" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url.happythreechoose"), dwFlags=0x1) returned 1 [0064.408] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Favorites\\Bing.url" | out: pszPath="C:\\Users\\FD1HVy\\Favorites") returned 1 [0064.408] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Favorites" | out: pszPath="C:\\Users\\FD1HVy\\Favorites\\") returned="" [0064.408] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Favorites\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Favorites\\Decryption INFO.html" [0064.408] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\favorites\\decryption info.html")) returned 0xffffffff [0064.408] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\favorites\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0064.420] GetProcessHeap () returned 0x630000 [0064.420] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6558c8 [0064.420] GetProcessHeap () returned 0x630000 [0064.420] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0064.427] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.427] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.427] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.428] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.428] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.428] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.428] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.428] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.428] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.428] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.428] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.428] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.428] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.428] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.428] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.428] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.429] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.429] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.429] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.429] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.429] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.429] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.429] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.429] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.429] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.429] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.429] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.464] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.464] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.464] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.464] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.464] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.465] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.465] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.465] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.465] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.465] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.466] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.466] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.466] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.466] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.466] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.466] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.466] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.466] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.466] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.466] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.467] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.467] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.467] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.467] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.467] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.467] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.467] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.467] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.467] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.467] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.467] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.467] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.467] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.467] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.468] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.468] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.468] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.468] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.468] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.468] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.468] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.468] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.468] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.468] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.468] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.469] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.469] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.469] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.469] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.469] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.469] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.469] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.469] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.469] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.469] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.469] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.469] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.469] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.469] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.470] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.470] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.470] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.470] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.470] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.470] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.470] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.470] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.470] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.470] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.470] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.470] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.470] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.470] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.471] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.471] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.471] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.471] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.471] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.471] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.471] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.471] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.471] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.471] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.471] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.471] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.471] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.471] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.472] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.472] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.472] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.472] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.472] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.472] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.472] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.472] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.472] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.472] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.472] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.472] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.472] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.472] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.472] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.473] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.473] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.473] GetProcessHeap () returned 0x630000 [0064.473] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6558c8 | out: hHeap=0x630000) returned 1 [0064.473] GetProcessHeap () returned 0x630000 [0064.473] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0064.473] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0064.473] GetProcessHeap () returned 0x630000 [0064.473] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655418 [0064.473] GetProcessHeap () returned 0x630000 [0064.473] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0064.480] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.481] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.481] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.481] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.481] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.481] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.481] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.481] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.481] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.481] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.482] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.482] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.482] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.482] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.482] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.482] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.482] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.482] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.482] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.482] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.482] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.483] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.483] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.483] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.483] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.483] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.483] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.483] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.483] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.483] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.483] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.484] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.484] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.484] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.484] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.484] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.484] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.484] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.484] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.484] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.485] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.485] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.485] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.485] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.485] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.485] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.485] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.485] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.485] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.486] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.486] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.486] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.486] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.486] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.486] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.486] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.486] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.487] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.487] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.487] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.487] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.487] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.487] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.487] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.487] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.488] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.488] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.488] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.488] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.488] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.488] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.488] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.488] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.488] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.488] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.489] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.489] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.489] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.489] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.489] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.489] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.489] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.489] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.490] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.490] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.490] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.490] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.490] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.490] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.490] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.490] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.490] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.490] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.491] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.491] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.491] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.491] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.491] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.491] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.491] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.491] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.492] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.492] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.492] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.492] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.492] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.492] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.492] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.492] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.492] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.492] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.492] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.492] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.492] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.493] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.493] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.493] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.493] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.493] GetProcessHeap () returned 0x630000 [0064.493] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655418 | out: hHeap=0x630000) returned 1 [0064.494] GetProcessHeap () returned 0x630000 [0064.494] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0064.494] CloseHandle (hObject=0x230) returned 1 [0064.502] GetProcessHeap () returned 0x630000 [0064.502] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0064.502] FindNextFileW (in: hFindFile=0x648850, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0064.502] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0064.502] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0064.502] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Favorites\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\desktop.ini") returned="C:\\Users\\FD1HVy\\Favorites\\desktop.ini" [0064.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0064.503] GetProcessHeap () returned 0x630000 [0064.503] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0064.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0064.503] lstrlenA (lpString="desktop.ini") returned 11 [0064.503] lstrlenA (lpString=".happythreechoose") returned 17 [0064.503] lstrcmpiW (lpString1="desktop.ini", lpString2="Decryption INFO.html") returned 1 [0064.503] lstrcmpiW (lpString1="desktop.ini", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0064.503] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0064.503] lstrcmpiW (lpString1="desktop.ini", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0064.503] GetProcessHeap () returned 0x630000 [0064.503] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0064.503] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\favorites\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0064.504] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=402) returned 1 [0064.504] GetProcessHeap () returned 0x630000 [0064.504] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655580 [0064.504] GetProcessHeap () returned 0x630000 [0064.504] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0064.504] lstrlenW (lpString="C:\\Users\\FD1HVy\\Favorites\\desktop.ini") returned 37 [0064.504] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0064.505] GetProcessHeap () returned 0x630000 [0064.505] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0064.505] GetProcessHeap () returned 0x630000 [0064.505] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38e) returned 0x659630 [0064.505] lstrlenA (lpString="rsa_encrypt") returned 11 [0064.505] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0064.505] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0064.505] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0064.505] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0064.505] GetProcessHeap () returned 0x630000 [0064.505] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0064.505] lstrlenA (lpString="010001") returned 6 [0064.505] GetProcessHeap () returned 0x630000 [0064.505] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a318 [0064.506] GetProcessHeap () returned 0x630000 [0064.506] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0064.506] GetProcessHeap () returned 0x630000 [0064.506] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e970 [0064.506] GetProcessHeap () returned 0x630000 [0064.506] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0064.506] GetProcessHeap () returned 0x630000 [0064.506] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0064.506] GetProcessHeap () returned 0x630000 [0064.506] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657558 [0064.506] GetProcessHeap () returned 0x630000 [0064.506] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0064.506] GetProcessHeap () returned 0x630000 [0064.506] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0064.506] GetProcessHeap () returned 0x630000 [0064.506] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0064.506] GetProcessHeap () returned 0x630000 [0064.506] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0064.506] GetProcessHeap () returned 0x630000 [0064.506] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0064.506] GetProcessHeap () returned 0x630000 [0064.506] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656fe0 [0064.507] GetProcessHeap () returned 0x630000 [0064.507] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0064.507] GetProcessHeap () returned 0x630000 [0064.507] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0064.507] GetProcessHeap () returned 0x630000 [0064.507] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dfe0 [0064.507] GetProcessHeap () returned 0x630000 [0064.507] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0064.507] GetProcessHeap () returned 0x630000 [0064.507] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0064.507] GetProcessHeap () returned 0x630000 [0064.507] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0064.507] GetProcessHeap () returned 0x630000 [0064.507] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0064.507] GetProcessHeap () returned 0x630000 [0064.507] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65ce20 [0064.507] GetProcessHeap () returned 0x630000 [0064.507] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0064.507] GetProcessHeap () returned 0x630000 [0064.507] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0064.507] GetProcessHeap () returned 0x630000 [0064.507] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0064.507] GetProcessHeap () returned 0x630000 [0064.507] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0064.507] GetProcessHeap () returned 0x630000 [0064.507] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ecd0 [0064.507] GetProcessHeap () returned 0x630000 [0064.507] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ce20 | out: hHeap=0x630000) returned 1 [0064.507] GetProcessHeap () returned 0x630000 [0064.507] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0064.507] GetProcessHeap () returned 0x630000 [0064.507] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ecd0 | out: hHeap=0x630000) returned 1 [0064.508] GetProcessHeap () returned 0x630000 [0064.508] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.508] GetProcessHeap () returned 0x630000 [0064.508] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.508] GetProcessHeap () returned 0x630000 [0064.508] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0064.508] GetProcessHeap () returned 0x630000 [0064.508] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0064.508] GetProcessHeap () returned 0x630000 [0064.508] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.508] GetProcessHeap () returned 0x630000 [0064.508] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.508] GetProcessHeap () returned 0x630000 [0064.508] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0064.508] GetProcessHeap () returned 0x630000 [0064.508] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0064.508] GetProcessHeap () returned 0x630000 [0064.508] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0064.508] GetProcessHeap () returned 0x630000 [0064.508] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0064.508] GetProcessHeap () returned 0x630000 [0064.508] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0064.508] GetProcessHeap () returned 0x630000 [0064.508] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0064.508] GetProcessHeap () returned 0x630000 [0064.508] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0064.508] GetProcessHeap () returned 0x630000 [0064.508] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0064.508] GetProcessHeap () returned 0x630000 [0064.508] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0064.508] GetProcessHeap () returned 0x630000 [0064.508] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0064.508] GetProcessHeap () returned 0x630000 [0064.508] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0064.508] GetProcessHeap () returned 0x630000 [0064.508] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0064.509] GetProcessHeap () returned 0x630000 [0064.509] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.509] GetProcessHeap () returned 0x630000 [0064.509] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.509] GetProcessHeap () returned 0x630000 [0064.509] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0064.509] GetProcessHeap () returned 0x630000 [0064.509] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0064.509] GetProcessHeap () returned 0x630000 [0064.509] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0064.509] GetProcessHeap () returned 0x630000 [0064.509] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0064.509] GetProcessHeap () returned 0x630000 [0064.509] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0064.509] GetProcessHeap () returned 0x630000 [0064.509] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0064.509] GetProcessHeap () returned 0x630000 [0064.509] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0064.509] GetProcessHeap () returned 0x630000 [0064.509] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0064.509] GetProcessHeap () returned 0x630000 [0064.509] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0064.510] GetProcessHeap () returned 0x630000 [0064.510] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0064.510] GetProcessHeap () returned 0x630000 [0064.510] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0064.510] GetProcessHeap () returned 0x630000 [0064.510] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0064.510] GetProcessHeap () returned 0x630000 [0064.510] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0064.510] GetProcessHeap () returned 0x630000 [0064.510] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0064.510] GetProcessHeap () returned 0x630000 [0064.510] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0064.510] GetProcessHeap () returned 0x630000 [0064.510] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0064.510] GetProcessHeap () returned 0x630000 [0064.510] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0064.510] GetProcessHeap () returned 0x630000 [0064.510] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0064.510] GetProcessHeap () returned 0x630000 [0064.510] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0064.510] GetProcessHeap () returned 0x630000 [0064.510] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0064.510] GetProcessHeap () returned 0x630000 [0064.510] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0064.510] GetProcessHeap () returned 0x630000 [0064.510] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0064.510] GetProcessHeap () returned 0x630000 [0064.510] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0064.511] GetProcessHeap () returned 0x630000 [0064.511] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0064.511] GetProcessHeap () returned 0x630000 [0064.511] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0064.511] GetProcessHeap () returned 0x630000 [0064.511] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0064.511] GetProcessHeap () returned 0x630000 [0064.511] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.511] GetProcessHeap () returned 0x630000 [0064.511] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.511] GetProcessHeap () returned 0x630000 [0064.511] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0064.512] GetProcessHeap () returned 0x630000 [0064.512] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0064.512] GetProcessHeap () returned 0x630000 [0064.512] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0064.512] GetProcessHeap () returned 0x630000 [0064.512] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0064.512] GetProcessHeap () returned 0x630000 [0064.512] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0064.512] GetProcessHeap () returned 0x630000 [0064.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0064.513] GetProcessHeap () returned 0x630000 [0064.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.513] GetProcessHeap () returned 0x630000 [0064.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.513] GetProcessHeap () returned 0x630000 [0064.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0064.513] GetProcessHeap () returned 0x630000 [0064.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0064.514] GetProcessHeap () returned 0x630000 [0064.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.514] GetProcessHeap () returned 0x630000 [0064.514] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.515] GetProcessHeap () returned 0x630000 [0064.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0064.515] GetProcessHeap () returned 0x630000 [0064.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0064.515] GetProcessHeap () returned 0x630000 [0064.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0064.515] GetProcessHeap () returned 0x630000 [0064.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0064.515] GetProcessHeap () returned 0x630000 [0064.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0064.515] GetProcessHeap () returned 0x630000 [0064.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0064.515] GetProcessHeap () returned 0x630000 [0064.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0064.515] GetProcessHeap () returned 0x630000 [0064.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0064.515] GetProcessHeap () returned 0x630000 [0064.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0064.515] GetProcessHeap () returned 0x630000 [0064.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0064.515] GetProcessHeap () returned 0x630000 [0064.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0064.515] GetProcessHeap () returned 0x630000 [0064.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0064.515] GetProcessHeap () returned 0x630000 [0064.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0064.515] GetProcessHeap () returned 0x630000 [0064.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0064.515] GetProcessHeap () returned 0x630000 [0064.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.515] GetProcessHeap () returned 0x630000 [0064.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.515] GetProcessHeap () returned 0x630000 [0064.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0064.515] GetProcessHeap () returned 0x630000 [0064.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0064.515] GetProcessHeap () returned 0x630000 [0064.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0064.516] GetProcessHeap () returned 0x630000 [0064.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0064.516] GetProcessHeap () returned 0x630000 [0064.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0064.516] GetProcessHeap () returned 0x630000 [0064.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0064.516] GetProcessHeap () returned 0x630000 [0064.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0064.516] GetProcessHeap () returned 0x630000 [0064.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0064.516] GetProcessHeap () returned 0x630000 [0064.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0064.516] GetProcessHeap () returned 0x630000 [0064.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0064.516] GetProcessHeap () returned 0x630000 [0064.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0064.516] GetProcessHeap () returned 0x630000 [0064.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0064.516] GetProcessHeap () returned 0x630000 [0064.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0064.516] GetProcessHeap () returned 0x630000 [0064.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0064.516] GetProcessHeap () returned 0x630000 [0064.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0064.516] GetProcessHeap () returned 0x630000 [0064.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0064.516] GetProcessHeap () returned 0x630000 [0064.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0064.516] WriteFile (in: hFile=0x230, lpBuffer=0x659630*, nNumberOfBytesToWrite=0x38e, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659630*, lpNumberOfBytesWritten=0x243d864*=0x38e, lpOverlapped=0x0) returned 1 [0064.720] GetProcessHeap () returned 0x630000 [0064.720] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659630, Size=0x30) returned 0x659630 [0064.720] GetProcessHeap () returned 0x630000 [0064.720] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0064.720] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0064.720] GetProcessHeap () returned 0x630000 [0064.720] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a0) returned 0x63f408 [0064.720] ReadFile (in: hFile=0x230, lpBuffer=0x63f408, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x63f408*, lpNumberOfBytesRead=0x243d7e8*=0x1a0, lpOverlapped=0x0) returned 1 [0064.720] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0064.720] WriteFile (in: hFile=0x230, lpBuffer=0x63f408*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x63f408*, lpNumberOfBytesWritten=0x243d7e4*=0x1a0, lpOverlapped=0x0) returned 1 [0064.723] GetProcessHeap () returned 0x630000 [0064.723] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63f408 | out: hHeap=0x630000) returned 1 [0064.723] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0064.724] WriteFile (in: hFile=0x230, lpBuffer=0x659630*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659630*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0064.726] CloseHandle (hObject=0x230) returned 1 [0064.727] GetProcessHeap () returned 0x630000 [0064.728] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0064.728] GetProcessHeap () returned 0x630000 [0064.728] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655580 | out: hHeap=0x630000) returned 1 [0064.728] GetProcessHeap () returned 0x630000 [0064.728] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0064.728] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Favorites\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\desktop.ini") returned="C:\\Users\\FD1HVy\\Favorites\\desktop.ini" [0064.728] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Favorites\\desktop.ini", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\desktop.ini.happythreechoose") returned="C:\\Users\\FD1HVy\\Favorites\\desktop.ini.happythreechoose" [0064.728] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Favorites\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\favorites\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Favorites\\desktop.ini.happythreechoose" (normalized: "c:\\users\\fd1hvy\\favorites\\desktop.ini.happythreechoose"), dwFlags=0x1) returned 1 [0064.728] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Favorites\\desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\Favorites") returned 1 [0064.728] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Favorites" | out: pszPath="C:\\Users\\FD1HVy\\Favorites\\") returned="" [0064.728] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Favorites\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Favorites\\Decryption INFO.html" [0064.728] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\favorites\\decryption info.html")) returned 0x20 [0064.728] GetProcessHeap () returned 0x630000 [0064.729] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0064.729] FindNextFileW (in: hFindFile=0x648850, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0064.729] lstrcmpiW (lpString1="Links", lpString2=".") returned 1 [0064.729] lstrcmpiW (lpString1="Links", lpString2="..") returned 1 [0064.729] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Favorites\\", lpString2="Links" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\Links") returned="C:\\Users\\FD1HVy\\Favorites\\Links" [0064.729] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Links", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0064.729] GetProcessHeap () returned 0x630000 [0064.729] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6) returned 0x65a2b8 [0064.729] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Links", cchWideChar=-1, lpMultiByteStr=0x65a2b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Links", lpUsedDefaultChar=0x0) returned 6 [0064.729] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0064.729] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0064.729] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0064.729] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0064.729] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0064.729] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0064.729] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0064.729] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0064.729] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0064.729] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0064.729] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0064.729] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0064.729] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0064.729] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0064.729] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0064.729] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0064.729] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0064.729] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0064.729] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0064.729] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0064.729] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0064.729] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0064.729] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0064.730] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0064.730] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0064.730] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0064.730] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0064.730] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0064.730] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0064.730] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0064.730] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0064.730] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0064.730] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0064.730] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0064.730] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0064.730] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0064.730] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0064.730] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0064.730] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0064.730] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0064.730] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0064.730] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0064.730] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0064.730] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Favorites\\Links", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\Links\\") returned="C:\\Users\\FD1HVy\\Favorites\\Links\\" [0064.730] GetProcessHeap () returned 0x630000 [0064.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a3b8 [0064.730] lstrlenW (lpString="C:\\Users\\FD1HVy\\Favorites\\Links\\") returned 32 [0064.730] GetProcessHeap () returned 0x630000 [0064.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x42) returned 0x65ff20 [0064.730] lstrcpyW (in: lpString1=0x65ff20, lpString2="C:\\Users\\FD1HVy\\Favorites\\Links\\" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\Links\\") returned="C:\\Users\\FD1HVy\\Favorites\\Links\\" [0064.730] GetProcessHeap () returned 0x630000 [0064.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0064.730] FindNextFileW (in: hFindFile=0x648850, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 0 [0064.730] FindClose (in: hFindFile=0x648850 | out: hFindFile=0x648850) returned 1 [0064.730] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\Favorites\\Links\\" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\Links\\") returned="C:\\Users\\FD1HVy\\Favorites\\Links\\" [0064.731] GetProcessHeap () returned 0x630000 [0064.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ff20 | out: hHeap=0x630000) returned 1 [0064.731] GetProcessHeap () returned 0x630000 [0064.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0064.731] lstrlenW (lpString="C:\\Users\\FD1HVy\\Favorites\\Links\\") returned 32 [0064.731] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Favorites\\Links\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\Links\\*") returned="C:\\Users\\FD1HVy\\Favorites\\Links\\*" [0064.731] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648ad0 [0064.731] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0064.731] FindNextFileW (in: hFindFile=0x648ad0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.731] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0064.731] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0064.731] FindNextFileW (in: hFindFile=0x648ad0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4360b38e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4360b38e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x4360b38e, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0064.731] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0064.731] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0064.731] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Favorites\\Links\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini") returned="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini" [0064.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0064.731] GetProcessHeap () returned 0x630000 [0064.731] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0064.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0064.731] lstrlenA (lpString="desktop.ini") returned 11 [0064.731] lstrlenA (lpString=".happythreechoose") returned 17 [0064.731] lstrcmpiW (lpString1="desktop.ini", lpString2="Decryption INFO.html") returned 1 [0064.731] lstrcmpiW (lpString1="desktop.ini", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0064.731] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0064.731] lstrcmpiW (lpString1="desktop.ini", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0064.731] GetProcessHeap () returned 0x630000 [0064.731] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f10 [0064.732] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\favorites\\links\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0064.732] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=80) returned 1 [0064.732] GetProcessHeap () returned 0x630000 [0064.732] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655850 [0064.732] GetProcessHeap () returned 0x630000 [0064.732] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0064.732] lstrlenW (lpString="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini") returned 43 [0064.732] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0064.732] GetProcessHeap () returned 0x630000 [0064.732] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0064.732] GetProcessHeap () returned 0x630000 [0064.732] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x659668 [0064.732] lstrlenA (lpString="rsa_encrypt") returned 11 [0064.732] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0064.733] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0064.733] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0064.733] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0064.733] GetProcessHeap () returned 0x630000 [0064.733] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0064.733] lstrlenA (lpString="010001") returned 6 [0064.733] GetProcessHeap () returned 0x630000 [0064.733] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0064.733] GetProcessHeap () returned 0x630000 [0064.733] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0064.733] GetProcessHeap () returned 0x630000 [0064.733] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e4f0 [0064.733] GetProcessHeap () returned 0x630000 [0064.733] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0064.733] GetProcessHeap () returned 0x630000 [0064.733] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dec0 [0064.733] GetProcessHeap () returned 0x630000 [0064.733] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656950 [0064.733] GetProcessHeap () returned 0x630000 [0064.733] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a318 [0064.733] GetProcessHeap () returned 0x630000 [0064.733] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0064.733] GetProcessHeap () returned 0x630000 [0064.733] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0064.733] GetProcessHeap () returned 0x630000 [0064.733] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0064.733] GetProcessHeap () returned 0x630000 [0064.733] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0064.733] GetProcessHeap () returned 0x630000 [0064.734] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657788 [0064.734] GetProcessHeap () returned 0x630000 [0064.734] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0064.734] GetProcessHeap () returned 0x630000 [0064.734] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0064.734] GetProcessHeap () returned 0x630000 [0064.734] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dfe0 [0064.734] GetProcessHeap () returned 0x630000 [0064.734] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0064.734] GetProcessHeap () returned 0x630000 [0064.734] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0064.734] GetProcessHeap () returned 0x630000 [0064.734] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0064.734] GetProcessHeap () returned 0x630000 [0064.734] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0064.734] GetProcessHeap () returned 0x630000 [0064.734] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65d0a8 [0064.734] GetProcessHeap () returned 0x630000 [0064.734] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0064.734] GetProcessHeap () returned 0x630000 [0064.734] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0064.734] GetProcessHeap () returned 0x630000 [0064.734] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0064.734] GetProcessHeap () returned 0x630000 [0064.734] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0064.734] GetProcessHeap () returned 0x630000 [0064.734] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e7c0 [0064.734] GetProcessHeap () returned 0x630000 [0064.734] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65d0a8 | out: hHeap=0x630000) returned 1 [0064.734] GetProcessHeap () returned 0x630000 [0064.734] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0064.734] GetProcessHeap () returned 0x630000 [0064.734] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e7c0 | out: hHeap=0x630000) returned 1 [0064.734] GetProcessHeap () returned 0x630000 [0064.734] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0064.734] GetProcessHeap () returned 0x630000 [0064.734] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0064.734] GetProcessHeap () returned 0x630000 [0064.735] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0064.735] GetProcessHeap () returned 0x630000 [0064.735] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0064.735] GetProcessHeap () returned 0x630000 [0064.735] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.735] GetProcessHeap () returned 0x630000 [0064.735] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.735] GetProcessHeap () returned 0x630000 [0064.735] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0064.735] GetProcessHeap () returned 0x630000 [0064.735] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0064.735] GetProcessHeap () returned 0x630000 [0064.735] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.735] GetProcessHeap () returned 0x630000 [0064.735] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.735] GetProcessHeap () returned 0x630000 [0064.735] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0064.735] GetProcessHeap () returned 0x630000 [0064.735] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0064.735] GetProcessHeap () returned 0x630000 [0064.735] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.735] GetProcessHeap () returned 0x630000 [0064.735] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.735] GetProcessHeap () returned 0x630000 [0064.735] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0064.735] GetProcessHeap () returned 0x630000 [0064.735] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0064.735] GetProcessHeap () returned 0x630000 [0064.735] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0064.736] GetProcessHeap () returned 0x630000 [0064.736] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0064.736] GetProcessHeap () returned 0x630000 [0064.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.736] GetProcessHeap () returned 0x630000 [0064.736] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.736] GetProcessHeap () returned 0x630000 [0064.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0064.736] GetProcessHeap () returned 0x630000 [0064.736] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0064.736] GetProcessHeap () returned 0x630000 [0064.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0064.736] GetProcessHeap () returned 0x630000 [0064.736] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0064.736] GetProcessHeap () returned 0x630000 [0064.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0064.736] GetProcessHeap () returned 0x630000 [0064.736] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0064.736] GetProcessHeap () returned 0x630000 [0064.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0064.736] GetProcessHeap () returned 0x630000 [0064.736] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0064.736] GetProcessHeap () returned 0x630000 [0064.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.736] GetProcessHeap () returned 0x630000 [0064.736] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.736] GetProcessHeap () returned 0x630000 [0064.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.736] GetProcessHeap () returned 0x630000 [0064.736] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.736] GetProcessHeap () returned 0x630000 [0064.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0064.736] GetProcessHeap () returned 0x630000 [0064.736] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0064.736] GetProcessHeap () returned 0x630000 [0064.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0064.736] GetProcessHeap () returned 0x630000 [0064.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0064.737] GetProcessHeap () returned 0x630000 [0064.737] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0064.737] GetProcessHeap () returned 0x630000 [0064.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0064.737] GetProcessHeap () returned 0x630000 [0064.737] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0064.737] GetProcessHeap () returned 0x630000 [0064.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0064.737] GetProcessHeap () returned 0x630000 [0064.737] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0064.737] GetProcessHeap () returned 0x630000 [0064.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0064.737] GetProcessHeap () returned 0x630000 [0064.737] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0064.737] GetProcessHeap () returned 0x630000 [0064.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0064.737] GetProcessHeap () returned 0x630000 [0064.737] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0064.737] GetProcessHeap () returned 0x630000 [0064.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0064.737] GetProcessHeap () returned 0x630000 [0064.737] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0064.737] GetProcessHeap () returned 0x630000 [0064.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0064.737] GetProcessHeap () returned 0x630000 [0064.737] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0064.737] GetProcessHeap () returned 0x630000 [0064.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0064.737] GetProcessHeap () returned 0x630000 [0064.737] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0064.737] GetProcessHeap () returned 0x630000 [0064.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0064.737] GetProcessHeap () returned 0x630000 [0064.737] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0064.737] GetProcessHeap () returned 0x630000 [0064.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0064.738] GetProcessHeap () returned 0x630000 [0064.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0064.738] GetProcessHeap () returned 0x630000 [0064.738] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0064.738] GetProcessHeap () returned 0x630000 [0064.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.738] GetProcessHeap () returned 0x630000 [0064.738] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.738] GetProcessHeap () returned 0x630000 [0064.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0064.738] GetProcessHeap () returned 0x630000 [0064.738] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0064.738] GetProcessHeap () returned 0x630000 [0064.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0064.738] GetProcessHeap () returned 0x630000 [0064.738] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0064.738] GetProcessHeap () returned 0x630000 [0064.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0064.738] GetProcessHeap () returned 0x630000 [0064.738] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0064.738] GetProcessHeap () returned 0x630000 [0064.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.738] GetProcessHeap () returned 0x630000 [0064.738] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.738] GetProcessHeap () returned 0x630000 [0064.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0064.738] GetProcessHeap () returned 0x630000 [0064.738] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0064.738] GetProcessHeap () returned 0x630000 [0064.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.738] GetProcessHeap () returned 0x630000 [0064.738] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.738] GetProcessHeap () returned 0x630000 [0064.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0064.738] GetProcessHeap () returned 0x630000 [0064.738] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0064.739] GetProcessHeap () returned 0x630000 [0064.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0064.739] GetProcessHeap () returned 0x630000 [0064.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0064.739] GetProcessHeap () returned 0x630000 [0064.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0064.739] GetProcessHeap () returned 0x630000 [0064.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0064.739] GetProcessHeap () returned 0x630000 [0064.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0064.739] GetProcessHeap () returned 0x630000 [0064.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0064.739] GetProcessHeap () returned 0x630000 [0064.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0064.739] GetProcessHeap () returned 0x630000 [0064.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0064.739] GetProcessHeap () returned 0x630000 [0064.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0064.739] GetProcessHeap () returned 0x630000 [0064.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0064.739] GetProcessHeap () returned 0x630000 [0064.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0064.739] GetProcessHeap () returned 0x630000 [0064.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0064.739] GetProcessHeap () returned 0x630000 [0064.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0064.739] GetProcessHeap () returned 0x630000 [0064.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0064.739] GetProcessHeap () returned 0x630000 [0064.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0064.739] GetProcessHeap () returned 0x630000 [0064.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0064.739] GetProcessHeap () returned 0x630000 [0064.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0064.739] GetProcessHeap () returned 0x630000 [0064.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0064.740] GetProcessHeap () returned 0x630000 [0064.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0064.740] GetProcessHeap () returned 0x630000 [0064.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0064.740] GetProcessHeap () returned 0x630000 [0064.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0064.740] WriteFile (in: hFile=0x230, lpBuffer=0x659668*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659668*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0064.746] GetProcessHeap () returned 0x630000 [0064.746] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659668, Size=0x30) returned 0x659668 [0064.746] GetProcessHeap () returned 0x630000 [0064.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0064.746] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0064.746] GetProcessHeap () returned 0x630000 [0064.746] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x50) returned 0x65ef08 [0064.746] ReadFile (in: hFile=0x230, lpBuffer=0x65ef08, nNumberOfBytesToRead=0x50, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ef08*, lpNumberOfBytesRead=0x243d7e8*=0x50, lpOverlapped=0x0) returned 1 [0064.746] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0064.746] WriteFile (in: hFile=0x230, lpBuffer=0x65ef08*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ef08*, lpNumberOfBytesWritten=0x243d7e4*=0x50, lpOverlapped=0x0) returned 1 [0064.747] GetProcessHeap () returned 0x630000 [0064.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ef08 | out: hHeap=0x630000) returned 1 [0064.748] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0064.748] WriteFile (in: hFile=0x230, lpBuffer=0x659668*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659668*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0064.749] CloseHandle (hObject=0x230) returned 1 [0064.750] GetProcessHeap () returned 0x630000 [0064.750] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f10 | out: hHeap=0x630000) returned 1 [0064.750] GetProcessHeap () returned 0x630000 [0064.751] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655850 | out: hHeap=0x630000) returned 1 [0064.751] GetProcessHeap () returned 0x630000 [0064.751] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0064.751] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini") returned="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini" [0064.751] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini.happythreechoose") returned="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini.happythreechoose" [0064.751] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\favorites\\links\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini.happythreechoose" (normalized: "c:\\users\\fd1hvy\\favorites\\links\\desktop.ini.happythreechoose"), dwFlags=0x1) returned 1 [0064.751] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Favorites\\Links\\desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\Favorites\\Links") returned 1 [0064.751] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Favorites\\Links" | out: pszPath="C:\\Users\\FD1HVy\\Favorites\\Links\\") returned="" [0064.751] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Favorites\\Links\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\Links\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Favorites\\Links\\Decryption INFO.html" [0064.751] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\favorites\\links\\decryption info.html")) returned 0xffffffff [0064.751] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\favorites\\links\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0064.763] GetProcessHeap () returned 0x630000 [0064.763] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6559b8 [0064.763] GetProcessHeap () returned 0x630000 [0064.763] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0064.770] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.771] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.771] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.771] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.771] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.771] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.772] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.772] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.772] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.772] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.772] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.772] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.772] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.772] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.772] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.772] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.772] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.772] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.772] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.773] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.773] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.773] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.773] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.773] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.773] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.773] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.773] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.773] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.773] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.773] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.773] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.774] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.774] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.774] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.774] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.774] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.774] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.775] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.775] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.775] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.775] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.775] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.776] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.776] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.776] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.776] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.776] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.776] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.776] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.776] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.776] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.776] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.776] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.776] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.777] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.777] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.777] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.777] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.777] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.777] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.777] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.777] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.777] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.777] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.777] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.777] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.778] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.778] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.778] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.778] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.778] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.778] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.778] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.778] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.778] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.778] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.778] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.778] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.779] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.779] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.779] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.779] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.779] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.779] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.779] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.779] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.779] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.779] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.779] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.780] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.780] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.780] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.780] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.780] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.780] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.780] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.780] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.780] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.780] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.780] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.780] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.780] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.781] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.781] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.781] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.781] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.781] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.781] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.781] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.781] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.781] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.781] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.781] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.781] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.781] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.781] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.783] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.783] GetProcessHeap () returned 0x630000 [0064.783] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6559b8 | out: hHeap=0x630000) returned 1 [0064.783] GetProcessHeap () returned 0x630000 [0064.783] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0064.783] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0064.783] GetProcessHeap () returned 0x630000 [0064.783] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655940 [0064.783] GetProcessHeap () returned 0x630000 [0064.783] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0064.791] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.791] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.791] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.791] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.791] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.791] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.791] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.791] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.791] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.793] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.793] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.793] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.793] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.793] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.793] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.793] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.793] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.793] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.793] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.793] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.793] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.793] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.793] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.794] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.794] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.794] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.794] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.794] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.794] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.794] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.794] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.794] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.794] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.794] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.794] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.794] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.794] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.795] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.795] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.795] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.795] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.795] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.795] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.795] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.795] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.795] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.795] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.795] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.795] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.795] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.795] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.796] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.796] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.796] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.796] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.796] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.796] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.796] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.796] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.796] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.796] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.796] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.796] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.796] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.797] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.797] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.797] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.797] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.797] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.797] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.797] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.797] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.797] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.797] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.797] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.797] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.798] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.798] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.798] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.798] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.798] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.798] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.798] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.798] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.798] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.798] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.798] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.798] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.798] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.798] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.799] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.799] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.799] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.799] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.799] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.799] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.799] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.799] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.799] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.799] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.799] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.799] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.799] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.800] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.800] GetProcessHeap () returned 0x630000 [0064.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655940 | out: hHeap=0x630000) returned 1 [0064.800] GetProcessHeap () returned 0x630000 [0064.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0064.800] CloseHandle (hObject=0x230) returned 1 [0064.801] GetProcessHeap () returned 0x630000 [0064.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0064.801] FindNextFileW (in: hFindFile=0x648ad0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4360b38e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4360b38e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x4360b38e, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0064.801] FindClose (in: hFindFile=0x648ad0 | out: hFindFile=0x648ad0) returned 1 [0064.801] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\Downloads\\" | out: lpString1="C:\\Users\\FD1HVy\\Downloads\\") returned="C:\\Users\\FD1HVy\\Downloads\\" [0064.801] GetProcessHeap () returned 0x630000 [0064.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x648c90 | out: hHeap=0x630000) returned 1 [0064.801] GetProcessHeap () returned 0x630000 [0064.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0064.801] lstrlenW (lpString="C:\\Users\\FD1HVy\\Downloads\\") returned 26 [0064.801] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Downloads\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Downloads\\*") returned="C:\\Users\\FD1HVy\\Downloads\\*" [0064.801] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa2dc870b, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xa2dc870b, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648ad0 [0064.801] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0064.801] FindNextFileW (in: hFindFile=0x648ad0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa2dc870b, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xa2dc870b, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.801] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0064.802] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0064.802] FindNextFileW (in: hFindFile=0x648ad0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0064.802] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0064.802] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0064.802] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Downloads\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Downloads\\desktop.ini") returned="C:\\Users\\FD1HVy\\Downloads\\desktop.ini" [0064.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0064.802] GetProcessHeap () returned 0x630000 [0064.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0064.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0064.802] lstrlenA (lpString="desktop.ini") returned 11 [0064.802] lstrlenA (lpString=".happythreechoose") returned 17 [0064.802] lstrcmpiW (lpString1="desktop.ini", lpString2="Decryption INFO.html") returned 1 [0064.802] lstrcmpiW (lpString1="desktop.ini", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0064.802] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0064.802] lstrcmpiW (lpString1="desktop.ini", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0064.802] GetProcessHeap () returned 0x630000 [0064.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0064.802] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Downloads\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\downloads\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0064.802] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=282) returned 1 [0064.802] GetProcessHeap () returned 0x630000 [0064.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6556e8 [0064.802] GetProcessHeap () returned 0x630000 [0064.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0064.802] lstrlenW (lpString="C:\\Users\\FD1HVy\\Downloads\\desktop.ini") returned 37 [0064.802] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0064.802] GetProcessHeap () returned 0x630000 [0064.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0064.803] GetProcessHeap () returned 0x630000 [0064.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x386) returned 0x6596a0 [0064.803] lstrlenA (lpString="rsa_encrypt") returned 11 [0064.803] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0064.803] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0064.803] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0064.803] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0064.803] GetProcessHeap () returned 0x630000 [0064.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0064.803] lstrlenA (lpString="010001") returned 6 [0064.803] GetProcessHeap () returned 0x630000 [0064.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0064.803] GetProcessHeap () returned 0x630000 [0064.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0064.803] GetProcessHeap () returned 0x630000 [0064.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e970 [0064.804] GetProcessHeap () returned 0x630000 [0064.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0064.804] GetProcessHeap () returned 0x630000 [0064.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e6a0 [0064.804] GetProcessHeap () returned 0x630000 [0064.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657440 [0064.804] GetProcessHeap () returned 0x630000 [0064.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2b8 [0064.804] GetProcessHeap () returned 0x630000 [0064.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0064.804] GetProcessHeap () returned 0x630000 [0064.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0064.804] GetProcessHeap () returned 0x630000 [0064.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0064.804] GetProcessHeap () returned 0x630000 [0064.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0064.804] GetProcessHeap () returned 0x630000 [0064.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x6570f8 [0064.804] GetProcessHeap () returned 0x630000 [0064.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0064.804] GetProcessHeap () returned 0x630000 [0064.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0064.804] GetProcessHeap () returned 0x630000 [0064.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0064.804] GetProcessHeap () returned 0x630000 [0064.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0064.804] GetProcessHeap () returned 0x630000 [0064.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0064.804] GetProcessHeap () returned 0x630000 [0064.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0064.804] GetProcessHeap () returned 0x630000 [0064.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0064.808] GetProcessHeap () returned 0x630000 [0064.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65ce68 [0064.808] GetProcessHeap () returned 0x630000 [0064.808] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0064.808] GetProcessHeap () returned 0x630000 [0064.808] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0064.808] GetProcessHeap () returned 0x630000 [0064.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0064.808] GetProcessHeap () returned 0x630000 [0064.808] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0064.808] GetProcessHeap () returned 0x630000 [0064.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65df50 [0064.808] GetProcessHeap () returned 0x630000 [0064.808] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ce68 | out: hHeap=0x630000) returned 1 [0064.808] GetProcessHeap () returned 0x630000 [0064.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0064.808] GetProcessHeap () returned 0x630000 [0064.808] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0064.808] GetProcessHeap () returned 0x630000 [0064.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0064.808] GetProcessHeap () returned 0x630000 [0064.808] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0064.808] GetProcessHeap () returned 0x630000 [0064.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0064.808] GetProcessHeap () returned 0x630000 [0064.808] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0064.809] GetProcessHeap () returned 0x630000 [0064.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0064.809] GetProcessHeap () returned 0x630000 [0064.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0064.809] GetProcessHeap () returned 0x630000 [0064.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0064.809] GetProcessHeap () returned 0x630000 [0064.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0064.809] GetProcessHeap () returned 0x630000 [0064.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0064.809] GetProcessHeap () returned 0x630000 [0064.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0064.809] GetProcessHeap () returned 0x630000 [0064.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0064.809] GetProcessHeap () returned 0x630000 [0064.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0064.809] GetProcessHeap () returned 0x630000 [0064.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0064.809] GetProcessHeap () returned 0x630000 [0064.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0064.809] GetProcessHeap () returned 0x630000 [0064.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.809] GetProcessHeap () returned 0x630000 [0064.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.809] GetProcessHeap () returned 0x630000 [0064.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0064.809] GetProcessHeap () returned 0x630000 [0064.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0064.809] GetProcessHeap () returned 0x630000 [0064.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0064.809] GetProcessHeap () returned 0x630000 [0064.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0064.809] GetProcessHeap () returned 0x630000 [0064.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.809] GetProcessHeap () returned 0x630000 [0064.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.809] GetProcessHeap () returned 0x630000 [0064.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0064.810] GetProcessHeap () returned 0x630000 [0064.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0064.810] GetProcessHeap () returned 0x630000 [0064.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.810] GetProcessHeap () returned 0x630000 [0064.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.810] GetProcessHeap () returned 0x630000 [0064.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0064.810] GetProcessHeap () returned 0x630000 [0064.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0064.810] GetProcessHeap () returned 0x630000 [0064.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0064.810] GetProcessHeap () returned 0x630000 [0064.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0064.810] GetProcessHeap () returned 0x630000 [0064.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0064.810] GetProcessHeap () returned 0x630000 [0064.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0064.810] GetProcessHeap () returned 0x630000 [0064.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0064.810] GetProcessHeap () returned 0x630000 [0064.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0064.810] GetProcessHeap () returned 0x630000 [0064.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0064.810] GetProcessHeap () returned 0x630000 [0064.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0064.810] GetProcessHeap () returned 0x630000 [0064.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0064.810] GetProcessHeap () returned 0x630000 [0064.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0064.810] GetProcessHeap () returned 0x630000 [0064.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0064.810] GetProcessHeap () returned 0x630000 [0064.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0064.810] GetProcessHeap () returned 0x630000 [0064.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0064.811] GetProcessHeap () returned 0x630000 [0064.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0064.811] GetProcessHeap () returned 0x630000 [0064.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0064.811] GetProcessHeap () returned 0x630000 [0064.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0064.811] GetProcessHeap () returned 0x630000 [0064.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.811] GetProcessHeap () returned 0x630000 [0064.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.811] GetProcessHeap () returned 0x630000 [0064.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.811] GetProcessHeap () returned 0x630000 [0064.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.811] GetProcessHeap () returned 0x630000 [0064.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0064.811] GetProcessHeap () returned 0x630000 [0064.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0064.811] GetProcessHeap () returned 0x630000 [0064.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0064.811] GetProcessHeap () returned 0x630000 [0064.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0064.811] GetProcessHeap () returned 0x630000 [0064.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0064.811] GetProcessHeap () returned 0x630000 [0064.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0064.811] GetProcessHeap () returned 0x630000 [0064.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0064.811] GetProcessHeap () returned 0x630000 [0064.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0064.811] GetProcessHeap () returned 0x630000 [0064.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.811] GetProcessHeap () returned 0x630000 [0064.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.811] GetProcessHeap () returned 0x630000 [0064.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0064.812] GetProcessHeap () returned 0x630000 [0064.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0064.812] GetProcessHeap () returned 0x630000 [0064.812] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.812] GetProcessHeap () returned 0x630000 [0064.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.812] GetProcessHeap () returned 0x630000 [0064.812] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0064.812] GetProcessHeap () returned 0x630000 [0064.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0064.812] GetProcessHeap () returned 0x630000 [0064.812] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0064.812] GetProcessHeap () returned 0x630000 [0064.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0064.812] GetProcessHeap () returned 0x630000 [0064.812] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.812] GetProcessHeap () returned 0x630000 [0064.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.812] GetProcessHeap () returned 0x630000 [0064.812] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0064.812] GetProcessHeap () returned 0x630000 [0064.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0064.812] GetProcessHeap () returned 0x630000 [0064.812] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0064.812] GetProcessHeap () returned 0x630000 [0064.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0064.812] GetProcessHeap () returned 0x630000 [0064.812] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0064.812] GetProcessHeap () returned 0x630000 [0064.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0064.812] GetProcessHeap () returned 0x630000 [0064.812] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.813] GetProcessHeap () returned 0x630000 [0064.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.813] GetProcessHeap () returned 0x630000 [0064.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0064.813] GetProcessHeap () returned 0x630000 [0064.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0064.813] GetProcessHeap () returned 0x630000 [0064.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0064.813] GetProcessHeap () returned 0x630000 [0064.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0064.813] GetProcessHeap () returned 0x630000 [0064.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0064.813] GetProcessHeap () returned 0x630000 [0064.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0064.813] GetProcessHeap () returned 0x630000 [0064.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0064.813] GetProcessHeap () returned 0x630000 [0064.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0064.813] GetProcessHeap () returned 0x630000 [0064.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0064.813] GetProcessHeap () returned 0x630000 [0064.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0064.813] GetProcessHeap () returned 0x630000 [0064.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0064.813] GetProcessHeap () returned 0x630000 [0064.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e6a0 | out: hHeap=0x630000) returned 1 [0064.813] GetProcessHeap () returned 0x630000 [0064.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0064.813] GetProcessHeap () returned 0x630000 [0064.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0064.813] GetProcessHeap () returned 0x630000 [0064.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0064.813] GetProcessHeap () returned 0x630000 [0064.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0064.814] GetProcessHeap () returned 0x630000 [0064.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0064.814] WriteFile (in: hFile=0x230, lpBuffer=0x6596a0*, nNumberOfBytesToWrite=0x386, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6596a0*, lpNumberOfBytesWritten=0x243d864*=0x386, lpOverlapped=0x0) returned 1 [0064.823] GetProcessHeap () returned 0x630000 [0064.823] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6596a0, Size=0x30) returned 0x6596a0 [0064.823] GetProcessHeap () returned 0x630000 [0064.823] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0064.823] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0064.823] GetProcessHeap () returned 0x630000 [0064.823] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x120) returned 0x63f408 [0064.823] ReadFile (in: hFile=0x230, lpBuffer=0x63f408, nNumberOfBytesToRead=0x120, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x63f408*, lpNumberOfBytesRead=0x243d7e8*=0x120, lpOverlapped=0x0) returned 1 [0064.823] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0064.823] WriteFile (in: hFile=0x230, lpBuffer=0x63f408*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x63f408*, lpNumberOfBytesWritten=0x243d7e4*=0x120, lpOverlapped=0x0) returned 1 [0064.826] GetProcessHeap () returned 0x630000 [0064.826] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63f408 | out: hHeap=0x630000) returned 1 [0064.826] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0064.826] WriteFile (in: hFile=0x230, lpBuffer=0x6596a0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6596a0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0064.827] CloseHandle (hObject=0x230) returned 1 [0064.828] GetProcessHeap () returned 0x630000 [0064.828] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0064.828] GetProcessHeap () returned 0x630000 [0064.829] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6556e8 | out: hHeap=0x630000) returned 1 [0064.829] GetProcessHeap () returned 0x630000 [0064.829] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0064.829] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Downloads\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Downloads\\desktop.ini") returned="C:\\Users\\FD1HVy\\Downloads\\desktop.ini" [0064.829] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Downloads\\desktop.ini", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Downloads\\desktop.ini.happythreechoose") returned="C:\\Users\\FD1HVy\\Downloads\\desktop.ini.happythreechoose" [0064.829] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Downloads\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\downloads\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Downloads\\desktop.ini.happythreechoose" (normalized: "c:\\users\\fd1hvy\\downloads\\desktop.ini.happythreechoose"), dwFlags=0x1) returned 1 [0064.829] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Downloads\\desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\Downloads") returned 1 [0064.829] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Downloads" | out: pszPath="C:\\Users\\FD1HVy\\Downloads\\") returned="" [0064.829] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Downloads\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Downloads\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Downloads\\Decryption INFO.html" [0064.829] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Downloads\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\downloads\\decryption info.html")) returned 0xffffffff [0064.829] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Downloads\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\downloads\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0064.830] GetProcessHeap () returned 0x630000 [0064.830] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655580 [0064.830] GetProcessHeap () returned 0x630000 [0064.830] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0064.837] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.838] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.838] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.838] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.838] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.838] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.839] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.839] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.839] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.839] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.839] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.839] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.839] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.839] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.839] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.839] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.840] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.840] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.840] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.840] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.840] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.840] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.840] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.840] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.840] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.840] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.840] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.840] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.840] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.841] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.841] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.841] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.841] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.841] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.841] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.841] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.841] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.842] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.842] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.842] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.843] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.843] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.843] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.843] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.843] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.843] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.843] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.843] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.843] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.843] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.843] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.843] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.843] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.843] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.844] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.844] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.844] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.844] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.844] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.844] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.844] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.844] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.844] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.844] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.844] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.844] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.845] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.845] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.845] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.845] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.845] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.845] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.845] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.845] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.845] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.845] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.845] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.845] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.845] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.845] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.846] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.847] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.847] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.847] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.847] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.847] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.847] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.847] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.847] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.847] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.847] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.847] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.847] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.847] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.847] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.847] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.848] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.848] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.848] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.848] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.848] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.848] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.848] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.848] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.848] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.848] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.848] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.848] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.848] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.848] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.849] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.849] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.849] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.849] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.849] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.849] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.849] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.849] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.849] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.849] GetProcessHeap () returned 0x630000 [0064.849] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655580 | out: hHeap=0x630000) returned 1 [0064.849] GetProcessHeap () returned 0x630000 [0064.849] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0064.849] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0064.849] GetProcessHeap () returned 0x630000 [0064.849] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655a30 [0064.849] GetProcessHeap () returned 0x630000 [0064.849] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0064.857] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.857] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.857] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.857] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.857] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.857] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.857] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.857] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.857] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.857] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.857] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.857] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.858] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.858] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.858] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.858] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.858] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.858] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.858] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.858] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.858] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.858] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.858] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.858] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.858] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.858] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.859] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.859] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.859] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.859] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.859] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.859] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.859] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.859] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.859] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.859] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.859] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.859] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.859] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.859] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.860] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.860] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.860] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.860] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.860] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.860] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.860] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.860] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.860] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.860] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.860] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.860] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.860] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.860] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.860] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.861] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.861] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.861] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.861] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.861] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.861] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.861] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.861] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.861] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.861] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.861] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.861] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.861] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.861] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.862] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.862] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.862] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.862] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.862] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.862] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.862] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.862] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.862] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.862] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.862] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.862] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.863] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.863] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.863] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.863] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.863] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.863] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.863] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.863] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.863] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.863] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.863] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.863] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.863] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.863] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.864] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.864] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.864] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.864] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.864] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.864] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.864] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.864] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.864] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.864] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.864] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.864] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.864] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.864] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.865] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.865] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.865] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.865] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.865] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.865] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.865] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.865] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.865] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.866] GetProcessHeap () returned 0x630000 [0064.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655a30 | out: hHeap=0x630000) returned 1 [0064.866] GetProcessHeap () returned 0x630000 [0064.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0064.866] CloseHandle (hObject=0x230) returned 1 [0064.866] GetProcessHeap () returned 0x630000 [0064.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0064.866] FindNextFileW (in: hFindFile=0x648ad0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0064.866] FindClose (in: hFindFile=0x648ad0 | out: hFindFile=0x648ad0) returned 1 [0064.867] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\Documents\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0064.867] GetProcessHeap () returned 0x630000 [0064.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x648810 | out: hHeap=0x630000) returned 1 [0064.867] GetProcessHeap () returned 0x630000 [0064.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0064.867] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\") returned 26 [0064.867] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\*") returned="C:\\Users\\FD1HVy\\Documents\\*" [0064.869] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3a712416, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3a712416, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648810 [0064.869] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0064.869] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3a712416, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3a712416, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.869] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0064.869] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0064.869] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12b19490, ftCreationTime.dwHighDateTime=0x1d588df, ftLastAccessTime.dwLowDateTime=0x2249e220, ftLastAccessTime.dwHighDateTime=0x1d58792, ftLastWriteTime.dwLowDateTime=0x2249e220, ftLastWriteTime.dwHighDateTime=0x1d58792, nFileSizeHigh=0x0, nFileSizeLow=0x12285, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3-MvVAc3Um.docx", cAlternateFileName="3-MVVA~1.DOC")) returned 1 [0064.869] lstrcmpiW (lpString1="3-MvVAc3Um.docx", lpString2=".") returned 1 [0064.869] lstrcmpiW (lpString1="3-MvVAc3Um.docx", lpString2="..") returned 1 [0064.869] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="3-MvVAc3Um.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\3-MvVAc3Um.docx") returned="C:\\Users\\FD1HVy\\Documents\\3-MvVAc3Um.docx" [0064.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="3-MvVAc3Um.docx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0064.869] GetProcessHeap () returned 0x630000 [0064.869] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x64c9f0 [0064.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="3-MvVAc3Um.docx", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3-MvVAc3Um.docx", lpUsedDefaultChar=0x0) returned 16 [0064.869] lstrlenA (lpString="3-MvVAc3Um.docx") returned 15 [0064.869] lstrlenA (lpString=".happythreechoose") returned 17 [0064.869] lstrcmpiW (lpString1="3-MvVAc3Um.docx", lpString2="Decryption INFO.html") returned -1 [0064.869] lstrcmpiW (lpString1="3-MvVAc3Um.docx", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned -1 [0064.869] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0064.869] lstrcmpiW (lpString1="3-MvVAc3Um.docx", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0064.869] GetProcessHeap () returned 0x630000 [0064.869] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0064.869] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\3-MvVAc3Um.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3-mvvac3um.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0064.870] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=74373) returned 1 [0064.870] GetProcessHeap () returned 0x630000 [0064.870] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6556e8 [0064.870] GetProcessHeap () returned 0x630000 [0064.870] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0064.870] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\3-MvVAc3Um.docx") returned 41 [0064.870] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0064.870] GetProcessHeap () returned 0x630000 [0064.870] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0064.870] GetProcessHeap () returned 0x630000 [0064.870] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x6596d8 [0064.870] lstrlenA (lpString="rsa_encrypt") returned 11 [0064.870] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0064.871] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0064.871] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0064.871] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0064.871] GetProcessHeap () returned 0x630000 [0064.871] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0064.871] lstrlenA (lpString="010001") returned 6 [0064.871] GetProcessHeap () returned 0x630000 [0064.871] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0064.871] GetProcessHeap () returned 0x630000 [0064.871] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0064.871] GetProcessHeap () returned 0x630000 [0064.871] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e190 [0064.871] GetProcessHeap () returned 0x630000 [0064.871] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0064.871] GetProcessHeap () returned 0x630000 [0064.871] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e610 [0064.871] GetProcessHeap () returned 0x630000 [0064.871] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656db0 [0064.871] GetProcessHeap () returned 0x630000 [0064.871] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2b8 [0064.871] GetProcessHeap () returned 0x630000 [0064.871] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0064.871] GetProcessHeap () returned 0x630000 [0064.871] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0064.871] GetProcessHeap () returned 0x630000 [0064.871] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0064.871] GetProcessHeap () returned 0x630000 [0064.871] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0064.871] GetProcessHeap () returned 0x630000 [0064.872] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x6570f8 [0064.872] GetProcessHeap () returned 0x630000 [0064.872] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0064.872] GetProcessHeap () returned 0x630000 [0064.872] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0064.872] GetProcessHeap () returned 0x630000 [0064.872] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e7c0 [0064.872] GetProcessHeap () returned 0x630000 [0064.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0064.872] GetProcessHeap () returned 0x630000 [0064.872] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0064.872] GetProcessHeap () returned 0x630000 [0064.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e7c0 | out: hHeap=0x630000) returned 1 [0064.872] GetProcessHeap () returned 0x630000 [0064.872] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0064.872] GetProcessHeap () returned 0x630000 [0064.872] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cf28 [0064.872] GetProcessHeap () returned 0x630000 [0064.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0064.872] GetProcessHeap () returned 0x630000 [0064.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0064.872] GetProcessHeap () returned 0x630000 [0064.872] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0064.872] GetProcessHeap () returned 0x630000 [0064.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0064.872] GetProcessHeap () returned 0x630000 [0064.872] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e730 [0064.872] GetProcessHeap () returned 0x630000 [0064.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cf28 | out: hHeap=0x630000) returned 1 [0064.872] GetProcessHeap () returned 0x630000 [0064.872] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0064.872] GetProcessHeap () returned 0x630000 [0064.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0064.872] GetProcessHeap () returned 0x630000 [0064.872] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0064.872] GetProcessHeap () returned 0x630000 [0064.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0064.872] GetProcessHeap () returned 0x630000 [0064.872] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0064.873] GetProcessHeap () returned 0x630000 [0064.873] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0064.873] GetProcessHeap () returned 0x630000 [0064.873] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0064.873] GetProcessHeap () returned 0x630000 [0064.873] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0064.873] GetProcessHeap () returned 0x630000 [0064.873] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0064.873] GetProcessHeap () returned 0x630000 [0064.873] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0064.873] GetProcessHeap () returned 0x630000 [0064.873] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0064.873] GetProcessHeap () returned 0x630000 [0064.873] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0064.873] GetProcessHeap () returned 0x630000 [0064.873] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0064.873] GetProcessHeap () returned 0x630000 [0064.873] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0064.873] GetProcessHeap () returned 0x630000 [0064.873] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0064.873] GetProcessHeap () returned 0x630000 [0064.873] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0064.873] GetProcessHeap () returned 0x630000 [0064.873] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0064.873] GetProcessHeap () returned 0x630000 [0064.874] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0064.874] GetProcessHeap () returned 0x630000 [0064.874] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0064.874] GetProcessHeap () returned 0x630000 [0064.874] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0064.874] GetProcessHeap () returned 0x630000 [0064.874] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0064.875] GetProcessHeap () returned 0x630000 [0064.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0064.875] GetProcessHeap () returned 0x630000 [0064.875] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.875] GetProcessHeap () returned 0x630000 [0064.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.875] GetProcessHeap () returned 0x630000 [0064.875] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0064.875] GetProcessHeap () returned 0x630000 [0064.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0064.875] GetProcessHeap () returned 0x630000 [0064.875] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0064.875] GetProcessHeap () returned 0x630000 [0064.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0064.875] GetProcessHeap () returned 0x630000 [0064.875] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.875] GetProcessHeap () returned 0x630000 [0064.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.875] GetProcessHeap () returned 0x630000 [0064.875] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.875] GetProcessHeap () returned 0x630000 [0064.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.875] GetProcessHeap () returned 0x630000 [0064.875] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.875] GetProcessHeap () returned 0x630000 [0064.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.875] GetProcessHeap () returned 0x630000 [0064.875] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0064.875] GetProcessHeap () returned 0x630000 [0064.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0064.875] GetProcessHeap () returned 0x630000 [0064.875] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0064.875] GetProcessHeap () returned 0x630000 [0064.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0064.875] GetProcessHeap () returned 0x630000 [0064.875] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0064.875] GetProcessHeap () returned 0x630000 [0064.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0064.876] GetProcessHeap () returned 0x630000 [0064.876] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0064.876] GetProcessHeap () returned 0x630000 [0064.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0064.876] GetProcessHeap () returned 0x630000 [0064.876] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0064.876] GetProcessHeap () returned 0x630000 [0064.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0064.876] GetProcessHeap () returned 0x630000 [0064.876] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0064.876] GetProcessHeap () returned 0x630000 [0064.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0064.876] GetProcessHeap () returned 0x630000 [0064.876] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0064.876] GetProcessHeap () returned 0x630000 [0064.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0064.876] GetProcessHeap () returned 0x630000 [0064.876] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0064.876] GetProcessHeap () returned 0x630000 [0064.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0064.876] GetProcessHeap () returned 0x630000 [0064.876] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.876] GetProcessHeap () returned 0x630000 [0064.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.876] GetProcessHeap () returned 0x630000 [0064.876] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0064.876] GetProcessHeap () returned 0x630000 [0064.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0064.876] GetProcessHeap () returned 0x630000 [0064.876] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0064.876] GetProcessHeap () returned 0x630000 [0064.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0064.876] GetProcessHeap () returned 0x630000 [0064.876] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0064.876] GetProcessHeap () returned 0x630000 [0064.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0064.876] GetProcessHeap () returned 0x630000 [0064.876] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0064.877] GetProcessHeap () returned 0x630000 [0064.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0064.877] GetProcessHeap () returned 0x630000 [0064.877] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0064.877] GetProcessHeap () returned 0x630000 [0064.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0064.877] GetProcessHeap () returned 0x630000 [0064.877] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0064.877] GetProcessHeap () returned 0x630000 [0064.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0064.877] GetProcessHeap () returned 0x630000 [0064.877] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0064.877] GetProcessHeap () returned 0x630000 [0064.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0064.877] GetProcessHeap () returned 0x630000 [0064.877] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.877] GetProcessHeap () returned 0x630000 [0064.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.877] GetProcessHeap () returned 0x630000 [0064.877] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.877] GetProcessHeap () returned 0x630000 [0064.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.877] GetProcessHeap () returned 0x630000 [0064.877] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0064.877] GetProcessHeap () returned 0x630000 [0064.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0064.877] GetProcessHeap () returned 0x630000 [0064.877] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0064.877] GetProcessHeap () returned 0x630000 [0064.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0064.877] GetProcessHeap () returned 0x630000 [0064.877] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0064.877] GetProcessHeap () returned 0x630000 [0064.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0064.877] GetProcessHeap () returned 0x630000 [0064.877] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0064.877] GetProcessHeap () returned 0x630000 [0064.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0064.878] GetProcessHeap () returned 0x630000 [0064.878] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0064.878] GetProcessHeap () returned 0x630000 [0064.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0064.878] GetProcessHeap () returned 0x630000 [0064.878] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0064.878] GetProcessHeap () returned 0x630000 [0064.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0064.878] GetProcessHeap () returned 0x630000 [0064.878] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0064.878] GetProcessHeap () returned 0x630000 [0064.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0064.878] GetProcessHeap () returned 0x630000 [0064.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0064.878] GetProcessHeap () returned 0x630000 [0064.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0064.878] GetProcessHeap () returned 0x630000 [0064.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0064.878] GetProcessHeap () returned 0x630000 [0064.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0064.878] GetProcessHeap () returned 0x630000 [0064.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0064.878] GetProcessHeap () returned 0x630000 [0064.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0064.878] GetProcessHeap () returned 0x630000 [0064.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0064.878] GetProcessHeap () returned 0x630000 [0064.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0064.878] GetProcessHeap () returned 0x630000 [0064.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0064.878] GetProcessHeap () returned 0x630000 [0064.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0064.878] GetProcessHeap () returned 0x630000 [0064.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0064.878] WriteFile (in: hFile=0x230, lpBuffer=0x6596d8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6596d8*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0064.897] GetProcessHeap () returned 0x630000 [0064.897] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6596d8, Size=0x30) returned 0x6596d8 [0064.897] GetProcessHeap () returned 0x630000 [0064.897] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0064.897] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0064.897] GetProcessHeap () returned 0x630000 [0064.897] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12285) returned 0x671bf0 [0064.897] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0x12285, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0x12285, lpOverlapped=0x0) returned 1 [0064.899] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0064.899] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x12285, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0x12285, lpOverlapped=0x0) returned 1 [0064.901] GetProcessHeap () returned 0x630000 [0064.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0064.902] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0064.902] WriteFile (in: hFile=0x230, lpBuffer=0x6596d8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6596d8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0064.903] CloseHandle (hObject=0x230) returned 1 [0064.906] GetProcessHeap () returned 0x630000 [0064.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0064.906] GetProcessHeap () returned 0x630000 [0064.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6556e8 | out: hHeap=0x630000) returned 1 [0064.906] GetProcessHeap () returned 0x630000 [0064.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0064.906] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\3-MvVAc3Um.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\3-MvVAc3Um.docx") returned="C:\\Users\\FD1HVy\\Documents\\3-MvVAc3Um.docx" [0064.906] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\3-MvVAc3Um.docx", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\3-MvVAc3Um.docx.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\3-MvVAc3Um.docx.happythreechoose" [0064.906] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\3-MvVAc3Um.docx" (normalized: "c:\\users\\fd1hvy\\documents\\3-mvvac3um.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\3-MvVAc3Um.docx.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\3-mvvac3um.docx.happythreechoose"), dwFlags=0x1) returned 1 [0064.907] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\3-MvVAc3Um.docx" | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0064.907] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned="" [0064.907] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" [0064.907] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\decryption info.html")) returned 0xffffffff [0064.907] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0064.907] GetProcessHeap () returned 0x630000 [0064.907] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6558c8 [0064.907] GetProcessHeap () returned 0x630000 [0064.907] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0064.915] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.916] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.916] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.916] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.916] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.916] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.916] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.916] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.916] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.916] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.917] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.917] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.917] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.917] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.917] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.917] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.917] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.917] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.917] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.917] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.917] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.917] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.917] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.918] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.918] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.918] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.918] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.918] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.918] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.918] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.918] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.918] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.918] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.918] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.918] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.919] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.919] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.921] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.921] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.921] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.921] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.921] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.921] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.922] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.922] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.922] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.922] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.922] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.922] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.922] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.922] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.922] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.922] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.922] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.922] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.922] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.922] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.922] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.923] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.923] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.923] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.923] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.923] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.923] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.923] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.923] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.923] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.923] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.923] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.923] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.923] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.923] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.924] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.924] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.924] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.924] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.924] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.924] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.924] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.924] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.924] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.924] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.924] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.924] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.924] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.924] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.925] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.925] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.925] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.925] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.925] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.925] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.925] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.925] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.925] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.925] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.925] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.925] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.925] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.926] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.926] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.926] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.926] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.926] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.926] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.926] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.926] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.926] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.926] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.926] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.926] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.926] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.926] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.927] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.927] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.927] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.927] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.927] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.927] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.927] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.927] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.927] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.927] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.927] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.927] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.927] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.927] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.928] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.928] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.928] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.928] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.928] GetProcessHeap () returned 0x630000 [0064.928] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6558c8 | out: hHeap=0x630000) returned 1 [0064.928] GetProcessHeap () returned 0x630000 [0064.928] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0064.928] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0064.928] GetProcessHeap () returned 0x630000 [0064.928] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655aa8 [0064.928] GetProcessHeap () returned 0x630000 [0064.928] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0064.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.936] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.937] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.937] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.937] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.937] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.937] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.937] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.937] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.937] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.937] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.937] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.937] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.937] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.937] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.937] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.938] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.938] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.938] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.938] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.938] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.938] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.938] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.938] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.938] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.938] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.938] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.938] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.938] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.938] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.939] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.939] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.939] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.939] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.939] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.939] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.939] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.939] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.939] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.939] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.939] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.939] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.939] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.939] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.940] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.940] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.940] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.940] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.940] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.940] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.940] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.940] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.940] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.940] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.940] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.940] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.940] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.940] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.941] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.941] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.941] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.941] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.941] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.941] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.941] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.941] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.941] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.941] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.941] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.941] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.941] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.941] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.942] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.942] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.942] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.942] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.942] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.942] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.942] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.942] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.942] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.942] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.942] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.942] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.943] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.943] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.943] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.943] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.943] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.943] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.943] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.943] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.943] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.943] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.943] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.943] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.943] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.943] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.944] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.944] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.944] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.944] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.944] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.944] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.944] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.944] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.944] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.944] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.944] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.944] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.944] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0064.944] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0065.065] GetProcessHeap () returned 0x630000 [0065.065] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655aa8 | out: hHeap=0x630000) returned 1 [0065.065] GetProcessHeap () returned 0x630000 [0065.065] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0065.066] CloseHandle (hObject=0x230) returned 1 [0065.066] GetProcessHeap () returned 0x630000 [0065.066] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0065.066] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1577a140, ftCreationTime.dwHighDateTime=0x1d59ad9, ftLastAccessTime.dwLowDateTime=0xd01eec90, ftLastAccessTime.dwHighDateTime=0x1d578bc, ftLastWriteTime.dwLowDateTime=0xd01eec90, ftLastWriteTime.dwHighDateTime=0x1d578bc, nFileSizeHigh=0x0, nFileSizeLow=0x2dbe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8v48dn6tiIlH6Cz70.docx", cAlternateFileName="8V48DN~1.DOC")) returned 1 [0065.066] lstrcmpiW (lpString1="8v48dn6tiIlH6Cz70.docx", lpString2=".") returned 1 [0065.066] lstrcmpiW (lpString1="8v48dn6tiIlH6Cz70.docx", lpString2="..") returned 1 [0065.066] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="8v48dn6tiIlH6Cz70.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\8v48dn6tiIlH6Cz70.docx") returned="C:\\Users\\FD1HVy\\Documents\\8v48dn6tiIlH6Cz70.docx" [0065.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="8v48dn6tiIlH6Cz70.docx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0065.066] GetProcessHeap () returned 0x630000 [0065.066] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x17) returned 0x645e58 [0065.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="8v48dn6tiIlH6Cz70.docx", cchWideChar=-1, lpMultiByteStr=0x645e58, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8v48dn6tiIlH6Cz70.docx", lpUsedDefaultChar=0x0) returned 23 [0065.066] lstrlenA (lpString="8v48dn6tiIlH6Cz70.docx") returned 22 [0065.066] lstrlenA (lpString=".happythreechoose") returned 17 [0065.066] lstrlenA (lpString=".happythreechoose") returned 17 [0065.066] lstrlenA (lpString="8v48dn6tiIlH6Cz70.docx") returned 22 [0065.066] lstrcmpiA (lpString1="n6tiIlH6Cz70.docx", lpString2=".happythreechoose") returned 1 [0065.067] lstrcmpiW (lpString1="8v48dn6tiIlH6Cz70.docx", lpString2="Decryption INFO.html") returned -1 [0065.067] lstrcmpiW (lpString1="8v48dn6tiIlH6Cz70.docx", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0065.067] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0065.067] lstrcmpiW (lpString1="8v48dn6tiIlH6Cz70.docx", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0065.067] GetProcessHeap () returned 0x630000 [0065.067] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0065.067] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\8v48dn6tiIlH6Cz70.docx" (normalized: "c:\\users\\fd1hvy\\documents\\8v48dn6tiilh6cz70.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0065.067] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=11710) returned 1 [0065.067] GetProcessHeap () returned 0x630000 [0065.067] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655760 [0065.067] GetProcessHeap () returned 0x630000 [0065.067] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0065.067] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\8v48dn6tiIlH6Cz70.docx") returned 48 [0065.067] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0065.067] GetProcessHeap () returned 0x630000 [0065.067] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0065.068] GetProcessHeap () returned 0x630000 [0065.068] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x659710 [0065.068] lstrlenA (lpString="rsa_encrypt") returned 11 [0065.068] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0065.068] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0065.068] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0065.069] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0065.069] GetProcessHeap () returned 0x630000 [0065.069] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0065.069] lstrlenA (lpString="010001") returned 6 [0065.069] GetProcessHeap () returned 0x630000 [0065.069] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0065.069] GetProcessHeap () returned 0x630000 [0065.069] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0065.069] GetProcessHeap () returned 0x630000 [0065.069] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e3d0 [0065.069] GetProcessHeap () returned 0x630000 [0065.069] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0065.069] GetProcessHeap () returned 0x630000 [0065.069] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e2b0 [0065.069] GetProcessHeap () returned 0x630000 [0065.070] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656db0 [0065.070] GetProcessHeap () returned 0x630000 [0065.070] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2b8 [0065.070] GetProcessHeap () returned 0x630000 [0065.070] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0065.070] GetProcessHeap () returned 0x630000 [0065.070] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.070] GetProcessHeap () returned 0x630000 [0065.070] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0065.070] GetProcessHeap () returned 0x630000 [0065.070] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0065.070] GetProcessHeap () returned 0x630000 [0065.070] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657558 [0065.070] GetProcessHeap () returned 0x630000 [0065.070] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.070] GetProcessHeap () returned 0x630000 [0065.070] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0065.070] GetProcessHeap () returned 0x630000 [0065.070] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e100 [0065.070] GetProcessHeap () returned 0x630000 [0065.070] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0065.070] GetProcessHeap () returned 0x630000 [0065.070] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0065.070] GetProcessHeap () returned 0x630000 [0065.070] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0065.070] GetProcessHeap () returned 0x630000 [0065.070] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.070] GetProcessHeap () returned 0x630000 [0065.070] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0065.070] GetProcessHeap () returned 0x630000 [0065.070] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.070] GetProcessHeap () returned 0x630000 [0065.070] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.070] GetProcessHeap () returned 0x630000 [0065.070] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.070] GetProcessHeap () returned 0x630000 [0065.070] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.070] GetProcessHeap () returned 0x630000 [0065.071] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e460 [0065.071] GetProcessHeap () returned 0x630000 [0065.071] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0065.071] GetProcessHeap () returned 0x630000 [0065.071] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0065.071] GetProcessHeap () returned 0x630000 [0065.071] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e460 | out: hHeap=0x630000) returned 1 [0065.071] GetProcessHeap () returned 0x630000 [0065.071] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.071] GetProcessHeap () returned 0x630000 [0065.071] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.071] GetProcessHeap () returned 0x630000 [0065.071] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.071] GetProcessHeap () returned 0x630000 [0065.071] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.071] GetProcessHeap () returned 0x630000 [0065.071] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.071] GetProcessHeap () returned 0x630000 [0065.071] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.071] GetProcessHeap () returned 0x630000 [0065.071] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.071] GetProcessHeap () returned 0x630000 [0065.071] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.071] GetProcessHeap () returned 0x630000 [0065.071] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.071] GetProcessHeap () returned 0x630000 [0065.071] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.071] GetProcessHeap () returned 0x630000 [0065.071] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.071] GetProcessHeap () returned 0x630000 [0065.071] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.071] GetProcessHeap () returned 0x630000 [0065.071] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.071] GetProcessHeap () returned 0x630000 [0065.071] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.071] GetProcessHeap () returned 0x630000 [0065.071] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.072] GetProcessHeap () returned 0x630000 [0065.072] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.072] GetProcessHeap () returned 0x630000 [0065.072] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.072] GetProcessHeap () returned 0x630000 [0065.072] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.072] GetProcessHeap () returned 0x630000 [0065.072] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.072] GetProcessHeap () returned 0x630000 [0065.072] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.072] GetProcessHeap () returned 0x630000 [0065.072] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.072] GetProcessHeap () returned 0x630000 [0065.072] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.072] GetProcessHeap () returned 0x630000 [0065.072] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.072] GetProcessHeap () returned 0x630000 [0065.072] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.072] GetProcessHeap () returned 0x630000 [0065.072] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.072] GetProcessHeap () returned 0x630000 [0065.072] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.072] GetProcessHeap () returned 0x630000 [0065.072] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.072] GetProcessHeap () returned 0x630000 [0065.072] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.072] GetProcessHeap () returned 0x630000 [0065.072] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0065.072] GetProcessHeap () returned 0x630000 [0065.072] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0065.072] GetProcessHeap () returned 0x630000 [0065.072] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.072] GetProcessHeap () returned 0x630000 [0065.072] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.072] GetProcessHeap () returned 0x630000 [0065.072] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0065.072] GetProcessHeap () returned 0x630000 [0065.072] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0065.073] GetProcessHeap () returned 0x630000 [0065.073] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.073] GetProcessHeap () returned 0x630000 [0065.073] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.073] GetProcessHeap () returned 0x630000 [0065.073] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.073] GetProcessHeap () returned 0x630000 [0065.073] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.073] GetProcessHeap () returned 0x630000 [0065.073] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.073] GetProcessHeap () returned 0x630000 [0065.073] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.073] GetProcessHeap () returned 0x630000 [0065.073] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.073] GetProcessHeap () returned 0x630000 [0065.073] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.073] GetProcessHeap () returned 0x630000 [0065.073] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.073] GetProcessHeap () returned 0x630000 [0065.073] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.073] GetProcessHeap () returned 0x630000 [0065.073] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.073] GetProcessHeap () returned 0x630000 [0065.073] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.073] GetProcessHeap () returned 0x630000 [0065.073] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.073] GetProcessHeap () returned 0x630000 [0065.073] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.073] GetProcessHeap () returned 0x630000 [0065.073] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.073] GetProcessHeap () returned 0x630000 [0065.073] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.073] GetProcessHeap () returned 0x630000 [0065.073] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.073] GetProcessHeap () returned 0x630000 [0065.073] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.073] GetProcessHeap () returned 0x630000 [0065.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.074] GetProcessHeap () returned 0x630000 [0065.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.074] GetProcessHeap () returned 0x630000 [0065.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.074] GetProcessHeap () returned 0x630000 [0065.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.074] GetProcessHeap () returned 0x630000 [0065.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.074] GetProcessHeap () returned 0x630000 [0065.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.074] GetProcessHeap () returned 0x630000 [0065.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.074] GetProcessHeap () returned 0x630000 [0065.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.074] GetProcessHeap () returned 0x630000 [0065.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.074] GetProcessHeap () returned 0x630000 [0065.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.074] GetProcessHeap () returned 0x630000 [0065.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.074] GetProcessHeap () returned 0x630000 [0065.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.074] GetProcessHeap () returned 0x630000 [0065.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.074] GetProcessHeap () returned 0x630000 [0065.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.074] GetProcessHeap () returned 0x630000 [0065.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.074] GetProcessHeap () returned 0x630000 [0065.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.074] GetProcessHeap () returned 0x630000 [0065.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.074] GetProcessHeap () returned 0x630000 [0065.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.074] GetProcessHeap () returned 0x630000 [0065.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.075] GetProcessHeap () returned 0x630000 [0065.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.075] GetProcessHeap () returned 0x630000 [0065.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.075] GetProcessHeap () returned 0x630000 [0065.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.075] GetProcessHeap () returned 0x630000 [0065.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.075] GetProcessHeap () returned 0x630000 [0065.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.075] GetProcessHeap () returned 0x630000 [0065.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.075] GetProcessHeap () returned 0x630000 [0065.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.075] GetProcessHeap () returned 0x630000 [0065.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0065.075] GetProcessHeap () returned 0x630000 [0065.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0065.075] GetProcessHeap () returned 0x630000 [0065.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.075] GetProcessHeap () returned 0x630000 [0065.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.075] GetProcessHeap () returned 0x630000 [0065.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0065.075] GetProcessHeap () returned 0x630000 [0065.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0065.075] GetProcessHeap () returned 0x630000 [0065.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0065.075] GetProcessHeap () returned 0x630000 [0065.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0065.075] GetProcessHeap () returned 0x630000 [0065.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0065.075] GetProcessHeap () returned 0x630000 [0065.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e2b0 | out: hHeap=0x630000) returned 1 [0065.075] GetProcessHeap () returned 0x630000 [0065.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0065.076] GetProcessHeap () returned 0x630000 [0065.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0065.076] GetProcessHeap () returned 0x630000 [0065.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0065.076] GetProcessHeap () returned 0x630000 [0065.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.076] GetProcessHeap () returned 0x630000 [0065.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0065.076] WriteFile (in: hFile=0x230, lpBuffer=0x659710*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659710*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0065.094] GetProcessHeap () returned 0x630000 [0065.094] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659710, Size=0x30) returned 0x659710 [0065.094] GetProcessHeap () returned 0x630000 [0065.094] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0065.094] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0065.094] GetProcessHeap () returned 0x630000 [0065.094] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2dbe) returned 0x671bf0 [0065.095] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0x2dbe, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0x2dbe, lpOverlapped=0x0) returned 1 [0065.096] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0065.096] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x2dbe, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0x2dbe, lpOverlapped=0x0) returned 1 [0065.102] GetProcessHeap () returned 0x630000 [0065.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0065.102] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0065.102] WriteFile (in: hFile=0x230, lpBuffer=0x659710*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659710*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0065.103] CloseHandle (hObject=0x230) returned 1 [0065.103] GetProcessHeap () returned 0x630000 [0065.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0065.104] GetProcessHeap () returned 0x630000 [0065.104] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655760 | out: hHeap=0x630000) returned 1 [0065.104] GetProcessHeap () returned 0x630000 [0065.104] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0065.104] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\8v48dn6tiIlH6Cz70.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\8v48dn6tiIlH6Cz70.docx") returned="C:\\Users\\FD1HVy\\Documents\\8v48dn6tiIlH6Cz70.docx" [0065.104] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\8v48dn6tiIlH6Cz70.docx", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\8v48dn6tiIlH6Cz70.docx.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\8v48dn6tiIlH6Cz70.docx.happythreechoose" [0065.104] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\8v48dn6tiIlH6Cz70.docx" (normalized: "c:\\users\\fd1hvy\\documents\\8v48dn6tiilh6cz70.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\8v48dn6tiIlH6Cz70.docx.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\8v48dn6tiilh6cz70.docx.happythreechoose"), dwFlags=0x1) returned 1 [0065.104] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\8v48dn6tiIlH6Cz70.docx" | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0065.104] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned="" [0065.104] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" [0065.104] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\decryption info.html")) returned 0x20 [0065.104] GetProcessHeap () returned 0x630000 [0065.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645e58 | out: hHeap=0x630000) returned 1 [0065.105] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31c78e30, ftCreationTime.dwHighDateTime=0x1d56066, ftLastAccessTime.dwLowDateTime=0xc5643f30, ftLastAccessTime.dwHighDateTime=0x1d5a56c, ftLastWriteTime.dwLowDateTime=0xc5643f30, ftLastWriteTime.dwHighDateTime=0x1d5a56c, nFileSizeHigh=0x0, nFileSizeLow=0x15b66, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9r_fAQ1WVKLjF1W9.pptx", cAlternateFileName="9R_FAQ~1.PPT")) returned 1 [0065.105] lstrcmpiW (lpString1="9r_fAQ1WVKLjF1W9.pptx", lpString2=".") returned 1 [0065.105] lstrcmpiW (lpString1="9r_fAQ1WVKLjF1W9.pptx", lpString2="..") returned 1 [0065.105] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="9r_fAQ1WVKLjF1W9.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\9r_fAQ1WVKLjF1W9.pptx") returned="C:\\Users\\FD1HVy\\Documents\\9r_fAQ1WVKLjF1W9.pptx" [0065.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="9r_fAQ1WVKLjF1W9.pptx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0065.105] GetProcessHeap () returned 0x630000 [0065.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x645e58 [0065.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="9r_fAQ1WVKLjF1W9.pptx", cchWideChar=-1, lpMultiByteStr=0x645e58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9r_fAQ1WVKLjF1W9.pptx", lpUsedDefaultChar=0x0) returned 22 [0065.105] lstrlenA (lpString="9r_fAQ1WVKLjF1W9.pptx") returned 21 [0065.105] lstrlenA (lpString=".happythreechoose") returned 17 [0065.105] lstrlenA (lpString=".happythreechoose") returned 17 [0065.105] lstrlenA (lpString="9r_fAQ1WVKLjF1W9.pptx") returned 21 [0065.105] lstrcmpiA (lpString1="AQ1WVKLjF1W9.pptx", lpString2=".happythreechoose") returned 1 [0065.105] lstrcmpiW (lpString1="9r_fAQ1WVKLjF1W9.pptx", lpString2="Decryption INFO.html") returned -1 [0065.105] lstrcmpiW (lpString1="9r_fAQ1WVKLjF1W9.pptx", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0065.105] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0065.105] lstrcmpiW (lpString1="9r_fAQ1WVKLjF1W9.pptx", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0065.105] GetProcessHeap () returned 0x630000 [0065.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0065.105] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\9r_fAQ1WVKLjF1W9.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\9r_faq1wvkljf1w9.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0065.105] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=88934) returned 1 [0065.105] GetProcessHeap () returned 0x630000 [0065.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6556e8 [0065.105] GetProcessHeap () returned 0x630000 [0065.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0065.105] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\9r_fAQ1WVKLjF1W9.pptx") returned 47 [0065.105] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0065.105] GetProcessHeap () returned 0x630000 [0065.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0065.106] GetProcessHeap () returned 0x630000 [0065.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38a) returned 0x659748 [0065.106] lstrlenA (lpString="rsa_encrypt") returned 11 [0065.106] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0065.106] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0065.106] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0065.106] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0065.106] GetProcessHeap () returned 0x630000 [0065.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0065.106] lstrlenA (lpString="010001") returned 6 [0065.106] GetProcessHeap () returned 0x630000 [0065.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0065.106] GetProcessHeap () returned 0x630000 [0065.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0065.107] GetProcessHeap () returned 0x630000 [0065.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e730 [0065.107] GetProcessHeap () returned 0x630000 [0065.107] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0065.107] GetProcessHeap () returned 0x630000 [0065.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e970 [0065.107] GetProcessHeap () returned 0x630000 [0065.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657670 [0065.107] GetProcessHeap () returned 0x630000 [0065.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a318 [0065.107] GetProcessHeap () returned 0x630000 [0065.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0065.107] GetProcessHeap () returned 0x630000 [0065.107] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.107] GetProcessHeap () returned 0x630000 [0065.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0065.107] GetProcessHeap () returned 0x630000 [0065.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0065.107] GetProcessHeap () returned 0x630000 [0065.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657788 [0065.107] GetProcessHeap () returned 0x630000 [0065.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.107] GetProcessHeap () returned 0x630000 [0065.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0065.107] GetProcessHeap () returned 0x630000 [0065.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea00 [0065.107] GetProcessHeap () returned 0x630000 [0065.107] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0065.107] GetProcessHeap () returned 0x630000 [0065.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0065.107] GetProcessHeap () returned 0x630000 [0065.107] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0065.107] GetProcessHeap () returned 0x630000 [0065.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.107] GetProcessHeap () returned 0x630000 [0065.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0065.107] GetProcessHeap () returned 0x630000 [0065.107] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.107] GetProcessHeap () returned 0x630000 [0065.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.108] GetProcessHeap () returned 0x630000 [0065.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.108] GetProcessHeap () returned 0x630000 [0065.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.108] GetProcessHeap () returned 0x630000 [0065.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e100 [0065.108] GetProcessHeap () returned 0x630000 [0065.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0065.108] GetProcessHeap () returned 0x630000 [0065.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0065.108] GetProcessHeap () returned 0x630000 [0065.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0065.108] GetProcessHeap () returned 0x630000 [0065.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.108] GetProcessHeap () returned 0x630000 [0065.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.108] GetProcessHeap () returned 0x630000 [0065.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.108] GetProcessHeap () returned 0x630000 [0065.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.108] GetProcessHeap () returned 0x630000 [0065.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.108] GetProcessHeap () returned 0x630000 [0065.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.108] GetProcessHeap () returned 0x630000 [0065.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.108] GetProcessHeap () returned 0x630000 [0065.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.108] GetProcessHeap () returned 0x630000 [0065.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.108] GetProcessHeap () returned 0x630000 [0065.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.108] GetProcessHeap () returned 0x630000 [0065.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.108] GetProcessHeap () returned 0x630000 [0065.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.109] GetProcessHeap () returned 0x630000 [0065.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.109] GetProcessHeap () returned 0x630000 [0065.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.109] GetProcessHeap () returned 0x630000 [0065.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.109] GetProcessHeap () returned 0x630000 [0065.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.109] GetProcessHeap () returned 0x630000 [0065.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.109] GetProcessHeap () returned 0x630000 [0065.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.109] GetProcessHeap () returned 0x630000 [0065.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.109] GetProcessHeap () returned 0x630000 [0065.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.109] GetProcessHeap () returned 0x630000 [0065.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.109] GetProcessHeap () returned 0x630000 [0065.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.109] GetProcessHeap () returned 0x630000 [0065.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.109] GetProcessHeap () returned 0x630000 [0065.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.109] GetProcessHeap () returned 0x630000 [0065.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.109] GetProcessHeap () returned 0x630000 [0065.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.109] GetProcessHeap () returned 0x630000 [0065.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0065.109] GetProcessHeap () returned 0x630000 [0065.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0065.109] GetProcessHeap () returned 0x630000 [0065.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.109] GetProcessHeap () returned 0x630000 [0065.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.110] GetProcessHeap () returned 0x630000 [0065.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0065.110] GetProcessHeap () returned 0x630000 [0065.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0065.110] GetProcessHeap () returned 0x630000 [0065.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.110] GetProcessHeap () returned 0x630000 [0065.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.110] GetProcessHeap () returned 0x630000 [0065.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.110] GetProcessHeap () returned 0x630000 [0065.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.110] GetProcessHeap () returned 0x630000 [0065.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.110] GetProcessHeap () returned 0x630000 [0065.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.110] GetProcessHeap () returned 0x630000 [0065.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0065.110] GetProcessHeap () returned 0x630000 [0065.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0065.110] GetProcessHeap () returned 0x630000 [0065.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.110] GetProcessHeap () returned 0x630000 [0065.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.110] GetProcessHeap () returned 0x630000 [0065.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.110] GetProcessHeap () returned 0x630000 [0065.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.110] GetProcessHeap () returned 0x630000 [0065.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.110] GetProcessHeap () returned 0x630000 [0065.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.110] GetProcessHeap () returned 0x630000 [0065.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.110] GetProcessHeap () returned 0x630000 [0065.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.111] GetProcessHeap () returned 0x630000 [0065.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.111] GetProcessHeap () returned 0x630000 [0065.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.111] GetProcessHeap () returned 0x630000 [0065.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0065.111] GetProcessHeap () returned 0x630000 [0065.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0065.111] GetProcessHeap () returned 0x630000 [0065.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.111] GetProcessHeap () returned 0x630000 [0065.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.111] GetProcessHeap () returned 0x630000 [0065.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.111] GetProcessHeap () returned 0x630000 [0065.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.111] GetProcessHeap () returned 0x630000 [0065.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.111] GetProcessHeap () returned 0x630000 [0065.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.111] GetProcessHeap () returned 0x630000 [0065.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0065.111] GetProcessHeap () returned 0x630000 [0065.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0065.111] GetProcessHeap () returned 0x630000 [0065.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.111] GetProcessHeap () returned 0x630000 [0065.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.111] GetProcessHeap () returned 0x630000 [0065.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.111] GetProcessHeap () returned 0x630000 [0065.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.111] GetProcessHeap () returned 0x630000 [0065.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.111] GetProcessHeap () returned 0x630000 [0065.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.111] GetProcessHeap () returned 0x630000 [0065.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.112] GetProcessHeap () returned 0x630000 [0065.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.112] GetProcessHeap () returned 0x630000 [0065.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.112] GetProcessHeap () returned 0x630000 [0065.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.112] GetProcessHeap () returned 0x630000 [0065.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.112] GetProcessHeap () returned 0x630000 [0065.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.112] GetProcessHeap () returned 0x630000 [0065.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.112] GetProcessHeap () returned 0x630000 [0065.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.112] GetProcessHeap () returned 0x630000 [0065.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.112] GetProcessHeap () returned 0x630000 [0065.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.112] GetProcessHeap () returned 0x630000 [0065.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.112] GetProcessHeap () returned 0x630000 [0065.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.112] GetProcessHeap () returned 0x630000 [0065.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.112] GetProcessHeap () returned 0x630000 [0065.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.112] GetProcessHeap () returned 0x630000 [0065.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.112] GetProcessHeap () returned 0x630000 [0065.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.112] GetProcessHeap () returned 0x630000 [0065.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0065.112] GetProcessHeap () returned 0x630000 [0065.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0065.112] GetProcessHeap () returned 0x630000 [0065.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0065.112] GetProcessHeap () returned 0x630000 [0065.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0065.113] GetProcessHeap () returned 0x630000 [0065.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0065.113] GetProcessHeap () returned 0x630000 [0065.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0065.113] GetProcessHeap () returned 0x630000 [0065.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0065.113] GetProcessHeap () returned 0x630000 [0065.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0065.113] GetProcessHeap () returned 0x630000 [0065.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0065.113] GetProcessHeap () returned 0x630000 [0065.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.113] GetProcessHeap () returned 0x630000 [0065.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0065.113] WriteFile (in: hFile=0x230, lpBuffer=0x659748*, nNumberOfBytesToWrite=0x38a, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659748*, lpNumberOfBytesWritten=0x243d864*=0x38a, lpOverlapped=0x0) returned 1 [0065.148] GetProcessHeap () returned 0x630000 [0065.149] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659748, Size=0x30) returned 0x659748 [0065.149] GetProcessHeap () returned 0x630000 [0065.149] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0065.149] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0065.149] GetProcessHeap () returned 0x630000 [0065.149] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x15b70) returned 0x671bf0 [0065.150] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0x15b70, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0x15b70, lpOverlapped=0x0) returned 1 [0065.151] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0065.151] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x15b70, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0x15b70, lpOverlapped=0x0) returned 1 [0065.164] GetProcessHeap () returned 0x630000 [0065.164] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0065.164] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0065.164] WriteFile (in: hFile=0x230, lpBuffer=0x659748*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659748*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0065.165] CloseHandle (hObject=0x230) returned 1 [0065.166] GetProcessHeap () returned 0x630000 [0065.166] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0065.166] GetProcessHeap () returned 0x630000 [0065.166] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6556e8 | out: hHeap=0x630000) returned 1 [0065.166] GetProcessHeap () returned 0x630000 [0065.166] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0065.166] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\9r_fAQ1WVKLjF1W9.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\9r_fAQ1WVKLjF1W9.pptx") returned="C:\\Users\\FD1HVy\\Documents\\9r_fAQ1WVKLjF1W9.pptx" [0065.166] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\9r_fAQ1WVKLjF1W9.pptx", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\9r_fAQ1WVKLjF1W9.pptx.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\9r_fAQ1WVKLjF1W9.pptx.happythreechoose" [0065.166] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\9r_fAQ1WVKLjF1W9.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\9r_faq1wvkljf1w9.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\9r_fAQ1WVKLjF1W9.pptx.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\9r_faq1wvkljf1w9.pptx.happythreechoose"), dwFlags=0x1) returned 1 [0065.167] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\9r_fAQ1WVKLjF1W9.pptx" | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0065.167] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned="" [0065.167] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" [0065.167] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\decryption info.html")) returned 0x20 [0065.167] GetProcessHeap () returned 0x630000 [0065.167] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645e58 | out: hHeap=0x630000) returned 1 [0065.167] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x631e09c0, ftCreationTime.dwHighDateTime=0x1d5c7a2, ftLastAccessTime.dwLowDateTime=0xb5bc3d20, ftLastAccessTime.dwHighDateTime=0x1d571a6, ftLastWriteTime.dwLowDateTime=0xb5bc3d20, ftLastWriteTime.dwHighDateTime=0x1d571a6, nFileSizeHigh=0x0, nFileSizeLow=0x3100, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="acXsVTlLUIG5P9MKIq.docx", cAlternateFileName="ACXSVT~1.DOC")) returned 1 [0065.167] lstrcmpiW (lpString1="acXsVTlLUIG5P9MKIq.docx", lpString2=".") returned 1 [0065.167] lstrcmpiW (lpString1="acXsVTlLUIG5P9MKIq.docx", lpString2="..") returned 1 [0065.167] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="acXsVTlLUIG5P9MKIq.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\acXsVTlLUIG5P9MKIq.docx") returned="C:\\Users\\FD1HVy\\Documents\\acXsVTlLUIG5P9MKIq.docx" [0065.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acXsVTlLUIG5P9MKIq.docx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0065.167] GetProcessHeap () returned 0x630000 [0065.167] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18) returned 0x645eb8 [0065.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="acXsVTlLUIG5P9MKIq.docx", cchWideChar=-1, lpMultiByteStr=0x645eb8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="acXsVTlLUIG5P9MKIq.docx", lpUsedDefaultChar=0x0) returned 24 [0065.167] lstrlenA (lpString="acXsVTlLUIG5P9MKIq.docx") returned 23 [0065.168] lstrlenA (lpString=".happythreechoose") returned 17 [0065.168] lstrlenA (lpString=".happythreechoose") returned 17 [0065.168] lstrlenA (lpString="acXsVTlLUIG5P9MKIq.docx") returned 23 [0065.168] lstrcmpiA (lpString1="lLUIG5P9MKIq.docx", lpString2=".happythreechoose") returned 1 [0065.168] lstrcmpiW (lpString1="acXsVTlLUIG5P9MKIq.docx", lpString2="Decryption INFO.html") returned -1 [0065.168] lstrcmpiW (lpString1="acXsVTlLUIG5P9MKIq.docx", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0065.168] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0065.168] lstrcmpiW (lpString1="acXsVTlLUIG5P9MKIq.docx", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0065.168] GetProcessHeap () returned 0x630000 [0065.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0065.168] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\acXsVTlLUIG5P9MKIq.docx" (normalized: "c:\\users\\fd1hvy\\documents\\acxsvtlluig5p9mkiq.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0065.168] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=12544) returned 1 [0065.168] GetProcessHeap () returned 0x630000 [0065.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655490 [0065.168] GetProcessHeap () returned 0x630000 [0065.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0065.168] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\acXsVTlLUIG5P9MKIq.docx") returned 49 [0065.168] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0065.168] GetProcessHeap () returned 0x630000 [0065.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0065.168] GetProcessHeap () returned 0x630000 [0065.168] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x659780 [0065.168] lstrlenA (lpString="rsa_encrypt") returned 11 [0065.168] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0065.169] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0065.169] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0065.169] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0065.169] GetProcessHeap () returned 0x630000 [0065.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0065.169] lstrlenA (lpString="010001") returned 6 [0065.169] GetProcessHeap () returned 0x630000 [0065.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0065.169] GetProcessHeap () returned 0x630000 [0065.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0065.169] GetProcessHeap () returned 0x630000 [0065.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ebb0 [0065.169] GetProcessHeap () returned 0x630000 [0065.169] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0065.169] GetProcessHeap () returned 0x630000 [0065.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e580 [0065.169] GetProcessHeap () returned 0x630000 [0065.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657210 [0065.169] GetProcessHeap () returned 0x630000 [0065.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0065.169] GetProcessHeap () returned 0x630000 [0065.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0065.169] GetProcessHeap () returned 0x630000 [0065.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.170] GetProcessHeap () returned 0x630000 [0065.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0065.170] GetProcessHeap () returned 0x630000 [0065.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0065.170] GetProcessHeap () returned 0x630000 [0065.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656950 [0065.170] GetProcessHeap () returned 0x630000 [0065.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.170] GetProcessHeap () returned 0x630000 [0065.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0065.170] GetProcessHeap () returned 0x630000 [0065.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e970 [0065.170] GetProcessHeap () returned 0x630000 [0065.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0065.170] GetProcessHeap () returned 0x630000 [0065.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0065.170] GetProcessHeap () returned 0x630000 [0065.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0065.170] GetProcessHeap () returned 0x630000 [0065.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.170] GetProcessHeap () returned 0x630000 [0065.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0065.170] GetProcessHeap () returned 0x630000 [0065.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.170] GetProcessHeap () returned 0x630000 [0065.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.170] GetProcessHeap () returned 0x630000 [0065.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.170] GetProcessHeap () returned 0x630000 [0065.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.170] GetProcessHeap () returned 0x630000 [0065.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65dfe0 [0065.170] GetProcessHeap () returned 0x630000 [0065.170] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0065.171] GetProcessHeap () returned 0x630000 [0065.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0065.171] GetProcessHeap () returned 0x630000 [0065.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0065.171] GetProcessHeap () returned 0x630000 [0065.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.171] GetProcessHeap () returned 0x630000 [0065.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.171] GetProcessHeap () returned 0x630000 [0065.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.171] GetProcessHeap () returned 0x630000 [0065.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.171] GetProcessHeap () returned 0x630000 [0065.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.171] GetProcessHeap () returned 0x630000 [0065.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.171] GetProcessHeap () returned 0x630000 [0065.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.171] GetProcessHeap () returned 0x630000 [0065.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.171] GetProcessHeap () returned 0x630000 [0065.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.171] GetProcessHeap () returned 0x630000 [0065.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.171] GetProcessHeap () returned 0x630000 [0065.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.171] GetProcessHeap () returned 0x630000 [0065.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.171] GetProcessHeap () returned 0x630000 [0065.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.171] GetProcessHeap () returned 0x630000 [0065.171] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.172] GetProcessHeap () returned 0x630000 [0065.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.172] GetProcessHeap () returned 0x630000 [0065.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.172] GetProcessHeap () returned 0x630000 [0065.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.172] GetProcessHeap () returned 0x630000 [0065.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.172] GetProcessHeap () returned 0x630000 [0065.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.172] GetProcessHeap () returned 0x630000 [0065.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.172] GetProcessHeap () returned 0x630000 [0065.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.172] GetProcessHeap () returned 0x630000 [0065.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.172] GetProcessHeap () returned 0x630000 [0065.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.172] GetProcessHeap () returned 0x630000 [0065.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.172] GetProcessHeap () returned 0x630000 [0065.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.172] GetProcessHeap () returned 0x630000 [0065.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.172] GetProcessHeap () returned 0x630000 [0065.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.172] GetProcessHeap () returned 0x630000 [0065.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.172] GetProcessHeap () returned 0x630000 [0065.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.172] GetProcessHeap () returned 0x630000 [0065.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.172] GetProcessHeap () returned 0x630000 [0065.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.172] GetProcessHeap () returned 0x630000 [0065.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.172] GetProcessHeap () returned 0x630000 [0065.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.173] GetProcessHeap () returned 0x630000 [0065.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.173] GetProcessHeap () returned 0x630000 [0065.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.173] GetProcessHeap () returned 0x630000 [0065.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.173] GetProcessHeap () returned 0x630000 [0065.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.173] GetProcessHeap () returned 0x630000 [0065.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.173] GetProcessHeap () returned 0x630000 [0065.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.173] GetProcessHeap () returned 0x630000 [0065.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.173] GetProcessHeap () returned 0x630000 [0065.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.173] GetProcessHeap () returned 0x630000 [0065.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.173] GetProcessHeap () returned 0x630000 [0065.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.173] GetProcessHeap () returned 0x630000 [0065.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.173] GetProcessHeap () returned 0x630000 [0065.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.173] GetProcessHeap () returned 0x630000 [0065.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.173] GetProcessHeap () returned 0x630000 [0065.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.173] GetProcessHeap () returned 0x630000 [0065.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.173] GetProcessHeap () returned 0x630000 [0065.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.173] GetProcessHeap () returned 0x630000 [0065.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.173] GetProcessHeap () returned 0x630000 [0065.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.174] GetProcessHeap () returned 0x630000 [0065.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.174] GetProcessHeap () returned 0x630000 [0065.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.174] GetProcessHeap () returned 0x630000 [0065.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.174] GetProcessHeap () returned 0x630000 [0065.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.174] GetProcessHeap () returned 0x630000 [0065.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.174] GetProcessHeap () returned 0x630000 [0065.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.174] GetProcessHeap () returned 0x630000 [0065.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.174] GetProcessHeap () returned 0x630000 [0065.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0065.174] GetProcessHeap () returned 0x630000 [0065.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0065.174] GetProcessHeap () returned 0x630000 [0065.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.174] GetProcessHeap () returned 0x630000 [0065.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.174] GetProcessHeap () returned 0x630000 [0065.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.174] GetProcessHeap () returned 0x630000 [0065.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.174] GetProcessHeap () returned 0x630000 [0065.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.174] GetProcessHeap () returned 0x630000 [0065.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.174] GetProcessHeap () returned 0x630000 [0065.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.174] GetProcessHeap () returned 0x630000 [0065.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.174] GetProcessHeap () returned 0x630000 [0065.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.175] GetProcessHeap () returned 0x630000 [0065.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.175] GetProcessHeap () returned 0x630000 [0065.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.175] GetProcessHeap () returned 0x630000 [0065.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.175] GetProcessHeap () returned 0x630000 [0065.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.175] GetProcessHeap () returned 0x630000 [0065.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.175] GetProcessHeap () returned 0x630000 [0065.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.175] GetProcessHeap () returned 0x630000 [0065.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.175] GetProcessHeap () returned 0x630000 [0065.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.175] GetProcessHeap () returned 0x630000 [0065.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.175] GetProcessHeap () returned 0x630000 [0065.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.175] GetProcessHeap () returned 0x630000 [0065.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.175] GetProcessHeap () returned 0x630000 [0065.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.175] GetProcessHeap () returned 0x630000 [0065.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.175] GetProcessHeap () returned 0x630000 [0065.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0065.175] GetProcessHeap () returned 0x630000 [0065.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0065.175] GetProcessHeap () returned 0x630000 [0065.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0065.175] GetProcessHeap () returned 0x630000 [0065.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0065.175] GetProcessHeap () returned 0x630000 [0065.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0065.176] GetProcessHeap () returned 0x630000 [0065.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0065.176] GetProcessHeap () returned 0x630000 [0065.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0065.176] GetProcessHeap () returned 0x630000 [0065.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0065.176] GetProcessHeap () returned 0x630000 [0065.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0065.176] GetProcessHeap () returned 0x630000 [0065.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.176] GetProcessHeap () returned 0x630000 [0065.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0065.176] WriteFile (in: hFile=0x230, lpBuffer=0x659780*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659780*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0065.177] GetProcessHeap () returned 0x630000 [0065.177] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659780, Size=0x30) returned 0x659780 [0065.177] GetProcessHeap () returned 0x630000 [0065.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0065.178] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0065.178] GetProcessHeap () returned 0x630000 [0065.178] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3100) returned 0x671bf0 [0065.178] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0x3100, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0x3100, lpOverlapped=0x0) returned 1 [0065.178] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0065.178] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x3100, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0x3100, lpOverlapped=0x0) returned 1 [0065.179] GetProcessHeap () returned 0x630000 [0065.179] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0065.180] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0065.180] WriteFile (in: hFile=0x230, lpBuffer=0x659780*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659780*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0065.181] CloseHandle (hObject=0x230) returned 1 [0065.182] GetProcessHeap () returned 0x630000 [0065.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0065.182] GetProcessHeap () returned 0x630000 [0065.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655490 | out: hHeap=0x630000) returned 1 [0065.182] GetProcessHeap () returned 0x630000 [0065.182] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0065.182] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\acXsVTlLUIG5P9MKIq.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\acXsVTlLUIG5P9MKIq.docx") returned="C:\\Users\\FD1HVy\\Documents\\acXsVTlLUIG5P9MKIq.docx" [0065.182] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\acXsVTlLUIG5P9MKIq.docx", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\acXsVTlLUIG5P9MKIq.docx.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\acXsVTlLUIG5P9MKIq.docx.happythreechoose" [0065.182] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\acXsVTlLUIG5P9MKIq.docx" (normalized: "c:\\users\\fd1hvy\\documents\\acxsvtlluig5p9mkiq.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\acXsVTlLUIG5P9MKIq.docx.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\acxsvtlluig5p9mkiq.docx.happythreechoose"), dwFlags=0x1) returned 1 [0065.183] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\acXsVTlLUIG5P9MKIq.docx" | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0065.183] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned="" [0065.183] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" [0065.183] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\decryption info.html")) returned 0x20 [0065.183] GetProcessHeap () returned 0x630000 [0065.183] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645eb8 | out: hHeap=0x630000) returned 1 [0065.183] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb3916c0, ftCreationTime.dwHighDateTime=0x1d5c31e, ftLastAccessTime.dwLowDateTime=0xdf0c6e60, ftLastAccessTime.dwHighDateTime=0x1d5bef0, ftLastWriteTime.dwLowDateTime=0xdf0c6e60, ftLastWriteTime.dwHighDateTime=0x1d5bef0, nFileSizeHigh=0x0, nFileSizeLow=0xa9d2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="aSSmp6ukvCuFl.pptx", cAlternateFileName="ASSMP6~1.PPT")) returned 1 [0065.183] lstrcmpiW (lpString1="aSSmp6ukvCuFl.pptx", lpString2=".") returned 1 [0065.183] lstrcmpiW (lpString1="aSSmp6ukvCuFl.pptx", lpString2="..") returned 1 [0065.183] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="aSSmp6ukvCuFl.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\aSSmp6ukvCuFl.pptx") returned="C:\\Users\\FD1HVy\\Documents\\aSSmp6ukvCuFl.pptx" [0065.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aSSmp6ukvCuFl.pptx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0065.183] GetProcessHeap () returned 0x630000 [0065.183] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x13) returned 0x645e58 [0065.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aSSmp6ukvCuFl.pptx", cchWideChar=-1, lpMultiByteStr=0x645e58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aSSmp6ukvCuFl.pptx", lpUsedDefaultChar=0x0) returned 19 [0065.183] lstrlenA (lpString="aSSmp6ukvCuFl.pptx") returned 18 [0065.183] lstrlenA (lpString=".happythreechoose") returned 17 [0065.183] lstrlenA (lpString=".happythreechoose") returned 17 [0065.183] lstrlenA (lpString="aSSmp6ukvCuFl.pptx") returned 18 [0065.183] lstrcmpiA (lpString1="SSmp6ukvCuFl.pptx", lpString2=".happythreechoose") returned 1 [0065.183] lstrcmpiW (lpString1="aSSmp6ukvCuFl.pptx", lpString2="Decryption INFO.html") returned -1 [0065.183] lstrcmpiW (lpString1="aSSmp6ukvCuFl.pptx", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0065.183] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0065.183] lstrcmpiW (lpString1="aSSmp6ukvCuFl.pptx", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0065.183] GetProcessHeap () returned 0x630000 [0065.183] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f10 [0065.183] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\aSSmp6ukvCuFl.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\assmp6ukvcufl.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0065.183] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=43474) returned 1 [0065.184] GetProcessHeap () returned 0x630000 [0065.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655580 [0065.184] GetProcessHeap () returned 0x630000 [0065.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0065.184] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\aSSmp6ukvCuFl.pptx") returned 44 [0065.184] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0065.184] GetProcessHeap () returned 0x630000 [0065.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0065.184] GetProcessHeap () returned 0x630000 [0065.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x6597b8 [0065.184] lstrlenA (lpString="rsa_encrypt") returned 11 [0065.184] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0065.184] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0065.184] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0065.184] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0065.184] GetProcessHeap () returned 0x630000 [0065.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0065.185] lstrlenA (lpString="010001") returned 6 [0065.185] GetProcessHeap () returned 0x630000 [0065.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0065.185] GetProcessHeap () returned 0x630000 [0065.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0065.185] GetProcessHeap () returned 0x630000 [0065.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0065.185] GetProcessHeap () returned 0x630000 [0065.185] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0065.185] GetProcessHeap () returned 0x630000 [0065.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0065.185] GetProcessHeap () returned 0x630000 [0065.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656ec8 [0065.185] GetProcessHeap () returned 0x630000 [0065.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0065.185] GetProcessHeap () returned 0x630000 [0065.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0065.185] GetProcessHeap () returned 0x630000 [0065.185] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.185] GetProcessHeap () returned 0x630000 [0065.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0065.185] GetProcessHeap () returned 0x630000 [0065.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0065.185] GetProcessHeap () returned 0x630000 [0065.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656fe0 [0065.185] GetProcessHeap () returned 0x630000 [0065.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.185] GetProcessHeap () returned 0x630000 [0065.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0065.185] GetProcessHeap () returned 0x630000 [0065.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e3d0 [0065.185] GetProcessHeap () returned 0x630000 [0065.185] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0065.185] GetProcessHeap () returned 0x630000 [0065.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0065.185] GetProcessHeap () returned 0x630000 [0065.185] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0065.186] GetProcessHeap () returned 0x630000 [0065.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.186] GetProcessHeap () returned 0x630000 [0065.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0065.186] GetProcessHeap () returned 0x630000 [0065.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.186] GetProcessHeap () returned 0x630000 [0065.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.186] GetProcessHeap () returned 0x630000 [0065.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.186] GetProcessHeap () returned 0x630000 [0065.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.186] GetProcessHeap () returned 0x630000 [0065.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e100 [0065.186] GetProcessHeap () returned 0x630000 [0065.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0065.186] GetProcessHeap () returned 0x630000 [0065.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0065.186] GetProcessHeap () returned 0x630000 [0065.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0065.186] GetProcessHeap () returned 0x630000 [0065.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.186] GetProcessHeap () returned 0x630000 [0065.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.186] GetProcessHeap () returned 0x630000 [0065.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.186] GetProcessHeap () returned 0x630000 [0065.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.187] GetProcessHeap () returned 0x630000 [0065.187] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.187] GetProcessHeap () returned 0x630000 [0065.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.187] GetProcessHeap () returned 0x630000 [0065.187] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.187] GetProcessHeap () returned 0x630000 [0065.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.187] GetProcessHeap () returned 0x630000 [0065.187] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.187] GetProcessHeap () returned 0x630000 [0065.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.187] GetProcessHeap () returned 0x630000 [0065.187] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.187] GetProcessHeap () returned 0x630000 [0065.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.187] GetProcessHeap () returned 0x630000 [0065.187] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.187] GetProcessHeap () returned 0x630000 [0065.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.187] GetProcessHeap () returned 0x630000 [0065.187] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.187] GetProcessHeap () returned 0x630000 [0065.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.187] GetProcessHeap () returned 0x630000 [0065.187] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.187] GetProcessHeap () returned 0x630000 [0065.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.187] GetProcessHeap () returned 0x630000 [0065.187] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.187] GetProcessHeap () returned 0x630000 [0065.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.187] GetProcessHeap () returned 0x630000 [0065.187] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.187] GetProcessHeap () returned 0x630000 [0065.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.187] GetProcessHeap () returned 0x630000 [0065.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.188] GetProcessHeap () returned 0x630000 [0065.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.188] GetProcessHeap () returned 0x630000 [0065.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.188] GetProcessHeap () returned 0x630000 [0065.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.188] GetProcessHeap () returned 0x630000 [0065.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.188] GetProcessHeap () returned 0x630000 [0065.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.188] GetProcessHeap () returned 0x630000 [0065.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.188] GetProcessHeap () returned 0x630000 [0065.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.188] GetProcessHeap () returned 0x630000 [0065.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.188] GetProcessHeap () returned 0x630000 [0065.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.188] GetProcessHeap () returned 0x630000 [0065.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.188] GetProcessHeap () returned 0x630000 [0065.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.188] GetProcessHeap () returned 0x630000 [0065.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.188] GetProcessHeap () returned 0x630000 [0065.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.188] GetProcessHeap () returned 0x630000 [0065.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.188] GetProcessHeap () returned 0x630000 [0065.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.188] GetProcessHeap () returned 0x630000 [0065.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.188] GetProcessHeap () returned 0x630000 [0065.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.188] GetProcessHeap () returned 0x630000 [0065.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.189] GetProcessHeap () returned 0x630000 [0065.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.189] GetProcessHeap () returned 0x630000 [0065.189] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.189] GetProcessHeap () returned 0x630000 [0065.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.189] GetProcessHeap () returned 0x630000 [0065.189] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.189] GetProcessHeap () returned 0x630000 [0065.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.189] GetProcessHeap () returned 0x630000 [0065.189] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.189] GetProcessHeap () returned 0x630000 [0065.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.189] GetProcessHeap () returned 0x630000 [0065.189] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.189] GetProcessHeap () returned 0x630000 [0065.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.189] GetProcessHeap () returned 0x630000 [0065.189] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.189] GetProcessHeap () returned 0x630000 [0065.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.189] GetProcessHeap () returned 0x630000 [0065.189] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.189] GetProcessHeap () returned 0x630000 [0065.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.189] GetProcessHeap () returned 0x630000 [0065.189] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.189] GetProcessHeap () returned 0x630000 [0065.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.189] GetProcessHeap () returned 0x630000 [0065.189] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.189] GetProcessHeap () returned 0x630000 [0065.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.189] GetProcessHeap () returned 0x630000 [0065.189] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.189] GetProcessHeap () returned 0x630000 [0065.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.190] GetProcessHeap () returned 0x630000 [0065.190] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.190] GetProcessHeap () returned 0x630000 [0065.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.190] GetProcessHeap () returned 0x630000 [0065.190] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.190] GetProcessHeap () returned 0x630000 [0065.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.190] GetProcessHeap () returned 0x630000 [0065.190] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.190] GetProcessHeap () returned 0x630000 [0065.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.190] GetProcessHeap () returned 0x630000 [0065.190] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.190] GetProcessHeap () returned 0x630000 [0065.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.190] GetProcessHeap () returned 0x630000 [0065.190] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.190] GetProcessHeap () returned 0x630000 [0065.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.190] GetProcessHeap () returned 0x630000 [0065.190] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.190] GetProcessHeap () returned 0x630000 [0065.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.190] GetProcessHeap () returned 0x630000 [0065.190] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.190] GetProcessHeap () returned 0x630000 [0065.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.190] GetProcessHeap () returned 0x630000 [0065.190] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.190] GetProcessHeap () returned 0x630000 [0065.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.190] GetProcessHeap () returned 0x630000 [0065.190] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.190] GetProcessHeap () returned 0x630000 [0065.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.191] GetProcessHeap () returned 0x630000 [0065.191] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.191] GetProcessHeap () returned 0x630000 [0065.191] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.191] GetProcessHeap () returned 0x630000 [0065.191] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.191] GetProcessHeap () returned 0x630000 [0065.191] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.191] GetProcessHeap () returned 0x630000 [0065.191] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0065.191] GetProcessHeap () returned 0x630000 [0065.191] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0065.191] GetProcessHeap () returned 0x630000 [0065.191] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0065.191] GetProcessHeap () returned 0x630000 [0065.191] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0065.191] GetProcessHeap () returned 0x630000 [0065.191] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0065.191] GetProcessHeap () returned 0x630000 [0065.191] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0065.191] GetProcessHeap () returned 0x630000 [0065.191] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0065.191] GetProcessHeap () returned 0x630000 [0065.191] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0065.191] GetProcessHeap () returned 0x630000 [0065.191] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0065.191] GetProcessHeap () returned 0x630000 [0065.191] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0065.191] GetProcessHeap () returned 0x630000 [0065.191] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0065.191] WriteFile (in: hFile=0x230, lpBuffer=0x6597b8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6597b8*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0065.193] GetProcessHeap () returned 0x630000 [0065.193] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6597b8, Size=0x30) returned 0x6597b8 [0065.193] GetProcessHeap () returned 0x630000 [0065.193] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0065.193] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0065.193] GetProcessHeap () returned 0x630000 [0065.193] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa9d2) returned 0x671bf0 [0065.205] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0xa9d2, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0xa9d2, lpOverlapped=0x0) returned 1 [0065.206] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0065.206] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0xa9d2, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0xa9d2, lpOverlapped=0x0) returned 1 [0065.207] GetProcessHeap () returned 0x630000 [0065.207] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0065.208] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0065.208] WriteFile (in: hFile=0x230, lpBuffer=0x6597b8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6597b8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0065.222] CloseHandle (hObject=0x230) returned 1 [0065.223] GetProcessHeap () returned 0x630000 [0065.223] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f10 | out: hHeap=0x630000) returned 1 [0065.223] GetProcessHeap () returned 0x630000 [0065.223] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655580 | out: hHeap=0x630000) returned 1 [0065.223] GetProcessHeap () returned 0x630000 [0065.223] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0065.223] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\aSSmp6ukvCuFl.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\aSSmp6ukvCuFl.pptx") returned="C:\\Users\\FD1HVy\\Documents\\aSSmp6ukvCuFl.pptx" [0065.223] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\aSSmp6ukvCuFl.pptx", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\aSSmp6ukvCuFl.pptx.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\aSSmp6ukvCuFl.pptx.happythreechoose" [0065.223] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\aSSmp6ukvCuFl.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\assmp6ukvcufl.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\aSSmp6ukvCuFl.pptx.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\assmp6ukvcufl.pptx.happythreechoose"), dwFlags=0x1) returned 1 [0065.224] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\aSSmp6ukvCuFl.pptx" | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0065.224] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned="" [0065.226] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" [0065.227] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\decryption info.html")) returned 0x20 [0065.227] GetProcessHeap () returned 0x630000 [0065.227] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645e58 | out: hHeap=0x630000) returned 1 [0065.227] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3340555c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3396299d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x9daec75b, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x55000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Database1.accdb", cAlternateFileName="DATABA~1.ACC")) returned 1 [0065.227] lstrcmpiW (lpString1="Database1.accdb", lpString2=".") returned 1 [0065.227] lstrcmpiW (lpString1="Database1.accdb", lpString2="..") returned 1 [0065.227] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="Database1.accdb" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Database1.accdb") returned="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" [0065.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Database1.accdb", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0065.227] GetProcessHeap () returned 0x630000 [0065.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x64c9f0 [0065.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Database1.accdb", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Database1.accdb", lpUsedDefaultChar=0x0) returned 16 [0065.228] lstrlenA (lpString="Database1.accdb") returned 15 [0065.228] lstrlenA (lpString=".happythreechoose") returned 17 [0065.228] lstrcmpiW (lpString1="Database1.accdb", lpString2="Decryption INFO.html") returned -1 [0065.228] lstrcmpiW (lpString1="Database1.accdb", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0065.228] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0065.228] lstrcmpiW (lpString1="Database1.accdb", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0065.228] GetProcessHeap () returned 0x630000 [0065.228] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0065.228] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0065.228] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=348160) returned 1 [0065.228] GetProcessHeap () returned 0x630000 [0065.228] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655aa8 [0065.228] GetProcessHeap () returned 0x630000 [0065.228] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0065.228] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\Database1.accdb") returned 41 [0065.228] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0065.228] GetProcessHeap () returned 0x630000 [0065.228] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0065.228] GetProcessHeap () returned 0x630000 [0065.228] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x6597f0 [0065.228] lstrlenA (lpString="rsa_encrypt") returned 11 [0065.229] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0065.230] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0065.230] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0065.230] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0065.230] GetProcessHeap () returned 0x630000 [0065.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0065.230] lstrlenA (lpString="010001") returned 6 [0065.230] GetProcessHeap () returned 0x630000 [0065.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0065.230] GetProcessHeap () returned 0x630000 [0065.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0065.230] GetProcessHeap () returned 0x630000 [0065.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e340 [0065.230] GetProcessHeap () returned 0x630000 [0065.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0065.230] GetProcessHeap () returned 0x630000 [0065.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea00 [0065.230] GetProcessHeap () returned 0x630000 [0065.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x6570f8 [0065.230] GetProcessHeap () returned 0x630000 [0065.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a298 [0065.230] GetProcessHeap () returned 0x630000 [0065.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0065.230] GetProcessHeap () returned 0x630000 [0065.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.230] GetProcessHeap () returned 0x630000 [0065.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0065.230] GetProcessHeap () returned 0x630000 [0065.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0065.230] GetProcessHeap () returned 0x630000 [0065.230] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657440 [0065.230] GetProcessHeap () returned 0x630000 [0065.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.231] GetProcessHeap () returned 0x630000 [0065.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0065.231] GetProcessHeap () returned 0x630000 [0065.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e3d0 [0065.231] GetProcessHeap () returned 0x630000 [0065.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0065.231] GetProcessHeap () returned 0x630000 [0065.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0065.231] GetProcessHeap () returned 0x630000 [0065.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0065.231] GetProcessHeap () returned 0x630000 [0065.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.231] GetProcessHeap () returned 0x630000 [0065.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cd30 [0065.231] GetProcessHeap () returned 0x630000 [0065.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.231] GetProcessHeap () returned 0x630000 [0065.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.231] GetProcessHeap () returned 0x630000 [0065.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.231] GetProcessHeap () returned 0x630000 [0065.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.231] GetProcessHeap () returned 0x630000 [0065.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e970 [0065.231] GetProcessHeap () returned 0x630000 [0065.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cd30 | out: hHeap=0x630000) returned 1 [0065.231] GetProcessHeap () returned 0x630000 [0065.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0065.231] GetProcessHeap () returned 0x630000 [0065.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0065.231] GetProcessHeap () returned 0x630000 [0065.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.231] GetProcessHeap () returned 0x630000 [0065.231] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.231] GetProcessHeap () returned 0x630000 [0065.231] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.231] GetProcessHeap () returned 0x630000 [0065.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.232] GetProcessHeap () returned 0x630000 [0065.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.232] GetProcessHeap () returned 0x630000 [0065.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.232] GetProcessHeap () returned 0x630000 [0065.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.232] GetProcessHeap () returned 0x630000 [0065.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.232] GetProcessHeap () returned 0x630000 [0065.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.232] GetProcessHeap () returned 0x630000 [0065.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.232] GetProcessHeap () returned 0x630000 [0065.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.232] GetProcessHeap () returned 0x630000 [0065.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.232] GetProcessHeap () returned 0x630000 [0065.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.232] GetProcessHeap () returned 0x630000 [0065.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.232] GetProcessHeap () returned 0x630000 [0065.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.232] GetProcessHeap () returned 0x630000 [0065.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.232] GetProcessHeap () returned 0x630000 [0065.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.232] GetProcessHeap () returned 0x630000 [0065.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.232] GetProcessHeap () returned 0x630000 [0065.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.232] GetProcessHeap () returned 0x630000 [0065.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.232] GetProcessHeap () returned 0x630000 [0065.232] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.232] GetProcessHeap () returned 0x630000 [0065.232] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.233] GetProcessHeap () returned 0x630000 [0065.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.233] GetProcessHeap () returned 0x630000 [0065.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.233] GetProcessHeap () returned 0x630000 [0065.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.233] GetProcessHeap () returned 0x630000 [0065.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.233] GetProcessHeap () returned 0x630000 [0065.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.233] GetProcessHeap () returned 0x630000 [0065.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.233] GetProcessHeap () returned 0x630000 [0065.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.233] GetProcessHeap () returned 0x630000 [0065.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.233] GetProcessHeap () returned 0x630000 [0065.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.233] GetProcessHeap () returned 0x630000 [0065.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.233] GetProcessHeap () returned 0x630000 [0065.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.233] GetProcessHeap () returned 0x630000 [0065.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.233] GetProcessHeap () returned 0x630000 [0065.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.233] GetProcessHeap () returned 0x630000 [0065.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.233] GetProcessHeap () returned 0x630000 [0065.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.233] GetProcessHeap () returned 0x630000 [0065.233] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.233] GetProcessHeap () returned 0x630000 [0065.233] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.234] GetProcessHeap () returned 0x630000 [0065.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.234] GetProcessHeap () returned 0x630000 [0065.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.234] GetProcessHeap () returned 0x630000 [0065.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.234] GetProcessHeap () returned 0x630000 [0065.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.234] GetProcessHeap () returned 0x630000 [0065.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.234] GetProcessHeap () returned 0x630000 [0065.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.234] GetProcessHeap () returned 0x630000 [0065.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.234] GetProcessHeap () returned 0x630000 [0065.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.234] GetProcessHeap () returned 0x630000 [0065.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.234] GetProcessHeap () returned 0x630000 [0065.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0065.234] GetProcessHeap () returned 0x630000 [0065.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0065.234] GetProcessHeap () returned 0x630000 [0065.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.234] GetProcessHeap () returned 0x630000 [0065.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.234] GetProcessHeap () returned 0x630000 [0065.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.234] GetProcessHeap () returned 0x630000 [0065.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.234] GetProcessHeap () returned 0x630000 [0065.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.234] GetProcessHeap () returned 0x630000 [0065.234] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.234] GetProcessHeap () returned 0x630000 [0065.234] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.234] GetProcessHeap () returned 0x630000 [0065.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.235] GetProcessHeap () returned 0x630000 [0065.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.235] GetProcessHeap () returned 0x630000 [0065.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.235] GetProcessHeap () returned 0x630000 [0065.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0065.235] GetProcessHeap () returned 0x630000 [0065.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0065.235] GetProcessHeap () returned 0x630000 [0065.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.235] GetProcessHeap () returned 0x630000 [0065.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.235] GetProcessHeap () returned 0x630000 [0065.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.235] GetProcessHeap () returned 0x630000 [0065.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.235] GetProcessHeap () returned 0x630000 [0065.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.235] GetProcessHeap () returned 0x630000 [0065.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.235] GetProcessHeap () returned 0x630000 [0065.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.235] GetProcessHeap () returned 0x630000 [0065.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.235] GetProcessHeap () returned 0x630000 [0065.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0065.235] GetProcessHeap () returned 0x630000 [0065.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0065.235] GetProcessHeap () returned 0x630000 [0065.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.235] GetProcessHeap () returned 0x630000 [0065.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.235] GetProcessHeap () returned 0x630000 [0065.235] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.235] GetProcessHeap () returned 0x630000 [0065.235] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.235] GetProcessHeap () returned 0x630000 [0065.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.236] GetProcessHeap () returned 0x630000 [0065.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.236] GetProcessHeap () returned 0x630000 [0065.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.236] GetProcessHeap () returned 0x630000 [0065.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.236] GetProcessHeap () returned 0x630000 [0065.236] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.236] GetProcessHeap () returned 0x630000 [0065.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.236] GetProcessHeap () returned 0x630000 [0065.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0065.236] GetProcessHeap () returned 0x630000 [0065.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0065.236] GetProcessHeap () returned 0x630000 [0065.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0065.236] GetProcessHeap () returned 0x630000 [0065.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0065.236] GetProcessHeap () returned 0x630000 [0065.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0065.236] GetProcessHeap () returned 0x630000 [0065.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0065.236] GetProcessHeap () returned 0x630000 [0065.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0065.236] GetProcessHeap () returned 0x630000 [0065.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0065.236] GetProcessHeap () returned 0x630000 [0065.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0065.236] GetProcessHeap () returned 0x630000 [0065.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.236] GetProcessHeap () returned 0x630000 [0065.236] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0065.236] WriteFile (in: hFile=0x230, lpBuffer=0x6597f0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6597f0*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0065.257] GetProcessHeap () returned 0x630000 [0065.257] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6597f0, Size=0x30) returned 0x6597f0 [0065.257] GetProcessHeap () returned 0x630000 [0065.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0065.257] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0065.257] GetProcessHeap () returned 0x630000 [0065.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x55000) returned 0x671bf0 [0065.264] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0x55000, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0x55000, lpOverlapped=0x0) returned 1 [0065.320] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0065.320] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x55000, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0x55000, lpOverlapped=0x0) returned 1 [0065.352] GetProcessHeap () returned 0x630000 [0065.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0065.353] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0065.353] WriteFile (in: hFile=0x230, lpBuffer=0x6597f0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6597f0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0065.358] CloseHandle (hObject=0x230) returned 1 [0065.358] GetProcessHeap () returned 0x630000 [0065.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0065.358] GetProcessHeap () returned 0x630000 [0065.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655aa8 | out: hHeap=0x630000) returned 1 [0065.358] GetProcessHeap () returned 0x630000 [0065.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0065.359] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Database1.accdb") returned="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" [0065.359] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Database1.accdb.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\Database1.accdb.happythreechoose" [0065.359] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb.happythreechoose"), dwFlags=0x1) returned 1 [0065.365] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0065.365] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned="" [0065.365] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" [0065.365] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\decryption info.html")) returned 0x20 [0065.366] GetProcessHeap () returned 0x630000 [0065.366] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0065.366] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440c5760, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440c5760, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0065.366] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0065.366] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0065.366] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\desktop.ini") returned="C:\\Users\\FD1HVy\\Documents\\desktop.ini" [0065.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0065.366] GetProcessHeap () returned 0x630000 [0065.366] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0065.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0065.366] lstrlenA (lpString="desktop.ini") returned 11 [0065.366] lstrlenA (lpString=".happythreechoose") returned 17 [0065.366] lstrcmpiW (lpString1="desktop.ini", lpString2="Decryption INFO.html") returned 1 [0065.366] lstrcmpiW (lpString1="desktop.ini", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0065.366] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0065.366] lstrcmpiW (lpString1="desktop.ini", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0065.366] GetProcessHeap () returned 0x630000 [0065.366] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0065.366] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0065.366] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=402) returned 1 [0065.366] GetProcessHeap () returned 0x630000 [0065.366] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655418 [0065.366] GetProcessHeap () returned 0x630000 [0065.366] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0065.366] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\desktop.ini") returned 37 [0065.367] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0065.367] GetProcessHeap () returned 0x630000 [0065.367] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0065.367] GetProcessHeap () returned 0x630000 [0065.367] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38e) returned 0x659828 [0065.367] lstrlenA (lpString="rsa_encrypt") returned 11 [0065.367] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0065.367] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0065.367] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0065.367] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0065.367] GetProcessHeap () returned 0x630000 [0065.367] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0065.367] lstrlenA (lpString="010001") returned 6 [0065.367] GetProcessHeap () returned 0x630000 [0065.367] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0065.368] GetProcessHeap () returned 0x630000 [0065.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0065.368] GetProcessHeap () returned 0x630000 [0065.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e8e0 [0065.368] GetProcessHeap () returned 0x630000 [0065.368] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0065.368] GetProcessHeap () returned 0x630000 [0065.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e970 [0065.368] GetProcessHeap () returned 0x630000 [0065.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657788 [0065.368] GetProcessHeap () returned 0x630000 [0065.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a298 [0065.368] GetProcessHeap () returned 0x630000 [0065.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0065.368] GetProcessHeap () returned 0x630000 [0065.368] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.368] GetProcessHeap () returned 0x630000 [0065.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0065.368] GetProcessHeap () returned 0x630000 [0065.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0065.368] GetProcessHeap () returned 0x630000 [0065.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656a68 [0065.368] GetProcessHeap () returned 0x630000 [0065.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0065.368] GetProcessHeap () returned 0x630000 [0065.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0065.368] GetProcessHeap () returned 0x630000 [0065.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e7c0 [0065.368] GetProcessHeap () returned 0x630000 [0065.368] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0065.368] GetProcessHeap () returned 0x630000 [0065.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0065.368] GetProcessHeap () returned 0x630000 [0065.368] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e7c0 | out: hHeap=0x630000) returned 1 [0065.368] GetProcessHeap () returned 0x630000 [0065.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.368] GetProcessHeap () returned 0x630000 [0065.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cd78 [0065.369] GetProcessHeap () returned 0x630000 [0065.369] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0065.369] GetProcessHeap () returned 0x630000 [0065.369] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.369] GetProcessHeap () returned 0x630000 [0065.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.369] GetProcessHeap () returned 0x630000 [0065.369] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.369] GetProcessHeap () returned 0x630000 [0065.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ecd0 [0065.369] GetProcessHeap () returned 0x630000 [0065.369] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cd78 | out: hHeap=0x630000) returned 1 [0065.369] GetProcessHeap () returned 0x630000 [0065.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0065.369] GetProcessHeap () returned 0x630000 [0065.369] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ecd0 | out: hHeap=0x630000) returned 1 [0065.369] GetProcessHeap () returned 0x630000 [0065.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.369] GetProcessHeap () returned 0x630000 [0065.369] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.369] GetProcessHeap () returned 0x630000 [0065.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.369] GetProcessHeap () returned 0x630000 [0065.369] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.369] GetProcessHeap () returned 0x630000 [0065.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.369] GetProcessHeap () returned 0x630000 [0065.369] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.369] GetProcessHeap () returned 0x630000 [0065.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.369] GetProcessHeap () returned 0x630000 [0065.369] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.369] GetProcessHeap () returned 0x630000 [0065.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.369] GetProcessHeap () returned 0x630000 [0065.369] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.369] GetProcessHeap () returned 0x630000 [0065.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.370] GetProcessHeap () returned 0x630000 [0065.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.370] GetProcessHeap () returned 0x630000 [0065.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.370] GetProcessHeap () returned 0x630000 [0065.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.370] GetProcessHeap () returned 0x630000 [0065.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.370] GetProcessHeap () returned 0x630000 [0065.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.370] GetProcessHeap () returned 0x630000 [0065.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0065.370] GetProcessHeap () returned 0x630000 [0065.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0065.370] GetProcessHeap () returned 0x630000 [0065.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.370] GetProcessHeap () returned 0x630000 [0065.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.370] GetProcessHeap () returned 0x630000 [0065.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.370] GetProcessHeap () returned 0x630000 [0065.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.370] GetProcessHeap () returned 0x630000 [0065.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.370] GetProcessHeap () returned 0x630000 [0065.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.370] GetProcessHeap () returned 0x630000 [0065.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.370] GetProcessHeap () returned 0x630000 [0065.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.370] GetProcessHeap () returned 0x630000 [0065.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.370] GetProcessHeap () returned 0x630000 [0065.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.370] GetProcessHeap () returned 0x630000 [0065.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.371] GetProcessHeap () returned 0x630000 [0065.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.371] GetProcessHeap () returned 0x630000 [0065.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.371] GetProcessHeap () returned 0x630000 [0065.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.371] GetProcessHeap () returned 0x630000 [0065.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.371] GetProcessHeap () returned 0x630000 [0065.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.371] GetProcessHeap () returned 0x630000 [0065.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.371] GetProcessHeap () returned 0x630000 [0065.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.371] GetProcessHeap () returned 0x630000 [0065.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.371] GetProcessHeap () returned 0x630000 [0065.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.371] GetProcessHeap () returned 0x630000 [0065.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.371] GetProcessHeap () returned 0x630000 [0065.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.371] GetProcessHeap () returned 0x630000 [0065.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.371] GetProcessHeap () returned 0x630000 [0065.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.371] GetProcessHeap () returned 0x630000 [0065.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.371] GetProcessHeap () returned 0x630000 [0065.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.371] GetProcessHeap () returned 0x630000 [0065.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.371] GetProcessHeap () returned 0x630000 [0065.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.371] GetProcessHeap () returned 0x630000 [0065.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0065.372] GetProcessHeap () returned 0x630000 [0065.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0065.372] GetProcessHeap () returned 0x630000 [0065.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.372] GetProcessHeap () returned 0x630000 [0065.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.372] GetProcessHeap () returned 0x630000 [0065.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.372] GetProcessHeap () returned 0x630000 [0065.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.372] GetProcessHeap () returned 0x630000 [0065.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.372] GetProcessHeap () returned 0x630000 [0065.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.372] GetProcessHeap () returned 0x630000 [0065.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.372] GetProcessHeap () returned 0x630000 [0065.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.372] GetProcessHeap () returned 0x630000 [0065.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.372] GetProcessHeap () returned 0x630000 [0065.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.372] GetProcessHeap () returned 0x630000 [0065.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.372] GetProcessHeap () returned 0x630000 [0065.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.372] GetProcessHeap () returned 0x630000 [0065.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.372] GetProcessHeap () returned 0x630000 [0065.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.372] GetProcessHeap () returned 0x630000 [0065.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.372] GetProcessHeap () returned 0x630000 [0065.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.372] GetProcessHeap () returned 0x630000 [0065.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.372] GetProcessHeap () returned 0x630000 [0065.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.372] GetProcessHeap () returned 0x630000 [0065.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.373] GetProcessHeap () returned 0x630000 [0065.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.373] GetProcessHeap () returned 0x630000 [0065.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0065.373] GetProcessHeap () returned 0x630000 [0065.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0065.373] GetProcessHeap () returned 0x630000 [0065.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.373] GetProcessHeap () returned 0x630000 [0065.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.373] GetProcessHeap () returned 0x630000 [0065.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0065.373] GetProcessHeap () returned 0x630000 [0065.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0065.373] GetProcessHeap () returned 0x630000 [0065.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.373] GetProcessHeap () returned 0x630000 [0065.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.373] GetProcessHeap () returned 0x630000 [0065.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.373] GetProcessHeap () returned 0x630000 [0065.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.373] GetProcessHeap () returned 0x630000 [0065.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.373] GetProcessHeap () returned 0x630000 [0065.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.373] GetProcessHeap () returned 0x630000 [0065.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.373] GetProcessHeap () returned 0x630000 [0065.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.373] GetProcessHeap () returned 0x630000 [0065.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0065.373] GetProcessHeap () returned 0x630000 [0065.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0065.373] GetProcessHeap () returned 0x630000 [0065.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0065.373] GetProcessHeap () returned 0x630000 [0065.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0065.373] GetProcessHeap () returned 0x630000 [0065.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0065.374] GetProcessHeap () returned 0x630000 [0065.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0065.374] GetProcessHeap () returned 0x630000 [0065.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0065.374] GetProcessHeap () returned 0x630000 [0065.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0065.374] GetProcessHeap () returned 0x630000 [0065.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0065.374] GetProcessHeap () returned 0x630000 [0065.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.374] GetProcessHeap () returned 0x630000 [0065.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0065.374] WriteFile (in: hFile=0x230, lpBuffer=0x659828*, nNumberOfBytesToWrite=0x38e, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659828*, lpNumberOfBytesWritten=0x243d864*=0x38e, lpOverlapped=0x0) returned 1 [0065.417] GetProcessHeap () returned 0x630000 [0065.418] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659828, Size=0x30) returned 0x659828 [0065.418] GetProcessHeap () returned 0x630000 [0065.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0065.418] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0065.418] GetProcessHeap () returned 0x630000 [0065.418] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a0) returned 0x63f408 [0065.418] ReadFile (in: hFile=0x230, lpBuffer=0x63f408, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x63f408*, lpNumberOfBytesRead=0x243d7e8*=0x1a0, lpOverlapped=0x0) returned 1 [0065.418] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0065.418] WriteFile (in: hFile=0x230, lpBuffer=0x63f408*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x63f408*, lpNumberOfBytesWritten=0x243d7e4*=0x1a0, lpOverlapped=0x0) returned 1 [0065.419] GetProcessHeap () returned 0x630000 [0065.419] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63f408 | out: hHeap=0x630000) returned 1 [0065.419] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0065.419] WriteFile (in: hFile=0x230, lpBuffer=0x659828*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659828*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0065.420] CloseHandle (hObject=0x230) returned 1 [0065.421] GetProcessHeap () returned 0x630000 [0065.421] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0065.421] GetProcessHeap () returned 0x630000 [0065.421] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655418 | out: hHeap=0x630000) returned 1 [0065.421] GetProcessHeap () returned 0x630000 [0065.421] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0065.421] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\desktop.ini") returned="C:\\Users\\FD1HVy\\Documents\\desktop.ini" [0065.421] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\desktop.ini", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\desktop.ini.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\desktop.ini.happythreechoose" [0065.421] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\desktop.ini.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\desktop.ini.happythreechoose"), dwFlags=0x1) returned 1 [0065.447] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0065.447] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned="" [0065.447] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" [0065.447] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\decryption info.html")) returned 0x20 [0065.447] GetProcessHeap () returned 0x630000 [0065.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0065.447] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa93b0bb0, ftCreationTime.dwHighDateTime=0x1d5d47c, ftLastAccessTime.dwLowDateTime=0x5adad490, ftLastAccessTime.dwHighDateTime=0x1d5d6d0, ftLastWriteTime.dwLowDateTime=0x5adad490, ftLastWriteTime.dwHighDateTime=0x1d5d6d0, nFileSizeHigh=0x0, nFileSizeLow=0x10165, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Dw69.ods", cAlternateFileName="")) returned 1 [0065.447] lstrcmpiW (lpString1="Dw69.ods", lpString2=".") returned 1 [0065.447] lstrcmpiW (lpString1="Dw69.ods", lpString2="..") returned 1 [0065.447] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="Dw69.ods" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Dw69.ods") returned="C:\\Users\\FD1HVy\\Documents\\Dw69.ods" [0065.447] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Dw69.ods", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0065.447] GetProcessHeap () returned 0x630000 [0065.448] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9) returned 0x64c9f0 [0065.448] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Dw69.ods", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dw69.ods", lpUsedDefaultChar=0x0) returned 9 [0065.448] lstrlenA (lpString="Dw69.ods") returned 8 [0065.448] lstrlenA (lpString=".happythreechoose") returned 17 [0065.448] lstrcmpiW (lpString1="Dw69.ods", lpString2="Decryption INFO.html") returned 1 [0065.448] lstrcmpiW (lpString1="Dw69.ods", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0065.448] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0065.448] lstrcmpiW (lpString1="Dw69.ods", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0065.448] GetProcessHeap () returned 0x630000 [0065.448] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0065.448] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Dw69.ods" (normalized: "c:\\users\\fd1hvy\\documents\\dw69.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0065.448] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=65893) returned 1 [0065.448] GetProcessHeap () returned 0x630000 [0065.448] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655a30 [0065.448] GetProcessHeap () returned 0x630000 [0065.448] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0065.448] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\Dw69.ods") returned 34 [0065.448] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0065.448] GetProcessHeap () returned 0x630000 [0065.448] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0065.448] GetProcessHeap () returned 0x630000 [0065.448] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38b) returned 0x659860 [0065.448] lstrlenA (lpString="rsa_encrypt") returned 11 [0065.448] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0065.449] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0065.449] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0065.449] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0065.449] GetProcessHeap () returned 0x630000 [0065.449] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0065.449] lstrlenA (lpString="010001") returned 6 [0065.449] GetProcessHeap () returned 0x630000 [0065.449] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0065.449] GetProcessHeap () returned 0x630000 [0065.449] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0065.449] GetProcessHeap () returned 0x630000 [0065.449] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ecd0 [0065.449] GetProcessHeap () returned 0x630000 [0065.449] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0065.449] GetProcessHeap () returned 0x630000 [0065.449] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dfe0 [0065.449] GetProcessHeap () returned 0x630000 [0065.449] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656b80 [0065.450] GetProcessHeap () returned 0x630000 [0065.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0065.450] GetProcessHeap () returned 0x630000 [0065.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0065.450] GetProcessHeap () returned 0x630000 [0065.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.450] GetProcessHeap () returned 0x630000 [0065.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0065.450] GetProcessHeap () returned 0x630000 [0065.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0065.450] GetProcessHeap () returned 0x630000 [0065.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656fe0 [0065.450] GetProcessHeap () returned 0x630000 [0065.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.450] GetProcessHeap () returned 0x630000 [0065.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0065.450] GetProcessHeap () returned 0x630000 [0065.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ebb0 [0065.450] GetProcessHeap () returned 0x630000 [0065.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0065.450] GetProcessHeap () returned 0x630000 [0065.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0065.450] GetProcessHeap () returned 0x630000 [0065.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0065.450] GetProcessHeap () returned 0x630000 [0065.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.450] GetProcessHeap () returned 0x630000 [0065.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65d000 [0065.450] GetProcessHeap () returned 0x630000 [0065.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.450] GetProcessHeap () returned 0x630000 [0065.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.450] GetProcessHeap () returned 0x630000 [0065.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.450] GetProcessHeap () returned 0x630000 [0065.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.450] GetProcessHeap () returned 0x630000 [0065.450] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e4f0 [0065.450] GetProcessHeap () returned 0x630000 [0065.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65d000 | out: hHeap=0x630000) returned 1 [0065.451] GetProcessHeap () returned 0x630000 [0065.451] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0065.451] GetProcessHeap () returned 0x630000 [0065.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0065.451] GetProcessHeap () returned 0x630000 [0065.451] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.451] GetProcessHeap () returned 0x630000 [0065.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.451] GetProcessHeap () returned 0x630000 [0065.451] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.451] GetProcessHeap () returned 0x630000 [0065.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.451] GetProcessHeap () returned 0x630000 [0065.451] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.451] GetProcessHeap () returned 0x630000 [0065.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.451] GetProcessHeap () returned 0x630000 [0065.451] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.451] GetProcessHeap () returned 0x630000 [0065.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.451] GetProcessHeap () returned 0x630000 [0065.451] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.451] GetProcessHeap () returned 0x630000 [0065.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.451] GetProcessHeap () returned 0x630000 [0065.451] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.451] GetProcessHeap () returned 0x630000 [0065.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.451] GetProcessHeap () returned 0x630000 [0065.451] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.451] GetProcessHeap () returned 0x630000 [0065.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.451] GetProcessHeap () returned 0x630000 [0065.451] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.451] GetProcessHeap () returned 0x630000 [0065.451] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.452] GetProcessHeap () returned 0x630000 [0065.452] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.452] GetProcessHeap () returned 0x630000 [0065.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.452] GetProcessHeap () returned 0x630000 [0065.452] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.452] GetProcessHeap () returned 0x630000 [0065.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.452] GetProcessHeap () returned 0x630000 [0065.452] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.452] GetProcessHeap () returned 0x630000 [0065.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.452] GetProcessHeap () returned 0x630000 [0065.452] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.452] GetProcessHeap () returned 0x630000 [0065.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.452] GetProcessHeap () returned 0x630000 [0065.452] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.452] GetProcessHeap () returned 0x630000 [0065.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.452] GetProcessHeap () returned 0x630000 [0065.452] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.452] GetProcessHeap () returned 0x630000 [0065.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.452] GetProcessHeap () returned 0x630000 [0065.452] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.452] GetProcessHeap () returned 0x630000 [0065.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.453] GetProcessHeap () returned 0x630000 [0065.453] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.453] GetProcessHeap () returned 0x630000 [0065.453] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.453] GetProcessHeap () returned 0x630000 [0065.453] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.453] GetProcessHeap () returned 0x630000 [0065.453] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.453] GetProcessHeap () returned 0x630000 [0065.453] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.453] GetProcessHeap () returned 0x630000 [0065.453] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.453] GetProcessHeap () returned 0x630000 [0065.453] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.453] GetProcessHeap () returned 0x630000 [0065.453] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.453] GetProcessHeap () returned 0x630000 [0065.453] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.453] GetProcessHeap () returned 0x630000 [0065.453] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.453] GetProcessHeap () returned 0x630000 [0065.453] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.453] GetProcessHeap () returned 0x630000 [0065.453] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.453] GetProcessHeap () returned 0x630000 [0065.453] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.453] GetProcessHeap () returned 0x630000 [0065.453] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.453] GetProcessHeap () returned 0x630000 [0065.453] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.453] GetProcessHeap () returned 0x630000 [0065.453] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.453] GetProcessHeap () returned 0x630000 [0065.453] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.453] GetProcessHeap () returned 0x630000 [0065.453] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.454] GetProcessHeap () returned 0x630000 [0065.454] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.454] GetProcessHeap () returned 0x630000 [0065.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.454] GetProcessHeap () returned 0x630000 [0065.454] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.454] GetProcessHeap () returned 0x630000 [0065.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.454] GetProcessHeap () returned 0x630000 [0065.454] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.454] GetProcessHeap () returned 0x630000 [0065.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.454] GetProcessHeap () returned 0x630000 [0065.454] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.454] GetProcessHeap () returned 0x630000 [0065.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.454] GetProcessHeap () returned 0x630000 [0065.454] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.454] GetProcessHeap () returned 0x630000 [0065.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.454] GetProcessHeap () returned 0x630000 [0065.454] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0065.454] GetProcessHeap () returned 0x630000 [0065.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0065.454] GetProcessHeap () returned 0x630000 [0065.454] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.454] GetProcessHeap () returned 0x630000 [0065.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.454] GetProcessHeap () returned 0x630000 [0065.454] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0065.454] GetProcessHeap () returned 0x630000 [0065.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0065.454] GetProcessHeap () returned 0x630000 [0065.454] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.454] GetProcessHeap () returned 0x630000 [0065.454] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.454] GetProcessHeap () returned 0x630000 [0065.455] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.455] GetProcessHeap () returned 0x630000 [0065.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.455] GetProcessHeap () returned 0x630000 [0065.455] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.455] GetProcessHeap () returned 0x630000 [0065.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.455] GetProcessHeap () returned 0x630000 [0065.455] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0065.455] GetProcessHeap () returned 0x630000 [0065.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0065.455] GetProcessHeap () returned 0x630000 [0065.455] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.455] GetProcessHeap () returned 0x630000 [0065.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.455] GetProcessHeap () returned 0x630000 [0065.455] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.455] GetProcessHeap () returned 0x630000 [0065.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.455] GetProcessHeap () returned 0x630000 [0065.455] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.455] GetProcessHeap () returned 0x630000 [0065.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.455] GetProcessHeap () returned 0x630000 [0065.455] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.455] GetProcessHeap () returned 0x630000 [0065.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.455] GetProcessHeap () returned 0x630000 [0065.455] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.455] GetProcessHeap () returned 0x630000 [0065.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.455] GetProcessHeap () returned 0x630000 [0065.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0065.455] GetProcessHeap () returned 0x630000 [0065.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0065.455] GetProcessHeap () returned 0x630000 [0065.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0065.456] GetProcessHeap () returned 0x630000 [0065.456] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0065.456] GetProcessHeap () returned 0x630000 [0065.456] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0065.456] GetProcessHeap () returned 0x630000 [0065.456] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0065.456] GetProcessHeap () returned 0x630000 [0065.456] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0065.456] GetProcessHeap () returned 0x630000 [0065.456] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ecd0 | out: hHeap=0x630000) returned 1 [0065.456] GetProcessHeap () returned 0x630000 [0065.456] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0065.456] GetProcessHeap () returned 0x630000 [0065.456] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.456] GetProcessHeap () returned 0x630000 [0065.456] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0065.456] WriteFile (in: hFile=0x230, lpBuffer=0x659860*, nNumberOfBytesToWrite=0x38b, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659860*, lpNumberOfBytesWritten=0x243d864*=0x38b, lpOverlapped=0x0) returned 1 [0065.460] GetProcessHeap () returned 0x630000 [0065.460] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659860, Size=0x30) returned 0x659860 [0065.460] GetProcessHeap () returned 0x630000 [0065.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0065.460] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0065.460] GetProcessHeap () returned 0x630000 [0065.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10170) returned 0x671bf0 [0065.460] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0x10170, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0x10170, lpOverlapped=0x0) returned 1 [0065.461] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0065.461] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x10170, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0x10170, lpOverlapped=0x0) returned 1 [0065.462] GetProcessHeap () returned 0x630000 [0065.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0065.463] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0065.463] WriteFile (in: hFile=0x230, lpBuffer=0x659860*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659860*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0065.463] CloseHandle (hObject=0x230) returned 1 [0065.464] GetProcessHeap () returned 0x630000 [0065.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0065.464] GetProcessHeap () returned 0x630000 [0065.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655a30 | out: hHeap=0x630000) returned 1 [0065.464] GetProcessHeap () returned 0x630000 [0065.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0065.464] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\Dw69.ods" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Dw69.ods") returned="C:\\Users\\FD1HVy\\Documents\\Dw69.ods" [0065.464] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\Dw69.ods", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Dw69.ods.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\Dw69.ods.happythreechoose" [0065.464] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Dw69.ods" (normalized: "c:\\users\\fd1hvy\\documents\\dw69.ods"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Dw69.ods.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\dw69.ods.happythreechoose"), dwFlags=0x1) returned 1 [0065.465] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\Dw69.ods" | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0065.465] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned="" [0065.465] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" [0065.465] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\decryption info.html")) returned 0x20 [0065.465] GetProcessHeap () returned 0x630000 [0065.465] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0065.465] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb10f020, ftCreationTime.dwHighDateTime=0x1d5d447, ftLastAccessTime.dwLowDateTime=0x17e79a00, ftLastAccessTime.dwHighDateTime=0x1d5d046, ftLastWriteTime.dwLowDateTime=0x17e79a00, ftLastWriteTime.dwHighDateTime=0x1d5d046, nFileSizeHigh=0x0, nFileSizeLow=0xdf1e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dzIWd3Xzm.docx", cAlternateFileName="DZIWD3~1.DOC")) returned 1 [0065.465] lstrcmpiW (lpString1="dzIWd3Xzm.docx", lpString2=".") returned 1 [0065.465] lstrcmpiW (lpString1="dzIWd3Xzm.docx", lpString2="..") returned 1 [0065.465] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="dzIWd3Xzm.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\dzIWd3Xzm.docx") returned="C:\\Users\\FD1HVy\\Documents\\dzIWd3Xzm.docx" [0065.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dzIWd3Xzm.docx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0065.465] GetProcessHeap () returned 0x630000 [0065.465] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0065.465] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dzIWd3Xzm.docx", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dzIWd3Xzm.docx", lpUsedDefaultChar=0x0) returned 15 [0065.465] lstrlenA (lpString="dzIWd3Xzm.docx") returned 14 [0065.465] lstrlenA (lpString=".happythreechoose") returned 17 [0065.465] lstrcmpiW (lpString1="dzIWd3Xzm.docx", lpString2="Decryption INFO.html") returned 1 [0065.465] lstrcmpiW (lpString1="dzIWd3Xzm.docx", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0065.465] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0065.465] lstrcmpiW (lpString1="dzIWd3Xzm.docx", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0065.465] GetProcessHeap () returned 0x630000 [0065.465] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0065.465] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\dzIWd3Xzm.docx" (normalized: "c:\\users\\fd1hvy\\documents\\dziwd3xzm.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0065.466] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=57118) returned 1 [0065.466] GetProcessHeap () returned 0x630000 [0065.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655508 [0065.466] GetProcessHeap () returned 0x630000 [0065.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0065.466] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\dzIWd3Xzm.docx") returned 40 [0065.466] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0065.466] GetProcessHeap () returned 0x630000 [0065.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0065.466] GetProcessHeap () returned 0x630000 [0065.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x382) returned 0x659898 [0065.466] lstrlenA (lpString="rsa_encrypt") returned 11 [0065.466] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0065.466] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0065.466] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0065.466] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0065.466] GetProcessHeap () returned 0x630000 [0065.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0065.467] lstrlenA (lpString="010001") returned 6 [0065.467] GetProcessHeap () returned 0x630000 [0065.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0065.467] GetProcessHeap () returned 0x630000 [0065.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0065.467] GetProcessHeap () returned 0x630000 [0065.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dec0 [0065.467] GetProcessHeap () returned 0x630000 [0065.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0065.467] GetProcessHeap () returned 0x630000 [0065.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e6a0 [0065.467] GetProcessHeap () returned 0x630000 [0065.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656c98 [0065.467] GetProcessHeap () returned 0x630000 [0065.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0065.467] GetProcessHeap () returned 0x630000 [0065.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0065.467] GetProcessHeap () returned 0x630000 [0065.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.467] GetProcessHeap () returned 0x630000 [0065.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0065.467] GetProcessHeap () returned 0x630000 [0065.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0065.467] GetProcessHeap () returned 0x630000 [0065.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657670 [0065.467] GetProcessHeap () returned 0x630000 [0065.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.501] GetProcessHeap () returned 0x630000 [0065.501] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0065.501] GetProcessHeap () returned 0x630000 [0065.501] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e4f0 [0065.501] GetProcessHeap () returned 0x630000 [0065.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0065.501] GetProcessHeap () returned 0x630000 [0065.501] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0065.501] GetProcessHeap () returned 0x630000 [0065.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0065.501] GetProcessHeap () returned 0x630000 [0065.501] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.501] GetProcessHeap () returned 0x630000 [0065.501] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65d0c0 [0065.501] GetProcessHeap () returned 0x630000 [0065.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.501] GetProcessHeap () returned 0x630000 [0065.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.501] GetProcessHeap () returned 0x630000 [0065.501] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.501] GetProcessHeap () returned 0x630000 [0065.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.501] GetProcessHeap () returned 0x630000 [0065.501] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ec40 [0065.501] GetProcessHeap () returned 0x630000 [0065.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65d0c0 | out: hHeap=0x630000) returned 1 [0065.501] GetProcessHeap () returned 0x630000 [0065.501] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0065.501] GetProcessHeap () returned 0x630000 [0065.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ec40 | out: hHeap=0x630000) returned 1 [0065.501] GetProcessHeap () returned 0x630000 [0065.501] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0065.501] GetProcessHeap () returned 0x630000 [0065.502] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0065.502] GetProcessHeap () returned 0x630000 [0065.502] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.502] GetProcessHeap () returned 0x630000 [0065.502] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.502] GetProcessHeap () returned 0x630000 [0065.502] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.502] GetProcessHeap () returned 0x630000 [0065.502] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.502] GetProcessHeap () returned 0x630000 [0065.502] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.502] GetProcessHeap () returned 0x630000 [0065.502] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.502] GetProcessHeap () returned 0x630000 [0065.502] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.502] GetProcessHeap () returned 0x630000 [0065.502] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.502] GetProcessHeap () returned 0x630000 [0065.502] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.502] GetProcessHeap () returned 0x630000 [0065.502] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.502] GetProcessHeap () returned 0x630000 [0065.502] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.502] GetProcessHeap () returned 0x630000 [0065.502] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.502] GetProcessHeap () returned 0x630000 [0065.502] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.502] GetProcessHeap () returned 0x630000 [0065.502] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.502] GetProcessHeap () returned 0x630000 [0065.502] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.502] GetProcessHeap () returned 0x630000 [0065.502] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.502] GetProcessHeap () returned 0x630000 [0065.502] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.502] GetProcessHeap () returned 0x630000 [0065.502] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.503] GetProcessHeap () returned 0x630000 [0065.503] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.503] GetProcessHeap () returned 0x630000 [0065.503] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.503] GetProcessHeap () returned 0x630000 [0065.503] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.503] GetProcessHeap () returned 0x630000 [0065.503] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.503] GetProcessHeap () returned 0x630000 [0065.503] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.503] GetProcessHeap () returned 0x630000 [0065.503] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.503] GetProcessHeap () returned 0x630000 [0065.503] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.503] GetProcessHeap () returned 0x630000 [0065.503] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.503] GetProcessHeap () returned 0x630000 [0065.503] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.503] GetProcessHeap () returned 0x630000 [0065.503] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.503] GetProcessHeap () returned 0x630000 [0065.503] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.503] GetProcessHeap () returned 0x630000 [0065.503] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.503] GetProcessHeap () returned 0x630000 [0065.503] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.503] GetProcessHeap () returned 0x630000 [0065.503] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.503] GetProcessHeap () returned 0x630000 [0065.503] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.503] GetProcessHeap () returned 0x630000 [0065.503] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.503] GetProcessHeap () returned 0x630000 [0065.503] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0065.503] GetProcessHeap () returned 0x630000 [0065.503] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0065.503] GetProcessHeap () returned 0x630000 [0065.503] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.504] GetProcessHeap () returned 0x630000 [0065.504] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.504] GetProcessHeap () returned 0x630000 [0065.504] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.504] GetProcessHeap () returned 0x630000 [0065.504] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.504] GetProcessHeap () returned 0x630000 [0065.504] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0065.504] GetProcessHeap () returned 0x630000 [0065.504] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0065.504] GetProcessHeap () returned 0x630000 [0065.504] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.504] GetProcessHeap () returned 0x630000 [0065.504] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.504] GetProcessHeap () returned 0x630000 [0065.504] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.504] GetProcessHeap () returned 0x630000 [0065.504] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.504] GetProcessHeap () returned 0x630000 [0065.504] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0065.504] GetProcessHeap () returned 0x630000 [0065.504] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0065.504] GetProcessHeap () returned 0x630000 [0065.504] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.504] GetProcessHeap () returned 0x630000 [0065.504] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.504] GetProcessHeap () returned 0x630000 [0065.504] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.504] GetProcessHeap () returned 0x630000 [0065.504] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.504] GetProcessHeap () returned 0x630000 [0065.504] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.504] GetProcessHeap () returned 0x630000 [0065.504] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.504] GetProcessHeap () returned 0x630000 [0065.504] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.504] GetProcessHeap () returned 0x630000 [0065.504] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.505] GetProcessHeap () returned 0x630000 [0065.505] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.505] GetProcessHeap () returned 0x630000 [0065.505] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.505] GetProcessHeap () returned 0x630000 [0065.505] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.505] GetProcessHeap () returned 0x630000 [0065.505] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.505] GetProcessHeap () returned 0x630000 [0065.505] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.505] GetProcessHeap () returned 0x630000 [0065.505] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.505] GetProcessHeap () returned 0x630000 [0065.505] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.505] GetProcessHeap () returned 0x630000 [0065.505] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.505] GetProcessHeap () returned 0x630000 [0065.505] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.505] GetProcessHeap () returned 0x630000 [0065.505] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.505] GetProcessHeap () returned 0x630000 [0065.505] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.505] GetProcessHeap () returned 0x630000 [0065.505] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.505] GetProcessHeap () returned 0x630000 [0065.505] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.505] GetProcessHeap () returned 0x630000 [0065.505] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.505] GetProcessHeap () returned 0x630000 [0065.505] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.505] GetProcessHeap () returned 0x630000 [0065.505] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.505] GetProcessHeap () returned 0x630000 [0065.505] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.505] GetProcessHeap () returned 0x630000 [0065.505] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.505] GetProcessHeap () returned 0x630000 [0065.505] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.506] GetProcessHeap () returned 0x630000 [0065.506] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.506] GetProcessHeap () returned 0x630000 [0065.506] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.506] GetProcessHeap () returned 0x630000 [0065.506] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.506] GetProcessHeap () returned 0x630000 [0065.506] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.506] GetProcessHeap () returned 0x630000 [0065.506] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.506] GetProcessHeap () returned 0x630000 [0065.506] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0065.506] GetProcessHeap () returned 0x630000 [0065.506] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0065.506] GetProcessHeap () returned 0x630000 [0065.506] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0065.506] GetProcessHeap () returned 0x630000 [0065.506] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0065.506] GetProcessHeap () returned 0x630000 [0065.506] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0065.506] GetProcessHeap () returned 0x630000 [0065.506] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e6a0 | out: hHeap=0x630000) returned 1 [0065.506] GetProcessHeap () returned 0x630000 [0065.506] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0065.506] GetProcessHeap () returned 0x630000 [0065.506] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0065.506] GetProcessHeap () returned 0x630000 [0065.506] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0065.506] GetProcessHeap () returned 0x630000 [0065.506] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.506] GetProcessHeap () returned 0x630000 [0065.506] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0065.506] WriteFile (in: hFile=0x230, lpBuffer=0x659898*, nNumberOfBytesToWrite=0x382, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659898*, lpNumberOfBytesWritten=0x243d864*=0x382, lpOverlapped=0x0) returned 1 [0065.509] GetProcessHeap () returned 0x630000 [0065.509] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659898, Size=0x30) returned 0x659898 [0065.509] GetProcessHeap () returned 0x630000 [0065.509] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0065.509] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0065.509] GetProcessHeap () returned 0x630000 [0065.509] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xdf20) returned 0x671bf0 [0065.509] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0xdf20, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0xdf20, lpOverlapped=0x0) returned 1 [0065.510] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0065.510] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0xdf20, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0xdf20, lpOverlapped=0x0) returned 1 [0065.511] GetProcessHeap () returned 0x630000 [0065.512] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0065.513] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0065.513] WriteFile (in: hFile=0x230, lpBuffer=0x659898*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659898*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0065.514] CloseHandle (hObject=0x230) returned 1 [0065.515] GetProcessHeap () returned 0x630000 [0065.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0065.515] GetProcessHeap () returned 0x630000 [0065.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655508 | out: hHeap=0x630000) returned 1 [0065.515] GetProcessHeap () returned 0x630000 [0065.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0065.515] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\dzIWd3Xzm.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\dzIWd3Xzm.docx") returned="C:\\Users\\FD1HVy\\Documents\\dzIWd3Xzm.docx" [0065.515] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\dzIWd3Xzm.docx", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\dzIWd3Xzm.docx.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\dzIWd3Xzm.docx.happythreechoose" [0065.515] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\dzIWd3Xzm.docx" (normalized: "c:\\users\\fd1hvy\\documents\\dziwd3xzm.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\dzIWd3Xzm.docx.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\dziwd3xzm.docx.happythreechoose"), dwFlags=0x1) returned 1 [0065.516] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\dzIWd3Xzm.docx" | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0065.516] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned="" [0065.516] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" [0065.516] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\decryption info.html")) returned 0x20 [0065.516] GetProcessHeap () returned 0x630000 [0065.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0065.516] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee0dac60, ftCreationTime.dwHighDateTime=0x1d5ab29, ftLastAccessTime.dwLowDateTime=0x36c7f0d0, ftLastAccessTime.dwHighDateTime=0x1d58011, ftLastWriteTime.dwLowDateTime=0x36c7f0d0, ftLastWriteTime.dwHighDateTime=0x1d58011, nFileSizeHigh=0x0, nFileSizeLow=0x13c65, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EmWjo7fB8z.pptx", cAlternateFileName="EMWJO7~1.PPT")) returned 1 [0065.516] lstrcmpiW (lpString1="EmWjo7fB8z.pptx", lpString2=".") returned 1 [0065.516] lstrcmpiW (lpString1="EmWjo7fB8z.pptx", lpString2="..") returned 1 [0065.516] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="EmWjo7fB8z.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\EmWjo7fB8z.pptx") returned="C:\\Users\\FD1HVy\\Documents\\EmWjo7fB8z.pptx" [0065.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EmWjo7fB8z.pptx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0065.516] GetProcessHeap () returned 0x630000 [0065.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x64c9f0 [0065.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EmWjo7fB8z.pptx", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EmWjo7fB8z.pptx", lpUsedDefaultChar=0x0) returned 16 [0065.516] lstrlenA (lpString="EmWjo7fB8z.pptx") returned 15 [0065.516] lstrlenA (lpString=".happythreechoose") returned 17 [0065.516] lstrcmpiW (lpString1="EmWjo7fB8z.pptx", lpString2="Decryption INFO.html") returned 1 [0065.516] lstrcmpiW (lpString1="EmWjo7fB8z.pptx", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0065.516] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0065.516] lstrcmpiW (lpString1="EmWjo7fB8z.pptx", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0065.516] GetProcessHeap () returned 0x630000 [0065.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0065.516] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\EmWjo7fB8z.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\emwjo7fb8z.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0065.517] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=80997) returned 1 [0065.517] GetProcessHeap () returned 0x630000 [0065.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655670 [0065.517] GetProcessHeap () returned 0x630000 [0065.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0065.517] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\EmWjo7fB8z.pptx") returned 41 [0065.517] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0065.517] GetProcessHeap () returned 0x630000 [0065.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0065.517] GetProcessHeap () returned 0x630000 [0065.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x6598d0 [0065.517] lstrlenA (lpString="rsa_encrypt") returned 11 [0065.517] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0065.518] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0065.518] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0065.518] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0065.518] GetProcessHeap () returned 0x630000 [0065.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0065.518] lstrlenA (lpString="010001") returned 6 [0065.518] GetProcessHeap () returned 0x630000 [0065.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0065.518] GetProcessHeap () returned 0x630000 [0065.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0065.518] GetProcessHeap () returned 0x630000 [0065.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e190 [0065.518] GetProcessHeap () returned 0x630000 [0065.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0065.518] GetProcessHeap () returned 0x630000 [0065.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e7c0 [0065.518] GetProcessHeap () returned 0x630000 [0065.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656db0 [0065.518] GetProcessHeap () returned 0x630000 [0065.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0065.518] GetProcessHeap () returned 0x630000 [0065.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0065.518] GetProcessHeap () returned 0x630000 [0065.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.518] GetProcessHeap () returned 0x630000 [0065.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0065.518] GetProcessHeap () returned 0x630000 [0065.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0065.518] GetProcessHeap () returned 0x630000 [0065.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656fe0 [0065.518] GetProcessHeap () returned 0x630000 [0065.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.519] GetProcessHeap () returned 0x630000 [0065.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0065.519] GetProcessHeap () returned 0x630000 [0065.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e460 [0065.519] GetProcessHeap () returned 0x630000 [0065.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0065.519] GetProcessHeap () returned 0x630000 [0065.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0065.519] GetProcessHeap () returned 0x630000 [0065.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e460 | out: hHeap=0x630000) returned 1 [0065.519] GetProcessHeap () returned 0x630000 [0065.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0065.519] GetProcessHeap () returned 0x630000 [0065.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cf28 [0065.519] GetProcessHeap () returned 0x630000 [0065.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.519] GetProcessHeap () returned 0x630000 [0065.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0065.519] GetProcessHeap () returned 0x630000 [0065.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.519] GetProcessHeap () returned 0x630000 [0065.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.519] GetProcessHeap () returned 0x630000 [0065.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ebb0 [0065.519] GetProcessHeap () returned 0x630000 [0065.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cf28 | out: hHeap=0x630000) returned 1 [0065.519] GetProcessHeap () returned 0x630000 [0065.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0065.519] GetProcessHeap () returned 0x630000 [0065.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0065.519] GetProcessHeap () returned 0x630000 [0065.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.519] GetProcessHeap () returned 0x630000 [0065.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.519] GetProcessHeap () returned 0x630000 [0065.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.519] GetProcessHeap () returned 0x630000 [0065.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.519] GetProcessHeap () returned 0x630000 [0065.520] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.520] GetProcessHeap () returned 0x630000 [0065.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.520] GetProcessHeap () returned 0x630000 [0065.520] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.520] GetProcessHeap () returned 0x630000 [0065.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.520] GetProcessHeap () returned 0x630000 [0065.520] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.520] GetProcessHeap () returned 0x630000 [0065.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.520] GetProcessHeap () returned 0x630000 [0065.520] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.520] GetProcessHeap () returned 0x630000 [0065.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.520] GetProcessHeap () returned 0x630000 [0065.520] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.520] GetProcessHeap () returned 0x630000 [0065.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.520] GetProcessHeap () returned 0x630000 [0065.520] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.520] GetProcessHeap () returned 0x630000 [0065.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.520] GetProcessHeap () returned 0x630000 [0065.520] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.520] GetProcessHeap () returned 0x630000 [0065.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.520] GetProcessHeap () returned 0x630000 [0065.520] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0065.520] GetProcessHeap () returned 0x630000 [0065.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0065.520] GetProcessHeap () returned 0x630000 [0065.520] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.520] GetProcessHeap () returned 0x630000 [0065.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.520] GetProcessHeap () returned 0x630000 [0065.520] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.520] GetProcessHeap () returned 0x630000 [0065.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.521] GetProcessHeap () returned 0x630000 [0065.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.521] GetProcessHeap () returned 0x630000 [0065.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.521] GetProcessHeap () returned 0x630000 [0065.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.521] GetProcessHeap () returned 0x630000 [0065.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.521] GetProcessHeap () returned 0x630000 [0065.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.521] GetProcessHeap () returned 0x630000 [0065.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.521] GetProcessHeap () returned 0x630000 [0065.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.521] GetProcessHeap () returned 0x630000 [0065.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.521] GetProcessHeap () returned 0x630000 [0065.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.521] GetProcessHeap () returned 0x630000 [0065.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.521] GetProcessHeap () returned 0x630000 [0065.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.521] GetProcessHeap () returned 0x630000 [0065.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.521] GetProcessHeap () returned 0x630000 [0065.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.521] GetProcessHeap () returned 0x630000 [0065.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.521] GetProcessHeap () returned 0x630000 [0065.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.521] GetProcessHeap () returned 0x630000 [0065.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.521] GetProcessHeap () returned 0x630000 [0065.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.521] GetProcessHeap () returned 0x630000 [0065.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.522] GetProcessHeap () returned 0x630000 [0065.522] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0065.522] GetProcessHeap () returned 0x630000 [0065.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0065.522] GetProcessHeap () returned 0x630000 [0065.522] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.522] GetProcessHeap () returned 0x630000 [0065.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.522] GetProcessHeap () returned 0x630000 [0065.522] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.522] GetProcessHeap () returned 0x630000 [0065.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.522] GetProcessHeap () returned 0x630000 [0065.522] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.522] GetProcessHeap () returned 0x630000 [0065.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.522] GetProcessHeap () returned 0x630000 [0065.522] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.522] GetProcessHeap () returned 0x630000 [0065.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.522] GetProcessHeap () returned 0x630000 [0065.522] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.522] GetProcessHeap () returned 0x630000 [0065.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.522] GetProcessHeap () returned 0x630000 [0065.522] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.522] GetProcessHeap () returned 0x630000 [0065.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.522] GetProcessHeap () returned 0x630000 [0065.522] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.522] GetProcessHeap () returned 0x630000 [0065.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.522] GetProcessHeap () returned 0x630000 [0065.522] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.522] GetProcessHeap () returned 0x630000 [0065.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.522] GetProcessHeap () returned 0x630000 [0065.522] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.522] GetProcessHeap () returned 0x630000 [0065.523] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.523] GetProcessHeap () returned 0x630000 [0065.523] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.523] GetProcessHeap () returned 0x630000 [0065.523] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.523] GetProcessHeap () returned 0x630000 [0065.523] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.523] GetProcessHeap () returned 0x630000 [0065.523] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.523] GetProcessHeap () returned 0x630000 [0065.523] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.523] GetProcessHeap () returned 0x630000 [0065.523] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.523] GetProcessHeap () returned 0x630000 [0065.523] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.523] GetProcessHeap () returned 0x630000 [0065.523] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.523] GetProcessHeap () returned 0x630000 [0065.523] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.523] GetProcessHeap () returned 0x630000 [0065.523] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.523] GetProcessHeap () returned 0x630000 [0065.523] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.523] GetProcessHeap () returned 0x630000 [0065.523] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.523] GetProcessHeap () returned 0x630000 [0065.523] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.523] GetProcessHeap () returned 0x630000 [0065.523] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.523] GetProcessHeap () returned 0x630000 [0065.523] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.523] GetProcessHeap () returned 0x630000 [0065.523] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.523] GetProcessHeap () returned 0x630000 [0065.523] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.523] GetProcessHeap () returned 0x630000 [0065.523] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.523] GetProcessHeap () returned 0x630000 [0065.524] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.524] GetProcessHeap () returned 0x630000 [0065.524] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.524] GetProcessHeap () returned 0x630000 [0065.524] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0065.524] GetProcessHeap () returned 0x630000 [0065.524] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0065.524] GetProcessHeap () returned 0x630000 [0065.524] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0065.524] GetProcessHeap () returned 0x630000 [0065.524] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0065.524] GetProcessHeap () returned 0x630000 [0065.524] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0065.524] GetProcessHeap () returned 0x630000 [0065.524] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e7c0 | out: hHeap=0x630000) returned 1 [0065.524] GetProcessHeap () returned 0x630000 [0065.524] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0065.524] GetProcessHeap () returned 0x630000 [0065.524] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0065.524] GetProcessHeap () returned 0x630000 [0065.524] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0065.524] GetProcessHeap () returned 0x630000 [0065.524] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.524] GetProcessHeap () returned 0x630000 [0065.524] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0065.524] WriteFile (in: hFile=0x230, lpBuffer=0x6598d0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6598d0*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0065.528] GetProcessHeap () returned 0x630000 [0065.528] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6598d0, Size=0x30) returned 0x6598d0 [0065.528] GetProcessHeap () returned 0x630000 [0065.528] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0065.528] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0065.528] GetProcessHeap () returned 0x630000 [0065.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x13c65) returned 0x671bf0 [0065.531] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0x13c65, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0x13c65, lpOverlapped=0x0) returned 1 [0065.531] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0065.532] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x13c65, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0x13c65, lpOverlapped=0x0) returned 1 [0065.533] GetProcessHeap () returned 0x630000 [0065.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0065.533] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0065.533] WriteFile (in: hFile=0x230, lpBuffer=0x6598d0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6598d0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0065.618] CloseHandle (hObject=0x230) returned 1 [0065.619] GetProcessHeap () returned 0x630000 [0065.619] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0065.619] GetProcessHeap () returned 0x630000 [0065.619] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655670 | out: hHeap=0x630000) returned 1 [0065.619] GetProcessHeap () returned 0x630000 [0065.619] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0065.619] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\EmWjo7fB8z.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\EmWjo7fB8z.pptx") returned="C:\\Users\\FD1HVy\\Documents\\EmWjo7fB8z.pptx" [0065.619] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\EmWjo7fB8z.pptx", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\EmWjo7fB8z.pptx.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\EmWjo7fB8z.pptx.happythreechoose" [0065.619] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\EmWjo7fB8z.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\emwjo7fb8z.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\EmWjo7fB8z.pptx.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\emwjo7fb8z.pptx.happythreechoose"), dwFlags=0x1) returned 1 [0065.620] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\EmWjo7fB8z.pptx" | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0065.620] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned="" [0065.620] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" [0065.620] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\decryption info.html")) returned 0x20 [0065.620] GetProcessHeap () returned 0x630000 [0065.620] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0065.620] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fc9ca70, ftCreationTime.dwHighDateTime=0x1d59a57, ftLastAccessTime.dwLowDateTime=0x48dd96c0, ftLastAccessTime.dwHighDateTime=0x1d5519b, ftLastWriteTime.dwLowDateTime=0x48dd96c0, ftLastWriteTime.dwHighDateTime=0x1d5519b, nFileSizeHigh=0x0, nFileSizeLow=0x26bc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FcR-V7.pptx", cAlternateFileName="FCR-V7~1.PPT")) returned 1 [0065.620] lstrcmpiW (lpString1="FcR-V7.pptx", lpString2=".") returned 1 [0065.620] lstrcmpiW (lpString1="FcR-V7.pptx", lpString2="..") returned 1 [0065.620] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="FcR-V7.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\FcR-V7.pptx") returned="C:\\Users\\FD1HVy\\Documents\\FcR-V7.pptx" [0065.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FcR-V7.pptx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0065.620] GetProcessHeap () returned 0x630000 [0065.620] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64ca20 [0065.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FcR-V7.pptx", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FcR-V7.pptx", lpUsedDefaultChar=0x0) returned 12 [0065.620] lstrlenA (lpString="FcR-V7.pptx") returned 11 [0065.620] lstrlenA (lpString=".happythreechoose") returned 17 [0065.620] lstrcmpiW (lpString1="FcR-V7.pptx", lpString2="Decryption INFO.html") returned 1 [0065.620] lstrcmpiW (lpString1="FcR-V7.pptx", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0065.620] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0065.620] lstrcmpiW (lpString1="FcR-V7.pptx", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0065.621] GetProcessHeap () returned 0x630000 [0065.621] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0065.621] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\FcR-V7.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\fcr-v7.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0065.621] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=9916) returned 1 [0065.621] GetProcessHeap () returned 0x630000 [0065.621] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655580 [0065.621] GetProcessHeap () returned 0x630000 [0065.621] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0065.621] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\FcR-V7.pptx") returned 37 [0065.621] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0065.621] GetProcessHeap () returned 0x630000 [0065.621] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0065.621] GetProcessHeap () returned 0x630000 [0065.621] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x659908 [0065.621] lstrlenA (lpString="rsa_encrypt") returned 11 [0065.621] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0065.622] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0065.622] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0065.622] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0065.622] GetProcessHeap () returned 0x630000 [0065.622] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0065.622] lstrlenA (lpString="010001") returned 6 [0065.622] GetProcessHeap () returned 0x630000 [0065.622] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a318 [0065.622] GetProcessHeap () returned 0x630000 [0065.622] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0065.622] GetProcessHeap () returned 0x630000 [0065.622] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0065.622] GetProcessHeap () returned 0x630000 [0065.622] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0065.622] GetProcessHeap () returned 0x630000 [0065.622] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e190 [0065.622] GetProcessHeap () returned 0x630000 [0065.622] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657788 [0065.622] GetProcessHeap () returned 0x630000 [0065.622] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0065.622] GetProcessHeap () returned 0x630000 [0065.622] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0065.622] GetProcessHeap () returned 0x630000 [0065.622] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.622] GetProcessHeap () returned 0x630000 [0065.622] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0065.622] GetProcessHeap () returned 0x630000 [0065.622] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0065.622] GetProcessHeap () returned 0x630000 [0065.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656fe0 [0065.623] GetProcessHeap () returned 0x630000 [0065.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0065.623] GetProcessHeap () returned 0x630000 [0065.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0065.623] GetProcessHeap () returned 0x630000 [0065.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e580 [0065.623] GetProcessHeap () returned 0x630000 [0065.623] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0065.623] GetProcessHeap () returned 0x630000 [0065.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0065.623] GetProcessHeap () returned 0x630000 [0065.623] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0065.623] GetProcessHeap () returned 0x630000 [0065.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0065.623] GetProcessHeap () returned 0x630000 [0065.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cf58 [0065.623] GetProcessHeap () returned 0x630000 [0065.623] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0065.623] GetProcessHeap () returned 0x630000 [0065.623] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0065.623] GetProcessHeap () returned 0x630000 [0065.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.623] GetProcessHeap () returned 0x630000 [0065.623] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.623] GetProcessHeap () returned 0x630000 [0065.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ea00 [0065.623] GetProcessHeap () returned 0x630000 [0065.623] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cf58 | out: hHeap=0x630000) returned 1 [0065.623] GetProcessHeap () returned 0x630000 [0065.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0065.623] GetProcessHeap () returned 0x630000 [0065.623] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0065.623] GetProcessHeap () returned 0x630000 [0065.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.623] GetProcessHeap () returned 0x630000 [0065.623] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.623] GetProcessHeap () returned 0x630000 [0065.623] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0065.624] GetProcessHeap () returned 0x630000 [0065.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0065.624] GetProcessHeap () returned 0x630000 [0065.624] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.624] GetProcessHeap () returned 0x630000 [0065.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.624] GetProcessHeap () returned 0x630000 [0065.624] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.624] GetProcessHeap () returned 0x630000 [0065.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.624] GetProcessHeap () returned 0x630000 [0065.624] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.624] GetProcessHeap () returned 0x630000 [0065.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.624] GetProcessHeap () returned 0x630000 [0065.624] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.624] GetProcessHeap () returned 0x630000 [0065.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.624] GetProcessHeap () returned 0x630000 [0065.624] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.624] GetProcessHeap () returned 0x630000 [0065.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.624] GetProcessHeap () returned 0x630000 [0065.624] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.624] GetProcessHeap () returned 0x630000 [0065.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.624] GetProcessHeap () returned 0x630000 [0065.624] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.624] GetProcessHeap () returned 0x630000 [0065.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.624] GetProcessHeap () returned 0x630000 [0065.624] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.624] GetProcessHeap () returned 0x630000 [0065.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.625] GetProcessHeap () returned 0x630000 [0065.625] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.625] GetProcessHeap () returned 0x630000 [0065.625] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.625] GetProcessHeap () returned 0x630000 [0065.625] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.625] GetProcessHeap () returned 0x630000 [0065.625] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.625] GetProcessHeap () returned 0x630000 [0065.625] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.625] GetProcessHeap () returned 0x630000 [0065.625] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.625] GetProcessHeap () returned 0x630000 [0065.625] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.625] GetProcessHeap () returned 0x630000 [0065.625] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.625] GetProcessHeap () returned 0x630000 [0065.625] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.625] GetProcessHeap () returned 0x630000 [0065.625] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.625] GetProcessHeap () returned 0x630000 [0065.625] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.625] GetProcessHeap () returned 0x630000 [0065.625] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.625] GetProcessHeap () returned 0x630000 [0065.625] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.625] GetProcessHeap () returned 0x630000 [0065.625] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.625] GetProcessHeap () returned 0x630000 [0065.625] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.625] GetProcessHeap () returned 0x630000 [0065.625] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.625] GetProcessHeap () returned 0x630000 [0065.625] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.625] GetProcessHeap () returned 0x630000 [0065.625] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.625] GetProcessHeap () returned 0x630000 [0065.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.626] GetProcessHeap () returned 0x630000 [0065.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.626] GetProcessHeap () returned 0x630000 [0065.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.626] GetProcessHeap () returned 0x630000 [0065.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.626] GetProcessHeap () returned 0x630000 [0065.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.626] GetProcessHeap () returned 0x630000 [0065.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.626] GetProcessHeap () returned 0x630000 [0065.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.626] GetProcessHeap () returned 0x630000 [0065.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.626] GetProcessHeap () returned 0x630000 [0065.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.626] GetProcessHeap () returned 0x630000 [0065.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.626] GetProcessHeap () returned 0x630000 [0065.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.626] GetProcessHeap () returned 0x630000 [0065.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.626] GetProcessHeap () returned 0x630000 [0065.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.626] GetProcessHeap () returned 0x630000 [0065.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.626] GetProcessHeap () returned 0x630000 [0065.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.626] GetProcessHeap () returned 0x630000 [0065.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.626] GetProcessHeap () returned 0x630000 [0065.626] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.626] GetProcessHeap () returned 0x630000 [0065.626] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.626] GetProcessHeap () returned 0x630000 [0065.627] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.627] GetProcessHeap () returned 0x630000 [0065.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.627] GetProcessHeap () returned 0x630000 [0065.627] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.627] GetProcessHeap () returned 0x630000 [0065.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.627] GetProcessHeap () returned 0x630000 [0065.627] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.627] GetProcessHeap () returned 0x630000 [0065.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.627] GetProcessHeap () returned 0x630000 [0065.627] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.627] GetProcessHeap () returned 0x630000 [0065.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.627] GetProcessHeap () returned 0x630000 [0065.627] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.627] GetProcessHeap () returned 0x630000 [0065.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.627] GetProcessHeap () returned 0x630000 [0065.627] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.627] GetProcessHeap () returned 0x630000 [0065.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.627] GetProcessHeap () returned 0x630000 [0065.627] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.627] GetProcessHeap () returned 0x630000 [0065.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.627] GetProcessHeap () returned 0x630000 [0065.627] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.627] GetProcessHeap () returned 0x630000 [0065.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.627] GetProcessHeap () returned 0x630000 [0065.627] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0065.627] GetProcessHeap () returned 0x630000 [0065.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0065.627] GetProcessHeap () returned 0x630000 [0065.628] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.628] GetProcessHeap () returned 0x630000 [0065.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.628] GetProcessHeap () returned 0x630000 [0065.628] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.628] GetProcessHeap () returned 0x630000 [0065.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.628] GetProcessHeap () returned 0x630000 [0065.628] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0065.628] GetProcessHeap () returned 0x630000 [0065.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0065.628] GetProcessHeap () returned 0x630000 [0065.628] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.628] GetProcessHeap () returned 0x630000 [0065.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.628] GetProcessHeap () returned 0x630000 [0065.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0065.628] GetProcessHeap () returned 0x630000 [0065.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0065.628] GetProcessHeap () returned 0x630000 [0065.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0065.628] GetProcessHeap () returned 0x630000 [0065.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0065.628] GetProcessHeap () returned 0x630000 [0065.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0065.628] GetProcessHeap () returned 0x630000 [0065.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0065.628] GetProcessHeap () returned 0x630000 [0065.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0065.628] GetProcessHeap () returned 0x630000 [0065.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0065.628] GetProcessHeap () returned 0x630000 [0065.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0065.628] GetProcessHeap () returned 0x630000 [0065.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.628] GetProcessHeap () returned 0x630000 [0065.629] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0065.629] WriteFile (in: hFile=0x230, lpBuffer=0x659908*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659908*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0065.632] GetProcessHeap () returned 0x630000 [0065.632] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659908, Size=0x30) returned 0x659908 [0065.632] GetProcessHeap () returned 0x630000 [0065.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0065.632] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0065.632] GetProcessHeap () returned 0x630000 [0065.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x26bc) returned 0x671bf0 [0065.632] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0x26bc, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0x26bc, lpOverlapped=0x0) returned 1 [0065.632] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0065.632] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x26bc, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0x26bc, lpOverlapped=0x0) returned 1 [0065.633] GetProcessHeap () returned 0x630000 [0065.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0065.633] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0065.633] WriteFile (in: hFile=0x230, lpBuffer=0x659908*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659908*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0065.634] CloseHandle (hObject=0x230) returned 1 [0065.635] GetProcessHeap () returned 0x630000 [0065.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0065.635] GetProcessHeap () returned 0x630000 [0065.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655580 | out: hHeap=0x630000) returned 1 [0065.635] GetProcessHeap () returned 0x630000 [0065.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0065.635] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\FcR-V7.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\FcR-V7.pptx") returned="C:\\Users\\FD1HVy\\Documents\\FcR-V7.pptx" [0065.635] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\FcR-V7.pptx", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\FcR-V7.pptx.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\FcR-V7.pptx.happythreechoose" [0065.635] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\FcR-V7.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\fcr-v7.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\FcR-V7.pptx.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\fcr-v7.pptx.happythreechoose"), dwFlags=0x1) returned 1 [0065.635] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\FcR-V7.pptx" | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0065.635] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned="" [0065.635] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" [0065.636] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\decryption info.html")) returned 0x20 [0065.636] GetProcessHeap () returned 0x630000 [0065.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0065.636] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16b23ac0, ftCreationTime.dwHighDateTime=0x1d57b35, ftLastAccessTime.dwLowDateTime=0xc07aa20, ftLastAccessTime.dwHighDateTime=0x1d54f29, ftLastWriteTime.dwLowDateTime=0xc07aa20, ftLastWriteTime.dwHighDateTime=0x1d54f29, nFileSizeHigh=0x0, nFileSizeLow=0x21eb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="fEVjO1rHN.xlsx", cAlternateFileName="FEVJO1~1.XLS")) returned 1 [0065.636] lstrcmpiW (lpString1="fEVjO1rHN.xlsx", lpString2=".") returned 1 [0065.636] lstrcmpiW (lpString1="fEVjO1rHN.xlsx", lpString2="..") returned 1 [0065.636] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="fEVjO1rHN.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\fEVjO1rHN.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\fEVjO1rHN.xlsx" [0065.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fEVjO1rHN.xlsx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0065.636] GetProcessHeap () returned 0x630000 [0065.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0065.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fEVjO1rHN.xlsx", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fEVjO1rHN.xlsx", lpUsedDefaultChar=0x0) returned 15 [0065.636] lstrlenA (lpString="fEVjO1rHN.xlsx") returned 14 [0065.636] lstrlenA (lpString=".happythreechoose") returned 17 [0065.636] lstrcmpiW (lpString1="fEVjO1rHN.xlsx", lpString2="Decryption INFO.html") returned 1 [0065.636] lstrcmpiW (lpString1="fEVjO1rHN.xlsx", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0065.636] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0065.636] lstrcmpiW (lpString1="fEVjO1rHN.xlsx", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0065.636] GetProcessHeap () returned 0x630000 [0065.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0065.636] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\fEVjO1rHN.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\fevjo1rhn.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0065.636] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=8683) returned 1 [0065.636] GetProcessHeap () returned 0x630000 [0065.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655940 [0065.636] GetProcessHeap () returned 0x630000 [0065.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0065.636] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\fEVjO1rHN.xlsx") returned 40 [0065.636] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0065.637] GetProcessHeap () returned 0x630000 [0065.637] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0065.637] GetProcessHeap () returned 0x630000 [0065.637] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x659940 [0065.637] lstrlenA (lpString="rsa_encrypt") returned 11 [0065.637] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0065.637] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0065.637] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0065.637] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0065.637] GetProcessHeap () returned 0x630000 [0065.637] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0065.637] lstrlenA (lpString="010001") returned 6 [0065.637] GetProcessHeap () returned 0x630000 [0065.637] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a318 [0065.637] GetProcessHeap () returned 0x630000 [0065.638] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0065.638] GetProcessHeap () returned 0x630000 [0065.638] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e970 [0065.638] GetProcessHeap () returned 0x630000 [0065.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0065.638] GetProcessHeap () returned 0x630000 [0065.638] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea00 [0065.638] GetProcessHeap () returned 0x630000 [0065.638] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656fe0 [0065.638] GetProcessHeap () returned 0x630000 [0065.638] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0065.638] GetProcessHeap () returned 0x630000 [0065.638] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0065.638] GetProcessHeap () returned 0x630000 [0065.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.638] GetProcessHeap () returned 0x630000 [0065.638] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0065.638] GetProcessHeap () returned 0x630000 [0065.638] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0065.638] GetProcessHeap () returned 0x630000 [0065.638] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656db0 [0065.638] GetProcessHeap () returned 0x630000 [0065.638] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.638] GetProcessHeap () returned 0x630000 [0065.638] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0065.638] GetProcessHeap () returned 0x630000 [0065.638] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0065.638] GetProcessHeap () returned 0x630000 [0065.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0065.638] GetProcessHeap () returned 0x630000 [0065.638] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0065.638] GetProcessHeap () returned 0x630000 [0065.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0065.638] GetProcessHeap () returned 0x630000 [0065.638] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.638] GetProcessHeap () returned 0x630000 [0065.638] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65d0c0 [0065.638] GetProcessHeap () returned 0x630000 [0065.639] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.639] GetProcessHeap () returned 0x630000 [0065.639] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.639] GetProcessHeap () returned 0x630000 [0065.639] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0065.639] GetProcessHeap () returned 0x630000 [0065.639] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0065.639] GetProcessHeap () returned 0x630000 [0065.639] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65eb20 [0065.639] GetProcessHeap () returned 0x630000 [0065.639] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65d0c0 | out: hHeap=0x630000) returned 1 [0065.639] GetProcessHeap () returned 0x630000 [0065.639] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0065.639] GetProcessHeap () returned 0x630000 [0065.639] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0065.639] GetProcessHeap () returned 0x630000 [0065.639] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0065.639] GetProcessHeap () returned 0x630000 [0065.639] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0065.639] GetProcessHeap () returned 0x630000 [0065.639] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.639] GetProcessHeap () returned 0x630000 [0065.639] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.639] GetProcessHeap () returned 0x630000 [0065.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.640] GetProcessHeap () returned 0x630000 [0065.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.640] GetProcessHeap () returned 0x630000 [0065.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.640] GetProcessHeap () returned 0x630000 [0065.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.640] GetProcessHeap () returned 0x630000 [0065.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0065.640] GetProcessHeap () returned 0x630000 [0065.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0065.640] GetProcessHeap () returned 0x630000 [0065.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.640] GetProcessHeap () returned 0x630000 [0065.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.640] GetProcessHeap () returned 0x630000 [0065.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.640] GetProcessHeap () returned 0x630000 [0065.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.640] GetProcessHeap () returned 0x630000 [0065.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.640] GetProcessHeap () returned 0x630000 [0065.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.640] GetProcessHeap () returned 0x630000 [0065.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.640] GetProcessHeap () returned 0x630000 [0065.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.640] GetProcessHeap () returned 0x630000 [0065.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.640] GetProcessHeap () returned 0x630000 [0065.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.640] GetProcessHeap () returned 0x630000 [0065.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.640] GetProcessHeap () returned 0x630000 [0065.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.641] GetProcessHeap () returned 0x630000 [0065.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.641] GetProcessHeap () returned 0x630000 [0065.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.641] GetProcessHeap () returned 0x630000 [0065.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.641] GetProcessHeap () returned 0x630000 [0065.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.641] GetProcessHeap () returned 0x630000 [0065.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.641] GetProcessHeap () returned 0x630000 [0065.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.641] GetProcessHeap () returned 0x630000 [0065.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.641] GetProcessHeap () returned 0x630000 [0065.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.641] GetProcessHeap () returned 0x630000 [0065.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.641] GetProcessHeap () returned 0x630000 [0065.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.641] GetProcessHeap () returned 0x630000 [0065.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.641] GetProcessHeap () returned 0x630000 [0065.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.641] GetProcessHeap () returned 0x630000 [0065.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.641] GetProcessHeap () returned 0x630000 [0065.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.641] GetProcessHeap () returned 0x630000 [0065.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.641] GetProcessHeap () returned 0x630000 [0065.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.641] GetProcessHeap () returned 0x630000 [0065.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0065.641] GetProcessHeap () returned 0x630000 [0065.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0065.642] GetProcessHeap () returned 0x630000 [0065.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.642] GetProcessHeap () returned 0x630000 [0065.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.642] GetProcessHeap () returned 0x630000 [0065.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.642] GetProcessHeap () returned 0x630000 [0065.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.642] GetProcessHeap () returned 0x630000 [0065.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.642] GetProcessHeap () returned 0x630000 [0065.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.642] GetProcessHeap () returned 0x630000 [0065.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0065.642] GetProcessHeap () returned 0x630000 [0065.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0065.642] GetProcessHeap () returned 0x630000 [0065.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.642] GetProcessHeap () returned 0x630000 [0065.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.642] GetProcessHeap () returned 0x630000 [0065.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.642] GetProcessHeap () returned 0x630000 [0065.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.642] GetProcessHeap () returned 0x630000 [0065.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.642] GetProcessHeap () returned 0x630000 [0065.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.642] GetProcessHeap () returned 0x630000 [0065.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.642] GetProcessHeap () returned 0x630000 [0065.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.642] GetProcessHeap () returned 0x630000 [0065.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.642] GetProcessHeap () returned 0x630000 [0065.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.643] GetProcessHeap () returned 0x630000 [0065.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.643] GetProcessHeap () returned 0x630000 [0065.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.643] GetProcessHeap () returned 0x630000 [0065.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.643] GetProcessHeap () returned 0x630000 [0065.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.643] GetProcessHeap () returned 0x630000 [0065.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.643] GetProcessHeap () returned 0x630000 [0065.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.643] GetProcessHeap () returned 0x630000 [0065.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.643] GetProcessHeap () returned 0x630000 [0065.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.643] GetProcessHeap () returned 0x630000 [0065.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0065.643] GetProcessHeap () returned 0x630000 [0065.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0065.643] GetProcessHeap () returned 0x630000 [0065.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.643] GetProcessHeap () returned 0x630000 [0065.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.643] GetProcessHeap () returned 0x630000 [0065.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.643] GetProcessHeap () returned 0x630000 [0065.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.643] GetProcessHeap () returned 0x630000 [0065.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.643] GetProcessHeap () returned 0x630000 [0065.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.643] GetProcessHeap () returned 0x630000 [0065.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.643] GetProcessHeap () returned 0x630000 [0065.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.643] GetProcessHeap () returned 0x630000 [0065.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0065.644] GetProcessHeap () returned 0x630000 [0065.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0065.644] GetProcessHeap () returned 0x630000 [0065.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.644] GetProcessHeap () returned 0x630000 [0065.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.644] GetProcessHeap () returned 0x630000 [0065.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.644] GetProcessHeap () returned 0x630000 [0065.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.644] GetProcessHeap () returned 0x630000 [0065.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0065.644] GetProcessHeap () returned 0x630000 [0065.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0065.644] GetProcessHeap () returned 0x630000 [0065.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0065.644] GetProcessHeap () returned 0x630000 [0065.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0065.644] GetProcessHeap () returned 0x630000 [0065.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0065.644] GetProcessHeap () returned 0x630000 [0065.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0065.644] GetProcessHeap () returned 0x630000 [0065.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0065.644] GetProcessHeap () returned 0x630000 [0065.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0065.644] GetProcessHeap () returned 0x630000 [0065.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0065.644] GetProcessHeap () returned 0x630000 [0065.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.644] GetProcessHeap () returned 0x630000 [0065.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0065.644] WriteFile (in: hFile=0x230, lpBuffer=0x659940*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659940*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0065.647] GetProcessHeap () returned 0x630000 [0065.647] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659940, Size=0x30) returned 0x659940 [0065.647] GetProcessHeap () returned 0x630000 [0065.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0065.647] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0065.647] GetProcessHeap () returned 0x630000 [0065.647] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x21eb) returned 0x671bf0 [0065.647] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0x21eb, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0x21eb, lpOverlapped=0x0) returned 1 [0065.647] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0065.647] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x21eb, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0x21eb, lpOverlapped=0x0) returned 1 [0065.648] GetProcessHeap () returned 0x630000 [0065.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0065.648] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0065.648] WriteFile (in: hFile=0x230, lpBuffer=0x659940*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659940*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0065.649] CloseHandle (hObject=0x230) returned 1 [0065.650] GetProcessHeap () returned 0x630000 [0065.650] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0065.650] GetProcessHeap () returned 0x630000 [0065.650] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655940 | out: hHeap=0x630000) returned 1 [0065.650] GetProcessHeap () returned 0x630000 [0065.650] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0065.650] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\fEVjO1rHN.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\fEVjO1rHN.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\fEVjO1rHN.xlsx" [0065.650] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\fEVjO1rHN.xlsx", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\fEVjO1rHN.xlsx.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\fEVjO1rHN.xlsx.happythreechoose" [0065.650] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\fEVjO1rHN.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\fevjo1rhn.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\fEVjO1rHN.xlsx.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\fevjo1rhn.xlsx.happythreechoose"), dwFlags=0x1) returned 1 [0065.650] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\fEVjO1rHN.xlsx" | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0065.650] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned="" [0065.650] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" [0065.650] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\decryption info.html")) returned 0x20 [0065.651] GetProcessHeap () returned 0x630000 [0065.651] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0065.651] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b441d00, ftCreationTime.dwHighDateTime=0x1d5b2fc, ftLastAccessTime.dwLowDateTime=0x351dee20, ftLastAccessTime.dwHighDateTime=0x1d59d0c, ftLastWriteTime.dwLowDateTime=0x351dee20, ftLastWriteTime.dwHighDateTime=0x1d59d0c, nFileSizeHigh=0x0, nFileSizeLow=0xe233, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HDHdw.xlsx", cAlternateFileName="HDHDW~1.XLS")) returned 1 [0065.651] lstrcmpiW (lpString1="HDHdw.xlsx", lpString2=".") returned 1 [0065.651] lstrcmpiW (lpString1="HDHdw.xlsx", lpString2="..") returned 1 [0065.651] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="HDHdw.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\HDHdw.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\HDHdw.xlsx" [0065.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HDHdw.xlsx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0065.651] GetProcessHeap () returned 0x630000 [0065.651] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb) returned 0x64c9f0 [0065.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HDHdw.xlsx", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HDHdw.xlsx", lpUsedDefaultChar=0x0) returned 11 [0065.651] lstrlenA (lpString="HDHdw.xlsx") returned 10 [0065.651] lstrlenA (lpString=".happythreechoose") returned 17 [0065.651] lstrcmpiW (lpString1="HDHdw.xlsx", lpString2="Decryption INFO.html") returned 1 [0065.651] lstrcmpiW (lpString1="HDHdw.xlsx", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0065.651] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0065.651] lstrcmpiW (lpString1="HDHdw.xlsx", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0065.651] GetProcessHeap () returned 0x630000 [0065.651] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0065.651] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\HDHdw.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\hdhdw.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0065.651] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=57907) returned 1 [0065.651] GetProcessHeap () returned 0x630000 [0065.651] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655580 [0065.651] GetProcessHeap () returned 0x630000 [0065.651] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0065.651] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\HDHdw.xlsx") returned 36 [0065.651] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0065.651] GetProcessHeap () returned 0x630000 [0065.651] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0065.652] GetProcessHeap () returned 0x630000 [0065.652] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x659978 [0065.652] lstrlenA (lpString="rsa_encrypt") returned 11 [0065.652] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0065.652] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0065.652] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0065.652] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0065.652] GetProcessHeap () returned 0x630000 [0065.652] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0065.652] lstrlenA (lpString="010001") returned 6 [0065.652] GetProcessHeap () returned 0x630000 [0065.652] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a318 [0065.652] GetProcessHeap () returned 0x630000 [0065.652] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0065.652] GetProcessHeap () returned 0x630000 [0065.652] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e610 [0065.652] GetProcessHeap () returned 0x630000 [0065.652] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0065.653] GetProcessHeap () returned 0x630000 [0065.653] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65df50 [0065.653] GetProcessHeap () returned 0x630000 [0065.653] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x6570f8 [0065.653] GetProcessHeap () returned 0x630000 [0065.653] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0065.653] GetProcessHeap () returned 0x630000 [0065.653] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0065.653] GetProcessHeap () returned 0x630000 [0065.653] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.653] GetProcessHeap () returned 0x630000 [0065.653] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0065.653] GetProcessHeap () returned 0x630000 [0065.653] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0065.653] GetProcessHeap () returned 0x630000 [0065.653] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656b80 [0065.653] GetProcessHeap () returned 0x630000 [0065.653] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.653] GetProcessHeap () returned 0x630000 [0065.653] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0065.653] GetProcessHeap () returned 0x630000 [0065.653] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e3d0 [0065.653] GetProcessHeap () returned 0x630000 [0065.653] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0065.653] GetProcessHeap () returned 0x630000 [0065.653] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0065.653] GetProcessHeap () returned 0x630000 [0065.653] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0065.653] GetProcessHeap () returned 0x630000 [0065.653] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.653] GetProcessHeap () returned 0x630000 [0065.653] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65ce50 [0065.653] GetProcessHeap () returned 0x630000 [0065.653] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.653] GetProcessHeap () returned 0x630000 [0065.653] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.653] GetProcessHeap () returned 0x630000 [0065.653] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.653] GetProcessHeap () returned 0x630000 [0065.654] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.654] GetProcessHeap () returned 0x630000 [0065.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ecd0 [0065.654] GetProcessHeap () returned 0x630000 [0065.654] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ce50 | out: hHeap=0x630000) returned 1 [0065.654] GetProcessHeap () returned 0x630000 [0065.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0065.654] GetProcessHeap () returned 0x630000 [0065.654] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ecd0 | out: hHeap=0x630000) returned 1 [0065.654] GetProcessHeap () returned 0x630000 [0065.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.654] GetProcessHeap () returned 0x630000 [0065.654] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.654] GetProcessHeap () returned 0x630000 [0065.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.654] GetProcessHeap () returned 0x630000 [0065.654] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.654] GetProcessHeap () returned 0x630000 [0065.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.654] GetProcessHeap () returned 0x630000 [0065.654] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.654] GetProcessHeap () returned 0x630000 [0065.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.654] GetProcessHeap () returned 0x630000 [0065.654] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.654] GetProcessHeap () returned 0x630000 [0065.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0065.654] GetProcessHeap () returned 0x630000 [0065.654] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0065.654] GetProcessHeap () returned 0x630000 [0065.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.654] GetProcessHeap () returned 0x630000 [0065.654] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.654] GetProcessHeap () returned 0x630000 [0065.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.654] GetProcessHeap () returned 0x630000 [0065.655] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.655] GetProcessHeap () returned 0x630000 [0065.655] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.655] GetProcessHeap () returned 0x630000 [0065.655] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.655] GetProcessHeap () returned 0x630000 [0065.655] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.655] GetProcessHeap () returned 0x630000 [0065.655] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.655] GetProcessHeap () returned 0x630000 [0065.655] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.655] GetProcessHeap () returned 0x630000 [0065.656] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.656] GetProcessHeap () returned 0x630000 [0065.656] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.656] GetProcessHeap () returned 0x630000 [0065.656] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.656] GetProcessHeap () returned 0x630000 [0065.656] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.656] GetProcessHeap () returned 0x630000 [0065.656] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.656] GetProcessHeap () returned 0x630000 [0065.656] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.656] GetProcessHeap () returned 0x630000 [0065.656] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.657] GetProcessHeap () returned 0x630000 [0065.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.657] GetProcessHeap () returned 0x630000 [0065.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.657] GetProcessHeap () returned 0x630000 [0065.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0065.657] GetProcessHeap () returned 0x630000 [0065.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0065.657] GetProcessHeap () returned 0x630000 [0065.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.657] GetProcessHeap () returned 0x630000 [0065.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.657] GetProcessHeap () returned 0x630000 [0065.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.657] GetProcessHeap () returned 0x630000 [0065.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.657] GetProcessHeap () returned 0x630000 [0065.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.657] GetProcessHeap () returned 0x630000 [0065.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.657] GetProcessHeap () returned 0x630000 [0065.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.657] GetProcessHeap () returned 0x630000 [0065.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.657] GetProcessHeap () returned 0x630000 [0065.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0065.657] GetProcessHeap () returned 0x630000 [0065.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0065.657] GetProcessHeap () returned 0x630000 [0065.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.657] GetProcessHeap () returned 0x630000 [0065.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.657] GetProcessHeap () returned 0x630000 [0065.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.657] GetProcessHeap () returned 0x630000 [0065.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.657] GetProcessHeap () returned 0x630000 [0065.658] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.658] GetProcessHeap () returned 0x630000 [0065.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.658] GetProcessHeap () returned 0x630000 [0065.658] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.658] GetProcessHeap () returned 0x630000 [0065.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.658] GetProcessHeap () returned 0x630000 [0065.658] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0065.658] GetProcessHeap () returned 0x630000 [0065.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0065.658] GetProcessHeap () returned 0x630000 [0065.658] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.658] GetProcessHeap () returned 0x630000 [0065.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.658] GetProcessHeap () returned 0x630000 [0065.658] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.658] GetProcessHeap () returned 0x630000 [0065.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.658] GetProcessHeap () returned 0x630000 [0065.658] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.658] GetProcessHeap () returned 0x630000 [0065.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.658] GetProcessHeap () returned 0x630000 [0065.658] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.658] GetProcessHeap () returned 0x630000 [0065.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.658] GetProcessHeap () returned 0x630000 [0065.658] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.658] GetProcessHeap () returned 0x630000 [0065.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.658] GetProcessHeap () returned 0x630000 [0065.658] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.658] GetProcessHeap () returned 0x630000 [0065.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.658] GetProcessHeap () returned 0x630000 [0065.658] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.659] GetProcessHeap () returned 0x630000 [0065.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.659] GetProcessHeap () returned 0x630000 [0065.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.659] GetProcessHeap () returned 0x630000 [0065.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.659] GetProcessHeap () returned 0x630000 [0065.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.659] GetProcessHeap () returned 0x630000 [0065.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.659] GetProcessHeap () returned 0x630000 [0065.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.659] GetProcessHeap () returned 0x630000 [0065.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.659] GetProcessHeap () returned 0x630000 [0065.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.659] GetProcessHeap () returned 0x630000 [0065.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.659] GetProcessHeap () returned 0x630000 [0065.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0065.659] GetProcessHeap () returned 0x630000 [0065.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0065.659] GetProcessHeap () returned 0x630000 [0065.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0065.659] GetProcessHeap () returned 0x630000 [0065.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0065.659] GetProcessHeap () returned 0x630000 [0065.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.659] GetProcessHeap () returned 0x630000 [0065.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.659] GetProcessHeap () returned 0x630000 [0065.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.659] GetProcessHeap () returned 0x630000 [0065.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.659] GetProcessHeap () returned 0x630000 [0065.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.660] GetProcessHeap () returned 0x630000 [0065.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.660] GetProcessHeap () returned 0x630000 [0065.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0065.660] GetProcessHeap () returned 0x630000 [0065.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0065.660] GetProcessHeap () returned 0x630000 [0065.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0065.660] GetProcessHeap () returned 0x630000 [0065.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0065.660] GetProcessHeap () returned 0x630000 [0065.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0065.660] GetProcessHeap () returned 0x630000 [0065.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0065.660] GetProcessHeap () returned 0x630000 [0065.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0065.660] GetProcessHeap () returned 0x630000 [0065.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0065.660] GetProcessHeap () returned 0x630000 [0065.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0065.660] GetProcessHeap () returned 0x630000 [0065.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.660] GetProcessHeap () returned 0x630000 [0065.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0065.660] WriteFile (in: hFile=0x230, lpBuffer=0x659978*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659978*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0065.662] GetProcessHeap () returned 0x630000 [0065.662] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659978, Size=0x30) returned 0x659978 [0065.662] GetProcessHeap () returned 0x630000 [0065.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0065.662] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0065.662] GetProcessHeap () returned 0x630000 [0065.662] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe233) returned 0x671bf0 [0065.662] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0xe233, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0xe233, lpOverlapped=0x0) returned 1 [0065.663] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0065.663] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0xe233, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0xe233, lpOverlapped=0x0) returned 1 [0065.664] GetProcessHeap () returned 0x630000 [0065.664] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0065.665] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0065.665] WriteFile (in: hFile=0x230, lpBuffer=0x659978*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659978*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0065.666] CloseHandle (hObject=0x230) returned 1 [0065.667] GetProcessHeap () returned 0x630000 [0065.667] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0065.667] GetProcessHeap () returned 0x630000 [0065.667] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655580 | out: hHeap=0x630000) returned 1 [0065.667] GetProcessHeap () returned 0x630000 [0065.667] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0065.667] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\HDHdw.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\HDHdw.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\HDHdw.xlsx" [0065.667] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\HDHdw.xlsx", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\HDHdw.xlsx.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\HDHdw.xlsx.happythreechoose" [0065.667] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\HDHdw.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\hdhdw.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\HDHdw.xlsx.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\hdhdw.xlsx.happythreechoose"), dwFlags=0x1) returned 1 [0065.668] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\HDHdw.xlsx" | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0065.668] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned="" [0065.668] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" [0065.668] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\decryption info.html")) returned 0x20 [0065.668] GetProcessHeap () returned 0x630000 [0065.668] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0065.668] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3de7ea0, ftCreationTime.dwHighDateTime=0x1d58872, ftLastAccessTime.dwLowDateTime=0xf9e871f0, ftLastAccessTime.dwHighDateTime=0x1d59210, ftLastWriteTime.dwLowDateTime=0xf9e871f0, ftLastWriteTime.dwHighDateTime=0x1d59210, nFileSizeHigh=0x0, nFileSizeLow=0x12698, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="H__Q4DEYEHBavzaZT.xlsx", cAlternateFileName="H__Q4D~1.XLS")) returned 1 [0065.668] lstrcmpiW (lpString1="H__Q4DEYEHBavzaZT.xlsx", lpString2=".") returned 1 [0065.668] lstrcmpiW (lpString1="H__Q4DEYEHBavzaZT.xlsx", lpString2="..") returned 1 [0065.668] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="H__Q4DEYEHBavzaZT.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\H__Q4DEYEHBavzaZT.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\H__Q4DEYEHBavzaZT.xlsx" [0065.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H__Q4DEYEHBavzaZT.xlsx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0065.668] GetProcessHeap () returned 0x630000 [0065.668] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x17) returned 0x645e58 [0065.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H__Q4DEYEHBavzaZT.xlsx", cchWideChar=-1, lpMultiByteStr=0x645e58, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H__Q4DEYEHBavzaZT.xlsx", lpUsedDefaultChar=0x0) returned 23 [0065.668] lstrlenA (lpString="H__Q4DEYEHBavzaZT.xlsx") returned 22 [0065.668] lstrlenA (lpString=".happythreechoose") returned 17 [0065.668] lstrlenA (lpString=".happythreechoose") returned 17 [0065.668] lstrlenA (lpString="H__Q4DEYEHBavzaZT.xlsx") returned 22 [0065.668] lstrcmpiA (lpString1="DEYEHBavzaZT.xlsx", lpString2=".happythreechoose") returned 1 [0065.668] lstrcmpiW (lpString1="H__Q4DEYEHBavzaZT.xlsx", lpString2="Decryption INFO.html") returned 1 [0065.668] lstrcmpiW (lpString1="H__Q4DEYEHBavzaZT.xlsx", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0065.668] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0065.668] lstrcmpiW (lpString1="H__Q4DEYEHBavzaZT.xlsx", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0065.668] GetProcessHeap () returned 0x630000 [0065.668] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0065.668] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\H__Q4DEYEHBavzaZT.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\h__q4deyehbavzazt.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0065.668] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=75416) returned 1 [0065.668] GetProcessHeap () returned 0x630000 [0065.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655aa8 [0065.669] GetProcessHeap () returned 0x630000 [0065.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0065.669] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\H__Q4DEYEHBavzaZT.xlsx") returned 48 [0065.669] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0065.669] GetProcessHeap () returned 0x630000 [0065.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0065.669] GetProcessHeap () returned 0x630000 [0065.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x6599b0 [0065.669] lstrlenA (lpString="rsa_encrypt") returned 11 [0065.669] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0065.669] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0065.669] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0065.669] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0065.669] GetProcessHeap () returned 0x630000 [0065.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0065.669] lstrlenA (lpString="010001") returned 6 [0065.669] GetProcessHeap () returned 0x630000 [0065.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0065.670] GetProcessHeap () returned 0x630000 [0065.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0065.670] GetProcessHeap () returned 0x630000 [0065.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0065.670] GetProcessHeap () returned 0x630000 [0065.670] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0065.670] GetProcessHeap () returned 0x630000 [0065.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea90 [0065.670] GetProcessHeap () returned 0x630000 [0065.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657328 [0065.670] GetProcessHeap () returned 0x630000 [0065.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0065.670] GetProcessHeap () returned 0x630000 [0065.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0065.670] GetProcessHeap () returned 0x630000 [0065.670] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.670] GetProcessHeap () returned 0x630000 [0065.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0065.670] GetProcessHeap () returned 0x630000 [0065.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0065.670] GetProcessHeap () returned 0x630000 [0065.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656a68 [0065.670] GetProcessHeap () returned 0x630000 [0065.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.670] GetProcessHeap () returned 0x630000 [0065.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0065.670] GetProcessHeap () returned 0x630000 [0065.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0065.670] GetProcessHeap () returned 0x630000 [0065.670] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0065.670] GetProcessHeap () returned 0x630000 [0065.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0065.670] GetProcessHeap () returned 0x630000 [0065.670] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0065.670] GetProcessHeap () returned 0x630000 [0065.671] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0065.671] GetProcessHeap () returned 0x630000 [0065.671] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0065.671] GetProcessHeap () returned 0x630000 [0065.671] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.671] GetProcessHeap () returned 0x630000 [0065.671] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0065.671] GetProcessHeap () returned 0x630000 [0065.671] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.671] GetProcessHeap () returned 0x630000 [0065.671] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.671] GetProcessHeap () returned 0x630000 [0065.671] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e730 [0065.671] GetProcessHeap () returned 0x630000 [0065.671] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0065.671] GetProcessHeap () returned 0x630000 [0065.671] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0065.671] GetProcessHeap () returned 0x630000 [0065.671] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0065.671] GetProcessHeap () returned 0x630000 [0065.671] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.671] GetProcessHeap () returned 0x630000 [0065.671] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.671] GetProcessHeap () returned 0x630000 [0065.671] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0065.671] GetProcessHeap () returned 0x630000 [0065.671] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0065.672] GetProcessHeap () returned 0x630000 [0065.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.672] GetProcessHeap () returned 0x630000 [0065.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.672] GetProcessHeap () returned 0x630000 [0065.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.672] GetProcessHeap () returned 0x630000 [0065.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.672] GetProcessHeap () returned 0x630000 [0065.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.672] GetProcessHeap () returned 0x630000 [0065.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.672] GetProcessHeap () returned 0x630000 [0065.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.672] GetProcessHeap () returned 0x630000 [0065.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.672] GetProcessHeap () returned 0x630000 [0065.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0065.672] GetProcessHeap () returned 0x630000 [0065.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0065.672] GetProcessHeap () returned 0x630000 [0065.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.672] GetProcessHeap () returned 0x630000 [0065.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.672] GetProcessHeap () returned 0x630000 [0065.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.672] GetProcessHeap () returned 0x630000 [0065.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.672] GetProcessHeap () returned 0x630000 [0065.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.672] GetProcessHeap () returned 0x630000 [0065.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.672] GetProcessHeap () returned 0x630000 [0065.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.672] GetProcessHeap () returned 0x630000 [0065.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.672] GetProcessHeap () returned 0x630000 [0065.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.673] GetProcessHeap () returned 0x630000 [0065.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.673] GetProcessHeap () returned 0x630000 [0065.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.673] GetProcessHeap () returned 0x630000 [0065.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.673] GetProcessHeap () returned 0x630000 [0065.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.673] GetProcessHeap () returned 0x630000 [0065.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.673] GetProcessHeap () returned 0x630000 [0065.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.673] GetProcessHeap () returned 0x630000 [0065.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.673] GetProcessHeap () returned 0x630000 [0065.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.673] GetProcessHeap () returned 0x630000 [0065.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.673] GetProcessHeap () returned 0x630000 [0065.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.673] GetProcessHeap () returned 0x630000 [0065.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.673] GetProcessHeap () returned 0x630000 [0065.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.673] GetProcessHeap () returned 0x630000 [0065.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.673] GetProcessHeap () returned 0x630000 [0065.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0065.673] GetProcessHeap () returned 0x630000 [0065.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0065.673] GetProcessHeap () returned 0x630000 [0065.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.673] GetProcessHeap () returned 0x630000 [0065.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.673] GetProcessHeap () returned 0x630000 [0065.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.674] GetProcessHeap () returned 0x630000 [0065.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.674] GetProcessHeap () returned 0x630000 [0065.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.674] GetProcessHeap () returned 0x630000 [0065.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.674] GetProcessHeap () returned 0x630000 [0065.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.674] GetProcessHeap () returned 0x630000 [0065.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.674] GetProcessHeap () returned 0x630000 [0065.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.674] GetProcessHeap () returned 0x630000 [0065.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.674] GetProcessHeap () returned 0x630000 [0065.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.674] GetProcessHeap () returned 0x630000 [0065.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.674] GetProcessHeap () returned 0x630000 [0065.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.674] GetProcessHeap () returned 0x630000 [0065.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.674] GetProcessHeap () returned 0x630000 [0065.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.674] GetProcessHeap () returned 0x630000 [0065.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.674] GetProcessHeap () returned 0x630000 [0065.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.674] GetProcessHeap () returned 0x630000 [0065.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.674] GetProcessHeap () returned 0x630000 [0065.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.674] GetProcessHeap () returned 0x630000 [0065.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.674] GetProcessHeap () returned 0x630000 [0065.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.674] GetProcessHeap () returned 0x630000 [0065.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.675] GetProcessHeap () returned 0x630000 [0065.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.675] GetProcessHeap () returned 0x630000 [0065.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.675] GetProcessHeap () returned 0x630000 [0065.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.675] GetProcessHeap () returned 0x630000 [0065.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.675] GetProcessHeap () returned 0x630000 [0065.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.675] GetProcessHeap () returned 0x630000 [0065.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.675] GetProcessHeap () returned 0x630000 [0065.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.675] GetProcessHeap () returned 0x630000 [0065.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.675] GetProcessHeap () returned 0x630000 [0065.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.675] GetProcessHeap () returned 0x630000 [0065.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.675] GetProcessHeap () returned 0x630000 [0065.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.675] GetProcessHeap () returned 0x630000 [0065.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.675] GetProcessHeap () returned 0x630000 [0065.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.675] GetProcessHeap () returned 0x630000 [0065.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.675] GetProcessHeap () returned 0x630000 [0065.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.675] GetProcessHeap () returned 0x630000 [0065.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.675] GetProcessHeap () returned 0x630000 [0065.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.675] GetProcessHeap () returned 0x630000 [0065.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.675] GetProcessHeap () returned 0x630000 [0065.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.676] GetProcessHeap () returned 0x630000 [0065.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.676] GetProcessHeap () returned 0x630000 [0065.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.676] GetProcessHeap () returned 0x630000 [0065.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.676] GetProcessHeap () returned 0x630000 [0065.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0065.676] GetProcessHeap () returned 0x630000 [0065.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0065.676] GetProcessHeap () returned 0x630000 [0065.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0065.676] GetProcessHeap () returned 0x630000 [0065.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0065.676] GetProcessHeap () returned 0x630000 [0065.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0065.676] GetProcessHeap () returned 0x630000 [0065.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea90 | out: hHeap=0x630000) returned 1 [0065.676] GetProcessHeap () returned 0x630000 [0065.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0065.676] GetProcessHeap () returned 0x630000 [0065.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0065.676] GetProcessHeap () returned 0x630000 [0065.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0065.676] GetProcessHeap () returned 0x630000 [0065.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.676] GetProcessHeap () returned 0x630000 [0065.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0065.676] WriteFile (in: hFile=0x230, lpBuffer=0x6599b0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6599b0*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0065.686] GetProcessHeap () returned 0x630000 [0065.686] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6599b0, Size=0x30) returned 0x6599b0 [0065.686] GetProcessHeap () returned 0x630000 [0065.686] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0065.686] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0065.687] GetProcessHeap () returned 0x630000 [0065.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12698) returned 0x671bf0 [0065.689] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0x12698, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0x12698, lpOverlapped=0x0) returned 1 [0065.690] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0065.690] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x12698, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0x12698, lpOverlapped=0x0) returned 1 [0065.691] GetProcessHeap () returned 0x630000 [0065.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0065.691] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0065.691] WriteFile (in: hFile=0x230, lpBuffer=0x6599b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6599b0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0065.692] CloseHandle (hObject=0x230) returned 1 [0065.693] GetProcessHeap () returned 0x630000 [0065.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0065.693] GetProcessHeap () returned 0x630000 [0065.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655aa8 | out: hHeap=0x630000) returned 1 [0065.693] GetProcessHeap () returned 0x630000 [0065.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0065.693] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\H__Q4DEYEHBavzaZT.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\H__Q4DEYEHBavzaZT.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\H__Q4DEYEHBavzaZT.xlsx" [0065.693] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\H__Q4DEYEHBavzaZT.xlsx", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\H__Q4DEYEHBavzaZT.xlsx.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\H__Q4DEYEHBavzaZT.xlsx.happythreechoose" [0065.693] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\H__Q4DEYEHBavzaZT.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\h__q4deyehbavzazt.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\H__Q4DEYEHBavzaZT.xlsx.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\h__q4deyehbavzazt.xlsx.happythreechoose"), dwFlags=0x1) returned 1 [0065.693] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\H__Q4DEYEHBavzaZT.xlsx" | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0065.693] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned="" [0065.693] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" [0065.693] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\decryption info.html")) returned 0x20 [0065.693] GetProcessHeap () returned 0x630000 [0065.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645e58 | out: hHeap=0x630000) returned 1 [0065.694] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x223cf0, ftCreationTime.dwHighDateTime=0x1d55c5f, ftLastAccessTime.dwLowDateTime=0x1a5d2ce0, ftLastAccessTime.dwHighDateTime=0x1d58231, ftLastWriteTime.dwLowDateTime=0x1a5d2ce0, ftLastWriteTime.dwHighDateTime=0x1d58231, nFileSizeHigh=0x0, nFileSizeLow=0xdea3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jnflRr4J.xlsx", cAlternateFileName="JNFLRR~1.XLS")) returned 1 [0065.694] lstrcmpiW (lpString1="jnflRr4J.xlsx", lpString2=".") returned 1 [0065.694] lstrcmpiW (lpString1="jnflRr4J.xlsx", lpString2="..") returned 1 [0065.694] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="jnflRr4J.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\jnflRr4J.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\jnflRr4J.xlsx" [0065.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="jnflRr4J.xlsx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0065.694] GetProcessHeap () returned 0x630000 [0065.694] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x64ca20 [0065.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="jnflRr4J.xlsx", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jnflRr4J.xlsx", lpUsedDefaultChar=0x0) returned 14 [0065.694] lstrlenA (lpString="jnflRr4J.xlsx") returned 13 [0065.694] lstrlenA (lpString=".happythreechoose") returned 17 [0065.694] lstrcmpiW (lpString1="jnflRr4J.xlsx", lpString2="Decryption INFO.html") returned 1 [0065.694] lstrcmpiW (lpString1="jnflRr4J.xlsx", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0065.694] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0065.694] lstrcmpiW (lpString1="jnflRr4J.xlsx", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0065.694] GetProcessHeap () returned 0x630000 [0065.694] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0065.694] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\jnflRr4J.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\jnflrr4j.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0065.694] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=56995) returned 1 [0065.694] GetProcessHeap () returned 0x630000 [0065.694] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655850 [0065.694] GetProcessHeap () returned 0x630000 [0065.694] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0065.694] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\jnflRr4J.xlsx") returned 39 [0065.694] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0065.694] GetProcessHeap () returned 0x630000 [0065.694] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0065.694] GetProcessHeap () returned 0x630000 [0065.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38d) returned 0x6599e8 [0065.695] lstrlenA (lpString="rsa_encrypt") returned 11 [0065.695] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0065.695] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0065.695] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0065.695] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0065.695] GetProcessHeap () returned 0x630000 [0065.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0065.695] lstrlenA (lpString="010001") returned 6 [0065.695] GetProcessHeap () returned 0x630000 [0065.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0065.695] GetProcessHeap () returned 0x630000 [0065.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0065.695] GetProcessHeap () returned 0x630000 [0065.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e340 [0065.695] GetProcessHeap () returned 0x630000 [0065.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0065.696] GetProcessHeap () returned 0x630000 [0065.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e100 [0065.696] GetProcessHeap () returned 0x630000 [0065.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656950 [0065.696] GetProcessHeap () returned 0x630000 [0065.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0065.696] GetProcessHeap () returned 0x630000 [0065.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0065.696] GetProcessHeap () returned 0x630000 [0065.696] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.696] GetProcessHeap () returned 0x630000 [0065.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0065.696] GetProcessHeap () returned 0x630000 [0065.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0065.696] GetProcessHeap () returned 0x630000 [0065.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x6570f8 [0065.696] GetProcessHeap () returned 0x630000 [0065.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.696] GetProcessHeap () returned 0x630000 [0065.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0065.696] GetProcessHeap () returned 0x630000 [0065.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e190 [0065.696] GetProcessHeap () returned 0x630000 [0065.696] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0065.696] GetProcessHeap () returned 0x630000 [0065.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0065.696] GetProcessHeap () returned 0x630000 [0065.696] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0065.696] GetProcessHeap () returned 0x630000 [0065.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0065.696] GetProcessHeap () returned 0x630000 [0065.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cd60 [0065.696] GetProcessHeap () returned 0x630000 [0065.696] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.696] GetProcessHeap () returned 0x630000 [0065.696] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0065.696] GetProcessHeap () returned 0x630000 [0065.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.696] GetProcessHeap () returned 0x630000 [0065.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.697] GetProcessHeap () returned 0x630000 [0065.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e070 [0065.697] GetProcessHeap () returned 0x630000 [0065.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cd60 | out: hHeap=0x630000) returned 1 [0065.697] GetProcessHeap () returned 0x630000 [0065.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0065.697] GetProcessHeap () returned 0x630000 [0065.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0065.697] GetProcessHeap () returned 0x630000 [0065.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.697] GetProcessHeap () returned 0x630000 [0065.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.697] GetProcessHeap () returned 0x630000 [0065.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.697] GetProcessHeap () returned 0x630000 [0065.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.697] GetProcessHeap () returned 0x630000 [0065.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.697] GetProcessHeap () returned 0x630000 [0065.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.697] GetProcessHeap () returned 0x630000 [0065.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.697] GetProcessHeap () returned 0x630000 [0065.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.697] GetProcessHeap () returned 0x630000 [0065.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.697] GetProcessHeap () returned 0x630000 [0065.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.697] GetProcessHeap () returned 0x630000 [0065.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.697] GetProcessHeap () returned 0x630000 [0065.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.697] GetProcessHeap () returned 0x630000 [0065.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.697] GetProcessHeap () returned 0x630000 [0065.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.698] GetProcessHeap () returned 0x630000 [0065.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.698] GetProcessHeap () returned 0x630000 [0065.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.698] GetProcessHeap () returned 0x630000 [0065.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.698] GetProcessHeap () returned 0x630000 [0065.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.698] GetProcessHeap () returned 0x630000 [0065.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.698] GetProcessHeap () returned 0x630000 [0065.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.698] GetProcessHeap () returned 0x630000 [0065.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.698] GetProcessHeap () returned 0x630000 [0065.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.698] GetProcessHeap () returned 0x630000 [0065.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.698] GetProcessHeap () returned 0x630000 [0065.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.698] GetProcessHeap () returned 0x630000 [0065.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.698] GetProcessHeap () returned 0x630000 [0065.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.698] GetProcessHeap () returned 0x630000 [0065.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.698] GetProcessHeap () returned 0x630000 [0065.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.698] GetProcessHeap () returned 0x630000 [0065.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.698] GetProcessHeap () returned 0x630000 [0065.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.698] GetProcessHeap () returned 0x630000 [0065.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.698] GetProcessHeap () returned 0x630000 [0065.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.698] GetProcessHeap () returned 0x630000 [0065.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.699] GetProcessHeap () returned 0x630000 [0065.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.699] GetProcessHeap () returned 0x630000 [0065.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.699] GetProcessHeap () returned 0x630000 [0065.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.699] GetProcessHeap () returned 0x630000 [0065.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.699] GetProcessHeap () returned 0x630000 [0065.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.699] GetProcessHeap () returned 0x630000 [0065.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.699] GetProcessHeap () returned 0x630000 [0065.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.699] GetProcessHeap () returned 0x630000 [0065.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.699] GetProcessHeap () returned 0x630000 [0065.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.699] GetProcessHeap () returned 0x630000 [0065.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.699] GetProcessHeap () returned 0x630000 [0065.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.699] GetProcessHeap () returned 0x630000 [0065.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0065.699] GetProcessHeap () returned 0x630000 [0065.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0065.699] GetProcessHeap () returned 0x630000 [0065.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.699] GetProcessHeap () returned 0x630000 [0065.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.699] GetProcessHeap () returned 0x630000 [0065.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.699] GetProcessHeap () returned 0x630000 [0065.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.699] GetProcessHeap () returned 0x630000 [0065.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.700] GetProcessHeap () returned 0x630000 [0065.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.700] GetProcessHeap () returned 0x630000 [0065.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.700] GetProcessHeap () returned 0x630000 [0065.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.700] GetProcessHeap () returned 0x630000 [0065.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.700] GetProcessHeap () returned 0x630000 [0065.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.700] GetProcessHeap () returned 0x630000 [0065.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.700] GetProcessHeap () returned 0x630000 [0065.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.700] GetProcessHeap () returned 0x630000 [0065.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.700] GetProcessHeap () returned 0x630000 [0065.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.700] GetProcessHeap () returned 0x630000 [0065.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.700] GetProcessHeap () returned 0x630000 [0065.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.700] GetProcessHeap () returned 0x630000 [0065.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.700] GetProcessHeap () returned 0x630000 [0065.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.700] GetProcessHeap () returned 0x630000 [0065.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.700] GetProcessHeap () returned 0x630000 [0065.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.700] GetProcessHeap () returned 0x630000 [0065.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.700] GetProcessHeap () returned 0x630000 [0065.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.700] GetProcessHeap () returned 0x630000 [0065.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0065.700] GetProcessHeap () returned 0x630000 [0065.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0065.701] GetProcessHeap () returned 0x630000 [0065.701] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.701] GetProcessHeap () returned 0x630000 [0065.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.701] GetProcessHeap () returned 0x630000 [0065.701] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.701] GetProcessHeap () returned 0x630000 [0065.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.701] GetProcessHeap () returned 0x630000 [0065.701] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.701] GetProcessHeap () returned 0x630000 [0065.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.701] GetProcessHeap () returned 0x630000 [0065.701] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.701] GetProcessHeap () returned 0x630000 [0065.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.701] GetProcessHeap () returned 0x630000 [0065.701] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.701] GetProcessHeap () returned 0x630000 [0065.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.701] GetProcessHeap () returned 0x630000 [0065.701] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.701] GetProcessHeap () returned 0x630000 [0065.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.701] GetProcessHeap () returned 0x630000 [0065.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0065.701] GetProcessHeap () returned 0x630000 [0065.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0065.701] GetProcessHeap () returned 0x630000 [0065.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0065.701] GetProcessHeap () returned 0x630000 [0065.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0065.701] GetProcessHeap () returned 0x630000 [0065.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0065.701] GetProcessHeap () returned 0x630000 [0065.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0065.702] GetProcessHeap () returned 0x630000 [0065.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0065.702] GetProcessHeap () returned 0x630000 [0065.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0065.702] GetProcessHeap () returned 0x630000 [0065.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0065.702] GetProcessHeap () returned 0x630000 [0065.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.702] GetProcessHeap () returned 0x630000 [0065.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0065.702] WriteFile (in: hFile=0x230, lpBuffer=0x6599e8*, nNumberOfBytesToWrite=0x38d, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6599e8*, lpNumberOfBytesWritten=0x243d864*=0x38d, lpOverlapped=0x0) returned 1 [0065.731] GetProcessHeap () returned 0x630000 [0065.731] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6599e8, Size=0x30) returned 0x6599e8 [0065.731] GetProcessHeap () returned 0x630000 [0065.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0065.731] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0065.731] GetProcessHeap () returned 0x630000 [0065.731] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xdeb0) returned 0x671bf0 [0065.731] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0xdeb0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0xdeb0, lpOverlapped=0x0) returned 1 [0065.732] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0065.732] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0xdeb0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0xdeb0, lpOverlapped=0x0) returned 1 [0065.737] GetProcessHeap () returned 0x630000 [0065.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0065.738] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0065.738] WriteFile (in: hFile=0x230, lpBuffer=0x6599e8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6599e8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0065.739] CloseHandle (hObject=0x230) returned 1 [0065.739] GetProcessHeap () returned 0x630000 [0065.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0065.739] GetProcessHeap () returned 0x630000 [0065.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655850 | out: hHeap=0x630000) returned 1 [0065.739] GetProcessHeap () returned 0x630000 [0065.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0065.740] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\jnflRr4J.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\jnflRr4J.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\jnflRr4J.xlsx" [0065.740] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\jnflRr4J.xlsx", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\jnflRr4J.xlsx.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\jnflRr4J.xlsx.happythreechoose" [0065.740] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\jnflRr4J.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\jnflrr4j.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\jnflRr4J.xlsx.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\jnflrr4j.xlsx.happythreechoose"), dwFlags=0x1) returned 1 [0065.740] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\jnflRr4J.xlsx" | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0065.740] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned="" [0065.740] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" [0065.740] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\decryption info.html")) returned 0x20 [0065.740] GetProcessHeap () returned 0x630000 [0065.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0065.740] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x781112f0, ftCreationTime.dwHighDateTime=0x1d5d4bd, ftLastAccessTime.dwLowDateTime=0x77862ca0, ftLastAccessTime.dwHighDateTime=0x1d57679, ftLastWriteTime.dwLowDateTime=0x77862ca0, ftLastWriteTime.dwHighDateTime=0x1d57679, nFileSizeHigh=0x0, nFileSizeLow=0x481b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mTscFbb1AGbf0zJo6BD.docx", cAlternateFileName="MTSCFB~1.DOC")) returned 1 [0065.740] lstrcmpiW (lpString1="mTscFbb1AGbf0zJo6BD.docx", lpString2=".") returned 1 [0065.740] lstrcmpiW (lpString1="mTscFbb1AGbf0zJo6BD.docx", lpString2="..") returned 1 [0065.741] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="mTscFbb1AGbf0zJo6BD.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\mTscFbb1AGbf0zJo6BD.docx") returned="C:\\Users\\FD1HVy\\Documents\\mTscFbb1AGbf0zJo6BD.docx" [0065.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mTscFbb1AGbf0zJo6BD.docx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0065.741] GetProcessHeap () returned 0x630000 [0065.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x19) returned 0x651e98 [0065.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mTscFbb1AGbf0zJo6BD.docx", cchWideChar=-1, lpMultiByteStr=0x651e98, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mTscFbb1AGbf0zJo6BD.docx", lpUsedDefaultChar=0x0) returned 25 [0065.741] lstrlenA (lpString="mTscFbb1AGbf0zJo6BD.docx") returned 24 [0065.741] lstrlenA (lpString=".happythreechoose") returned 17 [0065.741] lstrlenA (lpString=".happythreechoose") returned 17 [0065.741] lstrlenA (lpString="mTscFbb1AGbf0zJo6BD.docx") returned 24 [0065.741] lstrcmpiA (lpString1="1AGbf0zJo6BD.docx", lpString2=".happythreechoose") returned 1 [0065.741] lstrcmpiW (lpString1="mTscFbb1AGbf0zJo6BD.docx", lpString2="Decryption INFO.html") returned 1 [0065.741] lstrcmpiW (lpString1="mTscFbb1AGbf0zJo6BD.docx", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0065.741] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0065.741] lstrcmpiW (lpString1="mTscFbb1AGbf0zJo6BD.docx", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0065.741] GetProcessHeap () returned 0x630000 [0065.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0065.741] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\mTscFbb1AGbf0zJo6BD.docx" (normalized: "c:\\users\\fd1hvy\\documents\\mtscfbb1agbf0zjo6bd.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0065.741] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=18459) returned 1 [0065.741] GetProcessHeap () returned 0x630000 [0065.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6555f8 [0065.741] GetProcessHeap () returned 0x630000 [0065.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0065.741] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\mTscFbb1AGbf0zJo6BD.docx") returned 50 [0065.741] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0065.741] GetProcessHeap () returned 0x630000 [0065.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0065.741] GetProcessHeap () returned 0x630000 [0065.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x385) returned 0x659a20 [0065.742] lstrlenA (lpString="rsa_encrypt") returned 11 [0065.742] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0065.742] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0065.742] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0065.742] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0065.742] GetProcessHeap () returned 0x630000 [0065.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0065.742] lstrlenA (lpString="010001") returned 6 [0065.742] GetProcessHeap () returned 0x630000 [0065.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2f8 [0065.742] GetProcessHeap () returned 0x630000 [0065.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0065.742] GetProcessHeap () returned 0x630000 [0065.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dfe0 [0065.742] GetProcessHeap () returned 0x630000 [0065.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0065.742] GetProcessHeap () returned 0x630000 [0065.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ecd0 [0065.743] GetProcessHeap () returned 0x630000 [0065.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656c98 [0065.743] GetProcessHeap () returned 0x630000 [0065.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0065.743] GetProcessHeap () returned 0x630000 [0065.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0065.743] GetProcessHeap () returned 0x630000 [0065.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.743] GetProcessHeap () returned 0x630000 [0065.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0065.743] GetProcessHeap () returned 0x630000 [0065.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0065.743] GetProcessHeap () returned 0x630000 [0065.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656a68 [0065.743] GetProcessHeap () returned 0x630000 [0065.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.743] GetProcessHeap () returned 0x630000 [0065.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0065.743] GetProcessHeap () returned 0x630000 [0065.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e340 [0065.743] GetProcessHeap () returned 0x630000 [0065.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0065.743] GetProcessHeap () returned 0x630000 [0065.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0065.743] GetProcessHeap () returned 0x630000 [0065.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0065.743] GetProcessHeap () returned 0x630000 [0065.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.743] GetProcessHeap () returned 0x630000 [0065.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0065.743] GetProcessHeap () returned 0x630000 [0065.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.743] GetProcessHeap () returned 0x630000 [0065.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.743] GetProcessHeap () returned 0x630000 [0065.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.744] GetProcessHeap () returned 0x630000 [0065.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.744] GetProcessHeap () returned 0x630000 [0065.744] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e070 [0065.744] GetProcessHeap () returned 0x630000 [0065.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0065.744] GetProcessHeap () returned 0x630000 [0065.744] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0065.744] GetProcessHeap () returned 0x630000 [0065.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0065.744] GetProcessHeap () returned 0x630000 [0065.744] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.744] GetProcessHeap () returned 0x630000 [0065.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.744] GetProcessHeap () returned 0x630000 [0065.744] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.744] GetProcessHeap () returned 0x630000 [0065.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.744] GetProcessHeap () returned 0x630000 [0065.744] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.744] GetProcessHeap () returned 0x630000 [0065.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.744] GetProcessHeap () returned 0x630000 [0065.744] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.744] GetProcessHeap () returned 0x630000 [0065.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.744] GetProcessHeap () returned 0x630000 [0065.744] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.744] GetProcessHeap () returned 0x630000 [0065.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.744] GetProcessHeap () returned 0x630000 [0065.744] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.744] GetProcessHeap () returned 0x630000 [0065.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.744] GetProcessHeap () returned 0x630000 [0065.744] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.744] GetProcessHeap () returned 0x630000 [0065.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.745] GetProcessHeap () returned 0x630000 [0065.745] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.745] GetProcessHeap () returned 0x630000 [0065.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.745] GetProcessHeap () returned 0x630000 [0065.745] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.745] GetProcessHeap () returned 0x630000 [0065.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.745] GetProcessHeap () returned 0x630000 [0065.745] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.745] GetProcessHeap () returned 0x630000 [0065.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.745] GetProcessHeap () returned 0x630000 [0065.745] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.745] GetProcessHeap () returned 0x630000 [0065.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.745] GetProcessHeap () returned 0x630000 [0065.745] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.745] GetProcessHeap () returned 0x630000 [0065.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.745] GetProcessHeap () returned 0x630000 [0065.745] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.745] GetProcessHeap () returned 0x630000 [0065.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.745] GetProcessHeap () returned 0x630000 [0065.745] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0065.745] GetProcessHeap () returned 0x630000 [0065.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0065.745] GetProcessHeap () returned 0x630000 [0065.745] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.745] GetProcessHeap () returned 0x630000 [0065.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.745] GetProcessHeap () returned 0x630000 [0065.745] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.745] GetProcessHeap () returned 0x630000 [0065.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.745] GetProcessHeap () returned 0x630000 [0065.745] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0065.746] GetProcessHeap () returned 0x630000 [0065.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0065.746] GetProcessHeap () returned 0x630000 [0065.746] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.746] GetProcessHeap () returned 0x630000 [0065.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.746] GetProcessHeap () returned 0x630000 [0065.746] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.746] GetProcessHeap () returned 0x630000 [0065.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.746] GetProcessHeap () returned 0x630000 [0065.746] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.746] GetProcessHeap () returned 0x630000 [0065.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.746] GetProcessHeap () returned 0x630000 [0065.746] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.746] GetProcessHeap () returned 0x630000 [0065.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.746] GetProcessHeap () returned 0x630000 [0065.746] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.746] GetProcessHeap () returned 0x630000 [0065.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.746] GetProcessHeap () returned 0x630000 [0065.746] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.746] GetProcessHeap () returned 0x630000 [0065.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.746] GetProcessHeap () returned 0x630000 [0065.746] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.746] GetProcessHeap () returned 0x630000 [0065.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.746] GetProcessHeap () returned 0x630000 [0065.746] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.746] GetProcessHeap () returned 0x630000 [0065.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.746] GetProcessHeap () returned 0x630000 [0065.746] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.746] GetProcessHeap () returned 0x630000 [0065.747] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.747] GetProcessHeap () returned 0x630000 [0065.747] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.747] GetProcessHeap () returned 0x630000 [0065.747] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.747] GetProcessHeap () returned 0x630000 [0065.747] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.747] GetProcessHeap () returned 0x630000 [0065.747] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.747] GetProcessHeap () returned 0x630000 [0065.747] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.747] GetProcessHeap () returned 0x630000 [0065.747] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.747] GetProcessHeap () returned 0x630000 [0065.747] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.747] GetProcessHeap () returned 0x630000 [0065.747] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.747] GetProcessHeap () returned 0x630000 [0065.747] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0065.747] GetProcessHeap () returned 0x630000 [0065.747] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0065.747] GetProcessHeap () returned 0x630000 [0065.747] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.747] GetProcessHeap () returned 0x630000 [0065.747] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.747] GetProcessHeap () returned 0x630000 [0065.747] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.747] GetProcessHeap () returned 0x630000 [0065.747] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.747] GetProcessHeap () returned 0x630000 [0065.747] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.747] GetProcessHeap () returned 0x630000 [0065.747] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.747] GetProcessHeap () returned 0x630000 [0065.747] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0065.747] GetProcessHeap () returned 0x630000 [0065.747] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0065.748] GetProcessHeap () returned 0x630000 [0065.748] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.748] GetProcessHeap () returned 0x630000 [0065.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.748] GetProcessHeap () returned 0x630000 [0065.748] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.748] GetProcessHeap () returned 0x630000 [0065.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.748] GetProcessHeap () returned 0x630000 [0065.748] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.748] GetProcessHeap () returned 0x630000 [0065.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.748] GetProcessHeap () returned 0x630000 [0065.748] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.748] GetProcessHeap () returned 0x630000 [0065.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.748] GetProcessHeap () returned 0x630000 [0065.748] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0065.748] GetProcessHeap () returned 0x630000 [0065.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0065.748] GetProcessHeap () returned 0x630000 [0065.748] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.748] GetProcessHeap () returned 0x630000 [0065.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.748] GetProcessHeap () returned 0x630000 [0065.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0065.748] GetProcessHeap () returned 0x630000 [0065.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0065.748] GetProcessHeap () returned 0x630000 [0065.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0065.748] GetProcessHeap () returned 0x630000 [0065.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0065.748] GetProcessHeap () returned 0x630000 [0065.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0065.748] GetProcessHeap () returned 0x630000 [0065.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ecd0 | out: hHeap=0x630000) returned 1 [0065.749] GetProcessHeap () returned 0x630000 [0065.749] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0065.749] GetProcessHeap () returned 0x630000 [0065.749] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0065.749] GetProcessHeap () returned 0x630000 [0065.749] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0065.749] GetProcessHeap () returned 0x630000 [0065.749] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.749] GetProcessHeap () returned 0x630000 [0065.749] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0065.749] WriteFile (in: hFile=0x230, lpBuffer=0x659a20*, nNumberOfBytesToWrite=0x385, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659a20*, lpNumberOfBytesWritten=0x243d864*=0x385, lpOverlapped=0x0) returned 1 [0065.776] GetProcessHeap () returned 0x630000 [0065.776] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659a20, Size=0x30) returned 0x659a20 [0065.776] GetProcessHeap () returned 0x630000 [0065.776] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0065.776] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0065.776] GetProcessHeap () returned 0x630000 [0065.776] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4820) returned 0x671bf0 [0065.777] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0x4820, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0x4820, lpOverlapped=0x0) returned 1 [0065.777] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0065.777] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x4820, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0x4820, lpOverlapped=0x0) returned 1 [0065.783] GetProcessHeap () returned 0x630000 [0065.783] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0065.783] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0065.783] WriteFile (in: hFile=0x230, lpBuffer=0x659a20*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659a20*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0065.784] CloseHandle (hObject=0x230) returned 1 [0065.785] GetProcessHeap () returned 0x630000 [0065.785] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0065.785] GetProcessHeap () returned 0x630000 [0065.785] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6555f8 | out: hHeap=0x630000) returned 1 [0065.785] GetProcessHeap () returned 0x630000 [0065.785] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0065.785] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\mTscFbb1AGbf0zJo6BD.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\mTscFbb1AGbf0zJo6BD.docx") returned="C:\\Users\\FD1HVy\\Documents\\mTscFbb1AGbf0zJo6BD.docx" [0065.785] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\mTscFbb1AGbf0zJo6BD.docx", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\mTscFbb1AGbf0zJo6BD.docx.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\mTscFbb1AGbf0zJo6BD.docx.happythreechoose" [0065.785] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\mTscFbb1AGbf0zJo6BD.docx" (normalized: "c:\\users\\fd1hvy\\documents\\mtscfbb1agbf0zjo6bd.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\mTscFbb1AGbf0zJo6BD.docx.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\mtscfbb1agbf0zjo6bd.docx.happythreechoose"), dwFlags=0x1) returned 1 [0065.785] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\mTscFbb1AGbf0zJo6BD.docx" | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0065.785] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned="" [0065.785] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" [0065.785] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\decryption info.html")) returned 0x20 [0065.786] GetProcessHeap () returned 0x630000 [0065.786] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0065.786] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0065.786] lstrcmpiW (lpString1="My Music", lpString2=".") returned 1 [0065.786] lstrcmpiW (lpString1="My Music", lpString2="..") returned 1 [0065.786] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="My Music" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Music") returned="C:\\Users\\FD1HVy\\Documents\\My Music" [0065.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="My Music", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0065.786] GetProcessHeap () returned 0x630000 [0065.786] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9) returned 0x64c9f0 [0065.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="My Music", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="My Music", lpUsedDefaultChar=0x0) returned 9 [0065.786] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0065.786] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0065.786] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0065.786] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0065.786] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0065.786] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0065.786] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0065.786] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0065.786] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0065.786] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0065.786] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0065.786] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0065.786] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0065.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0065.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0065.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0065.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0065.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0065.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0065.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0065.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0065.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0065.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0065.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0065.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0065.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0065.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0065.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0065.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0065.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0065.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0065.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0065.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0065.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0065.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0065.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0065.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0065.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0065.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0065.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0065.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0065.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0065.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0065.787] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Music", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Music\\") returned="C:\\Users\\FD1HVy\\Documents\\My Music\\" [0065.787] GetProcessHeap () returned 0x630000 [0065.787] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a3b8 [0065.787] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\My Music\\") returned 35 [0065.787] GetProcessHeap () returned 0x630000 [0065.788] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x48) returned 0x65fa20 [0065.788] lstrcpyW (in: lpString1=0x65fa20, lpString2="C:\\Users\\FD1HVy\\Documents\\My Music\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Music\\") returned="C:\\Users\\FD1HVy\\Documents\\My Music\\" [0065.788] GetProcessHeap () returned 0x630000 [0065.788] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0065.788] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0065.788] lstrcmpiW (lpString1="My Pictures", lpString2=".") returned 1 [0065.788] lstrcmpiW (lpString1="My Pictures", lpString2="..") returned 1 [0065.788] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="My Pictures" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Pictures") returned="C:\\Users\\FD1HVy\\Documents\\My Pictures" [0065.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="My Pictures", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0065.788] GetProcessHeap () returned 0x630000 [0065.788] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0065.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="My Pictures", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="My Pictures", lpUsedDefaultChar=0x0) returned 12 [0065.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0065.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0065.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0065.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0065.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0065.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0065.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0065.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0065.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0065.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0065.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0065.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0065.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0065.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0065.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0065.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0065.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0065.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0065.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0065.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0065.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0065.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0065.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0065.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0065.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0065.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0065.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0065.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0065.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0065.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0065.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0065.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0065.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0065.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0065.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0065.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0065.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0065.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0065.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0065.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0065.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0065.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0065.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0065.789] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Pictures", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Pictures\\") returned="C:\\Users\\FD1HVy\\Documents\\My Pictures\\" [0065.789] GetProcessHeap () returned 0x630000 [0065.789] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a318 [0065.789] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\My Pictures\\") returned 38 [0065.789] GetProcessHeap () returned 0x630000 [0065.789] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4e) returned 0x65ef60 [0065.789] lstrcpyW (in: lpString1=0x65ef60, lpString2="C:\\Users\\FD1HVy\\Documents\\My Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Pictures\\") returned="C:\\Users\\FD1HVy\\Documents\\My Pictures\\" [0065.789] GetProcessHeap () returned 0x630000 [0065.789] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0065.789] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0065.789] lstrcmpiW (lpString1="My Shapes", lpString2=".") returned 1 [0065.789] lstrcmpiW (lpString1="My Shapes", lpString2="..") returned 1 [0065.789] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="My Shapes" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes" [0065.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="My Shapes", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.790] GetProcessHeap () returned 0x630000 [0065.790] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x64c9f0 [0065.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="My Shapes", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="My Shapes", lpUsedDefaultChar=0x0) returned 10 [0065.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0065.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0065.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0065.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0065.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0065.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0065.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0065.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0065.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0065.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0065.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0065.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0065.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0065.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0065.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0065.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0065.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0065.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0065.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0065.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0065.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0065.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0065.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0065.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0065.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0065.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0065.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0065.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0065.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0065.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0065.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0065.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0065.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0065.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0065.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0065.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0065.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0065.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0065.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0065.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0065.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0065.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0065.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Shapes", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0065.791] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\" [0065.791] GetProcessHeap () returned 0x630000 [0065.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a338 [0065.791] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\My Shapes\\") returned 36 [0065.791] GetProcessHeap () returned 0x630000 [0065.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4a) returned 0x65eda8 [0065.791] lstrcpyW (in: lpString1=0x65eda8, lpString2="C:\\Users\\FD1HVy\\Documents\\My Shapes\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\" [0065.791] GetProcessHeap () returned 0x630000 [0065.791] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0065.791] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0065.791] lstrcmpiW (lpString1="My Videos", lpString2=".") returned 1 [0065.791] lstrcmpiW (lpString1="My Videos", lpString2="..") returned 1 [0065.791] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="My Videos" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Videos") returned="C:\\Users\\FD1HVy\\Documents\\My Videos" [0065.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="My Videos", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0065.791] GetProcessHeap () returned 0x630000 [0065.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x64c9f0 [0065.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="My Videos", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="My Videos", lpUsedDefaultChar=0x0) returned 10 [0065.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0065.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0065.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0065.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0065.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0065.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0065.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0065.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0065.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0065.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0065.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0065.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0065.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0065.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0065.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0065.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0065.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0065.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0065.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0065.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0065.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0065.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0065.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0065.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0065.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0065.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0065.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0065.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0065.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0065.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0065.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0065.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0065.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0065.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0065.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0065.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0065.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0065.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0065.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0065.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0065.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0065.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0065.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0065.793] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Videos", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Videos\\") returned="C:\\Users\\FD1HVy\\Documents\\My Videos\\" [0065.793] GetProcessHeap () returned 0x630000 [0065.793] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a408 [0065.793] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\My Videos\\") returned 36 [0065.793] GetProcessHeap () returned 0x630000 [0065.793] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4a) returned 0x65f010 [0065.793] lstrcpyW (in: lpString1=0x65f010, lpString2="C:\\Users\\FD1HVy\\Documents\\My Videos\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Videos\\") returned="C:\\Users\\FD1HVy\\Documents\\My Videos\\" [0065.793] GetProcessHeap () returned 0x630000 [0065.793] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0065.793] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0065.793] lstrcmpiW (lpString1="Outlook Files", lpString2=".") returned 1 [0065.793] lstrcmpiW (lpString1="Outlook Files", lpString2="..") returned 1 [0065.793] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="Outlook Files" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Outlook Files") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files" [0065.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Outlook Files", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0065.793] GetProcessHeap () returned 0x630000 [0065.793] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x64c9f0 [0065.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Outlook Files", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Outlook Files", lpUsedDefaultChar=0x0) returned 14 [0065.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0065.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0065.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0065.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0065.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0065.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0065.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0065.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0065.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0065.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0065.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0065.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0065.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0065.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0065.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0065.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0065.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0065.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0065.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0065.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0065.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0065.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0065.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0065.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0065.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0065.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0065.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0065.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0065.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0065.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0065.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0065.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0065.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0065.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0065.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0065.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0065.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0065.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0065.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0065.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0065.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0065.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0065.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Outlook Files", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0065.794] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\Outlook Files", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\" [0065.794] GetProcessHeap () returned 0x630000 [0065.794] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a328 [0065.794] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\") returned 40 [0065.794] GetProcessHeap () returned 0x630000 [0065.794] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x52) returned 0x653e70 [0065.794] lstrcpyW (in: lpString1=0x653e70, lpString2="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\" [0065.794] GetProcessHeap () returned 0x630000 [0065.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0065.795] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c109d90, ftCreationTime.dwHighDateTime=0x1d56eb4, ftLastAccessTime.dwLowDateTime=0x6a157820, ftLastAccessTime.dwHighDateTime=0x1d59d64, ftLastWriteTime.dwLowDateTime=0x6a157820, ftLastWriteTime.dwHighDateTime=0x1d59d64, nFileSizeHigh=0x0, nFileSizeLow=0xd965, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pQ0FYpSc.docx", cAlternateFileName="PQ0FYP~1.DOC")) returned 1 [0065.795] lstrcmpiW (lpString1="pQ0FYpSc.docx", lpString2=".") returned 1 [0065.795] lstrcmpiW (lpString1="pQ0FYpSc.docx", lpString2="..") returned 1 [0065.795] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="pQ0FYpSc.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\pQ0FYpSc.docx") returned="C:\\Users\\FD1HVy\\Documents\\pQ0FYpSc.docx" [0065.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQ0FYpSc.docx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0065.795] GetProcessHeap () returned 0x630000 [0065.795] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x64c9f0 [0065.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pQ0FYpSc.docx", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pQ0FYpSc.docx", lpUsedDefaultChar=0x0) returned 14 [0065.795] lstrlenA (lpString="pQ0FYpSc.docx") returned 13 [0065.795] lstrlenA (lpString=".happythreechoose") returned 17 [0065.795] lstrcmpiW (lpString1="pQ0FYpSc.docx", lpString2="Decryption INFO.html") returned 1 [0065.795] lstrcmpiW (lpString1="pQ0FYpSc.docx", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0065.795] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0065.795] lstrcmpiW (lpString1="pQ0FYpSc.docx", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0065.795] GetProcessHeap () returned 0x630000 [0065.795] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0065.795] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\pQ0FYpSc.docx" (normalized: "c:\\users\\fd1hvy\\documents\\pq0fypsc.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0065.795] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=55653) returned 1 [0065.795] GetProcessHeap () returned 0x630000 [0065.795] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655760 [0065.795] GetProcessHeap () returned 0x630000 [0065.795] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0065.795] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\pQ0FYpSc.docx") returned 39 [0065.795] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0065.795] GetProcessHeap () returned 0x630000 [0065.795] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0065.796] GetProcessHeap () returned 0x630000 [0065.796] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38b) returned 0x659a58 [0065.796] lstrlenA (lpString="rsa_encrypt") returned 11 [0065.796] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0065.796] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0065.796] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0065.796] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0065.796] GetProcessHeap () returned 0x630000 [0065.796] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0065.796] lstrlenA (lpString="010001") returned 6 [0065.796] GetProcessHeap () returned 0x630000 [0065.797] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0065.797] GetProcessHeap () returned 0x630000 [0065.797] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0065.797] GetProcessHeap () returned 0x630000 [0065.797] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e100 [0065.797] GetProcessHeap () returned 0x630000 [0065.797] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0065.797] GetProcessHeap () returned 0x630000 [0065.797] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea90 [0065.797] GetProcessHeap () returned 0x630000 [0065.797] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656c98 [0065.797] GetProcessHeap () returned 0x630000 [0065.797] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2f8 [0065.797] GetProcessHeap () returned 0x630000 [0065.797] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0065.797] GetProcessHeap () returned 0x630000 [0065.797] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.797] GetProcessHeap () returned 0x630000 [0065.797] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0065.797] GetProcessHeap () returned 0x630000 [0065.797] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0065.797] GetProcessHeap () returned 0x630000 [0065.797] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657210 [0065.797] GetProcessHeap () returned 0x630000 [0065.797] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.797] GetProcessHeap () returned 0x630000 [0065.797] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0065.797] GetProcessHeap () returned 0x630000 [0065.797] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e340 [0065.797] GetProcessHeap () returned 0x630000 [0065.797] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0065.797] GetProcessHeap () returned 0x630000 [0065.797] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0065.797] GetProcessHeap () returned 0x630000 [0065.797] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0065.797] GetProcessHeap () returned 0x630000 [0065.797] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.798] GetProcessHeap () returned 0x630000 [0065.798] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65d090 [0065.798] GetProcessHeap () returned 0x630000 [0065.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.798] GetProcessHeap () returned 0x630000 [0065.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.798] GetProcessHeap () returned 0x630000 [0065.798] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.798] GetProcessHeap () returned 0x630000 [0065.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.798] GetProcessHeap () returned 0x630000 [0065.798] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e070 [0065.798] GetProcessHeap () returned 0x630000 [0065.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65d090 | out: hHeap=0x630000) returned 1 [0065.798] GetProcessHeap () returned 0x630000 [0065.798] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0065.798] GetProcessHeap () returned 0x630000 [0065.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0065.798] GetProcessHeap () returned 0x630000 [0065.798] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.798] GetProcessHeap () returned 0x630000 [0065.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.798] GetProcessHeap () returned 0x630000 [0065.798] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.798] GetProcessHeap () returned 0x630000 [0065.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.798] GetProcessHeap () returned 0x630000 [0065.798] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.798] GetProcessHeap () returned 0x630000 [0065.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.798] GetProcessHeap () returned 0x630000 [0065.798] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.798] GetProcessHeap () returned 0x630000 [0065.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.798] GetProcessHeap () returned 0x630000 [0065.798] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.798] GetProcessHeap () returned 0x630000 [0065.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.799] GetProcessHeap () returned 0x630000 [0065.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.799] GetProcessHeap () returned 0x630000 [0065.799] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.799] GetProcessHeap () returned 0x630000 [0065.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.799] GetProcessHeap () returned 0x630000 [0065.799] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.799] GetProcessHeap () returned 0x630000 [0065.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.799] GetProcessHeap () returned 0x630000 [0065.799] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.799] GetProcessHeap () returned 0x630000 [0065.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.799] GetProcessHeap () returned 0x630000 [0065.799] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.799] GetProcessHeap () returned 0x630000 [0065.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.799] GetProcessHeap () returned 0x630000 [0065.799] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.799] GetProcessHeap () returned 0x630000 [0065.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.799] GetProcessHeap () returned 0x630000 [0065.799] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.799] GetProcessHeap () returned 0x630000 [0065.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.799] GetProcessHeap () returned 0x630000 [0065.799] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.799] GetProcessHeap () returned 0x630000 [0065.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.799] GetProcessHeap () returned 0x630000 [0065.799] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.799] GetProcessHeap () returned 0x630000 [0065.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.799] GetProcessHeap () returned 0x630000 [0065.799] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.799] GetProcessHeap () returned 0x630000 [0065.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.800] GetProcessHeap () returned 0x630000 [0065.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.800] GetProcessHeap () returned 0x630000 [0065.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.800] GetProcessHeap () returned 0x630000 [0065.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.800] GetProcessHeap () returned 0x630000 [0065.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.800] GetProcessHeap () returned 0x630000 [0065.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.800] GetProcessHeap () returned 0x630000 [0065.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.800] GetProcessHeap () returned 0x630000 [0065.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.800] GetProcessHeap () returned 0x630000 [0065.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.800] GetProcessHeap () returned 0x630000 [0065.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.800] GetProcessHeap () returned 0x630000 [0065.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.800] GetProcessHeap () returned 0x630000 [0065.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.800] GetProcessHeap () returned 0x630000 [0065.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.800] GetProcessHeap () returned 0x630000 [0065.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.800] GetProcessHeap () returned 0x630000 [0065.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.800] GetProcessHeap () returned 0x630000 [0065.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.800] GetProcessHeap () returned 0x630000 [0065.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.800] GetProcessHeap () returned 0x630000 [0065.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.800] GetProcessHeap () returned 0x630000 [0065.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.800] GetProcessHeap () returned 0x630000 [0065.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.801] GetProcessHeap () returned 0x630000 [0065.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.801] GetProcessHeap () returned 0x630000 [0065.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.801] GetProcessHeap () returned 0x630000 [0065.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.801] GetProcessHeap () returned 0x630000 [0065.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.801] GetProcessHeap () returned 0x630000 [0065.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.801] GetProcessHeap () returned 0x630000 [0065.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.801] GetProcessHeap () returned 0x630000 [0065.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.801] GetProcessHeap () returned 0x630000 [0065.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.801] GetProcessHeap () returned 0x630000 [0065.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.801] GetProcessHeap () returned 0x630000 [0065.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.801] GetProcessHeap () returned 0x630000 [0065.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.801] GetProcessHeap () returned 0x630000 [0065.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.801] GetProcessHeap () returned 0x630000 [0065.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.801] GetProcessHeap () returned 0x630000 [0065.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.801] GetProcessHeap () returned 0x630000 [0065.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.801] GetProcessHeap () returned 0x630000 [0065.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.801] GetProcessHeap () returned 0x630000 [0065.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.801] GetProcessHeap () returned 0x630000 [0065.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.801] GetProcessHeap () returned 0x630000 [0065.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.802] GetProcessHeap () returned 0x630000 [0065.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.802] GetProcessHeap () returned 0x630000 [0065.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.802] GetProcessHeap () returned 0x630000 [0065.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.802] GetProcessHeap () returned 0x630000 [0065.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.802] GetProcessHeap () returned 0x630000 [0065.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.802] GetProcessHeap () returned 0x630000 [0065.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.802] GetProcessHeap () returned 0x630000 [0065.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.802] GetProcessHeap () returned 0x630000 [0065.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.802] GetProcessHeap () returned 0x630000 [0065.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.802] GetProcessHeap () returned 0x630000 [0065.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.802] GetProcessHeap () returned 0x630000 [0065.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.802] GetProcessHeap () returned 0x630000 [0065.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.802] GetProcessHeap () returned 0x630000 [0065.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.802] GetProcessHeap () returned 0x630000 [0065.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.802] GetProcessHeap () returned 0x630000 [0065.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.802] GetProcessHeap () returned 0x630000 [0065.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0065.802] GetProcessHeap () returned 0x630000 [0065.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0065.802] GetProcessHeap () returned 0x630000 [0065.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0065.802] GetProcessHeap () returned 0x630000 [0065.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0065.803] GetProcessHeap () returned 0x630000 [0065.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0065.803] GetProcessHeap () returned 0x630000 [0065.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea90 | out: hHeap=0x630000) returned 1 [0065.803] GetProcessHeap () returned 0x630000 [0065.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0065.803] GetProcessHeap () returned 0x630000 [0065.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0065.803] GetProcessHeap () returned 0x630000 [0065.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0065.803] GetProcessHeap () returned 0x630000 [0065.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.803] GetProcessHeap () returned 0x630000 [0065.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0065.803] WriteFile (in: hFile=0x230, lpBuffer=0x659a58*, nNumberOfBytesToWrite=0x38b, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659a58*, lpNumberOfBytesWritten=0x243d864*=0x38b, lpOverlapped=0x0) returned 1 [0065.808] GetProcessHeap () returned 0x630000 [0065.808] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659a58, Size=0x30) returned 0x659a58 [0065.808] GetProcessHeap () returned 0x630000 [0065.808] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0065.808] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0065.808] GetProcessHeap () returned 0x630000 [0065.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd970) returned 0x671bf0 [0065.808] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0xd970, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0xd970, lpOverlapped=0x0) returned 1 [0065.809] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0065.809] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0xd970, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0xd970, lpOverlapped=0x0) returned 1 [0065.810] GetProcessHeap () returned 0x630000 [0065.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0065.811] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0065.812] WriteFile (in: hFile=0x230, lpBuffer=0x659a58*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659a58*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0065.812] CloseHandle (hObject=0x230) returned 1 [0065.813] GetProcessHeap () returned 0x630000 [0065.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0065.813] GetProcessHeap () returned 0x630000 [0065.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655760 | out: hHeap=0x630000) returned 1 [0065.813] GetProcessHeap () returned 0x630000 [0065.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0065.813] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\pQ0FYpSc.docx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\pQ0FYpSc.docx") returned="C:\\Users\\FD1HVy\\Documents\\pQ0FYpSc.docx" [0065.813] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\pQ0FYpSc.docx", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\pQ0FYpSc.docx.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\pQ0FYpSc.docx.happythreechoose" [0065.813] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\pQ0FYpSc.docx" (normalized: "c:\\users\\fd1hvy\\documents\\pq0fypsc.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\pQ0FYpSc.docx.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\pq0fypsc.docx.happythreechoose"), dwFlags=0x1) returned 1 [0065.814] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\pQ0FYpSc.docx" | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0065.814] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned="" [0065.814] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" [0065.814] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\decryption info.html")) returned 0x20 [0065.814] GetProcessHeap () returned 0x630000 [0065.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0065.814] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf19afb50, ftCreationTime.dwHighDateTime=0x1d5d7eb, ftLastAccessTime.dwLowDateTime=0x21d58950, ftLastAccessTime.dwHighDateTime=0x1d5ca29, ftLastWriteTime.dwLowDateTime=0x21d58950, ftLastWriteTime.dwHighDateTime=0x1d5ca29, nFileSizeHigh=0x0, nFileSizeLow=0x1671d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PyF jf6mLqWJ8Rqk.csv", cAlternateFileName="PYFJF6~1.CSV")) returned 1 [0065.814] lstrcmpiW (lpString1="PyF jf6mLqWJ8Rqk.csv", lpString2=".") returned 1 [0065.814] lstrcmpiW (lpString1="PyF jf6mLqWJ8Rqk.csv", lpString2="..") returned 1 [0065.814] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="PyF jf6mLqWJ8Rqk.csv" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\PyF jf6mLqWJ8Rqk.csv") returned="C:\\Users\\FD1HVy\\Documents\\PyF jf6mLqWJ8Rqk.csv" [0065.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PyF jf6mLqWJ8Rqk.csv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0065.814] GetProcessHeap () returned 0x630000 [0065.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x15) returned 0x645d18 [0065.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PyF jf6mLqWJ8Rqk.csv", cchWideChar=-1, lpMultiByteStr=0x645d18, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PyF jf6mLqWJ8Rqk.csv", lpUsedDefaultChar=0x0) returned 21 [0065.814] lstrlenA (lpString="PyF jf6mLqWJ8Rqk.csv") returned 20 [0065.814] lstrlenA (lpString=".happythreechoose") returned 17 [0065.814] lstrlenA (lpString=".happythreechoose") returned 17 [0065.814] lstrlenA (lpString="PyF jf6mLqWJ8Rqk.csv") returned 20 [0065.814] lstrcmpiA (lpString1=" jf6mLqWJ8Rqk.csv", lpString2=".happythreechoose") returned -1 [0065.814] lstrcmpiW (lpString1="PyF jf6mLqWJ8Rqk.csv", lpString2="Decryption INFO.html") returned 1 [0065.814] lstrcmpiW (lpString1="PyF jf6mLqWJ8Rqk.csv", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0065.814] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0065.814] lstrcmpiW (lpString1="PyF jf6mLqWJ8Rqk.csv", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0065.814] GetProcessHeap () returned 0x630000 [0065.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f10 [0065.814] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\PyF jf6mLqWJ8Rqk.csv" (normalized: "c:\\users\\fd1hvy\\documents\\pyf jf6mlqwj8rqk.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0065.815] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=91933) returned 1 [0065.815] GetProcessHeap () returned 0x630000 [0065.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655940 [0065.815] GetProcessHeap () returned 0x630000 [0065.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0065.815] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\PyF jf6mLqWJ8Rqk.csv") returned 46 [0065.815] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0065.815] GetProcessHeap () returned 0x630000 [0065.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0065.815] GetProcessHeap () returned 0x630000 [0065.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x659a90 [0065.815] lstrlenA (lpString="rsa_encrypt") returned 11 [0065.815] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0065.815] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0065.815] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0065.816] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0065.816] GetProcessHeap () returned 0x630000 [0065.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0065.816] lstrlenA (lpString="010001") returned 6 [0065.816] GetProcessHeap () returned 0x630000 [0065.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0065.816] GetProcessHeap () returned 0x630000 [0065.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0065.816] GetProcessHeap () returned 0x630000 [0065.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0065.816] GetProcessHeap () returned 0x630000 [0065.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0065.816] GetProcessHeap () returned 0x630000 [0065.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e8e0 [0065.816] GetProcessHeap () returned 0x630000 [0065.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656950 [0065.816] GetProcessHeap () returned 0x630000 [0065.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a298 [0065.816] GetProcessHeap () returned 0x630000 [0065.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0065.816] GetProcessHeap () returned 0x630000 [0065.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.816] GetProcessHeap () returned 0x630000 [0065.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0065.816] GetProcessHeap () returned 0x630000 [0065.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0065.816] GetProcessHeap () returned 0x630000 [0065.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656a68 [0065.816] GetProcessHeap () returned 0x630000 [0065.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.816] GetProcessHeap () returned 0x630000 [0065.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0065.816] GetProcessHeap () returned 0x630000 [0065.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e460 [0065.816] GetProcessHeap () returned 0x630000 [0065.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0065.817] GetProcessHeap () returned 0x630000 [0065.817] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0065.817] GetProcessHeap () returned 0x630000 [0065.817] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e460 | out: hHeap=0x630000) returned 1 [0065.817] GetProcessHeap () returned 0x630000 [0065.817] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.817] GetProcessHeap () returned 0x630000 [0065.817] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0065.817] GetProcessHeap () returned 0x630000 [0065.817] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.817] GetProcessHeap () returned 0x630000 [0065.817] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.817] GetProcessHeap () returned 0x630000 [0065.817] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.817] GetProcessHeap () returned 0x630000 [0065.817] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.817] GetProcessHeap () returned 0x630000 [0065.817] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e070 [0065.817] GetProcessHeap () returned 0x630000 [0065.817] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0065.817] GetProcessHeap () returned 0x630000 [0065.817] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0065.817] GetProcessHeap () returned 0x630000 [0065.817] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0065.817] GetProcessHeap () returned 0x630000 [0065.817] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.817] GetProcessHeap () returned 0x630000 [0065.817] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.817] GetProcessHeap () returned 0x630000 [0065.817] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.817] GetProcessHeap () returned 0x630000 [0065.817] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.817] GetProcessHeap () returned 0x630000 [0065.817] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.817] GetProcessHeap () returned 0x630000 [0065.817] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.817] GetProcessHeap () returned 0x630000 [0065.817] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.817] GetProcessHeap () returned 0x630000 [0065.817] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.818] GetProcessHeap () returned 0x630000 [0065.818] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.818] GetProcessHeap () returned 0x630000 [0065.818] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.818] GetProcessHeap () returned 0x630000 [0065.818] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.818] GetProcessHeap () returned 0x630000 [0065.818] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.818] GetProcessHeap () returned 0x630000 [0065.818] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.818] GetProcessHeap () returned 0x630000 [0065.818] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.818] GetProcessHeap () returned 0x630000 [0065.818] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.818] GetProcessHeap () returned 0x630000 [0065.818] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.818] GetProcessHeap () returned 0x630000 [0065.818] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.818] GetProcessHeap () returned 0x630000 [0065.818] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.818] GetProcessHeap () returned 0x630000 [0065.818] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.818] GetProcessHeap () returned 0x630000 [0065.818] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.818] GetProcessHeap () returned 0x630000 [0065.818] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.818] GetProcessHeap () returned 0x630000 [0065.818] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.818] GetProcessHeap () returned 0x630000 [0065.818] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.818] GetProcessHeap () returned 0x630000 [0065.818] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.818] GetProcessHeap () returned 0x630000 [0065.818] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.818] GetProcessHeap () returned 0x630000 [0065.818] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.819] GetProcessHeap () returned 0x630000 [0065.819] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.819] GetProcessHeap () returned 0x630000 [0065.819] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.819] GetProcessHeap () returned 0x630000 [0065.819] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.819] GetProcessHeap () returned 0x630000 [0065.819] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.819] GetProcessHeap () returned 0x630000 [0065.819] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.819] GetProcessHeap () returned 0x630000 [0065.819] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.819] GetProcessHeap () returned 0x630000 [0065.819] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.819] GetProcessHeap () returned 0x630000 [0065.819] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.819] GetProcessHeap () returned 0x630000 [0065.819] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.819] GetProcessHeap () returned 0x630000 [0065.819] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.819] GetProcessHeap () returned 0x630000 [0065.819] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.819] GetProcessHeap () returned 0x630000 [0065.819] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.819] GetProcessHeap () returned 0x630000 [0065.819] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.819] GetProcessHeap () returned 0x630000 [0065.819] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.819] GetProcessHeap () returned 0x630000 [0065.819] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.819] GetProcessHeap () returned 0x630000 [0065.819] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.819] GetProcessHeap () returned 0x630000 [0065.819] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.819] GetProcessHeap () returned 0x630000 [0065.819] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.819] GetProcessHeap () returned 0x630000 [0065.820] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.820] GetProcessHeap () returned 0x630000 [0065.820] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.820] GetProcessHeap () returned 0x630000 [0065.820] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.820] GetProcessHeap () returned 0x630000 [0065.820] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.820] GetProcessHeap () returned 0x630000 [0065.820] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.820] GetProcessHeap () returned 0x630000 [0065.820] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.820] GetProcessHeap () returned 0x630000 [0065.820] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.820] GetProcessHeap () returned 0x630000 [0065.820] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.820] GetProcessHeap () returned 0x630000 [0065.820] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.820] GetProcessHeap () returned 0x630000 [0065.820] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.820] GetProcessHeap () returned 0x630000 [0065.820] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.820] GetProcessHeap () returned 0x630000 [0065.820] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.820] GetProcessHeap () returned 0x630000 [0065.820] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.820] GetProcessHeap () returned 0x630000 [0065.820] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.820] GetProcessHeap () returned 0x630000 [0065.820] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.820] GetProcessHeap () returned 0x630000 [0065.820] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.820] GetProcessHeap () returned 0x630000 [0065.820] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.820] GetProcessHeap () returned 0x630000 [0065.820] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.820] GetProcessHeap () returned 0x630000 [0065.820] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.820] GetProcessHeap () returned 0x630000 [0065.821] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.821] GetProcessHeap () returned 0x630000 [0065.821] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.821] GetProcessHeap () returned 0x630000 [0065.821] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.821] GetProcessHeap () returned 0x630000 [0065.821] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.821] GetProcessHeap () returned 0x630000 [0065.821] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.821] GetProcessHeap () returned 0x630000 [0065.821] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.821] GetProcessHeap () returned 0x630000 [0065.821] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.821] GetProcessHeap () returned 0x630000 [0065.821] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.821] GetProcessHeap () returned 0x630000 [0065.821] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.821] GetProcessHeap () returned 0x630000 [0065.821] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.821] GetProcessHeap () returned 0x630000 [0065.821] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.821] GetProcessHeap () returned 0x630000 [0065.821] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.821] GetProcessHeap () returned 0x630000 [0065.821] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.821] GetProcessHeap () returned 0x630000 [0065.821] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.821] GetProcessHeap () returned 0x630000 [0065.821] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.821] GetProcessHeap () returned 0x630000 [0065.821] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.821] GetProcessHeap () returned 0x630000 [0065.821] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.821] GetProcessHeap () returned 0x630000 [0065.821] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0065.821] GetProcessHeap () returned 0x630000 [0065.821] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.821] GetProcessHeap () returned 0x630000 [0065.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0065.822] GetProcessHeap () returned 0x630000 [0065.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0065.822] GetProcessHeap () returned 0x630000 [0065.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0065.822] GetProcessHeap () returned 0x630000 [0065.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0065.822] GetProcessHeap () returned 0x630000 [0065.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0065.822] GetProcessHeap () returned 0x630000 [0065.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0065.822] GetProcessHeap () returned 0x630000 [0065.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0065.822] GetProcessHeap () returned 0x630000 [0065.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0065.822] GetProcessHeap () returned 0x630000 [0065.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0065.822] GetProcessHeap () returned 0x630000 [0065.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.822] GetProcessHeap () returned 0x630000 [0065.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0065.822] WriteFile (in: hFile=0x230, lpBuffer=0x659a90*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659a90*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0065.825] GetProcessHeap () returned 0x630000 [0065.825] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659a90, Size=0x30) returned 0x659a90 [0065.825] GetProcessHeap () returned 0x630000 [0065.825] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0065.825] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0065.825] GetProcessHeap () returned 0x630000 [0065.825] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1671d) returned 0x671bf0 [0065.827] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0x1671d, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0x1671d, lpOverlapped=0x0) returned 1 [0065.828] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0065.829] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x1671d, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0x1671d, lpOverlapped=0x0) returned 1 [0065.831] GetProcessHeap () returned 0x630000 [0065.831] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0065.831] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0065.831] WriteFile (in: hFile=0x230, lpBuffer=0x659a90*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659a90*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0065.832] CloseHandle (hObject=0x230) returned 1 [0065.832] GetProcessHeap () returned 0x630000 [0065.832] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f10 | out: hHeap=0x630000) returned 1 [0065.832] GetProcessHeap () returned 0x630000 [0065.832] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655940 | out: hHeap=0x630000) returned 1 [0065.832] GetProcessHeap () returned 0x630000 [0065.832] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0065.832] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\PyF jf6mLqWJ8Rqk.csv" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\PyF jf6mLqWJ8Rqk.csv") returned="C:\\Users\\FD1HVy\\Documents\\PyF jf6mLqWJ8Rqk.csv" [0065.832] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\PyF jf6mLqWJ8Rqk.csv", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\PyF jf6mLqWJ8Rqk.csv.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\PyF jf6mLqWJ8Rqk.csv.happythreechoose" [0065.833] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\PyF jf6mLqWJ8Rqk.csv" (normalized: "c:\\users\\fd1hvy\\documents\\pyf jf6mlqwj8rqk.csv"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\PyF jf6mLqWJ8Rqk.csv.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\pyf jf6mlqwj8rqk.csv.happythreechoose"), dwFlags=0x1) returned 1 [0065.833] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\PyF jf6mLqWJ8Rqk.csv" | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0065.833] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned="" [0065.833] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" [0065.833] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\decryption info.html")) returned 0x20 [0065.833] GetProcessHeap () returned 0x630000 [0065.833] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645d18 | out: hHeap=0x630000) returned 1 [0065.833] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aff6800, ftCreationTime.dwHighDateTime=0x1d5cd16, ftLastAccessTime.dwLowDateTime=0x4b7697e0, ftLastAccessTime.dwHighDateTime=0x1d5d5c3, ftLastWriteTime.dwLowDateTime=0x4b7697e0, ftLastWriteTime.dwHighDateTime=0x1d5d5c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SBPS k", cAlternateFileName="SBPSK~1")) returned 1 [0065.833] lstrcmpiW (lpString1="SBPS k", lpString2=".") returned 1 [0065.833] lstrcmpiW (lpString1="SBPS k", lpString2="..") returned 1 [0065.833] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="SBPS k" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k" [0065.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SBPS k", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0065.833] GetProcessHeap () returned 0x630000 [0065.833] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7) returned 0x65a258 [0065.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SBPS k", cchWideChar=-1, lpMultiByteStr=0x65a258, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SBPS k", lpUsedDefaultChar=0x0) returned 7 [0065.833] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SBPS k", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0065.834] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SBPS k", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0065.834] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SBPS k", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0065.834] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SBPS k", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0065.834] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SBPS k", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0065.834] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SBPS k", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0065.834] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SBPS k", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0065.834] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SBPS k", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0065.834] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SBPS k", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0065.834] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SBPS k", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0065.834] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SBPS k", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0065.834] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SBPS k", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0065.834] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SBPS k", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0065.834] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SBPS k", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0065.834] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SBPS k", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0065.834] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SBPS k", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0065.834] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SBPS k", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0065.834] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SBPS k", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0065.834] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SBPS k", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0065.834] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SBPS k", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0065.834] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SBPS k", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0065.834] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SBPS k", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0065.834] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SBPS k", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0065.834] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SBPS k", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0065.834] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SBPS k", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0065.834] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SBPS k", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0065.834] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SBPS k", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0065.834] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SBPS k", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0065.834] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SBPS k", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0065.834] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SBPS k", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0065.834] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SBPS k", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0065.834] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SBPS k", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0065.834] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SBPS k", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0065.834] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SBPS k", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0065.834] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SBPS k", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0065.835] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SBPS k", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0065.835] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SBPS k", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0065.835] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SBPS k", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0065.835] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SBPS k", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0065.835] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SBPS k", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0065.835] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SBPS k", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0065.835] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SBPS k", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0065.835] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SBPS k", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0065.835] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\" [0065.835] GetProcessHeap () returned 0x630000 [0065.835] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a268 [0065.835] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\SBPS k\\") returned 33 [0065.835] GetProcessHeap () returned 0x630000 [0065.835] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x44) returned 0x660060 [0065.835] lstrcpyW (in: lpString1=0x660060, lpString2="C:\\Users\\FD1HVy\\Documents\\SBPS k\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\" [0065.835] GetProcessHeap () returned 0x630000 [0065.835] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.835] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77ef88d0, ftCreationTime.dwHighDateTime=0x1d5ccc8, ftLastAccessTime.dwLowDateTime=0xf42eabd0, ftLastAccessTime.dwHighDateTime=0x1d5cc35, ftLastWriteTime.dwLowDateTime=0xf42eabd0, ftLastWriteTime.dwHighDateTime=0x1d5cc35, nFileSizeHigh=0x0, nFileSizeLow=0x6454, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="t55WiJR5B98hO.rtf", cAlternateFileName="T55WIJ~1.RTF")) returned 1 [0065.835] lstrcmpiW (lpString1="t55WiJR5B98hO.rtf", lpString2=".") returned 1 [0065.835] lstrcmpiW (lpString1="t55WiJR5B98hO.rtf", lpString2="..") returned 1 [0065.835] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="t55WiJR5B98hO.rtf" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\t55WiJR5B98hO.rtf") returned="C:\\Users\\FD1HVy\\Documents\\t55WiJR5B98hO.rtf" [0065.835] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="t55WiJR5B98hO.rtf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0065.835] GetProcessHeap () returned 0x630000 [0065.835] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x645cd8 [0065.835] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="t55WiJR5B98hO.rtf", cchWideChar=-1, lpMultiByteStr=0x645cd8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="t55WiJR5B98hO.rtf", lpUsedDefaultChar=0x0) returned 18 [0065.835] lstrlenA (lpString="t55WiJR5B98hO.rtf") returned 17 [0065.835] lstrlenA (lpString=".happythreechoose") returned 17 [0065.835] lstrlenA (lpString=".happythreechoose") returned 17 [0065.835] lstrlenA (lpString="t55WiJR5B98hO.rtf") returned 17 [0065.835] lstrcmpiA (lpString1="t55WiJR5B98hO.rtf", lpString2=".happythreechoose") returned 1 [0065.835] lstrcmpiW (lpString1="t55WiJR5B98hO.rtf", lpString2="Decryption INFO.html") returned 1 [0065.835] lstrcmpiW (lpString1="t55WiJR5B98hO.rtf", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0065.835] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0065.835] lstrcmpiW (lpString1="t55WiJR5B98hO.rtf", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0065.835] GetProcessHeap () returned 0x630000 [0065.835] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651ec0 [0065.836] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\t55WiJR5B98hO.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\t55wijr5b98ho.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0065.836] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=25684) returned 1 [0065.836] GetProcessHeap () returned 0x630000 [0065.836] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655508 [0065.836] GetProcessHeap () returned 0x630000 [0065.836] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0065.836] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\t55WiJR5B98hO.rtf") returned 43 [0065.836] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0065.836] GetProcessHeap () returned 0x630000 [0065.836] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0065.836] GetProcessHeap () returned 0x630000 [0065.836] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x659ac8 [0065.836] lstrlenA (lpString="rsa_encrypt") returned 11 [0065.836] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0065.837] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0065.837] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0065.837] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0065.837] GetProcessHeap () returned 0x630000 [0065.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0065.837] lstrlenA (lpString="010001") returned 6 [0065.837] GetProcessHeap () returned 0x630000 [0065.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0065.837] GetProcessHeap () returned 0x630000 [0065.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0065.837] GetProcessHeap () returned 0x630000 [0065.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea00 [0065.837] GetProcessHeap () returned 0x630000 [0065.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0065.837] GetProcessHeap () returned 0x630000 [0065.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e7c0 [0065.837] GetProcessHeap () returned 0x630000 [0065.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657210 [0065.837] GetProcessHeap () returned 0x630000 [0065.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0065.837] GetProcessHeap () returned 0x630000 [0065.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0065.837] GetProcessHeap () returned 0x630000 [0065.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.837] GetProcessHeap () returned 0x630000 [0065.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0065.837] GetProcessHeap () returned 0x630000 [0065.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0065.837] GetProcessHeap () returned 0x630000 [0065.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657328 [0065.837] GetProcessHeap () returned 0x630000 [0065.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.837] GetProcessHeap () returned 0x630000 [0065.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0065.837] GetProcessHeap () returned 0x630000 [0065.838] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e850 [0065.838] GetProcessHeap () returned 0x630000 [0065.838] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0065.838] GetProcessHeap () returned 0x630000 [0065.838] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0065.838] GetProcessHeap () returned 0x630000 [0065.838] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0065.838] GetProcessHeap () returned 0x630000 [0065.838] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.838] GetProcessHeap () returned 0x630000 [0065.838] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0065.838] GetProcessHeap () returned 0x630000 [0065.838] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.838] GetProcessHeap () returned 0x630000 [0065.838] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.838] GetProcessHeap () returned 0x630000 [0065.838] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.838] GetProcessHeap () returned 0x630000 [0065.838] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.838] GetProcessHeap () returned 0x630000 [0065.838] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e190 [0065.838] GetProcessHeap () returned 0x630000 [0065.838] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0065.838] GetProcessHeap () returned 0x630000 [0065.838] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0065.838] GetProcessHeap () returned 0x630000 [0065.838] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0065.838] GetProcessHeap () returned 0x630000 [0065.838] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.838] GetProcessHeap () returned 0x630000 [0065.838] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.838] GetProcessHeap () returned 0x630000 [0065.838] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.838] GetProcessHeap () returned 0x630000 [0065.838] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.838] GetProcessHeap () returned 0x630000 [0065.838] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.838] GetProcessHeap () returned 0x630000 [0065.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.839] GetProcessHeap () returned 0x630000 [0065.839] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.839] GetProcessHeap () returned 0x630000 [0065.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.839] GetProcessHeap () returned 0x630000 [0065.839] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.839] GetProcessHeap () returned 0x630000 [0065.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.839] GetProcessHeap () returned 0x630000 [0065.839] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.839] GetProcessHeap () returned 0x630000 [0065.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.839] GetProcessHeap () returned 0x630000 [0065.839] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.839] GetProcessHeap () returned 0x630000 [0065.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.839] GetProcessHeap () returned 0x630000 [0065.839] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.839] GetProcessHeap () returned 0x630000 [0065.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.839] GetProcessHeap () returned 0x630000 [0065.839] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.839] GetProcessHeap () returned 0x630000 [0065.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.839] GetProcessHeap () returned 0x630000 [0065.839] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.839] GetProcessHeap () returned 0x630000 [0065.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.839] GetProcessHeap () returned 0x630000 [0065.839] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.839] GetProcessHeap () returned 0x630000 [0065.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.839] GetProcessHeap () returned 0x630000 [0065.839] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.839] GetProcessHeap () returned 0x630000 [0065.840] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.840] GetProcessHeap () returned 0x630000 [0065.840] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.840] GetProcessHeap () returned 0x630000 [0065.840] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.840] GetProcessHeap () returned 0x630000 [0065.840] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.840] GetProcessHeap () returned 0x630000 [0065.840] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.840] GetProcessHeap () returned 0x630000 [0065.840] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.840] GetProcessHeap () returned 0x630000 [0065.840] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.840] GetProcessHeap () returned 0x630000 [0065.840] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.840] GetProcessHeap () returned 0x630000 [0065.840] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.840] GetProcessHeap () returned 0x630000 [0065.840] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.840] GetProcessHeap () returned 0x630000 [0065.840] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.840] GetProcessHeap () returned 0x630000 [0065.840] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.840] GetProcessHeap () returned 0x630000 [0065.840] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.840] GetProcessHeap () returned 0x630000 [0065.840] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.840] GetProcessHeap () returned 0x630000 [0065.840] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.840] GetProcessHeap () returned 0x630000 [0065.840] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.840] GetProcessHeap () returned 0x630000 [0065.840] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.840] GetProcessHeap () returned 0x630000 [0065.840] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.840] GetProcessHeap () returned 0x630000 [0065.840] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.841] GetProcessHeap () returned 0x630000 [0065.841] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.841] GetProcessHeap () returned 0x630000 [0065.841] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.841] GetProcessHeap () returned 0x630000 [0065.841] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.841] GetProcessHeap () returned 0x630000 [0065.841] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.841] GetProcessHeap () returned 0x630000 [0065.841] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.841] GetProcessHeap () returned 0x630000 [0065.841] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.841] GetProcessHeap () returned 0x630000 [0065.841] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.841] GetProcessHeap () returned 0x630000 [0065.841] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.841] GetProcessHeap () returned 0x630000 [0065.841] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.841] GetProcessHeap () returned 0x630000 [0065.841] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.841] GetProcessHeap () returned 0x630000 [0065.841] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.841] GetProcessHeap () returned 0x630000 [0065.841] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.841] GetProcessHeap () returned 0x630000 [0065.841] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.841] GetProcessHeap () returned 0x630000 [0065.841] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.841] GetProcessHeap () returned 0x630000 [0065.841] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.841] GetProcessHeap () returned 0x630000 [0065.841] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.841] GetProcessHeap () returned 0x630000 [0065.841] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.841] GetProcessHeap () returned 0x630000 [0065.841] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.841] GetProcessHeap () returned 0x630000 [0065.841] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.842] GetProcessHeap () returned 0x630000 [0065.842] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.842] GetProcessHeap () returned 0x630000 [0065.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.842] GetProcessHeap () returned 0x630000 [0065.842] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.842] GetProcessHeap () returned 0x630000 [0065.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.842] GetProcessHeap () returned 0x630000 [0065.842] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.842] GetProcessHeap () returned 0x630000 [0065.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.842] GetProcessHeap () returned 0x630000 [0065.842] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.842] GetProcessHeap () returned 0x630000 [0065.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.842] GetProcessHeap () returned 0x630000 [0065.842] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.842] GetProcessHeap () returned 0x630000 [0065.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.842] GetProcessHeap () returned 0x630000 [0065.842] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.842] GetProcessHeap () returned 0x630000 [0065.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.842] GetProcessHeap () returned 0x630000 [0065.842] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.842] GetProcessHeap () returned 0x630000 [0065.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.842] GetProcessHeap () returned 0x630000 [0065.842] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.842] GetProcessHeap () returned 0x630000 [0065.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.842] GetProcessHeap () returned 0x630000 [0065.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.843] GetProcessHeap () returned 0x630000 [0065.843] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.843] GetProcessHeap () returned 0x630000 [0065.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.843] GetProcessHeap () returned 0x630000 [0065.843] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.843] GetProcessHeap () returned 0x630000 [0065.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.843] GetProcessHeap () returned 0x630000 [0065.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0065.843] GetProcessHeap () returned 0x630000 [0065.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0065.843] GetProcessHeap () returned 0x630000 [0065.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0065.843] GetProcessHeap () returned 0x630000 [0065.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0065.843] GetProcessHeap () returned 0x630000 [0065.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0065.843] GetProcessHeap () returned 0x630000 [0065.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e7c0 | out: hHeap=0x630000) returned 1 [0065.843] GetProcessHeap () returned 0x630000 [0065.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0065.843] GetProcessHeap () returned 0x630000 [0065.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0065.843] GetProcessHeap () returned 0x630000 [0065.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0065.843] GetProcessHeap () returned 0x630000 [0065.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.843] GetProcessHeap () returned 0x630000 [0065.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0065.843] WriteFile (in: hFile=0x230, lpBuffer=0x659ac8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659ac8*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0065.893] GetProcessHeap () returned 0x630000 [0065.893] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659ac8, Size=0x30) returned 0x659ac8 [0065.893] GetProcessHeap () returned 0x630000 [0065.893] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0065.893] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0065.893] GetProcessHeap () returned 0x630000 [0065.893] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6454) returned 0x671bf0 [0065.893] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0x6454, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0x6454, lpOverlapped=0x0) returned 1 [0065.893] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0065.894] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x6454, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0x6454, lpOverlapped=0x0) returned 1 [0065.895] GetProcessHeap () returned 0x630000 [0065.895] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0065.896] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0065.896] WriteFile (in: hFile=0x230, lpBuffer=0x659ac8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659ac8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0065.897] CloseHandle (hObject=0x230) returned 1 [0065.897] GetProcessHeap () returned 0x630000 [0065.897] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651ec0 | out: hHeap=0x630000) returned 1 [0065.897] GetProcessHeap () returned 0x630000 [0065.898] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655508 | out: hHeap=0x630000) returned 1 [0065.898] GetProcessHeap () returned 0x630000 [0065.898] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0065.898] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\t55WiJR5B98hO.rtf" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\t55WiJR5B98hO.rtf") returned="C:\\Users\\FD1HVy\\Documents\\t55WiJR5B98hO.rtf" [0065.898] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\t55WiJR5B98hO.rtf", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\t55WiJR5B98hO.rtf.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\t55WiJR5B98hO.rtf.happythreechoose" [0065.898] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\t55WiJR5B98hO.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\t55wijr5b98ho.rtf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\t55WiJR5B98hO.rtf.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\t55wijr5b98ho.rtf.happythreechoose"), dwFlags=0x1) returned 1 [0065.898] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\t55WiJR5B98hO.rtf" | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0065.898] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned="" [0065.898] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" [0065.898] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\decryption info.html")) returned 0x20 [0065.898] GetProcessHeap () returned 0x630000 [0065.898] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645cd8 | out: hHeap=0x630000) returned 1 [0065.898] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3df87150, ftCreationTime.dwHighDateTime=0x1d5d7cc, ftLastAccessTime.dwLowDateTime=0x1e65df30, ftLastAccessTime.dwHighDateTime=0x1d5ca43, ftLastWriteTime.dwLowDateTime=0x1e65df30, ftLastWriteTime.dwHighDateTime=0x1d5ca43, nFileSizeHigh=0x0, nFileSizeLow=0xc2cb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tLvZeS.ots", cAlternateFileName="")) returned 1 [0065.899] lstrcmpiW (lpString1="tLvZeS.ots", lpString2=".") returned 1 [0065.899] lstrcmpiW (lpString1="tLvZeS.ots", lpString2="..") returned 1 [0065.899] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="tLvZeS.ots" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\tLvZeS.ots") returned="C:\\Users\\FD1HVy\\Documents\\tLvZeS.ots" [0065.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tLvZeS.ots", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0065.899] GetProcessHeap () returned 0x630000 [0065.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb) returned 0x64c9f0 [0065.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="tLvZeS.ots", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tLvZeS.ots", lpUsedDefaultChar=0x0) returned 11 [0065.899] lstrlenA (lpString="tLvZeS.ots") returned 10 [0065.899] lstrlenA (lpString=".happythreechoose") returned 17 [0065.899] lstrcmpiW (lpString1="tLvZeS.ots", lpString2="Decryption INFO.html") returned 1 [0065.899] lstrcmpiW (lpString1="tLvZeS.ots", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0065.899] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0065.899] lstrcmpiW (lpString1="tLvZeS.ots", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0065.899] GetProcessHeap () returned 0x630000 [0065.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0065.899] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\tLvZeS.ots" (normalized: "c:\\users\\fd1hvy\\documents\\tlvzes.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0065.899] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=49867) returned 1 [0065.899] GetProcessHeap () returned 0x630000 [0065.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655490 [0065.899] GetProcessHeap () returned 0x630000 [0065.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0065.899] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\tLvZeS.ots") returned 36 [0065.899] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0065.899] GetProcessHeap () returned 0x630000 [0065.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0065.899] GetProcessHeap () returned 0x630000 [0065.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x385) returned 0x659b00 [0065.899] lstrlenA (lpString="rsa_encrypt") returned 11 [0065.899] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0065.900] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0065.900] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0065.900] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0065.900] GetProcessHeap () returned 0x630000 [0065.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0065.900] lstrlenA (lpString="010001") returned 6 [0065.900] GetProcessHeap () returned 0x630000 [0065.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2f8 [0065.900] GetProcessHeap () returned 0x630000 [0065.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0065.900] GetProcessHeap () returned 0x630000 [0065.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e100 [0065.900] GetProcessHeap () returned 0x630000 [0065.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0065.900] GetProcessHeap () returned 0x630000 [0065.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0065.900] GetProcessHeap () returned 0x630000 [0065.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657210 [0065.901] GetProcessHeap () returned 0x630000 [0065.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0065.901] GetProcessHeap () returned 0x630000 [0065.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0065.901] GetProcessHeap () returned 0x630000 [0065.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.901] GetProcessHeap () returned 0x630000 [0065.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0065.901] GetProcessHeap () returned 0x630000 [0065.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0065.901] GetProcessHeap () returned 0x630000 [0065.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657440 [0065.901] GetProcessHeap () returned 0x630000 [0065.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.901] GetProcessHeap () returned 0x630000 [0065.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0065.901] GetProcessHeap () returned 0x630000 [0065.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e6a0 [0065.901] GetProcessHeap () returned 0x630000 [0065.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0065.901] GetProcessHeap () returned 0x630000 [0065.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0065.901] GetProcessHeap () returned 0x630000 [0065.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e6a0 | out: hHeap=0x630000) returned 1 [0065.901] GetProcessHeap () returned 0x630000 [0065.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.901] GetProcessHeap () returned 0x630000 [0065.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65ce80 [0065.901] GetProcessHeap () returned 0x630000 [0065.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.901] GetProcessHeap () returned 0x630000 [0065.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.901] GetProcessHeap () returned 0x630000 [0065.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.901] GetProcessHeap () returned 0x630000 [0065.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.901] GetProcessHeap () returned 0x630000 [0065.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e580 [0065.902] GetProcessHeap () returned 0x630000 [0065.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ce80 | out: hHeap=0x630000) returned 1 [0065.902] GetProcessHeap () returned 0x630000 [0065.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0065.902] GetProcessHeap () returned 0x630000 [0065.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0065.902] GetProcessHeap () returned 0x630000 [0065.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.902] GetProcessHeap () returned 0x630000 [0065.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.902] GetProcessHeap () returned 0x630000 [0065.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.902] GetProcessHeap () returned 0x630000 [0065.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.902] GetProcessHeap () returned 0x630000 [0065.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.902] GetProcessHeap () returned 0x630000 [0065.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.902] GetProcessHeap () returned 0x630000 [0065.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.902] GetProcessHeap () returned 0x630000 [0065.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.902] GetProcessHeap () returned 0x630000 [0065.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.902] GetProcessHeap () returned 0x630000 [0065.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.902] GetProcessHeap () returned 0x630000 [0065.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.902] GetProcessHeap () returned 0x630000 [0065.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.902] GetProcessHeap () returned 0x630000 [0065.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.902] GetProcessHeap () returned 0x630000 [0065.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.902] GetProcessHeap () returned 0x630000 [0065.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.902] GetProcessHeap () returned 0x630000 [0065.903] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.903] GetProcessHeap () returned 0x630000 [0065.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.903] GetProcessHeap () returned 0x630000 [0065.903] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.903] GetProcessHeap () returned 0x630000 [0065.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.903] GetProcessHeap () returned 0x630000 [0065.903] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.903] GetProcessHeap () returned 0x630000 [0065.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.903] GetProcessHeap () returned 0x630000 [0065.903] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.903] GetProcessHeap () returned 0x630000 [0065.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.903] GetProcessHeap () returned 0x630000 [0065.903] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.903] GetProcessHeap () returned 0x630000 [0065.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.903] GetProcessHeap () returned 0x630000 [0065.903] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.903] GetProcessHeap () returned 0x630000 [0065.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.903] GetProcessHeap () returned 0x630000 [0065.903] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.903] GetProcessHeap () returned 0x630000 [0065.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.903] GetProcessHeap () returned 0x630000 [0065.903] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.903] GetProcessHeap () returned 0x630000 [0065.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.903] GetProcessHeap () returned 0x630000 [0065.903] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.903] GetProcessHeap () returned 0x630000 [0065.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.903] GetProcessHeap () returned 0x630000 [0065.903] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.904] GetProcessHeap () returned 0x630000 [0065.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.904] GetProcessHeap () returned 0x630000 [0065.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.904] GetProcessHeap () returned 0x630000 [0065.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.904] GetProcessHeap () returned 0x630000 [0065.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.904] GetProcessHeap () returned 0x630000 [0065.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.904] GetProcessHeap () returned 0x630000 [0065.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.904] GetProcessHeap () returned 0x630000 [0065.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.904] GetProcessHeap () returned 0x630000 [0065.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.904] GetProcessHeap () returned 0x630000 [0065.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.904] GetProcessHeap () returned 0x630000 [0065.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.904] GetProcessHeap () returned 0x630000 [0065.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.904] GetProcessHeap () returned 0x630000 [0065.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.904] GetProcessHeap () returned 0x630000 [0065.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.904] GetProcessHeap () returned 0x630000 [0065.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.904] GetProcessHeap () returned 0x630000 [0065.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.904] GetProcessHeap () returned 0x630000 [0065.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.904] GetProcessHeap () returned 0x630000 [0065.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.904] GetProcessHeap () returned 0x630000 [0065.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.904] GetProcessHeap () returned 0x630000 [0065.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.905] GetProcessHeap () returned 0x630000 [0065.905] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.905] GetProcessHeap () returned 0x630000 [0065.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.905] GetProcessHeap () returned 0x630000 [0065.905] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.905] GetProcessHeap () returned 0x630000 [0065.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.905] GetProcessHeap () returned 0x630000 [0065.905] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.905] GetProcessHeap () returned 0x630000 [0065.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.905] GetProcessHeap () returned 0x630000 [0065.905] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.905] GetProcessHeap () returned 0x630000 [0065.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.905] GetProcessHeap () returned 0x630000 [0065.905] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.905] GetProcessHeap () returned 0x630000 [0065.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.905] GetProcessHeap () returned 0x630000 [0065.905] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.905] GetProcessHeap () returned 0x630000 [0065.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.905] GetProcessHeap () returned 0x630000 [0065.905] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.905] GetProcessHeap () returned 0x630000 [0065.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.905] GetProcessHeap () returned 0x630000 [0065.905] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.905] GetProcessHeap () returned 0x630000 [0065.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.905] GetProcessHeap () returned 0x630000 [0065.905] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.905] GetProcessHeap () returned 0x630000 [0065.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.906] GetProcessHeap () returned 0x630000 [0065.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.906] GetProcessHeap () returned 0x630000 [0065.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.906] GetProcessHeap () returned 0x630000 [0065.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.906] GetProcessHeap () returned 0x630000 [0065.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.906] GetProcessHeap () returned 0x630000 [0065.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.906] GetProcessHeap () returned 0x630000 [0065.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.906] GetProcessHeap () returned 0x630000 [0065.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.906] GetProcessHeap () returned 0x630000 [0065.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.906] GetProcessHeap () returned 0x630000 [0065.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.906] GetProcessHeap () returned 0x630000 [0065.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0065.906] GetProcessHeap () returned 0x630000 [0065.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.906] GetProcessHeap () returned 0x630000 [0065.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0065.906] GetProcessHeap () returned 0x630000 [0065.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0065.906] GetProcessHeap () returned 0x630000 [0065.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0065.906] GetProcessHeap () returned 0x630000 [0065.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0065.906] GetProcessHeap () returned 0x630000 [0065.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0065.906] GetProcessHeap () returned 0x630000 [0065.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0065.907] GetProcessHeap () returned 0x630000 [0065.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0065.907] GetProcessHeap () returned 0x630000 [0065.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0065.907] GetProcessHeap () returned 0x630000 [0065.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0065.907] GetProcessHeap () returned 0x630000 [0065.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.907] GetProcessHeap () returned 0x630000 [0065.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0065.907] WriteFile (in: hFile=0x230, lpBuffer=0x659b00*, nNumberOfBytesToWrite=0x385, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659b00*, lpNumberOfBytesWritten=0x243d864*=0x385, lpOverlapped=0x0) returned 1 [0065.908] GetProcessHeap () returned 0x630000 [0065.908] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659b00, Size=0x30) returned 0x659b00 [0065.908] GetProcessHeap () returned 0x630000 [0065.908] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0065.908] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0065.908] GetProcessHeap () returned 0x630000 [0065.908] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc2d0) returned 0x671bf0 [0065.910] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0xc2d0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0xc2d0, lpOverlapped=0x0) returned 1 [0065.911] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0065.911] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0xc2d0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0xc2d0, lpOverlapped=0x0) returned 1 [0065.912] GetProcessHeap () returned 0x630000 [0065.912] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0065.912] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0065.912] WriteFile (in: hFile=0x230, lpBuffer=0x659b00*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659b00*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0065.913] CloseHandle (hObject=0x230) returned 1 [0065.914] GetProcessHeap () returned 0x630000 [0065.914] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0065.914] GetProcessHeap () returned 0x630000 [0065.914] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655490 | out: hHeap=0x630000) returned 1 [0065.914] GetProcessHeap () returned 0x630000 [0065.915] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0065.915] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\tLvZeS.ots" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\tLvZeS.ots") returned="C:\\Users\\FD1HVy\\Documents\\tLvZeS.ots" [0065.915] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\tLvZeS.ots", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\tLvZeS.ots.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\tLvZeS.ots.happythreechoose" [0065.915] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\tLvZeS.ots" (normalized: "c:\\users\\fd1hvy\\documents\\tlvzes.ots"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\tLvZeS.ots.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\tlvzes.ots.happythreechoose"), dwFlags=0x1) returned 1 [0065.915] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\tLvZeS.ots" | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0065.915] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned="" [0065.915] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" [0065.916] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\decryption info.html")) returned 0x20 [0065.916] GetProcessHeap () returned 0x630000 [0065.916] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0065.916] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcad130, ftCreationTime.dwHighDateTime=0x1d588ce, ftLastAccessTime.dwLowDateTime=0x8d3aa180, ftLastAccessTime.dwHighDateTime=0x1d56dd1, ftLastWriteTime.dwLowDateTime=0x8d3aa180, ftLastWriteTime.dwHighDateTime=0x1d56dd1, nFileSizeHigh=0x0, nFileSizeLow=0xc21a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vSNwmkBy0QKy.pptx", cAlternateFileName="VSNWMK~1.PPT")) returned 1 [0065.916] lstrcmpiW (lpString1="vSNwmkBy0QKy.pptx", lpString2=".") returned 1 [0065.916] lstrcmpiW (lpString1="vSNwmkBy0QKy.pptx", lpString2="..") returned 1 [0065.916] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="vSNwmkBy0QKy.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\vSNwmkBy0QKy.pptx") returned="C:\\Users\\FD1HVy\\Documents\\vSNwmkBy0QKy.pptx" [0065.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vSNwmkBy0QKy.pptx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0065.916] GetProcessHeap () returned 0x630000 [0065.916] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x645f78 [0065.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vSNwmkBy0QKy.pptx", cchWideChar=-1, lpMultiByteStr=0x645f78, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vSNwmkBy0QKy.pptx", lpUsedDefaultChar=0x0) returned 18 [0065.916] lstrlenA (lpString="vSNwmkBy0QKy.pptx") returned 17 [0065.916] lstrlenA (lpString=".happythreechoose") returned 17 [0065.916] lstrlenA (lpString=".happythreechoose") returned 17 [0065.916] lstrlenA (lpString="vSNwmkBy0QKy.pptx") returned 17 [0065.916] lstrcmpiA (lpString1="vSNwmkBy0QKy.pptx", lpString2=".happythreechoose") returned 1 [0065.916] lstrcmpiW (lpString1="vSNwmkBy0QKy.pptx", lpString2="Decryption INFO.html") returned 1 [0065.916] lstrcmpiW (lpString1="vSNwmkBy0QKy.pptx", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0065.916] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0065.916] lstrcmpiW (lpString1="vSNwmkBy0QKy.pptx", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0065.916] GetProcessHeap () returned 0x630000 [0065.916] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0065.916] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\vSNwmkBy0QKy.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\vsnwmkby0qky.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0065.916] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=49690) returned 1 [0065.916] GetProcessHeap () returned 0x630000 [0065.916] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655418 [0065.916] GetProcessHeap () returned 0x630000 [0065.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0065.917] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\vSNwmkBy0QKy.pptx") returned 43 [0065.917] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0065.917] GetProcessHeap () returned 0x630000 [0065.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0065.917] GetProcessHeap () returned 0x630000 [0065.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x386) returned 0x659b38 [0065.917] lstrlenA (lpString="rsa_encrypt") returned 11 [0065.917] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0065.917] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0065.917] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0065.917] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0065.917] GetProcessHeap () returned 0x630000 [0065.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0065.917] lstrlenA (lpString="010001") returned 6 [0065.917] GetProcessHeap () returned 0x630000 [0065.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0065.918] GetProcessHeap () returned 0x630000 [0065.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0065.918] GetProcessHeap () returned 0x630000 [0065.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0065.918] GetProcessHeap () returned 0x630000 [0065.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0065.918] GetProcessHeap () returned 0x630000 [0065.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e2b0 [0065.918] GetProcessHeap () returned 0x630000 [0065.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656b80 [0065.918] GetProcessHeap () returned 0x630000 [0065.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0065.918] GetProcessHeap () returned 0x630000 [0065.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0065.918] GetProcessHeap () returned 0x630000 [0065.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.918] GetProcessHeap () returned 0x630000 [0065.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0065.918] GetProcessHeap () returned 0x630000 [0065.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0065.918] GetProcessHeap () returned 0x630000 [0065.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656950 [0065.918] GetProcessHeap () returned 0x630000 [0065.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.918] GetProcessHeap () returned 0x630000 [0065.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0065.918] GetProcessHeap () returned 0x630000 [0065.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0065.918] GetProcessHeap () returned 0x630000 [0065.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0065.918] GetProcessHeap () returned 0x630000 [0065.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0065.918] GetProcessHeap () returned 0x630000 [0065.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0065.918] GetProcessHeap () returned 0x630000 [0065.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.918] GetProcessHeap () returned 0x630000 [0065.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0065.919] GetProcessHeap () returned 0x630000 [0065.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.919] GetProcessHeap () returned 0x630000 [0065.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.919] GetProcessHeap () returned 0x630000 [0065.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.919] GetProcessHeap () returned 0x630000 [0065.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.919] GetProcessHeap () returned 0x630000 [0065.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ec40 [0065.919] GetProcessHeap () returned 0x630000 [0065.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0065.919] GetProcessHeap () returned 0x630000 [0065.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0065.919] GetProcessHeap () returned 0x630000 [0065.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ec40 | out: hHeap=0x630000) returned 1 [0065.919] GetProcessHeap () returned 0x630000 [0065.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.919] GetProcessHeap () returned 0x630000 [0065.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.919] GetProcessHeap () returned 0x630000 [0065.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.919] GetProcessHeap () returned 0x630000 [0065.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.919] GetProcessHeap () returned 0x630000 [0065.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.919] GetProcessHeap () returned 0x630000 [0065.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.919] GetProcessHeap () returned 0x630000 [0065.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.919] GetProcessHeap () returned 0x630000 [0065.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.919] GetProcessHeap () returned 0x630000 [0065.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.919] GetProcessHeap () returned 0x630000 [0065.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.920] GetProcessHeap () returned 0x630000 [0065.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.920] GetProcessHeap () returned 0x630000 [0065.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.920] GetProcessHeap () returned 0x630000 [0065.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.920] GetProcessHeap () returned 0x630000 [0065.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.920] GetProcessHeap () returned 0x630000 [0065.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.920] GetProcessHeap () returned 0x630000 [0065.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.920] GetProcessHeap () returned 0x630000 [0065.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.920] GetProcessHeap () returned 0x630000 [0065.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.920] GetProcessHeap () returned 0x630000 [0065.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.920] GetProcessHeap () returned 0x630000 [0065.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.920] GetProcessHeap () returned 0x630000 [0065.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.920] GetProcessHeap () returned 0x630000 [0065.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.920] GetProcessHeap () returned 0x630000 [0065.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.920] GetProcessHeap () returned 0x630000 [0065.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.920] GetProcessHeap () returned 0x630000 [0065.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.920] GetProcessHeap () returned 0x630000 [0065.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.920] GetProcessHeap () returned 0x630000 [0065.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.921] GetProcessHeap () returned 0x630000 [0065.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.921] GetProcessHeap () returned 0x630000 [0065.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.921] GetProcessHeap () returned 0x630000 [0065.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.921] GetProcessHeap () returned 0x630000 [0065.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.921] GetProcessHeap () returned 0x630000 [0065.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.921] GetProcessHeap () returned 0x630000 [0065.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.921] GetProcessHeap () returned 0x630000 [0065.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.921] GetProcessHeap () returned 0x630000 [0065.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.921] GetProcessHeap () returned 0x630000 [0065.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.921] GetProcessHeap () returned 0x630000 [0065.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.921] GetProcessHeap () returned 0x630000 [0065.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.921] GetProcessHeap () returned 0x630000 [0065.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.921] GetProcessHeap () returned 0x630000 [0065.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.921] GetProcessHeap () returned 0x630000 [0065.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.922] GetProcessHeap () returned 0x630000 [0065.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.922] GetProcessHeap () returned 0x630000 [0065.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.922] GetProcessHeap () returned 0x630000 [0065.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.922] GetProcessHeap () returned 0x630000 [0065.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.922] GetProcessHeap () returned 0x630000 [0065.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.922] GetProcessHeap () returned 0x630000 [0065.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.922] GetProcessHeap () returned 0x630000 [0065.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.922] GetProcessHeap () returned 0x630000 [0065.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.922] GetProcessHeap () returned 0x630000 [0065.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.922] GetProcessHeap () returned 0x630000 [0065.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.922] GetProcessHeap () returned 0x630000 [0065.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.922] GetProcessHeap () returned 0x630000 [0065.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.922] GetProcessHeap () returned 0x630000 [0065.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.922] GetProcessHeap () returned 0x630000 [0065.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.922] GetProcessHeap () returned 0x630000 [0065.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.922] GetProcessHeap () returned 0x630000 [0065.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.922] GetProcessHeap () returned 0x630000 [0065.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.922] GetProcessHeap () returned 0x630000 [0065.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.923] GetProcessHeap () returned 0x630000 [0065.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.923] GetProcessHeap () returned 0x630000 [0065.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.923] GetProcessHeap () returned 0x630000 [0065.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.923] GetProcessHeap () returned 0x630000 [0065.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.923] GetProcessHeap () returned 0x630000 [0065.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.923] GetProcessHeap () returned 0x630000 [0065.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.923] GetProcessHeap () returned 0x630000 [0065.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.923] GetProcessHeap () returned 0x630000 [0065.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.923] GetProcessHeap () returned 0x630000 [0065.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.923] GetProcessHeap () returned 0x630000 [0065.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.923] GetProcessHeap () returned 0x630000 [0065.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.923] GetProcessHeap () returned 0x630000 [0065.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.923] GetProcessHeap () returned 0x630000 [0065.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.923] GetProcessHeap () returned 0x630000 [0065.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.923] GetProcessHeap () returned 0x630000 [0065.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.923] GetProcessHeap () returned 0x630000 [0065.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.923] GetProcessHeap () returned 0x630000 [0065.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.923] GetProcessHeap () returned 0x630000 [0065.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.924] GetProcessHeap () returned 0x630000 [0065.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.924] GetProcessHeap () returned 0x630000 [0065.924] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.924] GetProcessHeap () returned 0x630000 [0065.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.924] GetProcessHeap () returned 0x630000 [0065.924] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.924] GetProcessHeap () returned 0x630000 [0065.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.924] GetProcessHeap () returned 0x630000 [0065.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0065.924] GetProcessHeap () returned 0x630000 [0065.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0065.924] GetProcessHeap () returned 0x630000 [0065.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0065.924] GetProcessHeap () returned 0x630000 [0065.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0065.924] GetProcessHeap () returned 0x630000 [0065.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0065.924] GetProcessHeap () returned 0x630000 [0065.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e2b0 | out: hHeap=0x630000) returned 1 [0065.924] GetProcessHeap () returned 0x630000 [0065.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0065.924] GetProcessHeap () returned 0x630000 [0065.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0065.924] GetProcessHeap () returned 0x630000 [0065.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0065.924] GetProcessHeap () returned 0x630000 [0065.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.924] GetProcessHeap () returned 0x630000 [0065.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0065.924] WriteFile (in: hFile=0x230, lpBuffer=0x659b38*, nNumberOfBytesToWrite=0x386, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659b38*, lpNumberOfBytesWritten=0x243d864*=0x386, lpOverlapped=0x0) returned 1 [0065.945] GetProcessHeap () returned 0x630000 [0065.945] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659b38, Size=0x30) returned 0x659b38 [0065.945] GetProcessHeap () returned 0x630000 [0065.945] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0065.945] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0065.945] GetProcessHeap () returned 0x630000 [0065.945] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc220) returned 0x671bf0 [0065.945] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0xc220, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0xc220, lpOverlapped=0x0) returned 1 [0065.946] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0065.946] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0xc220, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0xc220, lpOverlapped=0x0) returned 1 [0065.947] GetProcessHeap () returned 0x630000 [0065.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0065.948] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0065.948] WriteFile (in: hFile=0x230, lpBuffer=0x659b38*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659b38*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0065.949] CloseHandle (hObject=0x230) returned 1 [0065.949] GetProcessHeap () returned 0x630000 [0065.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0065.949] GetProcessHeap () returned 0x630000 [0065.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655418 | out: hHeap=0x630000) returned 1 [0065.950] GetProcessHeap () returned 0x630000 [0065.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0065.950] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\vSNwmkBy0QKy.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\vSNwmkBy0QKy.pptx") returned="C:\\Users\\FD1HVy\\Documents\\vSNwmkBy0QKy.pptx" [0065.950] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\vSNwmkBy0QKy.pptx", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\vSNwmkBy0QKy.pptx.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\vSNwmkBy0QKy.pptx.happythreechoose" [0065.950] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\vSNwmkBy0QKy.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\vsnwmkby0qky.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\vSNwmkBy0QKy.pptx.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\vsnwmkby0qky.pptx.happythreechoose"), dwFlags=0x1) returned 1 [0065.950] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\vSNwmkBy0QKy.pptx" | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0065.950] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned="" [0065.950] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" [0065.950] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\decryption info.html")) returned 0x20 [0065.950] GetProcessHeap () returned 0x630000 [0065.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645f78 | out: hHeap=0x630000) returned 1 [0065.950] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31bd26d0, ftCreationTime.dwHighDateTime=0x1d581f8, ftLastAccessTime.dwLowDateTime=0xb774f980, ftLastAccessTime.dwHighDateTime=0x1d58877, ftLastWriteTime.dwLowDateTime=0xb774f980, ftLastWriteTime.dwHighDateTime=0x1d58877, nFileSizeHigh=0x0, nFileSizeLow=0xcb60, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Xy0Paz.xlsx", cAlternateFileName="XY0PAZ~1.XLS")) returned 1 [0065.950] lstrcmpiW (lpString1="Xy0Paz.xlsx", lpString2=".") returned 1 [0065.951] lstrcmpiW (lpString1="Xy0Paz.xlsx", lpString2="..") returned 1 [0065.951] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="Xy0Paz.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Xy0Paz.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\Xy0Paz.xlsx" [0065.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Xy0Paz.xlsx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0065.951] GetProcessHeap () returned 0x630000 [0065.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0065.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Xy0Paz.xlsx", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Xy0Paz.xlsx", lpUsedDefaultChar=0x0) returned 12 [0065.951] lstrlenA (lpString="Xy0Paz.xlsx") returned 11 [0065.951] lstrlenA (lpString=".happythreechoose") returned 17 [0065.951] lstrcmpiW (lpString1="Xy0Paz.xlsx", lpString2="Decryption INFO.html") returned 1 [0065.951] lstrcmpiW (lpString1="Xy0Paz.xlsx", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0065.951] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0065.951] lstrcmpiW (lpString1="Xy0Paz.xlsx", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0065.951] GetProcessHeap () returned 0x630000 [0065.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0065.951] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Xy0Paz.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\xy0paz.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0065.951] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=52064) returned 1 [0065.951] GetProcessHeap () returned 0x630000 [0065.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6559b8 [0065.951] GetProcessHeap () returned 0x630000 [0065.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0065.951] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\Xy0Paz.xlsx") returned 37 [0065.951] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0065.951] GetProcessHeap () returned 0x630000 [0065.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0065.951] GetProcessHeap () returned 0x630000 [0065.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x659b70 [0065.951] lstrlenA (lpString="rsa_encrypt") returned 11 [0065.951] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0065.952] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0065.953] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0065.953] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0065.953] GetProcessHeap () returned 0x630000 [0065.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0065.953] lstrlenA (lpString="010001") returned 6 [0065.953] GetProcessHeap () returned 0x630000 [0065.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0065.953] GetProcessHeap () returned 0x630000 [0065.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0065.953] GetProcessHeap () returned 0x630000 [0065.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e970 [0065.953] GetProcessHeap () returned 0x630000 [0065.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0065.953] GetProcessHeap () returned 0x630000 [0065.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e6a0 [0065.953] GetProcessHeap () returned 0x630000 [0065.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656b80 [0065.953] GetProcessHeap () returned 0x630000 [0065.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a298 [0065.953] GetProcessHeap () returned 0x630000 [0065.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0065.953] GetProcessHeap () returned 0x630000 [0065.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.953] GetProcessHeap () returned 0x630000 [0065.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0065.953] GetProcessHeap () returned 0x630000 [0065.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0065.953] GetProcessHeap () returned 0x630000 [0065.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657210 [0065.953] GetProcessHeap () returned 0x630000 [0065.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.953] GetProcessHeap () returned 0x630000 [0065.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0065.953] GetProcessHeap () returned 0x630000 [0065.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e460 [0065.954] GetProcessHeap () returned 0x630000 [0065.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0065.954] GetProcessHeap () returned 0x630000 [0065.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0065.954] GetProcessHeap () returned 0x630000 [0065.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e460 | out: hHeap=0x630000) returned 1 [0065.954] GetProcessHeap () returned 0x630000 [0065.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.954] GetProcessHeap () returned 0x630000 [0065.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65ce98 [0065.954] GetProcessHeap () returned 0x630000 [0065.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.954] GetProcessHeap () returned 0x630000 [0065.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.954] GetProcessHeap () returned 0x630000 [0065.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.954] GetProcessHeap () returned 0x630000 [0065.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.954] GetProcessHeap () returned 0x630000 [0065.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e3d0 [0065.954] GetProcessHeap () returned 0x630000 [0065.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ce98 | out: hHeap=0x630000) returned 1 [0065.954] GetProcessHeap () returned 0x630000 [0065.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0065.954] GetProcessHeap () returned 0x630000 [0065.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0065.954] GetProcessHeap () returned 0x630000 [0065.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.954] GetProcessHeap () returned 0x630000 [0065.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.954] GetProcessHeap () returned 0x630000 [0065.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.954] GetProcessHeap () returned 0x630000 [0065.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.954] GetProcessHeap () returned 0x630000 [0065.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.955] GetProcessHeap () returned 0x630000 [0065.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.955] GetProcessHeap () returned 0x630000 [0065.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.955] GetProcessHeap () returned 0x630000 [0065.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.955] GetProcessHeap () returned 0x630000 [0065.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.955] GetProcessHeap () returned 0x630000 [0065.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.955] GetProcessHeap () returned 0x630000 [0065.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.955] GetProcessHeap () returned 0x630000 [0065.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.955] GetProcessHeap () returned 0x630000 [0065.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.955] GetProcessHeap () returned 0x630000 [0065.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.955] GetProcessHeap () returned 0x630000 [0065.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.955] GetProcessHeap () returned 0x630000 [0065.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.955] GetProcessHeap () returned 0x630000 [0065.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.955] GetProcessHeap () returned 0x630000 [0065.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.955] GetProcessHeap () returned 0x630000 [0065.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.955] GetProcessHeap () returned 0x630000 [0065.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.955] GetProcessHeap () returned 0x630000 [0065.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.955] GetProcessHeap () returned 0x630000 [0065.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.955] GetProcessHeap () returned 0x630000 [0065.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.956] GetProcessHeap () returned 0x630000 [0065.956] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.956] GetProcessHeap () returned 0x630000 [0065.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.956] GetProcessHeap () returned 0x630000 [0065.956] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.956] GetProcessHeap () returned 0x630000 [0065.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.956] GetProcessHeap () returned 0x630000 [0065.956] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.956] GetProcessHeap () returned 0x630000 [0065.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.956] GetProcessHeap () returned 0x630000 [0065.956] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.956] GetProcessHeap () returned 0x630000 [0065.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.956] GetProcessHeap () returned 0x630000 [0065.956] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.956] GetProcessHeap () returned 0x630000 [0065.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.956] GetProcessHeap () returned 0x630000 [0065.956] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.956] GetProcessHeap () returned 0x630000 [0065.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.956] GetProcessHeap () returned 0x630000 [0065.956] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.956] GetProcessHeap () returned 0x630000 [0065.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.956] GetProcessHeap () returned 0x630000 [0065.956] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.956] GetProcessHeap () returned 0x630000 [0065.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.956] GetProcessHeap () returned 0x630000 [0065.956] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.956] GetProcessHeap () returned 0x630000 [0065.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.957] GetProcessHeap () returned 0x630000 [0065.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.957] GetProcessHeap () returned 0x630000 [0065.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.957] GetProcessHeap () returned 0x630000 [0065.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.957] GetProcessHeap () returned 0x630000 [0065.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.957] GetProcessHeap () returned 0x630000 [0065.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.957] GetProcessHeap () returned 0x630000 [0065.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.957] GetProcessHeap () returned 0x630000 [0065.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.957] GetProcessHeap () returned 0x630000 [0065.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0065.957] GetProcessHeap () returned 0x630000 [0065.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0065.957] GetProcessHeap () returned 0x630000 [0065.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.957] GetProcessHeap () returned 0x630000 [0065.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.957] GetProcessHeap () returned 0x630000 [0065.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.957] GetProcessHeap () returned 0x630000 [0065.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.957] GetProcessHeap () returned 0x630000 [0065.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.957] GetProcessHeap () returned 0x630000 [0065.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.957] GetProcessHeap () returned 0x630000 [0065.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.957] GetProcessHeap () returned 0x630000 [0065.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.957] GetProcessHeap () returned 0x630000 [0065.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.957] GetProcessHeap () returned 0x630000 [0065.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.958] GetProcessHeap () returned 0x630000 [0065.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.958] GetProcessHeap () returned 0x630000 [0065.958] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.958] GetProcessHeap () returned 0x630000 [0065.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.958] GetProcessHeap () returned 0x630000 [0065.958] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.958] GetProcessHeap () returned 0x630000 [0065.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.958] GetProcessHeap () returned 0x630000 [0065.958] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.958] GetProcessHeap () returned 0x630000 [0065.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.958] GetProcessHeap () returned 0x630000 [0065.958] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.958] GetProcessHeap () returned 0x630000 [0065.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.958] GetProcessHeap () returned 0x630000 [0065.958] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.958] GetProcessHeap () returned 0x630000 [0065.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0065.958] GetProcessHeap () returned 0x630000 [0065.958] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0065.958] GetProcessHeap () returned 0x630000 [0065.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.958] GetProcessHeap () returned 0x630000 [0065.958] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.958] GetProcessHeap () returned 0x630000 [0065.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0065.958] GetProcessHeap () returned 0x630000 [0065.958] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0065.958] GetProcessHeap () returned 0x630000 [0065.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.958] GetProcessHeap () returned 0x630000 [0065.958] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.959] GetProcessHeap () returned 0x630000 [0065.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0065.959] GetProcessHeap () returned 0x630000 [0065.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0065.959] GetProcessHeap () returned 0x630000 [0065.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0065.959] GetProcessHeap () returned 0x630000 [0065.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0065.959] GetProcessHeap () returned 0x630000 [0065.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0065.959] GetProcessHeap () returned 0x630000 [0065.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0065.959] GetProcessHeap () returned 0x630000 [0065.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0065.959] GetProcessHeap () returned 0x630000 [0065.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0065.959] GetProcessHeap () returned 0x630000 [0065.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0065.959] GetProcessHeap () returned 0x630000 [0065.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e6a0 | out: hHeap=0x630000) returned 1 [0065.959] GetProcessHeap () returned 0x630000 [0065.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0065.959] GetProcessHeap () returned 0x630000 [0065.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0065.959] GetProcessHeap () returned 0x630000 [0065.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0065.959] GetProcessHeap () returned 0x630000 [0065.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0065.959] GetProcessHeap () returned 0x630000 [0065.959] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0065.959] WriteFile (in: hFile=0x230, lpBuffer=0x659b70*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659b70*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0065.990] GetProcessHeap () returned 0x630000 [0065.990] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659b70, Size=0x30) returned 0x659b70 [0065.990] GetProcessHeap () returned 0x630000 [0065.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0065.990] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0065.991] GetProcessHeap () returned 0x630000 [0065.991] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xcb60) returned 0x671bf0 [0065.992] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0xcb60, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0xcb60, lpOverlapped=0x0) returned 1 [0065.993] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0065.993] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0xcb60, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0xcb60, lpOverlapped=0x0) returned 1 [0065.994] GetProcessHeap () returned 0x630000 [0065.994] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0065.994] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0065.995] WriteFile (in: hFile=0x230, lpBuffer=0x659b70*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659b70*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0065.995] CloseHandle (hObject=0x230) returned 1 [0065.996] GetProcessHeap () returned 0x630000 [0065.996] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0065.996] GetProcessHeap () returned 0x630000 [0065.996] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6559b8 | out: hHeap=0x630000) returned 1 [0065.996] GetProcessHeap () returned 0x630000 [0065.996] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0065.996] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\Xy0Paz.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Xy0Paz.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\Xy0Paz.xlsx" [0065.996] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\Xy0Paz.xlsx", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Xy0Paz.xlsx.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\Xy0Paz.xlsx.happythreechoose" [0065.996] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Xy0Paz.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\xy0paz.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Xy0Paz.xlsx.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\xy0paz.xlsx.happythreechoose"), dwFlags=0x1) returned 1 [0065.997] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\Xy0Paz.xlsx" | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0065.997] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\") returned="" [0065.997] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" [0065.997] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\decryption info.html")) returned 0x20 [0065.997] GetProcessHeap () returned 0x630000 [0065.997] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0065.997] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31bd26d0, ftCreationTime.dwHighDateTime=0x1d581f8, ftLastAccessTime.dwLowDateTime=0xb774f980, ftLastAccessTime.dwHighDateTime=0x1d58877, ftLastWriteTime.dwLowDateTime=0xb774f980, ftLastWriteTime.dwHighDateTime=0x1d58877, nFileSizeHigh=0x0, nFileSizeLow=0xcb60, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Xy0Paz.xlsx", cAlternateFileName="XY0PAZ~1.XLS")) returned 0 [0065.997] FindClose (in: hFindFile=0x648810 | out: hFindFile=0x648810) returned 1 [0065.997] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\Documents\\SBPS k\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\" [0065.997] GetProcessHeap () returned 0x630000 [0065.997] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x660060 | out: hHeap=0x630000) returned 1 [0065.997] GetProcessHeap () returned 0x630000 [0065.997] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0065.997] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\SBPS k\\") returned 33 [0065.997] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\*") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\*" [0065.997] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aff6800, ftCreationTime.dwHighDateTime=0x1d5cd16, ftLastAccessTime.dwLowDateTime=0x4b7697e0, ftLastAccessTime.dwHighDateTime=0x1d5d5c3, ftLastWriteTime.dwLowDateTime=0x4b7697e0, ftLastWriteTime.dwHighDateTime=0x1d5d5c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648810 [0065.998] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0065.998] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aff6800, ftCreationTime.dwHighDateTime=0x1d5cd16, ftLastAccessTime.dwLowDateTime=0x4b7697e0, ftLastAccessTime.dwHighDateTime=0x1d5d5c3, ftLastWriteTime.dwLowDateTime=0x4b7697e0, ftLastWriteTime.dwHighDateTime=0x1d5d5c3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.998] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0065.998] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0065.998] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5a04b40, ftCreationTime.dwHighDateTime=0x1d5cad7, ftLastAccessTime.dwLowDateTime=0x83d85280, ftLastAccessTime.dwHighDateTime=0x1d5cf16, ftLastWriteTime.dwLowDateTime=0x83d85280, ftLastWriteTime.dwHighDateTime=0x1d5cf16, nFileSizeHigh=0x0, nFileSizeLow=0x8969, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="As_eknRFdGwv.xlsx", cAlternateFileName="AS_EKN~1.XLS")) returned 1 [0065.998] lstrcmpiW (lpString1="As_eknRFdGwv.xlsx", lpString2=".") returned 1 [0065.998] lstrcmpiW (lpString1="As_eknRFdGwv.xlsx", lpString2="..") returned 1 [0065.998] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\", lpString2="As_eknRFdGwv.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\As_eknRFdGwv.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\As_eknRFdGwv.xlsx" [0065.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="As_eknRFdGwv.xlsx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0065.998] GetProcessHeap () returned 0x630000 [0065.998] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x645ef8 [0065.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="As_eknRFdGwv.xlsx", cchWideChar=-1, lpMultiByteStr=0x645ef8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="As_eknRFdGwv.xlsx", lpUsedDefaultChar=0x0) returned 18 [0065.998] lstrlenA (lpString="As_eknRFdGwv.xlsx") returned 17 [0065.998] lstrlenA (lpString=".happythreechoose") returned 17 [0065.998] lstrlenA (lpString=".happythreechoose") returned 17 [0065.998] lstrlenA (lpString="As_eknRFdGwv.xlsx") returned 17 [0065.998] lstrcmpiA (lpString1="As_eknRFdGwv.xlsx", lpString2=".happythreechoose") returned 1 [0065.998] lstrcmpiW (lpString1="As_eknRFdGwv.xlsx", lpString2="Decryption INFO.html") returned -1 [0065.998] lstrcmpiW (lpString1="As_eknRFdGwv.xlsx", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0065.998] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0065.998] lstrcmpiW (lpString1="As_eknRFdGwv.xlsx", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0065.998] GetProcessHeap () returned 0x630000 [0065.998] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0065.998] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\As_eknRFdGwv.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\as_eknrfdgwv.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0065.999] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=35177) returned 1 [0065.999] GetProcessHeap () returned 0x630000 [0065.999] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6557d8 [0065.999] GetProcessHeap () returned 0x630000 [0065.999] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0065.999] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\SBPS k\\As_eknRFdGwv.xlsx") returned 50 [0065.999] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0065.999] GetProcessHeap () returned 0x630000 [0065.999] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0065.999] GetProcessHeap () returned 0x630000 [0065.999] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x387) returned 0x659ba8 [0065.999] lstrlenA (lpString="rsa_encrypt") returned 11 [0065.999] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0065.999] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0066.000] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0066.000] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0066.000] GetProcessHeap () returned 0x630000 [0066.000] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0066.000] lstrlenA (lpString="010001") returned 6 [0066.000] GetProcessHeap () returned 0x630000 [0066.000] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2b8 [0066.000] GetProcessHeap () returned 0x630000 [0066.000] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0066.000] GetProcessHeap () returned 0x630000 [0066.000] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e730 [0066.000] GetProcessHeap () returned 0x630000 [0066.000] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0066.000] GetProcessHeap () returned 0x630000 [0066.000] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0066.000] GetProcessHeap () returned 0x630000 [0066.000] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656fe0 [0066.000] GetProcessHeap () returned 0x630000 [0066.000] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0066.000] GetProcessHeap () returned 0x630000 [0066.000] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0066.000] GetProcessHeap () returned 0x630000 [0066.000] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0066.000] GetProcessHeap () returned 0x630000 [0066.000] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0066.000] GetProcessHeap () returned 0x630000 [0066.000] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0066.000] GetProcessHeap () returned 0x630000 [0066.000] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x6570f8 [0066.000] GetProcessHeap () returned 0x630000 [0066.000] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0066.000] GetProcessHeap () returned 0x630000 [0066.000] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0066.000] GetProcessHeap () returned 0x630000 [0066.000] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e850 [0066.000] GetProcessHeap () returned 0x630000 [0066.001] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0066.001] GetProcessHeap () returned 0x630000 [0066.001] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0066.001] GetProcessHeap () returned 0x630000 [0066.001] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0066.001] GetProcessHeap () returned 0x630000 [0066.001] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0066.001] GetProcessHeap () returned 0x630000 [0066.001] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0066.001] GetProcessHeap () returned 0x630000 [0066.001] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0066.001] GetProcessHeap () returned 0x630000 [0066.001] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0066.001] GetProcessHeap () returned 0x630000 [0066.001] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0066.001] GetProcessHeap () returned 0x630000 [0066.001] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0066.001] GetProcessHeap () returned 0x630000 [0066.001] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65de30 [0066.001] GetProcessHeap () returned 0x630000 [0066.001] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0066.001] GetProcessHeap () returned 0x630000 [0066.001] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0066.001] GetProcessHeap () returned 0x630000 [0066.001] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0066.001] GetProcessHeap () returned 0x630000 [0066.001] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0066.001] GetProcessHeap () returned 0x630000 [0066.001] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0066.001] GetProcessHeap () returned 0x630000 [0066.001] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0066.001] GetProcessHeap () returned 0x630000 [0066.001] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0066.001] GetProcessHeap () returned 0x630000 [0066.001] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0066.001] GetProcessHeap () returned 0x630000 [0066.001] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0066.001] GetProcessHeap () returned 0x630000 [0066.001] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0066.002] GetProcessHeap () returned 0x630000 [0066.002] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0066.002] GetProcessHeap () returned 0x630000 [0066.002] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0066.002] GetProcessHeap () returned 0x630000 [0066.002] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0066.002] GetProcessHeap () returned 0x630000 [0066.002] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0066.002] GetProcessHeap () returned 0x630000 [0066.002] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0066.002] GetProcessHeap () returned 0x630000 [0066.002] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0066.002] GetProcessHeap () returned 0x630000 [0066.002] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0066.002] GetProcessHeap () returned 0x630000 [0066.002] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0066.002] GetProcessHeap () returned 0x630000 [0066.002] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0066.002] GetProcessHeap () returned 0x630000 [0066.002] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0066.002] GetProcessHeap () returned 0x630000 [0066.002] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0066.002] GetProcessHeap () returned 0x630000 [0066.002] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0066.002] GetProcessHeap () returned 0x630000 [0066.002] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0066.002] GetProcessHeap () returned 0x630000 [0066.002] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0066.002] GetProcessHeap () returned 0x630000 [0066.002] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0066.002] GetProcessHeap () returned 0x630000 [0066.002] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0066.002] GetProcessHeap () returned 0x630000 [0066.002] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0066.002] GetProcessHeap () returned 0x630000 [0066.003] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0066.003] GetProcessHeap () returned 0x630000 [0066.003] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0066.003] GetProcessHeap () returned 0x630000 [0066.003] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0066.003] GetProcessHeap () returned 0x630000 [0066.003] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0066.003] GetProcessHeap () returned 0x630000 [0066.003] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0066.003] GetProcessHeap () returned 0x630000 [0066.003] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0066.003] GetProcessHeap () returned 0x630000 [0066.003] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0066.003] GetProcessHeap () returned 0x630000 [0066.003] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0066.003] GetProcessHeap () returned 0x630000 [0066.003] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0066.003] GetProcessHeap () returned 0x630000 [0066.003] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0066.003] GetProcessHeap () returned 0x630000 [0066.003] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0066.003] GetProcessHeap () returned 0x630000 [0066.003] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0066.003] GetProcessHeap () returned 0x630000 [0066.003] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0066.003] GetProcessHeap () returned 0x630000 [0066.003] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0066.003] GetProcessHeap () returned 0x630000 [0066.003] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0066.003] GetProcessHeap () returned 0x630000 [0066.003] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0066.003] GetProcessHeap () returned 0x630000 [0066.003] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0066.003] GetProcessHeap () returned 0x630000 [0066.003] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0066.003] GetProcessHeap () returned 0x630000 [0066.004] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0066.004] GetProcessHeap () returned 0x630000 [0066.004] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0066.004] GetProcessHeap () returned 0x630000 [0066.004] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0066.004] GetProcessHeap () returned 0x630000 [0066.004] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0066.004] GetProcessHeap () returned 0x630000 [0066.004] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0066.004] GetProcessHeap () returned 0x630000 [0066.004] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0066.004] GetProcessHeap () returned 0x630000 [0066.004] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0066.004] GetProcessHeap () returned 0x630000 [0066.004] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0066.004] GetProcessHeap () returned 0x630000 [0066.004] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0066.004] GetProcessHeap () returned 0x630000 [0066.004] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0066.004] GetProcessHeap () returned 0x630000 [0066.004] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0066.004] GetProcessHeap () returned 0x630000 [0066.004] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0066.004] GetProcessHeap () returned 0x630000 [0066.005] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0066.005] GetProcessHeap () returned 0x630000 [0066.005] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0066.005] GetProcessHeap () returned 0x630000 [0066.005] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0066.005] GetProcessHeap () returned 0x630000 [0066.005] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0066.005] GetProcessHeap () returned 0x630000 [0066.005] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0066.005] GetProcessHeap () returned 0x630000 [0066.005] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0066.005] GetProcessHeap () returned 0x630000 [0066.005] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0066.005] GetProcessHeap () returned 0x630000 [0066.005] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0066.005] GetProcessHeap () returned 0x630000 [0066.005] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0066.005] GetProcessHeap () returned 0x630000 [0066.005] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0066.005] GetProcessHeap () returned 0x630000 [0066.005] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0066.005] GetProcessHeap () returned 0x630000 [0066.005] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0066.005] GetProcessHeap () returned 0x630000 [0066.005] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0066.005] GetProcessHeap () returned 0x630000 [0066.005] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0066.005] GetProcessHeap () returned 0x630000 [0066.005] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0066.005] GetProcessHeap () returned 0x630000 [0066.005] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0066.005] GetProcessHeap () returned 0x630000 [0066.005] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0066.005] GetProcessHeap () returned 0x630000 [0066.005] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0066.005] GetProcessHeap () returned 0x630000 [0066.005] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0066.006] GetProcessHeap () returned 0x630000 [0066.006] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0066.006] GetProcessHeap () returned 0x630000 [0066.006] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0066.006] GetProcessHeap () returned 0x630000 [0066.006] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0066.006] GetProcessHeap () returned 0x630000 [0066.006] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0066.006] GetProcessHeap () returned 0x630000 [0066.006] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0066.006] GetProcessHeap () returned 0x630000 [0066.006] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0066.006] GetProcessHeap () returned 0x630000 [0066.006] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0066.006] GetProcessHeap () returned 0x630000 [0066.006] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0066.006] GetProcessHeap () returned 0x630000 [0066.006] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0066.006] GetProcessHeap () returned 0x630000 [0066.006] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0066.006] GetProcessHeap () returned 0x630000 [0066.006] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0066.006] GetProcessHeap () returned 0x630000 [0066.006] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0066.006] GetProcessHeap () returned 0x630000 [0066.006] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0066.006] GetProcessHeap () returned 0x630000 [0066.006] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0066.006] GetProcessHeap () returned 0x630000 [0066.006] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0066.006] GetProcessHeap () returned 0x630000 [0066.006] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0066.006] GetProcessHeap () returned 0x630000 [0066.006] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0066.006] GetProcessHeap () returned 0x630000 [0066.006] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0066.007] GetProcessHeap () returned 0x630000 [0066.007] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0066.007] GetProcessHeap () returned 0x630000 [0066.007] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0066.007] WriteFile (in: hFile=0x230, lpBuffer=0x659ba8*, nNumberOfBytesToWrite=0x387, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659ba8*, lpNumberOfBytesWritten=0x243d864*=0x387, lpOverlapped=0x0) returned 1 [0066.044] GetProcessHeap () returned 0x630000 [0066.044] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659ba8, Size=0x30) returned 0x659ba8 [0066.044] GetProcessHeap () returned 0x630000 [0066.044] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0066.044] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0066.044] GetProcessHeap () returned 0x630000 [0066.044] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8970) returned 0x671bf0 [0066.044] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0x8970, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0x8970, lpOverlapped=0x0) returned 1 [0066.044] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0066.044] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x8970, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0x8970, lpOverlapped=0x0) returned 1 [0066.046] GetProcessHeap () returned 0x630000 [0066.046] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0066.047] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0066.048] WriteFile (in: hFile=0x230, lpBuffer=0x659ba8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659ba8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0066.049] CloseHandle (hObject=0x230) returned 1 [0066.049] GetProcessHeap () returned 0x630000 [0066.049] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0066.049] GetProcessHeap () returned 0x630000 [0066.049] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6557d8 | out: hHeap=0x630000) returned 1 [0066.049] GetProcessHeap () returned 0x630000 [0066.049] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0066.049] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\SBPS k\\As_eknRFdGwv.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\As_eknRFdGwv.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\As_eknRFdGwv.xlsx" [0066.049] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\As_eknRFdGwv.xlsx", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\As_eknRFdGwv.xlsx.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\As_eknRFdGwv.xlsx.happythreechoose" [0066.049] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\As_eknRFdGwv.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\as_eknrfdgwv.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\As_eknRFdGwv.xlsx.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\as_eknrfdgwv.xlsx.happythreechoose"), dwFlags=0x1) returned 1 [0066.054] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\As_eknRFdGwv.xlsx" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k") returned 1 [0066.054] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\") returned="" [0066.054] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\Decryption INFO.html" [0066.054] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\decryption info.html")) returned 0xffffffff [0066.054] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0066.054] GetProcessHeap () returned 0x630000 [0066.054] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655a30 [0066.054] GetProcessHeap () returned 0x630000 [0066.054] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0066.061] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.062] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.062] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.063] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.063] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.063] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.063] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.063] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.063] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.063] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.063] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.063] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.063] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.063] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.063] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.063] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.064] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.064] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.064] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.064] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.064] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.064] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.064] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.064] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.064] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.064] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.064] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.064] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.064] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.065] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.065] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.065] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.065] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.065] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.065] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.065] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.065] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.091] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.091] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.091] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.092] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.092] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.092] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.092] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.092] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.092] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.092] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.092] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.092] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.092] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.092] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.092] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.093] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.093] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.093] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.093] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.093] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.093] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.093] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.093] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.093] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.093] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.093] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.093] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.093] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.093] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.094] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.094] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.094] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.094] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.094] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.094] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.094] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.094] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.094] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.094] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.094] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.094] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.094] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.094] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.095] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.095] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.095] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.095] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.095] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.095] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.095] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.095] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.095] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.095] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.095] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.095] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.095] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.096] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.096] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.096] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.096] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.096] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.096] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.096] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.096] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.096] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.096] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.096] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.096] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.096] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.096] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.097] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.097] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.097] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.097] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.097] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.097] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.097] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.097] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.097] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.097] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.097] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.097] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.097] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.097] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.098] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.098] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.098] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.098] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.098] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.098] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.098] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.098] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.098] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.098] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.098] GetProcessHeap () returned 0x630000 [0066.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655a30 | out: hHeap=0x630000) returned 1 [0066.098] GetProcessHeap () returned 0x630000 [0066.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0066.098] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0066.099] GetProcessHeap () returned 0x630000 [0066.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655b20 [0066.099] GetProcessHeap () returned 0x630000 [0066.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0066.105] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.106] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.106] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.106] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.106] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.106] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.106] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.106] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.106] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.106] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.106] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.106] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.106] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.106] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.107] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.107] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.107] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.107] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.107] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.107] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.107] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.107] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.107] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.107] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.107] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.107] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.107] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.107] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.108] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.108] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.108] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.108] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.108] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.108] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.146] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.146] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.146] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.146] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.146] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.146] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.147] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.147] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.147] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.147] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.147] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.147] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.147] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.147] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.147] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.147] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.147] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.147] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.147] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.147] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.148] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.148] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.148] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.148] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.148] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.148] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.148] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.148] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.148] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.148] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.148] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.148] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.148] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.148] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.149] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.149] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.149] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.149] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.149] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.149] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.149] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.149] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.149] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.149] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.149] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.150] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.150] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.150] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.150] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.150] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.150] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.150] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.150] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.150] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.150] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.150] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.150] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.150] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.151] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.151] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.151] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.151] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.151] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.151] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.151] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.151] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.151] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.151] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.151] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.152] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.152] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.152] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.152] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.152] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.152] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.152] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.152] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.152] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.152] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.152] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.152] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.152] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.152] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.153] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0066.153] GetProcessHeap () returned 0x630000 [0066.153] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655b20 | out: hHeap=0x630000) returned 1 [0066.153] GetProcessHeap () returned 0x630000 [0066.153] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0066.153] CloseHandle (hObject=0x230) returned 1 [0066.154] GetProcessHeap () returned 0x630000 [0066.154] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645ef8 | out: hHeap=0x630000) returned 1 [0066.154] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc845ac0, ftCreationTime.dwHighDateTime=0x1d5c8f2, ftLastAccessTime.dwLowDateTime=0x2e379560, ftLastAccessTime.dwHighDateTime=0x1d5c97c, ftLastWriteTime.dwLowDateTime=0x2e379560, ftLastWriteTime.dwHighDateTime=0x1d5c97c, nFileSizeHigh=0x0, nFileSizeLow=0x58c4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cgTSnv7pH.ods", cAlternateFileName="CGTSNV~1.ODS")) returned 1 [0066.154] lstrcmpiW (lpString1="cgTSnv7pH.ods", lpString2=".") returned 1 [0066.154] lstrcmpiW (lpString1="cgTSnv7pH.ods", lpString2="..") returned 1 [0066.154] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\", lpString2="cgTSnv7pH.ods" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\cgTSnv7pH.ods") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\cgTSnv7pH.ods" [0066.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cgTSnv7pH.ods", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0066.154] GetProcessHeap () returned 0x630000 [0066.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x64c9f0 [0066.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cgTSnv7pH.ods", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cgTSnv7pH.ods", lpUsedDefaultChar=0x0) returned 14 [0066.154] lstrlenA (lpString="cgTSnv7pH.ods") returned 13 [0066.154] lstrlenA (lpString=".happythreechoose") returned 17 [0066.154] lstrcmpiW (lpString1="cgTSnv7pH.ods", lpString2="Decryption INFO.html") returned -1 [0066.154] lstrcmpiW (lpString1="cgTSnv7pH.ods", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0066.154] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0066.154] lstrcmpiW (lpString1="cgTSnv7pH.ods", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0066.154] GetProcessHeap () returned 0x630000 [0066.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f10 [0066.154] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\cgTSnv7pH.ods" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\cgtsnv7ph.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0066.154] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=22724) returned 1 [0066.154] GetProcessHeap () returned 0x630000 [0066.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6556e8 [0066.154] GetProcessHeap () returned 0x630000 [0066.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0066.154] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\SBPS k\\cgTSnv7pH.ods") returned 46 [0066.155] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0066.155] GetProcessHeap () returned 0x630000 [0066.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0066.155] GetProcessHeap () returned 0x630000 [0066.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38c) returned 0x659be0 [0066.155] lstrlenA (lpString="rsa_encrypt") returned 11 [0066.155] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0066.155] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0066.155] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0066.155] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0066.155] GetProcessHeap () returned 0x630000 [0066.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0066.155] lstrlenA (lpString="010001") returned 6 [0066.155] GetProcessHeap () returned 0x630000 [0066.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0066.156] GetProcessHeap () returned 0x630000 [0066.156] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x659f78 [0066.156] GetProcessHeap () returned 0x630000 [0066.156] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e190 [0066.156] GetProcessHeap () returned 0x630000 [0066.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x659f78 | out: hHeap=0x630000) returned 1 [0066.156] GetProcessHeap () returned 0x630000 [0066.156] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e610 [0066.156] GetProcessHeap () returned 0x630000 [0066.156] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656db0 [0066.156] GetProcessHeap () returned 0x630000 [0066.156] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2b8 [0066.157] GetProcessHeap () returned 0x630000 [0066.157] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0066.157] GetProcessHeap () returned 0x630000 [0066.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0066.157] GetProcessHeap () returned 0x630000 [0066.157] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0066.157] GetProcessHeap () returned 0x630000 [0066.157] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x659f78 [0066.157] GetProcessHeap () returned 0x630000 [0066.157] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656fe0 [0066.157] GetProcessHeap () returned 0x630000 [0066.157] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0066.157] GetProcessHeap () returned 0x630000 [0066.157] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0066.157] GetProcessHeap () returned 0x630000 [0066.157] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e970 [0066.157] GetProcessHeap () returned 0x630000 [0066.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x659f78 | out: hHeap=0x630000) returned 1 [0066.157] GetProcessHeap () returned 0x630000 [0066.157] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0066.157] GetProcessHeap () returned 0x630000 [0066.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0066.157] GetProcessHeap () returned 0x630000 [0066.157] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0066.157] GetProcessHeap () returned 0x630000 [0066.157] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cef8 [0066.157] GetProcessHeap () returned 0x630000 [0066.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0066.157] GetProcessHeap () returned 0x630000 [0066.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0066.157] GetProcessHeap () returned 0x630000 [0066.157] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0066.157] GetProcessHeap () returned 0x630000 [0066.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0066.158] GetProcessHeap () returned 0x630000 [0066.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e580 [0066.158] GetProcessHeap () returned 0x630000 [0066.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cef8 | out: hHeap=0x630000) returned 1 [0066.158] GetProcessHeap () returned 0x630000 [0066.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0066.158] GetProcessHeap () returned 0x630000 [0066.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0066.158] GetProcessHeap () returned 0x630000 [0066.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0066.158] GetProcessHeap () returned 0x630000 [0066.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0066.158] GetProcessHeap () returned 0x630000 [0066.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0066.158] GetProcessHeap () returned 0x630000 [0066.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0066.158] GetProcessHeap () returned 0x630000 [0066.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0066.158] GetProcessHeap () returned 0x630000 [0066.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0066.158] GetProcessHeap () returned 0x630000 [0066.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0066.158] GetProcessHeap () returned 0x630000 [0066.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0066.158] GetProcessHeap () returned 0x630000 [0066.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0066.158] GetProcessHeap () returned 0x630000 [0066.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0066.158] GetProcessHeap () returned 0x630000 [0066.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0066.158] GetProcessHeap () returned 0x630000 [0066.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0066.158] GetProcessHeap () returned 0x630000 [0066.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0066.158] GetProcessHeap () returned 0x630000 [0066.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0066.159] GetProcessHeap () returned 0x630000 [0066.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0066.159] GetProcessHeap () returned 0x630000 [0066.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0066.159] GetProcessHeap () returned 0x630000 [0066.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0066.159] GetProcessHeap () returned 0x630000 [0066.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0066.159] GetProcessHeap () returned 0x630000 [0066.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0066.159] GetProcessHeap () returned 0x630000 [0066.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0066.159] GetProcessHeap () returned 0x630000 [0066.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0066.159] GetProcessHeap () returned 0x630000 [0066.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0066.159] GetProcessHeap () returned 0x630000 [0066.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0066.159] GetProcessHeap () returned 0x630000 [0066.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0066.159] GetProcessHeap () returned 0x630000 [0066.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0066.159] GetProcessHeap () returned 0x630000 [0066.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0066.159] GetProcessHeap () returned 0x630000 [0066.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0066.159] GetProcessHeap () returned 0x630000 [0066.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0066.159] GetProcessHeap () returned 0x630000 [0066.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0066.159] GetProcessHeap () returned 0x630000 [0066.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0066.159] GetProcessHeap () returned 0x630000 [0066.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0066.159] GetProcessHeap () returned 0x630000 [0066.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0066.159] GetProcessHeap () returned 0x630000 [0066.160] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0066.160] GetProcessHeap () returned 0x630000 [0066.160] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0066.160] GetProcessHeap () returned 0x630000 [0066.160] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0066.160] GetProcessHeap () returned 0x630000 [0066.160] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0066.160] GetProcessHeap () returned 0x630000 [0066.160] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0066.160] GetProcessHeap () returned 0x630000 [0066.160] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0066.160] GetProcessHeap () returned 0x630000 [0066.160] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0066.160] GetProcessHeap () returned 0x630000 [0066.160] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0066.160] GetProcessHeap () returned 0x630000 [0066.160] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0066.160] GetProcessHeap () returned 0x630000 [0066.160] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0066.160] GetProcessHeap () returned 0x630000 [0066.160] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0066.160] GetProcessHeap () returned 0x630000 [0066.160] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0066.160] GetProcessHeap () returned 0x630000 [0066.160] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0066.160] GetProcessHeap () returned 0x630000 [0066.160] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0066.160] GetProcessHeap () returned 0x630000 [0066.160] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0066.160] GetProcessHeap () returned 0x630000 [0066.160] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0066.160] GetProcessHeap () returned 0x630000 [0066.160] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0066.160] GetProcessHeap () returned 0x630000 [0066.160] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0066.160] GetProcessHeap () returned 0x630000 [0066.160] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0066.160] GetProcessHeap () returned 0x630000 [0066.161] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0066.161] GetProcessHeap () returned 0x630000 [0066.161] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0066.161] GetProcessHeap () returned 0x630000 [0066.161] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0066.161] GetProcessHeap () returned 0x630000 [0066.161] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0066.161] GetProcessHeap () returned 0x630000 [0066.161] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0066.161] GetProcessHeap () returned 0x630000 [0066.161] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0066.161] GetProcessHeap () returned 0x630000 [0066.161] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0066.161] GetProcessHeap () returned 0x630000 [0066.161] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0066.161] GetProcessHeap () returned 0x630000 [0066.161] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0066.161] GetProcessHeap () returned 0x630000 [0066.161] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0066.161] GetProcessHeap () returned 0x630000 [0066.161] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0066.161] GetProcessHeap () returned 0x630000 [0066.161] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0066.161] GetProcessHeap () returned 0x630000 [0066.161] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0066.161] GetProcessHeap () returned 0x630000 [0066.161] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0066.161] GetProcessHeap () returned 0x630000 [0066.161] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0066.161] GetProcessHeap () returned 0x630000 [0066.161] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0066.161] GetProcessHeap () returned 0x630000 [0066.161] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0066.161] GetProcessHeap () returned 0x630000 [0066.161] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0066.161] GetProcessHeap () returned 0x630000 [0066.161] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0066.162] GetProcessHeap () returned 0x630000 [0066.162] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0066.162] GetProcessHeap () returned 0x630000 [0066.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0066.162] GetProcessHeap () returned 0x630000 [0066.162] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0066.162] GetProcessHeap () returned 0x630000 [0066.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0066.162] GetProcessHeap () returned 0x630000 [0066.162] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0066.162] GetProcessHeap () returned 0x630000 [0066.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0066.162] GetProcessHeap () returned 0x630000 [0066.162] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0066.162] GetProcessHeap () returned 0x630000 [0066.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0066.162] GetProcessHeap () returned 0x630000 [0066.162] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0066.162] GetProcessHeap () returned 0x630000 [0066.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0066.162] GetProcessHeap () returned 0x630000 [0066.162] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0066.162] GetProcessHeap () returned 0x630000 [0066.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0066.162] GetProcessHeap () returned 0x630000 [0066.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0066.162] GetProcessHeap () returned 0x630000 [0066.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0066.162] GetProcessHeap () returned 0x630000 [0066.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0066.162] GetProcessHeap () returned 0x630000 [0066.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0066.162] GetProcessHeap () returned 0x630000 [0066.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0066.162] GetProcessHeap () returned 0x630000 [0066.162] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0066.163] GetProcessHeap () returned 0x630000 [0066.163] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0066.163] GetProcessHeap () returned 0x630000 [0066.163] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0066.163] GetProcessHeap () returned 0x630000 [0066.163] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0066.163] GetProcessHeap () returned 0x630000 [0066.163] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0066.163] GetProcessHeap () returned 0x630000 [0066.163] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0066.163] WriteFile (in: hFile=0x230, lpBuffer=0x659be0*, nNumberOfBytesToWrite=0x38c, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659be0*, lpNumberOfBytesWritten=0x243d864*=0x38c, lpOverlapped=0x0) returned 1 [0071.650] GetProcessHeap () returned 0x630000 [0071.650] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659be0, Size=0x30) returned 0x659be0 [0071.650] GetProcessHeap () returned 0x630000 [0071.650] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0071.650] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0071.651] GetProcessHeap () returned 0x630000 [0071.651] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x58d0) returned 0x671bf0 [0071.652] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0x58d0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0x58d0, lpOverlapped=0x0) returned 1 [0071.653] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0071.653] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x58d0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0x58d0, lpOverlapped=0x0) returned 1 [0071.660] GetProcessHeap () returned 0x630000 [0071.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0071.660] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0071.660] WriteFile (in: hFile=0x230, lpBuffer=0x659be0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659be0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0071.661] CloseHandle (hObject=0x230) returned 1 [0071.661] GetProcessHeap () returned 0x630000 [0071.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f10 | out: hHeap=0x630000) returned 1 [0071.661] GetProcessHeap () returned 0x630000 [0071.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6556e8 | out: hHeap=0x630000) returned 1 [0071.661] GetProcessHeap () returned 0x630000 [0071.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0071.661] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\SBPS k\\cgTSnv7pH.ods" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\cgTSnv7pH.ods") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\cgTSnv7pH.ods" [0071.661] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\cgTSnv7pH.ods", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\cgTSnv7pH.ods.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\cgTSnv7pH.ods.happythreechoose" [0071.662] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\cgTSnv7pH.ods" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\cgtsnv7ph.ods"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\cgTSnv7pH.ods.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\cgtsnv7ph.ods.happythreechoose"), dwFlags=0x1) returned 1 [0071.663] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\cgTSnv7pH.ods" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k") returned 1 [0071.663] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\") returned="" [0071.663] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\Decryption INFO.html" [0071.663] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\decryption info.html")) returned 0x20 [0071.663] GetProcessHeap () returned 0x630000 [0071.663] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0071.663] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2ab8dc0, ftCreationTime.dwHighDateTime=0x1d5d1e0, ftLastAccessTime.dwLowDateTime=0xfd3ad630, ftLastAccessTime.dwHighDateTime=0x1d5d217, ftLastWriteTime.dwLowDateTime=0xfd3ad630, ftLastWriteTime.dwHighDateTime=0x1d5d217, nFileSizeHigh=0x0, nFileSizeLow=0x13ec6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dkXwh8gxfRcRMt tPl.pps", cAlternateFileName="DKXWH8~1.PPS")) returned 1 [0071.664] lstrcmpiW (lpString1="dkXwh8gxfRcRMt tPl.pps", lpString2=".") returned 1 [0071.664] lstrcmpiW (lpString1="dkXwh8gxfRcRMt tPl.pps", lpString2="..") returned 1 [0071.664] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\", lpString2="dkXwh8gxfRcRMt tPl.pps" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\dkXwh8gxfRcRMt tPl.pps") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\dkXwh8gxfRcRMt tPl.pps" [0071.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dkXwh8gxfRcRMt tPl.pps", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0071.664] GetProcessHeap () returned 0x630000 [0071.664] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x17) returned 0x645e58 [0071.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dkXwh8gxfRcRMt tPl.pps", cchWideChar=-1, lpMultiByteStr=0x645e58, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dkXwh8gxfRcRMt tPl.pps", lpUsedDefaultChar=0x0) returned 23 [0071.664] lstrlenA (lpString="dkXwh8gxfRcRMt tPl.pps") returned 22 [0071.664] lstrlenA (lpString=".happythreechoose") returned 17 [0071.664] lstrlenA (lpString=".happythreechoose") returned 17 [0071.664] lstrlenA (lpString="dkXwh8gxfRcRMt tPl.pps") returned 22 [0071.664] lstrcmpiA (lpString1="8gxfRcRMt tPl.pps", lpString2=".happythreechoose") returned 1 [0071.664] lstrcmpiW (lpString1="dkXwh8gxfRcRMt tPl.pps", lpString2="Decryption INFO.html") returned 1 [0071.664] lstrcmpiW (lpString1="dkXwh8gxfRcRMt tPl.pps", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0071.664] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0071.664] lstrcmpiW (lpString1="dkXwh8gxfRcRMt tPl.pps", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0071.767] GetProcessHeap () returned 0x630000 [0071.767] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0071.767] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\dkXwh8gxfRcRMt tPl.pps" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\dkxwh8gxfrcrmt tpl.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0071.767] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=81606) returned 1 [0071.768] GetProcessHeap () returned 0x630000 [0071.768] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6557d8 [0071.768] GetProcessHeap () returned 0x630000 [0071.768] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0071.768] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\SBPS k\\dkXwh8gxfRcRMt tPl.pps") returned 55 [0071.768] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0071.768] GetProcessHeap () returned 0x630000 [0071.768] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0071.768] GetProcessHeap () returned 0x630000 [0071.768] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x659c18 [0071.768] lstrlenA (lpString="rsa_encrypt") returned 11 [0071.768] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0071.768] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0071.769] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0071.769] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0071.769] GetProcessHeap () returned 0x630000 [0071.769] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0071.769] lstrlenA (lpString="010001") returned 6 [0071.769] GetProcessHeap () returned 0x630000 [0071.769] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0071.769] GetProcessHeap () returned 0x630000 [0071.769] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0071.769] GetProcessHeap () returned 0x630000 [0071.769] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e730 [0071.769] GetProcessHeap () returned 0x630000 [0071.769] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0071.769] GetProcessHeap () returned 0x630000 [0071.769] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e190 [0071.769] GetProcessHeap () returned 0x630000 [0071.769] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657670 [0071.769] GetProcessHeap () returned 0x630000 [0071.769] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0071.769] GetProcessHeap () returned 0x630000 [0071.769] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0071.769] GetProcessHeap () returned 0x630000 [0071.769] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.769] GetProcessHeap () returned 0x630000 [0071.769] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0071.769] GetProcessHeap () returned 0x630000 [0071.769] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0071.769] GetProcessHeap () returned 0x630000 [0071.769] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656fe0 [0071.769] GetProcessHeap () returned 0x630000 [0071.769] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0071.769] GetProcessHeap () returned 0x630000 [0071.769] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0071.769] GetProcessHeap () returned 0x630000 [0071.769] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dfe0 [0071.769] GetProcessHeap () returned 0x630000 [0071.769] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0071.770] GetProcessHeap () returned 0x630000 [0071.770] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0071.770] GetProcessHeap () returned 0x630000 [0071.770] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0071.770] GetProcessHeap () returned 0x630000 [0071.770] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.770] GetProcessHeap () returned 0x630000 [0071.770] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0071.770] GetProcessHeap () returned 0x630000 [0071.770] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0071.770] GetProcessHeap () returned 0x630000 [0071.770] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.770] GetProcessHeap () returned 0x630000 [0071.770] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0071.770] GetProcessHeap () returned 0x630000 [0071.770] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0071.770] GetProcessHeap () returned 0x630000 [0071.770] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65dda0 [0071.770] GetProcessHeap () returned 0x630000 [0071.770] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0071.770] GetProcessHeap () returned 0x630000 [0071.770] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0071.770] GetProcessHeap () returned 0x630000 [0071.770] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0071.770] GetProcessHeap () returned 0x630000 [0071.770] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.770] GetProcessHeap () returned 0x630000 [0071.770] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.770] GetProcessHeap () returned 0x630000 [0071.770] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.770] GetProcessHeap () returned 0x630000 [0071.770] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.770] GetProcessHeap () returned 0x630000 [0071.770] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0071.770] GetProcessHeap () returned 0x630000 [0071.770] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0071.770] GetProcessHeap () returned 0x630000 [0071.770] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.770] GetProcessHeap () returned 0x630000 [0071.770] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.770] GetProcessHeap () returned 0x630000 [0071.771] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0071.771] GetProcessHeap () returned 0x630000 [0071.771] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0071.771] GetProcessHeap () returned 0x630000 [0071.771] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.771] GetProcessHeap () returned 0x630000 [0071.771] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.771] GetProcessHeap () returned 0x630000 [0071.771] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.771] GetProcessHeap () returned 0x630000 [0071.771] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.771] GetProcessHeap () returned 0x630000 [0071.771] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0071.771] GetProcessHeap () returned 0x630000 [0071.771] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0071.771] GetProcessHeap () returned 0x630000 [0071.771] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0071.771] GetProcessHeap () returned 0x630000 [0071.771] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0071.771] GetProcessHeap () returned 0x630000 [0071.771] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0071.771] GetProcessHeap () returned 0x630000 [0071.771] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0071.771] GetProcessHeap () returned 0x630000 [0071.771] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0071.771] GetProcessHeap () returned 0x630000 [0071.771] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0071.771] GetProcessHeap () returned 0x630000 [0071.771] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0071.771] GetProcessHeap () returned 0x630000 [0071.771] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0071.771] GetProcessHeap () returned 0x630000 [0071.771] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.771] GetProcessHeap () returned 0x630000 [0071.771] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.771] GetProcessHeap () returned 0x630000 [0071.771] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0071.771] GetProcessHeap () returned 0x630000 [0071.771] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0071.772] GetProcessHeap () returned 0x630000 [0071.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.772] GetProcessHeap () returned 0x630000 [0071.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.772] GetProcessHeap () returned 0x630000 [0071.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0071.772] GetProcessHeap () returned 0x630000 [0071.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0071.772] GetProcessHeap () returned 0x630000 [0071.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.772] GetProcessHeap () returned 0x630000 [0071.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.772] GetProcessHeap () returned 0x630000 [0071.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0071.772] GetProcessHeap () returned 0x630000 [0071.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0071.772] GetProcessHeap () returned 0x630000 [0071.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.772] GetProcessHeap () returned 0x630000 [0071.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.772] GetProcessHeap () returned 0x630000 [0071.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0071.772] GetProcessHeap () returned 0x630000 [0071.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0071.772] GetProcessHeap () returned 0x630000 [0071.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.772] GetProcessHeap () returned 0x630000 [0071.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.772] GetProcessHeap () returned 0x630000 [0071.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.772] GetProcessHeap () returned 0x630000 [0071.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.772] GetProcessHeap () returned 0x630000 [0071.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0071.772] GetProcessHeap () returned 0x630000 [0071.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0071.772] GetProcessHeap () returned 0x630000 [0071.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.772] GetProcessHeap () returned 0x630000 [0071.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.773] GetProcessHeap () returned 0x630000 [0071.773] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.773] GetProcessHeap () returned 0x630000 [0071.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.773] GetProcessHeap () returned 0x630000 [0071.773] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.773] GetProcessHeap () returned 0x630000 [0071.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.773] GetProcessHeap () returned 0x630000 [0071.773] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0071.773] GetProcessHeap () returned 0x630000 [0071.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0071.773] GetProcessHeap () returned 0x630000 [0071.773] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.773] GetProcessHeap () returned 0x630000 [0071.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.773] GetProcessHeap () returned 0x630000 [0071.773] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0071.773] GetProcessHeap () returned 0x630000 [0071.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0071.773] GetProcessHeap () returned 0x630000 [0071.773] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.773] GetProcessHeap () returned 0x630000 [0071.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.773] GetProcessHeap () returned 0x630000 [0071.773] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.773] GetProcessHeap () returned 0x630000 [0071.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.773] GetProcessHeap () returned 0x630000 [0071.773] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0071.773] GetProcessHeap () returned 0x630000 [0071.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0071.773] GetProcessHeap () returned 0x630000 [0071.773] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0071.773] GetProcessHeap () returned 0x630000 [0071.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0071.773] GetProcessHeap () returned 0x630000 [0071.773] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.773] GetProcessHeap () returned 0x630000 [0071.774] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.774] GetProcessHeap () returned 0x630000 [0071.774] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0071.774] GetProcessHeap () returned 0x630000 [0071.774] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0071.774] GetProcessHeap () returned 0x630000 [0071.774] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0071.774] GetProcessHeap () returned 0x630000 [0071.774] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0071.774] GetProcessHeap () returned 0x630000 [0071.774] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0071.774] GetProcessHeap () returned 0x630000 [0071.774] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0071.774] GetProcessHeap () returned 0x630000 [0071.774] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.774] GetProcessHeap () returned 0x630000 [0071.774] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.774] GetProcessHeap () returned 0x630000 [0071.774] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.774] GetProcessHeap () returned 0x630000 [0071.774] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.774] GetProcessHeap () returned 0x630000 [0071.774] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.774] GetProcessHeap () returned 0x630000 [0071.774] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.774] GetProcessHeap () returned 0x630000 [0071.774] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0071.774] GetProcessHeap () returned 0x630000 [0071.774] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0071.774] GetProcessHeap () returned 0x630000 [0071.774] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0071.774] GetProcessHeap () returned 0x630000 [0071.774] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0071.774] GetProcessHeap () returned 0x630000 [0071.774] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0071.774] GetProcessHeap () returned 0x630000 [0071.774] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0071.774] GetProcessHeap () returned 0x630000 [0071.774] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0071.775] GetProcessHeap () returned 0x630000 [0071.775] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0071.775] GetProcessHeap () returned 0x630000 [0071.775] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0071.775] GetProcessHeap () returned 0x630000 [0071.775] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0071.775] GetProcessHeap () returned 0x630000 [0071.775] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0071.775] GetProcessHeap () returned 0x630000 [0071.775] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0071.775] GetProcessHeap () returned 0x630000 [0071.775] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0071.775] WriteFile (in: hFile=0x230, lpBuffer=0x659c18*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659c18*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0071.936] GetProcessHeap () returned 0x630000 [0071.936] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659c18, Size=0x30) returned 0x659c18 [0071.936] GetProcessHeap () returned 0x630000 [0071.936] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0071.936] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0071.936] GetProcessHeap () returned 0x630000 [0071.936] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x13ec6) returned 0x671bf0 [0071.937] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0x13ec6, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0x13ec6, lpOverlapped=0x0) returned 1 [0071.937] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0071.937] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x13ec6, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0x13ec6, lpOverlapped=0x0) returned 1 [0071.939] GetProcessHeap () returned 0x630000 [0071.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0071.940] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0071.941] WriteFile (in: hFile=0x230, lpBuffer=0x659c18*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659c18*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0071.943] CloseHandle (hObject=0x230) returned 1 [0071.943] GetProcessHeap () returned 0x630000 [0071.943] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0071.943] GetProcessHeap () returned 0x630000 [0071.943] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6557d8 | out: hHeap=0x630000) returned 1 [0071.943] GetProcessHeap () returned 0x630000 [0071.943] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0071.943] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\SBPS k\\dkXwh8gxfRcRMt tPl.pps" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\dkXwh8gxfRcRMt tPl.pps") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\dkXwh8gxfRcRMt tPl.pps" [0071.943] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\dkXwh8gxfRcRMt tPl.pps", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\dkXwh8gxfRcRMt tPl.pps.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\dkXwh8gxfRcRMt tPl.pps.happythreechoose" [0071.943] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\dkXwh8gxfRcRMt tPl.pps" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\dkxwh8gxfrcrmt tpl.pps"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\dkXwh8gxfRcRMt tPl.pps.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\dkxwh8gxfrcrmt tpl.pps.happythreechoose"), dwFlags=0x1) returned 1 [0071.944] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\dkXwh8gxfRcRMt tPl.pps" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k") returned 1 [0071.944] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\") returned="" [0071.944] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\Decryption INFO.html" [0071.944] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\decryption info.html")) returned 0x20 [0071.944] GetProcessHeap () returned 0x630000 [0071.944] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645e58 | out: hHeap=0x630000) returned 1 [0071.944] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab033f10, ftCreationTime.dwHighDateTime=0x1d5c9e8, ftLastAccessTime.dwLowDateTime=0x583fa8a0, ftLastAccessTime.dwHighDateTime=0x1d5cc4e, ftLastWriteTime.dwLowDateTime=0x583fa8a0, ftLastWriteTime.dwHighDateTime=0x1d5cc4e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="JghA00WX0P", cAlternateFileName="JGHA00~1")) returned 1 [0071.944] lstrcmpiW (lpString1="JghA00WX0P", lpString2=".") returned 1 [0071.944] lstrcmpiW (lpString1="JghA00WX0P", lpString2="..") returned 1 [0071.944] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\", lpString2="JghA00WX0P" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P" [0071.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="JghA00WX0P", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0071.944] GetProcessHeap () returned 0x630000 [0071.944] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb) returned 0x64c9f0 [0071.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="JghA00WX0P", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JghA00WX0P", lpUsedDefaultChar=0x0) returned 11 [0071.945] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="JghA00WX0P", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0071.945] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="JghA00WX0P", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0071.945] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="JghA00WX0P", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0071.945] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="JghA00WX0P", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0071.945] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="JghA00WX0P", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0071.945] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="JghA00WX0P", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0071.945] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="JghA00WX0P", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0071.945] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="JghA00WX0P", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0071.945] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="JghA00WX0P", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0071.945] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="JghA00WX0P", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0071.945] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="JghA00WX0P", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0071.945] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="JghA00WX0P", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0071.945] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="JghA00WX0P", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0071.945] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="JghA00WX0P", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0071.945] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="JghA00WX0P", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0071.945] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="JghA00WX0P", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0071.945] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="JghA00WX0P", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0071.945] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="JghA00WX0P", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0071.945] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="JghA00WX0P", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0071.945] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="JghA00WX0P", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0071.945] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="JghA00WX0P", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0071.945] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="JghA00WX0P", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0071.945] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="JghA00WX0P", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0071.945] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="JghA00WX0P", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0071.945] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="JghA00WX0P", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0071.945] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="JghA00WX0P", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0071.945] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="JghA00WX0P", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0071.945] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="JghA00WX0P", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0071.945] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="JghA00WX0P", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0071.945] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="JghA00WX0P", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0071.945] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="JghA00WX0P", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0071.945] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="JghA00WX0P", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0071.945] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="JghA00WX0P", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0071.945] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="JghA00WX0P", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0071.945] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="JghA00WX0P", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0071.945] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="JghA00WX0P", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0071.946] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="JghA00WX0P", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0071.946] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="JghA00WX0P", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0071.946] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="JghA00WX0P", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0071.946] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="JghA00WX0P", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0071.946] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="JghA00WX0P", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0071.946] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="JghA00WX0P", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0071.946] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="JghA00WX0P", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0071.946] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\" [0071.946] GetProcessHeap () returned 0x630000 [0071.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a348 [0071.946] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\") returned 44 [0071.946] GetProcessHeap () returned 0x630000 [0071.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5a) returned 0x63e830 [0071.946] lstrcpyW (in: lpString1=0x63e830, lpString2="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\" [0071.946] GetProcessHeap () returned 0x630000 [0071.946] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0071.946] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88a76d0, ftCreationTime.dwHighDateTime=0x1d5d2ea, ftLastAccessTime.dwLowDateTime=0x21b32800, ftLastAccessTime.dwHighDateTime=0x1d5cdbd, ftLastWriteTime.dwLowDateTime=0x21b32800, ftLastWriteTime.dwHighDateTime=0x1d5cdbd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MxXKF6", cAlternateFileName="")) returned 1 [0071.946] lstrcmpiW (lpString1="MxXKF6", lpString2=".") returned 1 [0071.946] lstrcmpiW (lpString1="MxXKF6", lpString2="..") returned 1 [0071.946] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\", lpString2="MxXKF6" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6" [0071.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MxXKF6", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0071.946] GetProcessHeap () returned 0x630000 [0071.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7) returned 0x65a258 [0071.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MxXKF6", cchWideChar=-1, lpMultiByteStr=0x65a258, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MxXKF6", lpUsedDefaultChar=0x0) returned 7 [0071.946] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MxXKF6", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0071.946] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MxXKF6", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0071.946] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MxXKF6", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0071.946] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MxXKF6", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0071.946] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MxXKF6", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0071.946] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MxXKF6", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0071.946] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MxXKF6", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0071.946] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MxXKF6", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0071.946] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MxXKF6", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0071.946] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MxXKF6", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0071.946] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MxXKF6", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0071.946] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MxXKF6", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0071.947] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MxXKF6", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0071.947] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MxXKF6", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0071.947] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MxXKF6", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0071.947] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MxXKF6", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0071.947] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MxXKF6", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0071.947] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MxXKF6", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0071.947] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MxXKF6", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0071.947] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MxXKF6", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0071.947] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MxXKF6", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0071.947] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MxXKF6", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0071.947] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MxXKF6", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0071.947] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MxXKF6", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0071.947] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MxXKF6", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0071.947] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MxXKF6", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0071.947] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MxXKF6", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0071.947] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MxXKF6", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0071.947] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MxXKF6", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0071.947] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MxXKF6", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0071.947] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MxXKF6", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0071.947] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MxXKF6", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0071.947] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MxXKF6", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0071.947] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MxXKF6", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0071.947] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MxXKF6", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0071.947] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MxXKF6", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0071.947] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MxXKF6", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0071.947] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MxXKF6", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0071.947] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MxXKF6", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0071.947] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MxXKF6", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0071.947] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MxXKF6", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0071.947] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MxXKF6", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0071.947] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="MxXKF6", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0071.947] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\" [0071.947] GetProcessHeap () returned 0x630000 [0071.947] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a2f8 [0071.947] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\") returned 40 [0071.948] GetProcessHeap () returned 0x630000 [0071.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x52) returned 0x653ab0 [0071.948] lstrcpyW (in: lpString1=0x653ab0, lpString2="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\" [0071.948] GetProcessHeap () returned 0x630000 [0071.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0071.948] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5245b4d0, ftCreationTime.dwHighDateTime=0x1d5cae1, ftLastAccessTime.dwLowDateTime=0x92bf9b00, ftLastAccessTime.dwHighDateTime=0x1d5c8a4, ftLastWriteTime.dwLowDateTime=0x92bf9b00, ftLastWriteTime.dwHighDateTime=0x1d5c8a4, nFileSizeHigh=0x0, nFileSizeLow=0x3d6e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="w7zhJggtq20w0FeONQ.ods", cAlternateFileName="W7ZHJG~1.ODS")) returned 1 [0071.948] lstrcmpiW (lpString1="w7zhJggtq20w0FeONQ.ods", lpString2=".") returned 1 [0071.948] lstrcmpiW (lpString1="w7zhJggtq20w0FeONQ.ods", lpString2="..") returned 1 [0071.948] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\", lpString2="w7zhJggtq20w0FeONQ.ods" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\w7zhJggtq20w0FeONQ.ods") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\w7zhJggtq20w0FeONQ.ods" [0071.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="w7zhJggtq20w0FeONQ.ods", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0071.948] GetProcessHeap () returned 0x630000 [0071.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x17) returned 0x645e58 [0071.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="w7zhJggtq20w0FeONQ.ods", cchWideChar=-1, lpMultiByteStr=0x645e58, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="w7zhJggtq20w0FeONQ.ods", lpUsedDefaultChar=0x0) returned 23 [0071.948] lstrlenA (lpString="w7zhJggtq20w0FeONQ.ods") returned 22 [0071.948] lstrlenA (lpString=".happythreechoose") returned 17 [0071.948] lstrlenA (lpString=".happythreechoose") returned 17 [0071.948] lstrlenA (lpString="w7zhJggtq20w0FeONQ.ods") returned 22 [0071.948] lstrcmpiA (lpString1="ggtq20w0FeONQ.ods", lpString2=".happythreechoose") returned 1 [0071.948] lstrcmpiW (lpString1="w7zhJggtq20w0FeONQ.ods", lpString2="Decryption INFO.html") returned 1 [0071.948] lstrcmpiW (lpString1="w7zhJggtq20w0FeONQ.ods", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0071.948] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0071.948] lstrcmpiW (lpString1="w7zhJggtq20w0FeONQ.ods", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0071.948] GetProcessHeap () returned 0x630000 [0071.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0071.948] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\w7zhJggtq20w0FeONQ.ods" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\w7zhjggtq20w0feonq.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0071.948] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=15726) returned 1 [0071.948] GetProcessHeap () returned 0x630000 [0071.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655508 [0071.948] GetProcessHeap () returned 0x630000 [0071.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0071.948] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\SBPS k\\w7zhJggtq20w0FeONQ.ods") returned 55 [0071.949] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0071.949] GetProcessHeap () returned 0x630000 [0071.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0071.949] GetProcessHeap () returned 0x630000 [0071.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x659c50 [0071.949] lstrlenA (lpString="rsa_encrypt") returned 11 [0071.949] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0071.949] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0071.949] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0071.949] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0071.949] GetProcessHeap () returned 0x630000 [0071.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0071.949] lstrlenA (lpString="010001") returned 6 [0071.949] GetProcessHeap () returned 0x630000 [0071.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0071.949] GetProcessHeap () returned 0x630000 [0071.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0071.950] GetProcessHeap () returned 0x630000 [0071.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e4f0 [0071.950] GetProcessHeap () returned 0x630000 [0071.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0071.950] GetProcessHeap () returned 0x630000 [0071.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea00 [0071.950] GetProcessHeap () returned 0x630000 [0071.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657210 [0071.950] GetProcessHeap () returned 0x630000 [0071.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0071.950] GetProcessHeap () returned 0x630000 [0071.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0071.950] GetProcessHeap () returned 0x630000 [0071.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.950] GetProcessHeap () returned 0x630000 [0071.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0071.950] GetProcessHeap () returned 0x630000 [0071.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0071.950] GetProcessHeap () returned 0x630000 [0071.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x6570f8 [0071.950] GetProcessHeap () returned 0x630000 [0071.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.950] GetProcessHeap () returned 0x630000 [0071.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0071.950] GetProcessHeap () returned 0x630000 [0071.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0071.950] GetProcessHeap () returned 0x630000 [0071.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0071.950] GetProcessHeap () returned 0x630000 [0071.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0071.950] GetProcessHeap () returned 0x630000 [0071.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0071.950] GetProcessHeap () returned 0x630000 [0071.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0071.951] GetProcessHeap () returned 0x630000 [0071.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0071.951] GetProcessHeap () returned 0x630000 [0071.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.951] GetProcessHeap () returned 0x630000 [0071.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0071.951] GetProcessHeap () returned 0x630000 [0071.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.951] GetProcessHeap () returned 0x630000 [0071.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.951] GetProcessHeap () returned 0x630000 [0071.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65dfe0 [0071.951] GetProcessHeap () returned 0x630000 [0071.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0071.951] GetProcessHeap () returned 0x630000 [0071.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0071.951] GetProcessHeap () returned 0x630000 [0071.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0071.951] GetProcessHeap () returned 0x630000 [0071.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0071.951] GetProcessHeap () returned 0x630000 [0071.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0071.951] GetProcessHeap () returned 0x630000 [0071.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.951] GetProcessHeap () returned 0x630000 [0071.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.951] GetProcessHeap () returned 0x630000 [0071.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.951] GetProcessHeap () returned 0x630000 [0071.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.951] GetProcessHeap () returned 0x630000 [0071.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.951] GetProcessHeap () returned 0x630000 [0071.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.952] GetProcessHeap () returned 0x630000 [0071.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.952] GetProcessHeap () returned 0x630000 [0071.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.952] GetProcessHeap () returned 0x630000 [0071.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.952] GetProcessHeap () returned 0x630000 [0071.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.952] GetProcessHeap () returned 0x630000 [0071.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.952] GetProcessHeap () returned 0x630000 [0071.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.952] GetProcessHeap () returned 0x630000 [0071.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.952] GetProcessHeap () returned 0x630000 [0071.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.952] GetProcessHeap () returned 0x630000 [0071.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0071.952] GetProcessHeap () returned 0x630000 [0071.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0071.952] GetProcessHeap () returned 0x630000 [0071.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.952] GetProcessHeap () returned 0x630000 [0071.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.952] GetProcessHeap () returned 0x630000 [0071.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.952] GetProcessHeap () returned 0x630000 [0071.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.952] GetProcessHeap () returned 0x630000 [0071.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.952] GetProcessHeap () returned 0x630000 [0071.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.952] GetProcessHeap () returned 0x630000 [0071.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0071.952] GetProcessHeap () returned 0x630000 [0071.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0071.952] GetProcessHeap () returned 0x630000 [0071.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.952] GetProcessHeap () returned 0x630000 [0071.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.953] GetProcessHeap () returned 0x630000 [0071.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.953] GetProcessHeap () returned 0x630000 [0071.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.953] GetProcessHeap () returned 0x630000 [0071.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.953] GetProcessHeap () returned 0x630000 [0071.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.953] GetProcessHeap () returned 0x630000 [0071.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.953] GetProcessHeap () returned 0x630000 [0071.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.953] GetProcessHeap () returned 0x630000 [0071.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.953] GetProcessHeap () returned 0x630000 [0071.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.953] GetProcessHeap () returned 0x630000 [0071.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0071.953] GetProcessHeap () returned 0x630000 [0071.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0071.953] GetProcessHeap () returned 0x630000 [0071.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0071.953] GetProcessHeap () returned 0x630000 [0071.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0071.953] GetProcessHeap () returned 0x630000 [0071.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0071.953] GetProcessHeap () returned 0x630000 [0071.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0071.953] GetProcessHeap () returned 0x630000 [0071.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0071.953] GetProcessHeap () returned 0x630000 [0071.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0071.953] GetProcessHeap () returned 0x630000 [0071.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.953] GetProcessHeap () returned 0x630000 [0071.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.953] GetProcessHeap () returned 0x630000 [0071.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.953] GetProcessHeap () returned 0x630000 [0071.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.954] GetProcessHeap () returned 0x630000 [0071.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.954] GetProcessHeap () returned 0x630000 [0071.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.954] GetProcessHeap () returned 0x630000 [0071.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.954] GetProcessHeap () returned 0x630000 [0071.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.954] GetProcessHeap () returned 0x630000 [0071.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0071.954] GetProcessHeap () returned 0x630000 [0071.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0071.954] GetProcessHeap () returned 0x630000 [0071.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.954] GetProcessHeap () returned 0x630000 [0071.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.954] GetProcessHeap () returned 0x630000 [0071.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.954] GetProcessHeap () returned 0x630000 [0071.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.954] GetProcessHeap () returned 0x630000 [0071.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.954] GetProcessHeap () returned 0x630000 [0071.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.954] GetProcessHeap () returned 0x630000 [0071.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.954] GetProcessHeap () returned 0x630000 [0071.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.954] GetProcessHeap () returned 0x630000 [0071.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.954] GetProcessHeap () returned 0x630000 [0071.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.954] GetProcessHeap () returned 0x630000 [0071.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0071.954] GetProcessHeap () returned 0x630000 [0071.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0071.954] GetProcessHeap () returned 0x630000 [0071.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0071.954] GetProcessHeap () returned 0x630000 [0071.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0071.955] GetProcessHeap () returned 0x630000 [0071.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.955] GetProcessHeap () returned 0x630000 [0071.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.955] GetProcessHeap () returned 0x630000 [0071.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.955] GetProcessHeap () returned 0x630000 [0071.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.955] GetProcessHeap () returned 0x630000 [0071.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.955] GetProcessHeap () returned 0x630000 [0071.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.955] GetProcessHeap () returned 0x630000 [0071.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.955] GetProcessHeap () returned 0x630000 [0071.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.955] GetProcessHeap () returned 0x630000 [0071.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.955] GetProcessHeap () returned 0x630000 [0071.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.955] GetProcessHeap () returned 0x630000 [0071.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0071.955] GetProcessHeap () returned 0x630000 [0071.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0071.955] GetProcessHeap () returned 0x630000 [0071.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0071.955] GetProcessHeap () returned 0x630000 [0071.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0071.955] GetProcessHeap () returned 0x630000 [0071.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0071.955] GetProcessHeap () returned 0x630000 [0071.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0071.955] GetProcessHeap () returned 0x630000 [0071.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0071.955] GetProcessHeap () returned 0x630000 [0071.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0071.955] GetProcessHeap () returned 0x630000 [0071.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0071.956] GetProcessHeap () returned 0x630000 [0071.956] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0071.956] GetProcessHeap () returned 0x630000 [0071.956] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0071.956] GetProcessHeap () returned 0x630000 [0071.956] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0071.956] GetProcessHeap () returned 0x630000 [0071.956] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0071.956] GetProcessHeap () returned 0x630000 [0071.956] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0071.956] GetProcessHeap () returned 0x630000 [0071.956] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0071.956] WriteFile (in: hFile=0x230, lpBuffer=0x659c50*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659c50*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0071.995] GetProcessHeap () returned 0x630000 [0071.995] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659c50, Size=0x30) returned 0x659c50 [0071.995] GetProcessHeap () returned 0x630000 [0071.995] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0071.995] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0071.995] GetProcessHeap () returned 0x630000 [0071.995] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3d6e) returned 0x671bf0 [0071.997] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0x3d6e, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0x3d6e, lpOverlapped=0x0) returned 1 [0071.997] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0071.997] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x3d6e, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0x3d6e, lpOverlapped=0x0) returned 1 [0072.106] GetProcessHeap () returned 0x630000 [0072.106] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0072.107] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0072.107] WriteFile (in: hFile=0x230, lpBuffer=0x659c50*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659c50*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0072.122] CloseHandle (hObject=0x230) returned 1 [0072.446] GetProcessHeap () returned 0x630000 [0072.446] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0072.446] GetProcessHeap () returned 0x630000 [0072.446] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655508 | out: hHeap=0x630000) returned 1 [0072.446] GetProcessHeap () returned 0x630000 [0072.446] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0072.446] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\SBPS k\\w7zhJggtq20w0FeONQ.ods" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\w7zhJggtq20w0FeONQ.ods") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\w7zhJggtq20w0FeONQ.ods" [0072.446] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\w7zhJggtq20w0FeONQ.ods", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\w7zhJggtq20w0FeONQ.ods.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\w7zhJggtq20w0FeONQ.ods.happythreechoose" [0072.446] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\w7zhJggtq20w0FeONQ.ods" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\w7zhjggtq20w0feonq.ods"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\w7zhJggtq20w0FeONQ.ods.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\w7zhjggtq20w0feonq.ods.happythreechoose"), dwFlags=0x1) returned 1 [0072.447] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\w7zhJggtq20w0FeONQ.ods" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k") returned 1 [0072.447] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\") returned="" [0072.447] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\Decryption INFO.html" [0072.447] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\decryption info.html")) returned 0x20 [0072.447] GetProcessHeap () returned 0x630000 [0072.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645e58 | out: hHeap=0x630000) returned 1 [0072.447] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4ba0ce0, ftCreationTime.dwHighDateTime=0x1d5d73a, ftLastAccessTime.dwLowDateTime=0x607d580, ftLastAccessTime.dwHighDateTime=0x1d5cb95, ftLastWriteTime.dwLowDateTime=0x607d580, ftLastWriteTime.dwHighDateTime=0x1d5cb95, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ymdJCigCua5CLrDmiMm", cAlternateFileName="YMDJCI~1")) returned 1 [0072.447] lstrcmpiW (lpString1="ymdJCigCua5CLrDmiMm", lpString2=".") returned 1 [0072.447] lstrcmpiW (lpString1="ymdJCigCua5CLrDmiMm", lpString2="..") returned 1 [0072.448] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\", lpString2="ymdJCigCua5CLrDmiMm" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\ymdJCigCua5CLrDmiMm") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\ymdJCigCua5CLrDmiMm" [0072.448] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ymdJCigCua5CLrDmiMm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0072.448] GetProcessHeap () returned 0x630000 [0072.448] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x645d58 [0072.448] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ymdJCigCua5CLrDmiMm", cchWideChar=-1, lpMultiByteStr=0x645d58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ymdJCigCua5CLrDmiMm", lpUsedDefaultChar=0x0) returned 20 [0072.448] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ymdJCigCua5CLrDmiMm", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 3 [0072.448] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ymdJCigCua5CLrDmiMm", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0072.448] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ymdJCigCua5CLrDmiMm", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0072.448] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ymdJCigCua5CLrDmiMm", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 3 [0072.448] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ymdJCigCua5CLrDmiMm", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 3 [0072.448] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ymdJCigCua5CLrDmiMm", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0072.448] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ymdJCigCua5CLrDmiMm", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0072.448] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ymdJCigCua5CLrDmiMm", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 3 [0072.448] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ymdJCigCua5CLrDmiMm", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 3 [0072.448] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ymdJCigCua5CLrDmiMm", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 3 [0072.448] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ymdJCigCua5CLrDmiMm", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 3 [0072.448] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ymdJCigCua5CLrDmiMm", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 3 [0072.448] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ymdJCigCua5CLrDmiMm", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 3 [0072.448] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ymdJCigCua5CLrDmiMm", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 3 [0072.448] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ymdJCigCua5CLrDmiMm", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 3 [0072.448] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ymdJCigCua5CLrDmiMm", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 3 [0072.448] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ymdJCigCua5CLrDmiMm", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 3 [0072.448] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ymdJCigCua5CLrDmiMm", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 3 [0072.448] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ymdJCigCua5CLrDmiMm", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0072.448] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ymdJCigCua5CLrDmiMm", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0072.448] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ymdJCigCua5CLrDmiMm", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0072.448] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ymdJCigCua5CLrDmiMm", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0072.448] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ymdJCigCua5CLrDmiMm", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0072.448] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ymdJCigCua5CLrDmiMm", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0072.448] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ymdJCigCua5CLrDmiMm", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 3 [0072.448] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ymdJCigCua5CLrDmiMm", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 3 [0072.448] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ymdJCigCua5CLrDmiMm", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0072.448] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ymdJCigCua5CLrDmiMm", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0072.449] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ymdJCigCua5CLrDmiMm", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 3 [0072.449] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ymdJCigCua5CLrDmiMm", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 3 [0072.449] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ymdJCigCua5CLrDmiMm", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 3 [0072.449] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ymdJCigCua5CLrDmiMm", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0072.449] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ymdJCigCua5CLrDmiMm", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0072.449] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ymdJCigCua5CLrDmiMm", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0072.449] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ymdJCigCua5CLrDmiMm", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0072.449] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ymdJCigCua5CLrDmiMm", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0072.449] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ymdJCigCua5CLrDmiMm", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0072.449] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ymdJCigCua5CLrDmiMm", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0072.449] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ymdJCigCua5CLrDmiMm", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0072.449] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ymdJCigCua5CLrDmiMm", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 3 [0072.449] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ymdJCigCua5CLrDmiMm", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0072.449] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ymdJCigCua5CLrDmiMm", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 3 [0072.449] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ymdJCigCua5CLrDmiMm", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0072.449] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\ymdJCigCua5CLrDmiMm", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\ymdJCigCua5CLrDmiMm\\") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\ymdJCigCua5CLrDmiMm\\" [0072.449] GetProcessHeap () returned 0x630000 [0072.449] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a258 [0072.449] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\SBPS k\\ymdJCigCua5CLrDmiMm\\") returned 53 [0072.449] GetProcessHeap () returned 0x630000 [0072.449] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6c) returned 0x655670 [0072.449] lstrcpyW (in: lpString1=0x655670, lpString2="C:\\Users\\FD1HVy\\Documents\\SBPS k\\ymdJCigCua5CLrDmiMm\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\ymdJCigCua5CLrDmiMm\\") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\ymdJCigCua5CLrDmiMm\\" [0072.449] GetProcessHeap () returned 0x630000 [0072.449] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645d58 | out: hHeap=0x630000) returned 1 [0072.449] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4ba0ce0, ftCreationTime.dwHighDateTime=0x1d5d73a, ftLastAccessTime.dwLowDateTime=0x607d580, ftLastAccessTime.dwHighDateTime=0x1d5cb95, ftLastWriteTime.dwLowDateTime=0x607d580, ftLastWriteTime.dwHighDateTime=0x1d5cb95, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ymdJCigCua5CLrDmiMm", cAlternateFileName="YMDJCI~1")) returned 0 [0072.449] FindClose (in: hFindFile=0x648810 | out: hFindFile=0x648810) returned 1 [0072.449] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\Documents\\SBPS k\\ymdJCigCua5CLrDmiMm\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\ymdJCigCua5CLrDmiMm\\") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\ymdJCigCua5CLrDmiMm\\" [0072.449] GetProcessHeap () returned 0x630000 [0072.449] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655670 | out: hHeap=0x630000) returned 1 [0072.449] GetProcessHeap () returned 0x630000 [0072.449] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0072.449] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\SBPS k\\ymdJCigCua5CLrDmiMm\\") returned 53 [0072.449] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\ymdJCigCua5CLrDmiMm\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\ymdJCigCua5CLrDmiMm\\*") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\ymdJCigCua5CLrDmiMm\\*" [0072.450] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\ymdJCigCua5CLrDmiMm\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4ba0ce0, ftCreationTime.dwHighDateTime=0x1d5d73a, ftLastAccessTime.dwLowDateTime=0x607d580, ftLastAccessTime.dwHighDateTime=0x1d5cb95, ftLastWriteTime.dwLowDateTime=0x607d580, ftLastWriteTime.dwHighDateTime=0x1d5cb95, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648ad0 [0072.450] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0072.450] FindNextFileW (in: hFindFile=0x648ad0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4ba0ce0, ftCreationTime.dwHighDateTime=0x1d5d73a, ftLastAccessTime.dwLowDateTime=0x607d580, ftLastAccessTime.dwHighDateTime=0x1d5cb95, ftLastWriteTime.dwLowDateTime=0x607d580, ftLastWriteTime.dwHighDateTime=0x1d5cb95, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.450] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0072.450] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0072.450] FindNextFileW (in: hFindFile=0x648ad0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4ba0ce0, ftCreationTime.dwHighDateTime=0x1d5d73a, ftLastAccessTime.dwLowDateTime=0x607d580, ftLastAccessTime.dwHighDateTime=0x1d5cb95, ftLastWriteTime.dwLowDateTime=0x607d580, ftLastWriteTime.dwHighDateTime=0x1d5cb95, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0072.450] FindClose (in: hFindFile=0x648ad0 | out: hFindFile=0x648ad0) returned 1 [0072.450] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\" [0072.450] GetProcessHeap () returned 0x630000 [0072.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653ab0 | out: hHeap=0x630000) returned 1 [0072.450] GetProcessHeap () returned 0x630000 [0072.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0072.450] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\") returned 40 [0072.450] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\*") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\*" [0072.450] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88a76d0, ftCreationTime.dwHighDateTime=0x1d5d2ea, ftLastAccessTime.dwLowDateTime=0x21b32800, ftLastAccessTime.dwHighDateTime=0x1d5cdbd, ftLastWriteTime.dwLowDateTime=0x21b32800, ftLastWriteTime.dwHighDateTime=0x1d5cdbd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648c90 [0072.456] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0072.456] FindNextFileW (in: hFindFile=0x648c90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88a76d0, ftCreationTime.dwHighDateTime=0x1d5d2ea, ftLastAccessTime.dwLowDateTime=0x21b32800, ftLastAccessTime.dwHighDateTime=0x1d5cdbd, ftLastWriteTime.dwLowDateTime=0x21b32800, ftLastWriteTime.dwHighDateTime=0x1d5cdbd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.456] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0072.456] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0072.456] FindNextFileW (in: hFindFile=0x648c90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b93a900, ftCreationTime.dwHighDateTime=0x1d5cf71, ftLastAccessTime.dwLowDateTime=0x37ef73c0, ftLastAccessTime.dwHighDateTime=0x1d5d048, ftLastWriteTime.dwLowDateTime=0x37ef73c0, ftLastWriteTime.dwHighDateTime=0x1d5d048, nFileSizeHigh=0x0, nFileSizeLow=0xf4b7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="p9Kas6UaSW97co0BYd.xlsx", cAlternateFileName="P9KAS6~1.XLS")) returned 1 [0072.456] lstrcmpiW (lpString1="p9Kas6UaSW97co0BYd.xlsx", lpString2=".") returned 1 [0072.456] lstrcmpiW (lpString1="p9Kas6UaSW97co0BYd.xlsx", lpString2="..") returned 1 [0072.456] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\", lpString2="p9Kas6UaSW97co0BYd.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\p9Kas6UaSW97co0BYd.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\p9Kas6UaSW97co0BYd.xlsx" [0072.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="p9Kas6UaSW97co0BYd.xlsx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0072.456] GetProcessHeap () returned 0x630000 [0072.456] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18) returned 0x645f58 [0072.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="p9Kas6UaSW97co0BYd.xlsx", cchWideChar=-1, lpMultiByteStr=0x645f58, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="p9Kas6UaSW97co0BYd.xlsx", lpUsedDefaultChar=0x0) returned 24 [0072.457] lstrlenA (lpString="p9Kas6UaSW97co0BYd.xlsx") returned 23 [0072.457] lstrlenA (lpString=".happythreechoose") returned 17 [0072.457] lstrlenA (lpString=".happythreechoose") returned 17 [0072.457] lstrlenA (lpString="p9Kas6UaSW97co0BYd.xlsx") returned 23 [0072.457] lstrcmpiA (lpString1="UaSW97co0BYd.xlsx", lpString2=".happythreechoose") returned 1 [0072.457] lstrcmpiW (lpString1="p9Kas6UaSW97co0BYd.xlsx", lpString2="Decryption INFO.html") returned 1 [0072.457] lstrcmpiW (lpString1="p9Kas6UaSW97co0BYd.xlsx", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0072.457] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0072.457] lstrcmpiW (lpString1="p9Kas6UaSW97co0BYd.xlsx", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0072.457] GetProcessHeap () returned 0x630000 [0072.457] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0072.457] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\p9Kas6UaSW97co0BYd.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\mxxkf6\\p9kas6uasw97co0byd.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0072.457] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=62647) returned 1 [0072.457] GetProcessHeap () returned 0x630000 [0072.457] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655490 [0072.457] GetProcessHeap () returned 0x630000 [0072.457] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0072.457] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\p9Kas6UaSW97co0BYd.xlsx") returned 63 [0072.457] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0072.457] GetProcessHeap () returned 0x630000 [0072.457] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0072.457] GetProcessHeap () returned 0x630000 [0072.457] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x659c88 [0072.457] lstrlenA (lpString="rsa_encrypt") returned 11 [0072.457] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0072.458] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0072.458] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0072.458] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0072.458] GetProcessHeap () returned 0x630000 [0072.458] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0072.458] lstrlenA (lpString="010001") returned 6 [0072.458] GetProcessHeap () returned 0x630000 [0072.458] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0072.459] GetProcessHeap () returned 0x630000 [0072.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0072.459] GetProcessHeap () returned 0x630000 [0072.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0072.459] GetProcessHeap () returned 0x630000 [0072.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0072.459] GetProcessHeap () returned 0x630000 [0072.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e580 [0072.459] GetProcessHeap () returned 0x630000 [0072.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656a68 [0072.459] GetProcessHeap () returned 0x630000 [0072.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0072.459] GetProcessHeap () returned 0x630000 [0072.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0072.459] GetProcessHeap () returned 0x630000 [0072.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.459] GetProcessHeap () returned 0x630000 [0072.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0072.459] GetProcessHeap () returned 0x630000 [0072.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0072.459] GetProcessHeap () returned 0x630000 [0072.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657440 [0072.459] GetProcessHeap () returned 0x630000 [0072.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.459] GetProcessHeap () returned 0x630000 [0072.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0072.459] GetProcessHeap () returned 0x630000 [0072.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0072.459] GetProcessHeap () returned 0x630000 [0072.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0072.459] GetProcessHeap () returned 0x630000 [0072.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0072.459] GetProcessHeap () returned 0x630000 [0072.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0072.459] GetProcessHeap () returned 0x630000 [0072.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0072.459] GetProcessHeap () returned 0x630000 [0072.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0072.459] GetProcessHeap () returned 0x630000 [0072.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.459] GetProcessHeap () returned 0x630000 [0072.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0072.460] GetProcessHeap () returned 0x630000 [0072.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.460] GetProcessHeap () returned 0x630000 [0072.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.460] GetProcessHeap () returned 0x630000 [0072.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ec40 [0072.460] GetProcessHeap () returned 0x630000 [0072.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0072.460] GetProcessHeap () returned 0x630000 [0072.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0072.460] GetProcessHeap () returned 0x630000 [0072.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ec40 | out: hHeap=0x630000) returned 1 [0072.460] GetProcessHeap () returned 0x630000 [0072.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.460] GetProcessHeap () returned 0x630000 [0072.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.460] GetProcessHeap () returned 0x630000 [0072.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.460] GetProcessHeap () returned 0x630000 [0072.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.460] GetProcessHeap () returned 0x630000 [0072.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.460] GetProcessHeap () returned 0x630000 [0072.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.460] GetProcessHeap () returned 0x630000 [0072.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0072.460] GetProcessHeap () returned 0x630000 [0072.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0072.460] GetProcessHeap () returned 0x630000 [0072.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.460] GetProcessHeap () returned 0x630000 [0072.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.460] GetProcessHeap () returned 0x630000 [0072.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.460] GetProcessHeap () returned 0x630000 [0072.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.460] GetProcessHeap () returned 0x630000 [0072.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.460] GetProcessHeap () returned 0x630000 [0072.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.461] GetProcessHeap () returned 0x630000 [0072.461] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.461] GetProcessHeap () returned 0x630000 [0072.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.461] GetProcessHeap () returned 0x630000 [0072.461] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0072.461] GetProcessHeap () returned 0x630000 [0072.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0072.461] GetProcessHeap () returned 0x630000 [0072.461] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.461] GetProcessHeap () returned 0x630000 [0072.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.461] GetProcessHeap () returned 0x630000 [0072.461] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0072.461] GetProcessHeap () returned 0x630000 [0072.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0072.461] GetProcessHeap () returned 0x630000 [0072.461] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0072.461] GetProcessHeap () returned 0x630000 [0072.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0072.461] GetProcessHeap () returned 0x630000 [0072.461] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.461] GetProcessHeap () returned 0x630000 [0072.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.461] GetProcessHeap () returned 0x630000 [0072.461] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0072.461] GetProcessHeap () returned 0x630000 [0072.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0072.461] GetProcessHeap () returned 0x630000 [0072.461] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.461] GetProcessHeap () returned 0x630000 [0072.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.461] GetProcessHeap () returned 0x630000 [0072.461] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0072.461] GetProcessHeap () returned 0x630000 [0072.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0072.461] GetProcessHeap () returned 0x630000 [0072.461] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0072.462] GetProcessHeap () returned 0x630000 [0072.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0072.462] GetProcessHeap () returned 0x630000 [0072.462] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.462] GetProcessHeap () returned 0x630000 [0072.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.462] GetProcessHeap () returned 0x630000 [0072.462] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.462] GetProcessHeap () returned 0x630000 [0072.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.462] GetProcessHeap () returned 0x630000 [0072.462] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0072.462] GetProcessHeap () returned 0x630000 [0072.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0072.462] GetProcessHeap () returned 0x630000 [0072.462] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0072.462] GetProcessHeap () returned 0x630000 [0072.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0072.462] GetProcessHeap () returned 0x630000 [0072.462] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0072.462] GetProcessHeap () returned 0x630000 [0072.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0072.462] GetProcessHeap () returned 0x630000 [0072.462] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.462] GetProcessHeap () returned 0x630000 [0072.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.462] GetProcessHeap () returned 0x630000 [0072.462] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.462] GetProcessHeap () returned 0x630000 [0072.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.462] GetProcessHeap () returned 0x630000 [0072.462] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0072.462] GetProcessHeap () returned 0x630000 [0072.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0072.462] GetProcessHeap () returned 0x630000 [0072.462] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0072.462] GetProcessHeap () returned 0x630000 [0072.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0072.463] GetProcessHeap () returned 0x630000 [0072.463] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.463] GetProcessHeap () returned 0x630000 [0072.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.463] GetProcessHeap () returned 0x630000 [0072.463] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0072.463] GetProcessHeap () returned 0x630000 [0072.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0072.463] GetProcessHeap () returned 0x630000 [0072.463] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.463] GetProcessHeap () returned 0x630000 [0072.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.463] GetProcessHeap () returned 0x630000 [0072.463] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.463] GetProcessHeap () returned 0x630000 [0072.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.463] GetProcessHeap () returned 0x630000 [0072.463] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.463] GetProcessHeap () returned 0x630000 [0072.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.463] GetProcessHeap () returned 0x630000 [0072.463] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.463] GetProcessHeap () returned 0x630000 [0072.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.463] GetProcessHeap () returned 0x630000 [0072.463] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.463] GetProcessHeap () returned 0x630000 [0072.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.463] GetProcessHeap () returned 0x630000 [0072.463] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0072.463] GetProcessHeap () returned 0x630000 [0072.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0072.463] GetProcessHeap () returned 0x630000 [0072.463] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.463] GetProcessHeap () returned 0x630000 [0072.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.463] GetProcessHeap () returned 0x630000 [0072.463] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.463] GetProcessHeap () returned 0x630000 [0072.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.464] GetProcessHeap () returned 0x630000 [0072.464] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.464] GetProcessHeap () returned 0x630000 [0072.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.464] GetProcessHeap () returned 0x630000 [0072.464] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.464] GetProcessHeap () returned 0x630000 [0072.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.464] GetProcessHeap () returned 0x630000 [0072.464] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0072.464] GetProcessHeap () returned 0x630000 [0072.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0072.464] GetProcessHeap () returned 0x630000 [0072.464] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.464] GetProcessHeap () returned 0x630000 [0072.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.464] GetProcessHeap () returned 0x630000 [0072.464] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.464] GetProcessHeap () returned 0x630000 [0072.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.464] GetProcessHeap () returned 0x630000 [0072.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0072.464] GetProcessHeap () returned 0x630000 [0072.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0072.464] GetProcessHeap () returned 0x630000 [0072.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0072.464] GetProcessHeap () returned 0x630000 [0072.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0072.464] GetProcessHeap () returned 0x630000 [0072.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0072.464] GetProcessHeap () returned 0x630000 [0072.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0072.464] GetProcessHeap () returned 0x630000 [0072.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0072.464] GetProcessHeap () returned 0x630000 [0072.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0072.464] GetProcessHeap () returned 0x630000 [0072.465] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0072.465] GetProcessHeap () returned 0x630000 [0072.465] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0072.465] GetProcessHeap () returned 0x630000 [0072.465] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0072.465] WriteFile (in: hFile=0x230, lpBuffer=0x659c88*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659c88*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0072.489] GetProcessHeap () returned 0x630000 [0072.489] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x659c88, Size=0x30) returned 0x659c88 [0072.489] GetProcessHeap () returned 0x630000 [0072.489] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0072.489] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0072.489] GetProcessHeap () returned 0x630000 [0072.489] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf4b7) returned 0x671bf0 [0072.490] ReadFile (in: hFile=0x230, lpBuffer=0x671bf0, nNumberOfBytesToRead=0xf4b7, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesRead=0x243d7e8*=0xf4b7, lpOverlapped=0x0) returned 1 [0072.491] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0072.491] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0xf4b7, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d7e4*=0xf4b7, lpOverlapped=0x0) returned 1 [0072.495] GetProcessHeap () returned 0x630000 [0072.495] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671bf0 | out: hHeap=0x630000) returned 1 [0072.495] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0072.495] WriteFile (in: hFile=0x230, lpBuffer=0x659c88*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x659c88*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0072.497] CloseHandle (hObject=0x230) returned 1 [0072.503] GetProcessHeap () returned 0x630000 [0072.503] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0072.503] GetProcessHeap () returned 0x630000 [0072.503] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655490 | out: hHeap=0x630000) returned 1 [0072.503] GetProcessHeap () returned 0x630000 [0072.503] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0072.503] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\p9Kas6UaSW97co0BYd.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\p9Kas6UaSW97co0BYd.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\p9Kas6UaSW97co0BYd.xlsx" [0072.503] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\p9Kas6UaSW97co0BYd.xlsx", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\p9Kas6UaSW97co0BYd.xlsx.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\p9Kas6UaSW97co0BYd.xlsx.happythreechoose" [0072.503] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\p9Kas6UaSW97co0BYd.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\mxxkf6\\p9kas6uasw97co0byd.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\p9Kas6UaSW97co0BYd.xlsx.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\mxxkf6\\p9kas6uasw97co0byd.xlsx.happythreechoose"), dwFlags=0x1) returned 1 [0072.504] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\p9Kas6UaSW97co0BYd.xlsx" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6") returned 1 [0072.504] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\") returned="" [0072.504] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\Decryption INFO.html" [0072.504] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\mxxkf6\\decryption info.html")) returned 0xffffffff [0072.504] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\mxxkf6\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0072.504] GetProcessHeap () returned 0x630000 [0072.504] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655580 [0072.504] GetProcessHeap () returned 0x630000 [0072.505] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0072.511] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.512] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.513] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.514] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.514] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.514] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.514] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.514] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.514] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.514] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.514] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.514] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.514] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.514] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.514] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.515] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.515] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.515] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.515] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.515] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.515] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.515] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.515] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.515] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.515] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.515] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.515] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.515] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.516] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.516] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.517] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.517] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.517] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.517] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.517] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.517] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.517] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.517] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.517] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.517] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.517] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.517] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.517] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.517] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.518] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.518] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.518] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.518] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.518] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.518] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.518] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.518] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.518] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.518] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.518] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.518] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.518] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.518] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.519] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.519] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.519] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.519] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.519] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.519] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.519] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.519] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.519] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.519] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.519] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.519] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.519] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.520] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.520] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.520] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.520] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.520] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.520] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.520] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.520] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.520] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.520] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.520] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.520] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.520] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.520] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.521] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.521] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.521] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.521] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.521] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.521] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.521] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.521] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.521] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.521] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.521] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.521] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.521] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.521] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.522] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.523] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.523] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.523] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.523] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.523] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.523] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.523] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.523] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.523] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.523] GetProcessHeap () returned 0x630000 [0072.523] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655580 | out: hHeap=0x630000) returned 1 [0072.523] GetProcessHeap () returned 0x630000 [0072.523] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0072.523] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0072.523] GetProcessHeap () returned 0x630000 [0072.523] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6557d8 [0072.523] GetProcessHeap () returned 0x630000 [0072.523] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0072.536] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.536] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.536] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.536] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.536] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.536] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.536] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.536] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.536] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.536] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.537] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.537] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.537] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.537] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.537] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.537] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.537] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.537] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.537] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.537] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.537] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.537] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.537] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.537] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.538] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.538] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.538] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.538] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.538] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.538] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.538] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.538] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.538] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.538] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.538] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.538] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.538] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.538] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.539] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.539] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.539] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.539] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.539] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.539] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.539] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.539] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.539] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.539] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.539] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.539] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.539] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.539] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.540] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.540] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.540] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.540] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.540] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.540] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.540] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.540] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.540] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.540] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.540] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.540] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.540] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.541] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.541] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.541] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.541] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.541] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.541] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.541] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.541] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.541] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.541] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.541] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.541] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.541] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.542] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.542] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.542] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.542] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.542] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.542] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.542] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.542] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.542] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.542] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.542] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.542] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.542] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.543] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.543] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.543] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.543] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.543] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.543] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.543] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.543] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.543] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.543] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.543] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.543] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.543] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.544] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.544] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.544] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.544] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.544] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.544] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.544] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.732] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.732] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.733] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.733] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.733] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.733] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.733] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.734] GetProcessHeap () returned 0x630000 [0072.734] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6557d8 | out: hHeap=0x630000) returned 1 [0072.734] GetProcessHeap () returned 0x630000 [0072.734] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0072.734] CloseHandle (hObject=0x230) returned 1 [0072.734] GetProcessHeap () returned 0x630000 [0072.734] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645f58 | out: hHeap=0x630000) returned 1 [0072.734] FindNextFileW (in: hFindFile=0x648c90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26a9760, ftCreationTime.dwHighDateTime=0x1d5ceff, ftLastAccessTime.dwLowDateTime=0xa51884a0, ftLastAccessTime.dwHighDateTime=0x1d5c9c7, ftLastWriteTime.dwLowDateTime=0xa51884a0, ftLastWriteTime.dwHighDateTime=0x1d5c9c7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SqrCaRu_rhnscGd97t", cAlternateFileName="SQRCAR~1")) returned 1 [0072.734] lstrcmpiW (lpString1="SqrCaRu_rhnscGd97t", lpString2=".") returned 1 [0072.734] lstrcmpiW (lpString1="SqrCaRu_rhnscGd97t", lpString2="..") returned 1 [0072.734] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\", lpString2="SqrCaRu_rhnscGd97t" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t" [0072.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SqrCaRu_rhnscGd97t", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0072.734] GetProcessHeap () returned 0x630000 [0072.734] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x13) returned 0x645cd8 [0072.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SqrCaRu_rhnscGd97t", cchWideChar=-1, lpMultiByteStr=0x645cd8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SqrCaRu_rhnscGd97t", lpUsedDefaultChar=0x0) returned 19 [0072.734] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SqrCaRu_rhnscGd97t", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0072.734] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SqrCaRu_rhnscGd97t", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0072.734] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SqrCaRu_rhnscGd97t", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0072.734] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SqrCaRu_rhnscGd97t", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0072.734] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SqrCaRu_rhnscGd97t", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0072.734] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SqrCaRu_rhnscGd97t", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0072.734] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SqrCaRu_rhnscGd97t", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0072.734] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SqrCaRu_rhnscGd97t", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0072.734] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SqrCaRu_rhnscGd97t", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0072.735] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SqrCaRu_rhnscGd97t", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0072.735] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SqrCaRu_rhnscGd97t", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0072.735] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SqrCaRu_rhnscGd97t", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0072.735] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SqrCaRu_rhnscGd97t", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0072.735] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SqrCaRu_rhnscGd97t", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0072.735] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SqrCaRu_rhnscGd97t", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0072.735] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SqrCaRu_rhnscGd97t", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0072.735] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SqrCaRu_rhnscGd97t", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0072.735] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SqrCaRu_rhnscGd97t", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0072.735] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SqrCaRu_rhnscGd97t", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0072.735] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SqrCaRu_rhnscGd97t", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0072.735] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SqrCaRu_rhnscGd97t", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0072.735] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SqrCaRu_rhnscGd97t", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0072.735] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SqrCaRu_rhnscGd97t", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0072.735] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SqrCaRu_rhnscGd97t", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0072.735] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SqrCaRu_rhnscGd97t", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 3 [0072.735] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SqrCaRu_rhnscGd97t", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0072.735] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SqrCaRu_rhnscGd97t", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0072.735] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SqrCaRu_rhnscGd97t", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0072.735] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SqrCaRu_rhnscGd97t", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0072.735] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SqrCaRu_rhnscGd97t", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0072.735] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SqrCaRu_rhnscGd97t", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0072.735] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SqrCaRu_rhnscGd97t", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0072.735] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SqrCaRu_rhnscGd97t", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0072.735] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SqrCaRu_rhnscGd97t", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0072.735] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SqrCaRu_rhnscGd97t", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0072.735] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SqrCaRu_rhnscGd97t", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0072.735] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SqrCaRu_rhnscGd97t", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0072.735] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SqrCaRu_rhnscGd97t", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0072.735] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SqrCaRu_rhnscGd97t", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0072.735] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SqrCaRu_rhnscGd97t", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0072.735] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SqrCaRu_rhnscGd97t", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0072.735] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SqrCaRu_rhnscGd97t", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0072.735] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SqrCaRu_rhnscGd97t", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0072.735] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\" [0072.736] GetProcessHeap () returned 0x630000 [0072.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a258 [0072.736] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\") returned 59 [0072.736] GetProcessHeap () returned 0x630000 [0072.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x78) returned 0x63f290 [0072.736] lstrcpyW (in: lpString1=0x63f290, lpString2="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\" [0072.736] GetProcessHeap () returned 0x630000 [0072.736] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645cd8 | out: hHeap=0x630000) returned 1 [0072.736] FindNextFileW (in: hFindFile=0x648c90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5149cc90, ftCreationTime.dwHighDateTime=0x1d5d05b, ftLastAccessTime.dwLowDateTime=0xdc60c0a0, ftLastAccessTime.dwHighDateTime=0x1d5d05a, ftLastWriteTime.dwLowDateTime=0xdc60c0a0, ftLastWriteTime.dwHighDateTime=0x1d5d05a, nFileSizeHigh=0x0, nFileSizeLow=0xc315, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="US8GSIMeYuf.xls", cAlternateFileName="US8GSI~1.XLS")) returned 1 [0072.736] lstrcmpiW (lpString1="US8GSIMeYuf.xls", lpString2=".") returned 1 [0072.736] lstrcmpiW (lpString1="US8GSIMeYuf.xls", lpString2="..") returned 1 [0072.736] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\", lpString2="US8GSIMeYuf.xls" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\US8GSIMeYuf.xls") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\US8GSIMeYuf.xls" [0072.736] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="US8GSIMeYuf.xls", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0072.736] GetProcessHeap () returned 0x630000 [0072.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x64c9f0 [0072.736] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="US8GSIMeYuf.xls", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="US8GSIMeYuf.xls", lpUsedDefaultChar=0x0) returned 16 [0072.736] lstrlenA (lpString="US8GSIMeYuf.xls") returned 15 [0072.736] lstrlenA (lpString=".happythreechoose") returned 17 [0072.736] lstrcmpiW (lpString1="US8GSIMeYuf.xls", lpString2="Decryption INFO.html") returned 1 [0072.736] lstrcmpiW (lpString1="US8GSIMeYuf.xls", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0072.736] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0072.736] lstrcmpiW (lpString1="US8GSIMeYuf.xls", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0072.736] GetProcessHeap () returned 0x630000 [0072.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0072.736] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\US8GSIMeYuf.xls" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\mxxkf6\\us8gsimeyuf.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0072.736] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=49941) returned 1 [0072.736] GetProcessHeap () returned 0x630000 [0072.737] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655580 [0072.737] GetProcessHeap () returned 0x630000 [0072.737] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0072.737] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\US8GSIMeYuf.xls") returned 55 [0072.737] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0072.737] GetProcessHeap () returned 0x630000 [0072.737] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0072.737] GetProcessHeap () returned 0x630000 [0072.737] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38b) returned 0x671bf0 [0072.737] lstrlenA (lpString="rsa_encrypt") returned 11 [0072.737] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0072.737] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0072.737] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0072.737] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0072.737] GetProcessHeap () returned 0x630000 [0072.737] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0072.737] lstrlenA (lpString="010001") returned 6 [0072.738] GetProcessHeap () returned 0x630000 [0072.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0072.738] GetProcessHeap () returned 0x630000 [0072.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0072.738] GetProcessHeap () returned 0x630000 [0072.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e190 [0072.738] GetProcessHeap () returned 0x630000 [0072.738] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0072.738] GetProcessHeap () returned 0x630000 [0072.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea90 [0072.738] GetProcessHeap () returned 0x630000 [0072.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656db0 [0072.738] GetProcessHeap () returned 0x630000 [0072.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0072.738] GetProcessHeap () returned 0x630000 [0072.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0072.738] GetProcessHeap () returned 0x630000 [0072.738] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.738] GetProcessHeap () returned 0x630000 [0072.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0072.738] GetProcessHeap () returned 0x630000 [0072.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0072.738] GetProcessHeap () returned 0x630000 [0072.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657210 [0072.738] GetProcessHeap () returned 0x630000 [0072.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.738] GetProcessHeap () returned 0x630000 [0072.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0072.738] GetProcessHeap () returned 0x630000 [0072.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e730 [0072.738] GetProcessHeap () returned 0x630000 [0072.738] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0072.738] GetProcessHeap () returned 0x630000 [0072.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0072.738] GetProcessHeap () returned 0x630000 [0072.738] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0072.738] GetProcessHeap () returned 0x630000 [0072.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0072.738] GetProcessHeap () returned 0x630000 [0072.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65ce80 [0072.739] GetProcessHeap () returned 0x630000 [0072.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.739] GetProcessHeap () returned 0x630000 [0072.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0072.739] GetProcessHeap () returned 0x630000 [0072.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.739] GetProcessHeap () returned 0x630000 [0072.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.739] GetProcessHeap () returned 0x630000 [0072.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e100 [0072.739] GetProcessHeap () returned 0x630000 [0072.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ce80 | out: hHeap=0x630000) returned 1 [0072.739] GetProcessHeap () returned 0x630000 [0072.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0072.739] GetProcessHeap () returned 0x630000 [0072.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0072.739] GetProcessHeap () returned 0x630000 [0072.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.739] GetProcessHeap () returned 0x630000 [0072.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.739] GetProcessHeap () returned 0x630000 [0072.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.739] GetProcessHeap () returned 0x630000 [0072.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.739] GetProcessHeap () returned 0x630000 [0072.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.739] GetProcessHeap () returned 0x630000 [0072.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.739] GetProcessHeap () returned 0x630000 [0072.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0072.739] GetProcessHeap () returned 0x630000 [0072.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0072.739] GetProcessHeap () returned 0x630000 [0072.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.739] GetProcessHeap () returned 0x630000 [0072.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.739] GetProcessHeap () returned 0x630000 [0072.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.739] GetProcessHeap () returned 0x630000 [0072.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.740] GetProcessHeap () returned 0x630000 [0072.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.740] GetProcessHeap () returned 0x630000 [0072.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.740] GetProcessHeap () returned 0x630000 [0072.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.740] GetProcessHeap () returned 0x630000 [0072.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.740] GetProcessHeap () returned 0x630000 [0072.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0072.740] GetProcessHeap () returned 0x630000 [0072.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0072.740] GetProcessHeap () returned 0x630000 [0072.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.740] GetProcessHeap () returned 0x630000 [0072.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.740] GetProcessHeap () returned 0x630000 [0072.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.740] GetProcessHeap () returned 0x630000 [0072.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.740] GetProcessHeap () returned 0x630000 [0072.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.740] GetProcessHeap () returned 0x630000 [0072.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.740] GetProcessHeap () returned 0x630000 [0072.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.740] GetProcessHeap () returned 0x630000 [0072.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.740] GetProcessHeap () returned 0x630000 [0072.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0072.740] GetProcessHeap () returned 0x630000 [0072.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0072.740] GetProcessHeap () returned 0x630000 [0072.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.740] GetProcessHeap () returned 0x630000 [0072.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.740] GetProcessHeap () returned 0x630000 [0072.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.740] GetProcessHeap () returned 0x630000 [0072.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.741] GetProcessHeap () returned 0x630000 [0072.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0072.741] GetProcessHeap () returned 0x630000 [0072.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0072.741] GetProcessHeap () returned 0x630000 [0072.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.741] GetProcessHeap () returned 0x630000 [0072.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.741] GetProcessHeap () returned 0x630000 [0072.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.741] GetProcessHeap () returned 0x630000 [0072.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.741] GetProcessHeap () returned 0x630000 [0072.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0072.741] GetProcessHeap () returned 0x630000 [0072.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0072.741] GetProcessHeap () returned 0x630000 [0072.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0072.741] GetProcessHeap () returned 0x630000 [0072.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0072.741] GetProcessHeap () returned 0x630000 [0072.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0072.741] GetProcessHeap () returned 0x630000 [0072.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0072.741] GetProcessHeap () returned 0x630000 [0072.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.741] GetProcessHeap () returned 0x630000 [0072.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.741] GetProcessHeap () returned 0x630000 [0072.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0072.741] GetProcessHeap () returned 0x630000 [0072.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0072.741] GetProcessHeap () returned 0x630000 [0072.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.741] GetProcessHeap () returned 0x630000 [0072.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.741] GetProcessHeap () returned 0x630000 [0072.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0072.741] GetProcessHeap () returned 0x630000 [0072.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0072.742] GetProcessHeap () returned 0x630000 [0072.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.742] GetProcessHeap () returned 0x630000 [0072.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.742] GetProcessHeap () returned 0x630000 [0072.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0072.742] GetProcessHeap () returned 0x630000 [0072.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0072.742] GetProcessHeap () returned 0x630000 [0072.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.742] GetProcessHeap () returned 0x630000 [0072.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.742] GetProcessHeap () returned 0x630000 [0072.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.742] GetProcessHeap () returned 0x630000 [0072.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.742] GetProcessHeap () returned 0x630000 [0072.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.742] GetProcessHeap () returned 0x630000 [0072.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.742] GetProcessHeap () returned 0x630000 [0072.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.742] GetProcessHeap () returned 0x630000 [0072.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.742] GetProcessHeap () returned 0x630000 [0072.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.742] GetProcessHeap () returned 0x630000 [0072.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.742] GetProcessHeap () returned 0x630000 [0072.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.742] GetProcessHeap () returned 0x630000 [0072.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.742] GetProcessHeap () returned 0x630000 [0072.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.742] GetProcessHeap () returned 0x630000 [0072.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.742] GetProcessHeap () returned 0x630000 [0072.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.742] GetProcessHeap () returned 0x630000 [0072.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.743] GetProcessHeap () returned 0x630000 [0072.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.743] GetProcessHeap () returned 0x630000 [0072.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.743] GetProcessHeap () returned 0x630000 [0072.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.743] GetProcessHeap () returned 0x630000 [0072.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.743] GetProcessHeap () returned 0x630000 [0072.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.743] GetProcessHeap () returned 0x630000 [0072.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.743] GetProcessHeap () returned 0x630000 [0072.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.743] GetProcessHeap () returned 0x630000 [0072.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.743] GetProcessHeap () returned 0x630000 [0072.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.743] GetProcessHeap () returned 0x630000 [0072.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.743] GetProcessHeap () returned 0x630000 [0072.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0072.743] GetProcessHeap () returned 0x630000 [0072.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0072.743] GetProcessHeap () returned 0x630000 [0072.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0072.743] GetProcessHeap () returned 0x630000 [0072.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0072.743] GetProcessHeap () returned 0x630000 [0072.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0072.743] GetProcessHeap () returned 0x630000 [0072.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea90 | out: hHeap=0x630000) returned 1 [0072.743] GetProcessHeap () returned 0x630000 [0072.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0072.743] GetProcessHeap () returned 0x630000 [0072.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0072.743] GetProcessHeap () returned 0x630000 [0072.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0072.744] GetProcessHeap () returned 0x630000 [0072.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0072.744] GetProcessHeap () returned 0x630000 [0072.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0072.744] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x38b, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d864*=0x38b, lpOverlapped=0x0) returned 1 [0072.745] GetProcessHeap () returned 0x630000 [0072.745] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671bf0, Size=0x30) returned 0x671bf0 [0072.745] GetProcessHeap () returned 0x630000 [0072.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0072.746] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0072.746] GetProcessHeap () returned 0x630000 [0072.746] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc320) returned 0x671c28 [0072.746] ReadFile (in: hFile=0x230, lpBuffer=0x671c28, nNumberOfBytesToRead=0xc320, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671c28*, lpNumberOfBytesRead=0x243d7e8*=0xc320, lpOverlapped=0x0) returned 1 [0072.746] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0072.746] WriteFile (in: hFile=0x230, lpBuffer=0x671c28*, nNumberOfBytesToWrite=0xc320, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671c28*, lpNumberOfBytesWritten=0x243d7e4*=0xc320, lpOverlapped=0x0) returned 1 [0072.748] GetProcessHeap () returned 0x630000 [0072.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671c28 | out: hHeap=0x630000) returned 1 [0072.748] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0072.748] WriteFile (in: hFile=0x230, lpBuffer=0x671bf0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x671bf0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0072.749] CloseHandle (hObject=0x230) returned 1 [0072.749] GetProcessHeap () returned 0x630000 [0072.749] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0072.749] GetProcessHeap () returned 0x630000 [0072.749] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655580 | out: hHeap=0x630000) returned 1 [0072.749] GetProcessHeap () returned 0x630000 [0072.749] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0072.749] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\US8GSIMeYuf.xls" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\US8GSIMeYuf.xls") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\US8GSIMeYuf.xls" [0072.749] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\US8GSIMeYuf.xls", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\US8GSIMeYuf.xls.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\US8GSIMeYuf.xls.happythreechoose" [0072.749] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\US8GSIMeYuf.xls" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\mxxkf6\\us8gsimeyuf.xls"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\US8GSIMeYuf.xls.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\mxxkf6\\us8gsimeyuf.xls.happythreechoose"), dwFlags=0x1) returned 1 [0072.750] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\US8GSIMeYuf.xls" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6") returned 1 [0072.750] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\") returned="" [0072.750] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\Decryption INFO.html" [0072.750] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\mxxkf6\\decryption info.html")) returned 0x20 [0072.750] GetProcessHeap () returned 0x630000 [0072.750] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0072.750] FindNextFileW (in: hFindFile=0x648c90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5149cc90, ftCreationTime.dwHighDateTime=0x1d5d05b, ftLastAccessTime.dwLowDateTime=0xdc60c0a0, ftLastAccessTime.dwHighDateTime=0x1d5d05a, ftLastWriteTime.dwLowDateTime=0xdc60c0a0, ftLastWriteTime.dwHighDateTime=0x1d5d05a, nFileSizeHigh=0x0, nFileSizeLow=0xc315, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="US8GSIMeYuf.xls", cAlternateFileName="US8GSI~1.XLS")) returned 0 [0072.750] FindClose (in: hFindFile=0x648c90 | out: hFindFile=0x648c90) returned 1 [0072.750] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\" [0072.750] GetProcessHeap () returned 0x630000 [0072.750] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63f290 | out: hHeap=0x630000) returned 1 [0072.750] GetProcessHeap () returned 0x630000 [0072.750] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0072.751] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\") returned 59 [0072.751] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\*") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\*" [0072.751] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26a9760, ftCreationTime.dwHighDateTime=0x1d5ceff, ftLastAccessTime.dwLowDateTime=0xa51884a0, ftLastAccessTime.dwHighDateTime=0x1d5c9c7, ftLastWriteTime.dwLowDateTime=0xa51884a0, ftLastWriteTime.dwHighDateTime=0x1d5c9c7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648b10 [0072.751] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0072.751] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26a9760, ftCreationTime.dwHighDateTime=0x1d5ceff, ftLastAccessTime.dwLowDateTime=0xa51884a0, ftLastAccessTime.dwHighDateTime=0x1d5c9c7, ftLastWriteTime.dwLowDateTime=0xa51884a0, ftLastWriteTime.dwHighDateTime=0x1d5c9c7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.751] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0072.751] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0072.751] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb6264f0, ftCreationTime.dwHighDateTime=0x1d5cf87, ftLastAccessTime.dwLowDateTime=0xd2ac4bb0, ftLastAccessTime.dwHighDateTime=0x1d5caa1, ftLastWriteTime.dwLowDateTime=0xd2ac4bb0, ftLastWriteTime.dwHighDateTime=0x1d5caa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Rh1TWMV3MUXQsFlE", cAlternateFileName="RH1TWM~1")) returned 1 [0072.751] lstrcmpiW (lpString1="Rh1TWMV3MUXQsFlE", lpString2=".") returned 1 [0072.751] lstrcmpiW (lpString1="Rh1TWMV3MUXQsFlE", lpString2="..") returned 1 [0072.751] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\", lpString2="Rh1TWMV3MUXQsFlE" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE" [0072.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Rh1TWMV3MUXQsFlE", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0072.751] GetProcessHeap () returned 0x630000 [0072.751] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11) returned 0x645d58 [0072.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Rh1TWMV3MUXQsFlE", cchWideChar=-1, lpMultiByteStr=0x645d58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Rh1TWMV3MUXQsFlE", lpUsedDefaultChar=0x0) returned 17 [0072.751] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Rh1TWMV3MUXQsFlE", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0072.751] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Rh1TWMV3MUXQsFlE", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0072.751] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Rh1TWMV3MUXQsFlE", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0072.751] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Rh1TWMV3MUXQsFlE", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0072.751] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Rh1TWMV3MUXQsFlE", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0072.751] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Rh1TWMV3MUXQsFlE", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0072.751] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Rh1TWMV3MUXQsFlE", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0072.751] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Rh1TWMV3MUXQsFlE", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0072.751] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Rh1TWMV3MUXQsFlE", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0072.751] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Rh1TWMV3MUXQsFlE", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0072.751] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Rh1TWMV3MUXQsFlE", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0072.751] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Rh1TWMV3MUXQsFlE", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0072.751] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Rh1TWMV3MUXQsFlE", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0072.751] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Rh1TWMV3MUXQsFlE", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0072.752] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Rh1TWMV3MUXQsFlE", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0072.752] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Rh1TWMV3MUXQsFlE", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0072.752] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Rh1TWMV3MUXQsFlE", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0072.752] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Rh1TWMV3MUXQsFlE", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0072.752] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Rh1TWMV3MUXQsFlE", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0072.752] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Rh1TWMV3MUXQsFlE", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0072.752] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Rh1TWMV3MUXQsFlE", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0072.752] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Rh1TWMV3MUXQsFlE", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0072.752] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Rh1TWMV3MUXQsFlE", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0072.752] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Rh1TWMV3MUXQsFlE", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0072.752] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Rh1TWMV3MUXQsFlE", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0072.752] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Rh1TWMV3MUXQsFlE", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0072.752] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Rh1TWMV3MUXQsFlE", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0072.752] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Rh1TWMV3MUXQsFlE", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0072.752] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Rh1TWMV3MUXQsFlE", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0072.752] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Rh1TWMV3MUXQsFlE", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0072.752] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Rh1TWMV3MUXQsFlE", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0072.752] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Rh1TWMV3MUXQsFlE", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0072.752] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Rh1TWMV3MUXQsFlE", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0072.752] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Rh1TWMV3MUXQsFlE", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0072.752] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Rh1TWMV3MUXQsFlE", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0072.752] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Rh1TWMV3MUXQsFlE", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0072.752] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Rh1TWMV3MUXQsFlE", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0072.752] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Rh1TWMV3MUXQsFlE", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0072.752] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Rh1TWMV3MUXQsFlE", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0072.752] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Rh1TWMV3MUXQsFlE", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0072.752] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Rh1TWMV3MUXQsFlE", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0072.752] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Rh1TWMV3MUXQsFlE", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0072.752] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Rh1TWMV3MUXQsFlE", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0072.752] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\" [0072.752] GetProcessHeap () returned 0x630000 [0072.752] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a2f8 [0072.752] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\") returned 76 [0072.752] GetProcessHeap () returned 0x630000 [0072.752] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9a) returned 0x640c90 [0072.753] lstrcpyW (in: lpString1=0x640c90, lpString2="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\" [0072.753] GetProcessHeap () returned 0x630000 [0072.753] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645d58 | out: hHeap=0x630000) returned 1 [0072.753] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb6264f0, ftCreationTime.dwHighDateTime=0x1d5cf87, ftLastAccessTime.dwLowDateTime=0xd2ac4bb0, ftLastAccessTime.dwHighDateTime=0x1d5caa1, ftLastWriteTime.dwLowDateTime=0xd2ac4bb0, ftLastWriteTime.dwHighDateTime=0x1d5caa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Rh1TWMV3MUXQsFlE", cAlternateFileName="RH1TWM~1")) returned 0 [0072.753] FindClose (in: hFindFile=0x648b10 | out: hFindFile=0x648b10) returned 1 [0072.753] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\" [0072.753] GetProcessHeap () returned 0x630000 [0072.753] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0072.753] GetProcessHeap () returned 0x630000 [0072.753] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0072.753] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\") returned 76 [0072.753] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\*") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\*" [0072.753] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb6264f0, ftCreationTime.dwHighDateTime=0x1d5cf87, ftLastAccessTime.dwLowDateTime=0xd2ac4bb0, ftLastAccessTime.dwHighDateTime=0x1d5caa1, ftLastWriteTime.dwLowDateTime=0xd2ac4bb0, ftLastWriteTime.dwHighDateTime=0x1d5caa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648b10 [0072.753] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0072.753] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb6264f0, ftCreationTime.dwHighDateTime=0x1d5cf87, ftLastAccessTime.dwLowDateTime=0xd2ac4bb0, ftLastAccessTime.dwHighDateTime=0x1d5caa1, ftLastWriteTime.dwLowDateTime=0xd2ac4bb0, ftLastWriteTime.dwHighDateTime=0x1d5caa1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.753] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0072.753] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0072.753] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbefda6d0, ftCreationTime.dwHighDateTime=0x1d5d326, ftLastAccessTime.dwLowDateTime=0x4b8fae60, ftLastAccessTime.dwHighDateTime=0x1d5d203, ftLastWriteTime.dwLowDateTime=0x4b8fae60, ftLastWriteTime.dwHighDateTime=0x1d5d203, nFileSizeHigh=0x0, nFileSizeLow=0xdff2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="2rRMS3MxMcdsp-.odp", cAlternateFileName="2RRMS3~1.ODP")) returned 1 [0072.753] lstrcmpiW (lpString1="2rRMS3MxMcdsp-.odp", lpString2=".") returned 1 [0072.753] lstrcmpiW (lpString1="2rRMS3MxMcdsp-.odp", lpString2="..") returned 1 [0072.753] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\", lpString2="2rRMS3MxMcdsp-.odp" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\2rRMS3MxMcdsp-.odp") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\2rRMS3MxMcdsp-.odp" [0072.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="2rRMS3MxMcdsp-.odp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0072.753] GetProcessHeap () returned 0x630000 [0072.753] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x13) returned 0x645d38 [0072.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="2rRMS3MxMcdsp-.odp", cchWideChar=-1, lpMultiByteStr=0x645d38, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2rRMS3MxMcdsp-.odp", lpUsedDefaultChar=0x0) returned 19 [0072.753] lstrlenA (lpString="2rRMS3MxMcdsp-.odp") returned 18 [0072.753] lstrlenA (lpString=".happythreechoose") returned 17 [0072.753] lstrlenA (lpString=".happythreechoose") returned 17 [0072.753] lstrlenA (lpString="2rRMS3MxMcdsp-.odp") returned 18 [0072.753] lstrcmpiA (lpString1="rRMS3MxMcdsp-.odp", lpString2=".happythreechoose") returned 1 [0072.754] lstrcmpiW (lpString1="2rRMS3MxMcdsp-.odp", lpString2="Decryption INFO.html") returned -1 [0072.754] lstrcmpiW (lpString1="2rRMS3MxMcdsp-.odp", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned -1 [0072.754] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0072.754] lstrcmpiW (lpString1="2rRMS3MxMcdsp-.odp", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0072.754] GetProcessHeap () returned 0x630000 [0072.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0072.754] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\2rRMS3MxMcdsp-.odp" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\mxxkf6\\sqrcaru_rhnscgd97t\\rh1twmv3muxqsfle\\2rrms3mxmcdsp-.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0072.754] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=57330) returned 1 [0072.754] GetProcessHeap () returned 0x630000 [0072.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655b20 [0072.754] GetProcessHeap () returned 0x630000 [0072.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0072.754] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\2rRMS3MxMcdsp-.odp") returned 94 [0072.754] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0072.754] GetProcessHeap () returned 0x630000 [0072.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0072.754] GetProcessHeap () returned 0x630000 [0072.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38e) returned 0x671c28 [0072.754] lstrlenA (lpString="rsa_encrypt") returned 11 [0072.754] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0072.755] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0072.755] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0072.755] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0072.755] GetProcessHeap () returned 0x630000 [0072.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0072.755] lstrlenA (lpString="010001") returned 6 [0072.755] GetProcessHeap () returned 0x630000 [0072.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0072.755] GetProcessHeap () returned 0x630000 [0072.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0072.755] GetProcessHeap () returned 0x630000 [0072.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e970 [0072.755] GetProcessHeap () returned 0x630000 [0072.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0072.755] GetProcessHeap () returned 0x630000 [0072.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea00 [0072.755] GetProcessHeap () returned 0x630000 [0072.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656950 [0072.755] GetProcessHeap () returned 0x630000 [0072.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0072.755] GetProcessHeap () returned 0x630000 [0072.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0072.755] GetProcessHeap () returned 0x630000 [0072.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.755] GetProcessHeap () returned 0x630000 [0072.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0072.756] GetProcessHeap () returned 0x630000 [0072.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0072.756] GetProcessHeap () returned 0x630000 [0072.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656ec8 [0072.756] GetProcessHeap () returned 0x630000 [0072.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0072.756] GetProcessHeap () returned 0x630000 [0072.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0072.756] GetProcessHeap () returned 0x630000 [0072.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e730 [0072.756] GetProcessHeap () returned 0x630000 [0072.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0072.756] GetProcessHeap () returned 0x630000 [0072.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0072.756] GetProcessHeap () returned 0x630000 [0072.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0072.756] GetProcessHeap () returned 0x630000 [0072.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.756] GetProcessHeap () returned 0x630000 [0072.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0072.756] GetProcessHeap () returned 0x630000 [0072.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0072.756] GetProcessHeap () returned 0x630000 [0072.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.756] GetProcessHeap () returned 0x630000 [0072.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.756] GetProcessHeap () returned 0x630000 [0072.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.756] GetProcessHeap () returned 0x630000 [0072.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65dec0 [0072.756] GetProcessHeap () returned 0x630000 [0072.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0072.756] GetProcessHeap () returned 0x630000 [0072.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0072.756] GetProcessHeap () returned 0x630000 [0072.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0072.756] GetProcessHeap () returned 0x630000 [0072.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.756] GetProcessHeap () returned 0x630000 [0072.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.756] GetProcessHeap () returned 0x630000 [0072.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.757] GetProcessHeap () returned 0x630000 [0072.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.757] GetProcessHeap () returned 0x630000 [0072.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.757] GetProcessHeap () returned 0x630000 [0072.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.757] GetProcessHeap () returned 0x630000 [0072.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.757] GetProcessHeap () returned 0x630000 [0072.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.757] GetProcessHeap () returned 0x630000 [0072.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.757] GetProcessHeap () returned 0x630000 [0072.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.757] GetProcessHeap () returned 0x630000 [0072.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0072.757] GetProcessHeap () returned 0x630000 [0072.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0072.757] GetProcessHeap () returned 0x630000 [0072.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.757] GetProcessHeap () returned 0x630000 [0072.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.757] GetProcessHeap () returned 0x630000 [0072.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0072.757] GetProcessHeap () returned 0x630000 [0072.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0072.757] GetProcessHeap () returned 0x630000 [0072.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.757] GetProcessHeap () returned 0x630000 [0072.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.757] GetProcessHeap () returned 0x630000 [0072.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0072.757] GetProcessHeap () returned 0x630000 [0072.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0072.757] GetProcessHeap () returned 0x630000 [0072.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.757] GetProcessHeap () returned 0x630000 [0072.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.757] GetProcessHeap () returned 0x630000 [0072.758] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.758] GetProcessHeap () returned 0x630000 [0072.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.758] GetProcessHeap () returned 0x630000 [0072.758] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.758] GetProcessHeap () returned 0x630000 [0072.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.758] GetProcessHeap () returned 0x630000 [0072.758] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0072.758] GetProcessHeap () returned 0x630000 [0072.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0072.758] GetProcessHeap () returned 0x630000 [0072.758] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.758] GetProcessHeap () returned 0x630000 [0072.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.758] GetProcessHeap () returned 0x630000 [0072.758] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0072.758] GetProcessHeap () returned 0x630000 [0072.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0072.758] GetProcessHeap () returned 0x630000 [0072.758] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.758] GetProcessHeap () returned 0x630000 [0072.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.758] GetProcessHeap () returned 0x630000 [0072.758] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.758] GetProcessHeap () returned 0x630000 [0072.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.758] GetProcessHeap () returned 0x630000 [0072.758] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.758] GetProcessHeap () returned 0x630000 [0072.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.758] GetProcessHeap () returned 0x630000 [0072.758] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.758] GetProcessHeap () returned 0x630000 [0072.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.758] GetProcessHeap () returned 0x630000 [0072.758] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.758] GetProcessHeap () returned 0x630000 [0072.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.759] GetProcessHeap () returned 0x630000 [0072.759] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.759] GetProcessHeap () returned 0x630000 [0072.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.759] GetProcessHeap () returned 0x630000 [0072.759] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.759] GetProcessHeap () returned 0x630000 [0072.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.759] GetProcessHeap () returned 0x630000 [0072.759] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0072.759] GetProcessHeap () returned 0x630000 [0072.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0072.759] GetProcessHeap () returned 0x630000 [0072.759] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0072.759] GetProcessHeap () returned 0x630000 [0072.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0072.759] GetProcessHeap () returned 0x630000 [0072.759] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0072.759] GetProcessHeap () returned 0x630000 [0072.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0072.759] GetProcessHeap () returned 0x630000 [0072.759] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0072.759] GetProcessHeap () returned 0x630000 [0072.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0072.759] GetProcessHeap () returned 0x630000 [0072.759] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.759] GetProcessHeap () returned 0x630000 [0072.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.759] GetProcessHeap () returned 0x630000 [0072.759] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.759] GetProcessHeap () returned 0x630000 [0072.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.759] GetProcessHeap () returned 0x630000 [0072.759] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.759] GetProcessHeap () returned 0x630000 [0072.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.759] GetProcessHeap () returned 0x630000 [0072.759] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.759] GetProcessHeap () returned 0x630000 [0072.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.760] GetProcessHeap () returned 0x630000 [0072.760] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.760] GetProcessHeap () returned 0x630000 [0072.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.760] GetProcessHeap () returned 0x630000 [0072.760] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.760] GetProcessHeap () returned 0x630000 [0072.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.760] GetProcessHeap () returned 0x630000 [0072.760] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.760] GetProcessHeap () returned 0x630000 [0072.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.760] GetProcessHeap () returned 0x630000 [0072.760] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.760] GetProcessHeap () returned 0x630000 [0072.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.760] GetProcessHeap () returned 0x630000 [0072.760] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0072.760] GetProcessHeap () returned 0x630000 [0072.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0072.760] GetProcessHeap () returned 0x630000 [0072.760] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.760] GetProcessHeap () returned 0x630000 [0072.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.760] GetProcessHeap () returned 0x630000 [0072.760] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0072.760] GetProcessHeap () returned 0x630000 [0072.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0072.760] GetProcessHeap () returned 0x630000 [0072.760] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.760] GetProcessHeap () returned 0x630000 [0072.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.760] GetProcessHeap () returned 0x630000 [0072.760] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.760] GetProcessHeap () returned 0x630000 [0072.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.760] GetProcessHeap () returned 0x630000 [0072.760] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.760] GetProcessHeap () returned 0x630000 [0072.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.761] GetProcessHeap () returned 0x630000 [0072.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0072.761] GetProcessHeap () returned 0x630000 [0072.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0072.761] GetProcessHeap () returned 0x630000 [0072.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0072.761] GetProcessHeap () returned 0x630000 [0072.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0072.761] GetProcessHeap () returned 0x630000 [0072.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0072.761] GetProcessHeap () returned 0x630000 [0072.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0072.761] GetProcessHeap () returned 0x630000 [0072.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0072.761] GetProcessHeap () returned 0x630000 [0072.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0072.761] GetProcessHeap () returned 0x630000 [0072.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0072.761] GetProcessHeap () returned 0x630000 [0072.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0072.761] GetProcessHeap () returned 0x630000 [0072.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0072.761] WriteFile (in: hFile=0x230, lpBuffer=0x671c28*, nNumberOfBytesToWrite=0x38e, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x671c28*, lpNumberOfBytesWritten=0x243d864*=0x38e, lpOverlapped=0x0) returned 1 [0072.767] GetProcessHeap () returned 0x630000 [0072.767] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c28, Size=0x30) returned 0x671c28 [0072.767] GetProcessHeap () returned 0x630000 [0072.767] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0072.767] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0072.767] GetProcessHeap () returned 0x630000 [0072.767] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe000) returned 0x671c60 [0072.767] ReadFile (in: hFile=0x230, lpBuffer=0x671c60, nNumberOfBytesToRead=0xe000, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671c60*, lpNumberOfBytesRead=0x243d7e8*=0xe000, lpOverlapped=0x0) returned 1 [0072.768] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0072.768] WriteFile (in: hFile=0x230, lpBuffer=0x671c60*, nNumberOfBytesToWrite=0xe000, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671c60*, lpNumberOfBytesWritten=0x243d7e4*=0xe000, lpOverlapped=0x0) returned 1 [0072.771] GetProcessHeap () returned 0x630000 [0072.771] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671c60 | out: hHeap=0x630000) returned 1 [0072.771] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0072.771] WriteFile (in: hFile=0x230, lpBuffer=0x671c28*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x671c28*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0072.772] CloseHandle (hObject=0x230) returned 1 [0072.772] GetProcessHeap () returned 0x630000 [0072.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0072.772] GetProcessHeap () returned 0x630000 [0072.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655b20 | out: hHeap=0x630000) returned 1 [0072.772] GetProcessHeap () returned 0x630000 [0072.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0072.772] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\2rRMS3MxMcdsp-.odp" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\2rRMS3MxMcdsp-.odp") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\2rRMS3MxMcdsp-.odp" [0072.772] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\2rRMS3MxMcdsp-.odp", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\2rRMS3MxMcdsp-.odp.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\2rRMS3MxMcdsp-.odp.happythreechoose" [0072.772] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\2rRMS3MxMcdsp-.odp" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\mxxkf6\\sqrcaru_rhnscgd97t\\rh1twmv3muxqsfle\\2rrms3mxmcdsp-.odp"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\2rRMS3MxMcdsp-.odp.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\mxxkf6\\sqrcaru_rhnscgd97t\\rh1twmv3muxqsfle\\2rrms3mxmcdsp-.odp.happythreechoose"), dwFlags=0x1) returned 1 [0072.773] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\2rRMS3MxMcdsp-.odp" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE") returned 1 [0072.773] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\") returned="" [0072.773] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\Decryption INFO.html" [0072.773] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\mxxkf6\\sqrcaru_rhnscgd97t\\rh1twmv3muxqsfle\\decryption info.html")) returned 0xffffffff [0072.773] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\mxxkf6\\sqrcaru_rhnscgd97t\\rh1twmv3muxqsfle\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0072.773] GetProcessHeap () returned 0x630000 [0072.773] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655490 [0072.773] GetProcessHeap () returned 0x630000 [0072.773] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0072.781] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.783] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.783] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.783] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.783] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.783] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.783] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.783] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.783] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.783] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.783] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.783] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.783] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.784] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.784] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.784] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.784] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.784] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.784] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.784] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.784] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.784] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.784] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.784] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.785] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.785] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.785] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.785] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.785] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.785] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.785] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.786] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.786] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.786] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.786] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.786] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.786] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.786] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.786] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.786] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.786] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.786] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.786] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.787] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.787] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.787] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.787] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.787] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.787] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.787] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.787] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.787] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.787] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.787] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.787] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.787] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.788] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.788] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.788] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.788] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.788] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.788] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.788] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.788] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.788] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.788] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.788] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.788] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.788] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.789] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.789] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.789] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.789] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.789] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.789] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.789] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.789] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.789] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.789] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.789] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.789] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.790] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.790] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.790] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.790] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.790] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.790] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.790] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.790] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.790] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.790] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.790] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.790] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.790] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.791] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.791] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.791] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.791] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.791] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.791] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.791] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.791] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.791] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.791] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.791] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.791] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.792] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.793] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.793] GetProcessHeap () returned 0x630000 [0072.793] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655490 | out: hHeap=0x630000) returned 1 [0072.793] GetProcessHeap () returned 0x630000 [0072.793] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0072.793] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0072.793] GetProcessHeap () returned 0x630000 [0072.793] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655508 [0072.793] GetProcessHeap () returned 0x630000 [0072.793] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0072.800] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.800] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.800] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.800] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.800] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.800] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.800] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.801] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.801] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.801] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.801] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.801] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.801] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.801] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.801] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.801] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.801] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.801] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.801] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.801] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.802] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.802] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.802] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.802] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.802] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.802] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.802] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.802] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.802] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.802] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.802] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.802] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.803] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.803] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.803] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.803] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.803] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.803] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.803] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.803] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.803] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.803] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.803] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.803] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.803] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.804] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.804] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.804] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.804] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.804] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.804] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.804] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.804] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.804] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.804] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.804] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.804] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.805] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.805] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.805] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.805] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.805] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.805] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.805] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.805] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.805] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.805] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.805] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.805] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.805] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.806] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.806] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.806] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.806] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.806] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.806] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.806] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.806] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.806] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.806] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.806] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.807] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.807] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.807] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.807] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.807] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.807] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.807] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.807] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.807] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.807] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.807] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.807] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.808] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.808] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.808] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.808] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.808] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.808] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.808] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.808] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.808] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.808] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.808] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.808] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.808] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.809] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.809] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.809] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.809] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.809] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.809] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.809] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.809] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.809] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.809] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.809] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.809] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0072.986] GetProcessHeap () returned 0x630000 [0072.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655508 | out: hHeap=0x630000) returned 1 [0072.987] GetProcessHeap () returned 0x630000 [0072.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0072.987] CloseHandle (hObject=0x230) returned 1 [0072.987] GetProcessHeap () returned 0x630000 [0072.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645d38 | out: hHeap=0x630000) returned 1 [0072.987] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x269c2f0, ftCreationTime.dwHighDateTime=0x1d5cc60, ftLastAccessTime.dwLowDateTime=0x8a268630, ftLastAccessTime.dwHighDateTime=0x1d5cbb4, ftLastWriteTime.dwLowDateTime=0x8a268630, ftLastWriteTime.dwHighDateTime=0x1d5cbb4, nFileSizeHigh=0x0, nFileSizeLow=0xc298, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="e TefxcC_M.ots", cAlternateFileName="ETEFXC~1.OTS")) returned 1 [0072.987] lstrcmpiW (lpString1="e TefxcC_M.ots", lpString2=".") returned 1 [0072.987] lstrcmpiW (lpString1="e TefxcC_M.ots", lpString2="..") returned 1 [0072.987] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\", lpString2="e TefxcC_M.ots" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\e TefxcC_M.ots") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\e TefxcC_M.ots" [0072.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e TefxcC_M.ots", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0072.987] GetProcessHeap () returned 0x630000 [0072.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64ca20 [0072.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e TefxcC_M.ots", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="e TefxcC_M.ots", lpUsedDefaultChar=0x0) returned 15 [0072.987] lstrlenA (lpString="e TefxcC_M.ots") returned 14 [0072.987] lstrlenA (lpString=".happythreechoose") returned 17 [0072.987] lstrcmpiW (lpString1="e TefxcC_M.ots", lpString2="Decryption INFO.html") returned 1 [0072.987] lstrcmpiW (lpString1="e TefxcC_M.ots", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0072.987] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0072.987] lstrcmpiW (lpString1="e TefxcC_M.ots", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0072.987] GetProcessHeap () returned 0x630000 [0072.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0072.987] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\e TefxcC_M.ots" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\mxxkf6\\sqrcaru_rhnscgd97t\\rh1twmv3muxqsfle\\e tefxcc_m.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0072.988] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=49816) returned 1 [0072.988] GetProcessHeap () returned 0x630000 [0072.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655aa8 [0072.988] GetProcessHeap () returned 0x630000 [0072.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0072.988] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\e TefxcC_M.ots") returned 90 [0072.988] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0072.988] GetProcessHeap () returned 0x630000 [0072.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0072.988] GetProcessHeap () returned 0x630000 [0072.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x388) returned 0x671c60 [0072.988] lstrlenA (lpString="rsa_encrypt") returned 11 [0072.988] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0072.989] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0072.989] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0072.989] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0072.989] GetProcessHeap () returned 0x630000 [0072.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0072.989] lstrlenA (lpString="010001") returned 6 [0072.989] GetProcessHeap () returned 0x630000 [0072.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0072.989] GetProcessHeap () returned 0x630000 [0072.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0072.989] GetProcessHeap () returned 0x630000 [0072.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dec0 [0072.989] GetProcessHeap () returned 0x630000 [0072.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0072.989] GetProcessHeap () returned 0x630000 [0072.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea90 [0072.989] GetProcessHeap () returned 0x630000 [0072.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657788 [0072.989] GetProcessHeap () returned 0x630000 [0072.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0072.989] GetProcessHeap () returned 0x630000 [0072.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0072.989] GetProcessHeap () returned 0x630000 [0072.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.989] GetProcessHeap () returned 0x630000 [0072.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0072.989] GetProcessHeap () returned 0x630000 [0072.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0072.989] GetProcessHeap () returned 0x630000 [0072.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657670 [0072.989] GetProcessHeap () returned 0x630000 [0072.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.989] GetProcessHeap () returned 0x630000 [0072.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0072.990] GetProcessHeap () returned 0x630000 [0072.990] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e2b0 [0072.990] GetProcessHeap () returned 0x630000 [0072.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0072.990] GetProcessHeap () returned 0x630000 [0072.990] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0072.990] GetProcessHeap () returned 0x630000 [0072.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e2b0 | out: hHeap=0x630000) returned 1 [0072.990] GetProcessHeap () returned 0x630000 [0072.990] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0072.990] GetProcessHeap () returned 0x630000 [0072.990] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65d0d8 [0072.990] GetProcessHeap () returned 0x630000 [0072.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.990] GetProcessHeap () returned 0x630000 [0072.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0072.990] GetProcessHeap () returned 0x630000 [0072.990] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.990] GetProcessHeap () returned 0x630000 [0072.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.990] GetProcessHeap () returned 0x630000 [0072.990] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e340 [0072.990] GetProcessHeap () returned 0x630000 [0072.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65d0d8 | out: hHeap=0x630000) returned 1 [0072.990] GetProcessHeap () returned 0x630000 [0072.990] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0072.990] GetProcessHeap () returned 0x630000 [0072.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0072.990] GetProcessHeap () returned 0x630000 [0072.990] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.990] GetProcessHeap () returned 0x630000 [0072.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.990] GetProcessHeap () returned 0x630000 [0072.990] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.990] GetProcessHeap () returned 0x630000 [0072.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.990] GetProcessHeap () returned 0x630000 [0072.990] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.990] GetProcessHeap () returned 0x630000 [0072.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.990] GetProcessHeap () returned 0x630000 [0072.991] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.991] GetProcessHeap () returned 0x630000 [0072.991] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.991] GetProcessHeap () returned 0x630000 [0072.991] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.991] GetProcessHeap () returned 0x630000 [0072.991] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.991] GetProcessHeap () returned 0x630000 [0072.991] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.991] GetProcessHeap () returned 0x630000 [0072.991] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.991] GetProcessHeap () returned 0x630000 [0072.991] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0072.991] GetProcessHeap () returned 0x630000 [0072.991] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0072.991] GetProcessHeap () returned 0x630000 [0072.991] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.991] GetProcessHeap () returned 0x630000 [0072.991] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.991] GetProcessHeap () returned 0x630000 [0072.991] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.991] GetProcessHeap () returned 0x630000 [0072.991] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.991] GetProcessHeap () returned 0x630000 [0072.991] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0072.991] GetProcessHeap () returned 0x630000 [0072.991] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0072.991] GetProcessHeap () returned 0x630000 [0072.991] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.991] GetProcessHeap () returned 0x630000 [0072.991] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.991] GetProcessHeap () returned 0x630000 [0072.991] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0072.991] GetProcessHeap () returned 0x630000 [0072.991] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0072.991] GetProcessHeap () returned 0x630000 [0072.991] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0072.991] GetProcessHeap () returned 0x630000 [0072.991] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0072.992] GetProcessHeap () returned 0x630000 [0072.992] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.992] GetProcessHeap () returned 0x630000 [0072.992] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.992] GetProcessHeap () returned 0x630000 [0072.992] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.992] GetProcessHeap () returned 0x630000 [0072.992] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.992] GetProcessHeap () returned 0x630000 [0072.992] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.992] GetProcessHeap () returned 0x630000 [0072.992] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.992] GetProcessHeap () returned 0x630000 [0072.992] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.992] GetProcessHeap () returned 0x630000 [0072.992] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.992] GetProcessHeap () returned 0x630000 [0072.992] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0072.992] GetProcessHeap () returned 0x630000 [0072.992] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0072.992] GetProcessHeap () returned 0x630000 [0072.992] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.992] GetProcessHeap () returned 0x630000 [0072.992] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.992] GetProcessHeap () returned 0x630000 [0072.992] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0072.992] GetProcessHeap () returned 0x630000 [0072.992] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0072.992] GetProcessHeap () returned 0x630000 [0072.992] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.992] GetProcessHeap () returned 0x630000 [0072.992] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.992] GetProcessHeap () returned 0x630000 [0072.992] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0072.992] GetProcessHeap () returned 0x630000 [0072.992] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0072.992] GetProcessHeap () returned 0x630000 [0072.992] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.992] GetProcessHeap () returned 0x630000 [0072.993] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.993] GetProcessHeap () returned 0x630000 [0072.993] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.993] GetProcessHeap () returned 0x630000 [0072.993] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.993] GetProcessHeap () returned 0x630000 [0072.993] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.993] GetProcessHeap () returned 0x630000 [0072.993] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.993] GetProcessHeap () returned 0x630000 [0072.993] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.993] GetProcessHeap () returned 0x630000 [0072.993] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.993] GetProcessHeap () returned 0x630000 [0072.993] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.993] GetProcessHeap () returned 0x630000 [0072.993] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.993] GetProcessHeap () returned 0x630000 [0072.993] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.993] GetProcessHeap () returned 0x630000 [0072.993] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.993] GetProcessHeap () returned 0x630000 [0072.993] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0072.993] GetProcessHeap () returned 0x630000 [0072.993] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0072.993] GetProcessHeap () returned 0x630000 [0072.993] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.993] GetProcessHeap () returned 0x630000 [0072.993] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.993] GetProcessHeap () returned 0x630000 [0072.993] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.993] GetProcessHeap () returned 0x630000 [0072.993] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.993] GetProcessHeap () returned 0x630000 [0072.993] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.993] GetProcessHeap () returned 0x630000 [0072.993] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.993] GetProcessHeap () returned 0x630000 [0072.993] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.993] GetProcessHeap () returned 0x630000 [0072.993] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.994] GetProcessHeap () returned 0x630000 [0072.994] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0072.994] GetProcessHeap () returned 0x630000 [0072.994] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0072.994] GetProcessHeap () returned 0x630000 [0072.994] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0072.994] GetProcessHeap () returned 0x630000 [0072.994] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0072.994] GetProcessHeap () returned 0x630000 [0072.994] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.994] GetProcessHeap () returned 0x630000 [0072.994] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.994] GetProcessHeap () returned 0x630000 [0072.994] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0072.994] GetProcessHeap () returned 0x630000 [0072.994] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0072.994] GetProcessHeap () returned 0x630000 [0072.994] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.994] GetProcessHeap () returned 0x630000 [0072.994] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.994] GetProcessHeap () returned 0x630000 [0072.994] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.994] GetProcessHeap () returned 0x630000 [0072.994] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.994] GetProcessHeap () returned 0x630000 [0072.994] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.994] GetProcessHeap () returned 0x630000 [0072.994] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.994] GetProcessHeap () returned 0x630000 [0072.994] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0072.994] GetProcessHeap () returned 0x630000 [0072.994] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0072.994] GetProcessHeap () returned 0x630000 [0072.994] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0072.994] GetProcessHeap () returned 0x630000 [0072.994] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0072.994] GetProcessHeap () returned 0x630000 [0072.994] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0072.994] GetProcessHeap () returned 0x630000 [0072.995] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0072.995] GetProcessHeap () returned 0x630000 [0072.995] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0072.995] GetProcessHeap () returned 0x630000 [0072.995] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea90 | out: hHeap=0x630000) returned 1 [0072.995] GetProcessHeap () returned 0x630000 [0072.995] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0072.995] GetProcessHeap () returned 0x630000 [0072.995] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0072.995] GetProcessHeap () returned 0x630000 [0072.995] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0072.995] GetProcessHeap () returned 0x630000 [0072.995] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0072.995] GetProcessHeap () returned 0x630000 [0072.995] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0072.995] WriteFile (in: hFile=0x230, lpBuffer=0x671c60*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x671c60*, lpNumberOfBytesWritten=0x243d864*=0x388, lpOverlapped=0x0) returned 1 [0072.997] GetProcessHeap () returned 0x630000 [0072.997] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c60, Size=0x30) returned 0x671c60 [0072.997] GetProcessHeap () returned 0x630000 [0072.997] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0072.997] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0072.997] GetProcessHeap () returned 0x630000 [0072.997] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc2a0) returned 0x671c98 [0072.997] ReadFile (in: hFile=0x230, lpBuffer=0x671c98, nNumberOfBytesToRead=0xc2a0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671c98*, lpNumberOfBytesRead=0x243d7e8*=0xc2a0, lpOverlapped=0x0) returned 1 [0072.998] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0072.998] WriteFile (in: hFile=0x230, lpBuffer=0x671c98*, nNumberOfBytesToWrite=0xc2a0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671c98*, lpNumberOfBytesWritten=0x243d7e4*=0xc2a0, lpOverlapped=0x0) returned 1 [0072.999] GetProcessHeap () returned 0x630000 [0072.999] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671c98 | out: hHeap=0x630000) returned 1 [0073.000] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0073.000] WriteFile (in: hFile=0x230, lpBuffer=0x671c60*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x671c60*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0073.001] CloseHandle (hObject=0x230) returned 1 [0073.002] GetProcessHeap () returned 0x630000 [0073.002] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0073.002] GetProcessHeap () returned 0x630000 [0073.002] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655aa8 | out: hHeap=0x630000) returned 1 [0073.002] GetProcessHeap () returned 0x630000 [0073.002] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0073.002] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\e TefxcC_M.ots" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\e TefxcC_M.ots") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\e TefxcC_M.ots" [0073.002] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\e TefxcC_M.ots", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\e TefxcC_M.ots.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\e TefxcC_M.ots.happythreechoose" [0073.002] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\e TefxcC_M.ots" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\mxxkf6\\sqrcaru_rhnscgd97t\\rh1twmv3muxqsfle\\e tefxcc_m.ots"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\e TefxcC_M.ots.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\mxxkf6\\sqrcaru_rhnscgd97t\\rh1twmv3muxqsfle\\e tefxcc_m.ots.happythreechoose"), dwFlags=0x1) returned 1 [0073.003] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\e TefxcC_M.ots" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE") returned 1 [0073.003] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\") returned="" [0073.003] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\Decryption INFO.html" [0073.003] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\mxxkf6\\sqrcaru_rhnscgd97t\\rh1twmv3muxqsfle\\decryption info.html")) returned 0x20 [0073.003] GetProcessHeap () returned 0x630000 [0073.003] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0073.003] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf72340, ftCreationTime.dwHighDateTime=0x1d5cc5a, ftLastAccessTime.dwLowDateTime=0x78dbbcd0, ftLastAccessTime.dwHighDateTime=0x1d5d5f8, ftLastWriteTime.dwLowDateTime=0x78dbbcd0, ftLastWriteTime.dwHighDateTime=0x1d5d5f8, nFileSizeHigh=0x0, nFileSizeLow=0xc7c6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="yxyVl.ppt", cAlternateFileName="")) returned 1 [0073.003] lstrcmpiW (lpString1="yxyVl.ppt", lpString2=".") returned 1 [0073.003] lstrcmpiW (lpString1="yxyVl.ppt", lpString2="..") returned 1 [0073.003] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\", lpString2="yxyVl.ppt" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\yxyVl.ppt") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\yxyVl.ppt" [0073.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="yxyVl.ppt", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0073.003] GetProcessHeap () returned 0x630000 [0073.003] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x64ca20 [0073.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="yxyVl.ppt", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yxyVl.ppt", lpUsedDefaultChar=0x0) returned 10 [0073.003] lstrlenA (lpString="yxyVl.ppt") returned 9 [0073.003] lstrlenA (lpString=".happythreechoose") returned 17 [0073.003] lstrcmpiW (lpString1="yxyVl.ppt", lpString2="Decryption INFO.html") returned 1 [0073.004] lstrcmpiW (lpString1="yxyVl.ppt", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0073.004] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0073.004] lstrcmpiW (lpString1="yxyVl.ppt", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0073.004] GetProcessHeap () returned 0x630000 [0073.004] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x652000 [0073.004] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\yxyVl.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\mxxkf6\\sqrcaru_rhnscgd97t\\rh1twmv3muxqsfle\\yxyvl.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0073.004] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=51142) returned 1 [0073.004] GetProcessHeap () returned 0x630000 [0073.004] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655418 [0073.004] GetProcessHeap () returned 0x630000 [0073.004] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0073.004] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\yxyVl.ppt") returned 85 [0073.004] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0073.004] GetProcessHeap () returned 0x630000 [0073.004] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0073.004] GetProcessHeap () returned 0x630000 [0073.004] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38a) returned 0x671c98 [0073.005] lstrlenA (lpString="rsa_encrypt") returned 11 [0073.005] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0073.006] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0073.006] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0073.006] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0073.006] GetProcessHeap () returned 0x630000 [0073.006] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0073.006] lstrlenA (lpString="010001") returned 6 [0073.006] GetProcessHeap () returned 0x630000 [0073.006] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0073.006] GetProcessHeap () returned 0x630000 [0073.006] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0073.006] GetProcessHeap () returned 0x630000 [0073.006] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0073.006] GetProcessHeap () returned 0x630000 [0073.006] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0073.006] GetProcessHeap () returned 0x630000 [0073.006] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e610 [0073.006] GetProcessHeap () returned 0x630000 [0073.006] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656950 [0073.006] GetProcessHeap () returned 0x630000 [0073.006] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0073.006] GetProcessHeap () returned 0x630000 [0073.006] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0073.006] GetProcessHeap () returned 0x630000 [0073.006] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.006] GetProcessHeap () returned 0x630000 [0073.006] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0073.007] GetProcessHeap () returned 0x630000 [0073.007] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0073.007] GetProcessHeap () returned 0x630000 [0073.007] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656b80 [0073.007] GetProcessHeap () returned 0x630000 [0073.007] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.007] GetProcessHeap () returned 0x630000 [0073.007] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0073.007] GetProcessHeap () returned 0x630000 [0073.007] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e730 [0073.007] GetProcessHeap () returned 0x630000 [0073.007] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0073.007] GetProcessHeap () returned 0x630000 [0073.007] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0073.007] GetProcessHeap () returned 0x630000 [0073.007] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0073.007] GetProcessHeap () returned 0x630000 [0073.007] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0073.007] GetProcessHeap () returned 0x630000 [0073.007] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65ce38 [0073.007] GetProcessHeap () returned 0x630000 [0073.007] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.007] GetProcessHeap () returned 0x630000 [0073.007] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0073.007] GetProcessHeap () returned 0x630000 [0073.007] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.007] GetProcessHeap () returned 0x630000 [0073.007] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.007] GetProcessHeap () returned 0x630000 [0073.007] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e2b0 [0073.007] GetProcessHeap () returned 0x630000 [0073.007] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ce38 | out: hHeap=0x630000) returned 1 [0073.007] GetProcessHeap () returned 0x630000 [0073.007] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0073.007] GetProcessHeap () returned 0x630000 [0073.007] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e2b0 | out: hHeap=0x630000) returned 1 [0073.007] GetProcessHeap () returned 0x630000 [0073.007] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0073.007] GetProcessHeap () returned 0x630000 [0073.008] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0073.008] GetProcessHeap () returned 0x630000 [0073.008] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0073.008] GetProcessHeap () returned 0x630000 [0073.008] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0073.008] GetProcessHeap () returned 0x630000 [0073.008] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.008] GetProcessHeap () returned 0x630000 [0073.008] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.008] GetProcessHeap () returned 0x630000 [0073.008] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.008] GetProcessHeap () returned 0x630000 [0073.008] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.008] GetProcessHeap () returned 0x630000 [0073.008] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.008] GetProcessHeap () returned 0x630000 [0073.008] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.008] GetProcessHeap () returned 0x630000 [0073.008] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0073.008] GetProcessHeap () returned 0x630000 [0073.008] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0073.008] GetProcessHeap () returned 0x630000 [0073.008] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0073.008] GetProcessHeap () returned 0x630000 [0073.008] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0073.008] GetProcessHeap () returned 0x630000 [0073.008] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.008] GetProcessHeap () returned 0x630000 [0073.008] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.008] GetProcessHeap () returned 0x630000 [0073.008] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.008] GetProcessHeap () returned 0x630000 [0073.008] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.008] GetProcessHeap () returned 0x630000 [0073.008] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.008] GetProcessHeap () returned 0x630000 [0073.008] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.008] GetProcessHeap () returned 0x630000 [0073.009] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0073.009] GetProcessHeap () returned 0x630000 [0073.009] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0073.009] GetProcessHeap () returned 0x630000 [0073.009] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.009] GetProcessHeap () returned 0x630000 [0073.009] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.009] GetProcessHeap () returned 0x630000 [0073.009] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.009] GetProcessHeap () returned 0x630000 [0073.009] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.009] GetProcessHeap () returned 0x630000 [0073.009] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0073.009] GetProcessHeap () returned 0x630000 [0073.009] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0073.009] GetProcessHeap () returned 0x630000 [0073.009] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0073.009] GetProcessHeap () returned 0x630000 [0073.009] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0073.009] GetProcessHeap () returned 0x630000 [0073.009] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.009] GetProcessHeap () returned 0x630000 [0073.009] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.009] GetProcessHeap () returned 0x630000 [0073.009] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.009] GetProcessHeap () returned 0x630000 [0073.009] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.009] GetProcessHeap () returned 0x630000 [0073.009] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.009] GetProcessHeap () returned 0x630000 [0073.009] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.009] GetProcessHeap () returned 0x630000 [0073.009] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.009] GetProcessHeap () returned 0x630000 [0073.009] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.009] GetProcessHeap () returned 0x630000 [0073.009] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.009] GetProcessHeap () returned 0x630000 [0073.009] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.010] GetProcessHeap () returned 0x630000 [0073.010] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.010] GetProcessHeap () returned 0x630000 [0073.010] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.010] GetProcessHeap () returned 0x630000 [0073.010] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.010] GetProcessHeap () returned 0x630000 [0073.010] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.010] GetProcessHeap () returned 0x630000 [0073.010] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.010] GetProcessHeap () returned 0x630000 [0073.010] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.010] GetProcessHeap () returned 0x630000 [0073.010] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0073.010] GetProcessHeap () returned 0x630000 [0073.010] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0073.010] GetProcessHeap () returned 0x630000 [0073.010] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.010] GetProcessHeap () returned 0x630000 [0073.010] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.010] GetProcessHeap () returned 0x630000 [0073.010] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.010] GetProcessHeap () returned 0x630000 [0073.010] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.010] GetProcessHeap () returned 0x630000 [0073.010] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.010] GetProcessHeap () returned 0x630000 [0073.010] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.010] GetProcessHeap () returned 0x630000 [0073.010] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.010] GetProcessHeap () returned 0x630000 [0073.010] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.010] GetProcessHeap () returned 0x630000 [0073.010] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.010] GetProcessHeap () returned 0x630000 [0073.010] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.010] GetProcessHeap () returned 0x630000 [0073.010] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.010] GetProcessHeap () returned 0x630000 [0073.010] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.011] GetProcessHeap () returned 0x630000 [0073.011] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.011] GetProcessHeap () returned 0x630000 [0073.011] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.011] GetProcessHeap () returned 0x630000 [0073.011] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0073.011] GetProcessHeap () returned 0x630000 [0073.011] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0073.011] GetProcessHeap () returned 0x630000 [0073.011] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.011] GetProcessHeap () returned 0x630000 [0073.011] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.011] GetProcessHeap () returned 0x630000 [0073.011] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.011] GetProcessHeap () returned 0x630000 [0073.011] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.011] GetProcessHeap () returned 0x630000 [0073.011] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.011] GetProcessHeap () returned 0x630000 [0073.011] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.011] GetProcessHeap () returned 0x630000 [0073.011] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.011] GetProcessHeap () returned 0x630000 [0073.011] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.011] GetProcessHeap () returned 0x630000 [0073.011] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.011] GetProcessHeap () returned 0x630000 [0073.011] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.011] GetProcessHeap () returned 0x630000 [0073.011] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0073.011] GetProcessHeap () returned 0x630000 [0073.011] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0073.011] GetProcessHeap () returned 0x630000 [0073.011] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0073.011] GetProcessHeap () returned 0x630000 [0073.011] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0073.011] GetProcessHeap () returned 0x630000 [0073.011] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.011] GetProcessHeap () returned 0x630000 [0073.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.012] GetProcessHeap () returned 0x630000 [0073.012] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.012] GetProcessHeap () returned 0x630000 [0073.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.012] GetProcessHeap () returned 0x630000 [0073.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0073.012] GetProcessHeap () returned 0x630000 [0073.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0073.012] GetProcessHeap () returned 0x630000 [0073.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0073.012] GetProcessHeap () returned 0x630000 [0073.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0073.012] GetProcessHeap () returned 0x630000 [0073.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0073.012] GetProcessHeap () returned 0x630000 [0073.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0073.012] GetProcessHeap () returned 0x630000 [0073.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0073.012] GetProcessHeap () returned 0x630000 [0073.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0073.012] GetProcessHeap () returned 0x630000 [0073.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0073.012] GetProcessHeap () returned 0x630000 [0073.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.012] GetProcessHeap () returned 0x630000 [0073.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0073.012] WriteFile (in: hFile=0x230, lpBuffer=0x671c98*, nNumberOfBytesToWrite=0x38a, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x671c98*, lpNumberOfBytesWritten=0x243d864*=0x38a, lpOverlapped=0x0) returned 1 [0073.017] GetProcessHeap () returned 0x630000 [0073.017] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671c98, Size=0x30) returned 0x671c98 [0073.017] GetProcessHeap () returned 0x630000 [0073.017] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0073.017] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0073.018] GetProcessHeap () returned 0x630000 [0073.018] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc7d0) returned 0x671cd0 [0073.018] ReadFile (in: hFile=0x230, lpBuffer=0x671cd0, nNumberOfBytesToRead=0xc7d0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671cd0*, lpNumberOfBytesRead=0x243d7e8*=0xc7d0, lpOverlapped=0x0) returned 1 [0073.019] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0073.019] WriteFile (in: hFile=0x230, lpBuffer=0x671cd0*, nNumberOfBytesToWrite=0xc7d0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671cd0*, lpNumberOfBytesWritten=0x243d7e4*=0xc7d0, lpOverlapped=0x0) returned 1 [0073.020] GetProcessHeap () returned 0x630000 [0073.020] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671cd0 | out: hHeap=0x630000) returned 1 [0073.020] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0073.020] WriteFile (in: hFile=0x230, lpBuffer=0x671c98*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x671c98*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0073.021] CloseHandle (hObject=0x230) returned 1 [0073.022] GetProcessHeap () returned 0x630000 [0073.022] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x652000 | out: hHeap=0x630000) returned 1 [0073.022] GetProcessHeap () returned 0x630000 [0073.022] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655418 | out: hHeap=0x630000) returned 1 [0073.022] GetProcessHeap () returned 0x630000 [0073.022] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0073.022] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\yxyVl.ppt" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\yxyVl.ppt") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\yxyVl.ppt" [0073.022] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\yxyVl.ppt", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\yxyVl.ppt.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\yxyVl.ppt.happythreechoose" [0073.022] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\yxyVl.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\mxxkf6\\sqrcaru_rhnscgd97t\\rh1twmv3muxqsfle\\yxyvl.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\yxyVl.ppt.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\mxxkf6\\sqrcaru_rhnscgd97t\\rh1twmv3muxqsfle\\yxyvl.ppt.happythreechoose"), dwFlags=0x1) returned 1 [0073.023] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\yxyVl.ppt" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE") returned 1 [0073.023] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\") returned="" [0073.023] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\Decryption INFO.html" [0073.023] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\MxXKF6\\SqrCaRu_rhnscGd97t\\Rh1TWMV3MUXQsFlE\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\mxxkf6\\sqrcaru_rhnscgd97t\\rh1twmv3muxqsfle\\decryption info.html")) returned 0x20 [0073.023] GetProcessHeap () returned 0x630000 [0073.023] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0073.023] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf72340, ftCreationTime.dwHighDateTime=0x1d5cc5a, ftLastAccessTime.dwLowDateTime=0x78dbbcd0, ftLastAccessTime.dwHighDateTime=0x1d5d5f8, ftLastWriteTime.dwLowDateTime=0x78dbbcd0, ftLastWriteTime.dwHighDateTime=0x1d5d5f8, nFileSizeHigh=0x0, nFileSizeLow=0xc7c6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="yxyVl.ppt", cAlternateFileName="")) returned 0 [0073.023] FindClose (in: hFindFile=0x648b10 | out: hFindFile=0x648b10) returned 1 [0073.023] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\" [0073.023] GetProcessHeap () returned 0x630000 [0073.023] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0073.023] GetProcessHeap () returned 0x630000 [0073.023] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.023] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\") returned 44 [0073.023] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\*") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\*" [0073.023] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab033f10, ftCreationTime.dwHighDateTime=0x1d5c9e8, ftLastAccessTime.dwLowDateTime=0x583fa8a0, ftLastAccessTime.dwHighDateTime=0x1d5cc4e, ftLastWriteTime.dwLowDateTime=0x583fa8a0, ftLastWriteTime.dwHighDateTime=0x1d5cc4e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648810 [0073.023] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0073.023] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab033f10, ftCreationTime.dwHighDateTime=0x1d5c9e8, ftLastAccessTime.dwLowDateTime=0x583fa8a0, ftLastAccessTime.dwHighDateTime=0x1d5cc4e, ftLastWriteTime.dwLowDateTime=0x583fa8a0, ftLastWriteTime.dwHighDateTime=0x1d5cc4e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.023] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0073.023] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0073.024] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x280c39c0, ftCreationTime.dwHighDateTime=0x1d5cc1f, ftLastAccessTime.dwLowDateTime=0x91025c90, ftLastAccessTime.dwHighDateTime=0x1d5ce34, ftLastWriteTime.dwLowDateTime=0x91025c90, ftLastWriteTime.dwHighDateTime=0x1d5ce34, nFileSizeHigh=0x0, nFileSizeLow=0xba5b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Dent9cAt3lCAps.odp", cAlternateFileName="DENT9C~1.ODP")) returned 1 [0073.024] lstrcmpiW (lpString1="Dent9cAt3lCAps.odp", lpString2=".") returned 1 [0073.024] lstrcmpiW (lpString1="Dent9cAt3lCAps.odp", lpString2="..") returned 1 [0073.024] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\", lpString2="Dent9cAt3lCAps.odp" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\Dent9cAt3lCAps.odp") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\Dent9cAt3lCAps.odp" [0073.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Dent9cAt3lCAps.odp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0073.024] GetProcessHeap () returned 0x630000 [0073.024] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x13) returned 0x645c58 [0073.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Dent9cAt3lCAps.odp", cchWideChar=-1, lpMultiByteStr=0x645c58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dent9cAt3lCAps.odp", lpUsedDefaultChar=0x0) returned 19 [0073.024] lstrlenA (lpString="Dent9cAt3lCAps.odp") returned 18 [0073.024] lstrlenA (lpString=".happythreechoose") returned 17 [0073.024] lstrlenA (lpString=".happythreechoose") returned 17 [0073.024] lstrlenA (lpString="Dent9cAt3lCAps.odp") returned 18 [0073.024] lstrcmpiA (lpString1="ent9cAt3lCAps.odp", lpString2=".happythreechoose") returned 1 [0073.024] lstrcmpiW (lpString1="Dent9cAt3lCAps.odp", lpString2="Decryption INFO.html") returned 1 [0073.024] lstrcmpiW (lpString1="Dent9cAt3lCAps.odp", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0073.024] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0073.024] lstrcmpiW (lpString1="Dent9cAt3lCAps.odp", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0073.024] GetProcessHeap () returned 0x630000 [0073.024] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0073.024] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\Dent9cAt3lCAps.odp" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\dent9cat3lcaps.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0073.024] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=47707) returned 1 [0073.024] GetProcessHeap () returned 0x630000 [0073.024] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655670 [0073.024] GetProcessHeap () returned 0x630000 [0073.024] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0073.024] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\Dent9cAt3lCAps.odp") returned 62 [0073.024] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0073.024] GetProcessHeap () returned 0x630000 [0073.025] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0073.025] GetProcessHeap () returned 0x630000 [0073.025] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x671cd0 [0073.025] lstrlenA (lpString="rsa_encrypt") returned 11 [0073.025] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0073.025] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0073.025] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0073.025] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0073.025] GetProcessHeap () returned 0x630000 [0073.025] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0073.025] lstrlenA (lpString="010001") returned 6 [0073.025] GetProcessHeap () returned 0x630000 [0073.025] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a298 [0073.025] GetProcessHeap () returned 0x630000 [0073.025] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0073.025] GetProcessHeap () returned 0x630000 [0073.026] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e2b0 [0073.026] GetProcessHeap () returned 0x630000 [0073.026] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0073.026] GetProcessHeap () returned 0x630000 [0073.026] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e8e0 [0073.026] GetProcessHeap () returned 0x630000 [0073.026] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657210 [0073.026] GetProcessHeap () returned 0x630000 [0073.026] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0073.026] GetProcessHeap () returned 0x630000 [0073.026] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0073.026] GetProcessHeap () returned 0x630000 [0073.026] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.026] GetProcessHeap () returned 0x630000 [0073.026] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0073.026] GetProcessHeap () returned 0x630000 [0073.026] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0073.026] GetProcessHeap () returned 0x630000 [0073.026] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x6570f8 [0073.026] GetProcessHeap () returned 0x630000 [0073.026] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.026] GetProcessHeap () returned 0x630000 [0073.026] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0073.026] GetProcessHeap () returned 0x630000 [0073.026] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dec0 [0073.026] GetProcessHeap () returned 0x630000 [0073.026] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0073.026] GetProcessHeap () returned 0x630000 [0073.026] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0073.026] GetProcessHeap () returned 0x630000 [0073.026] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0073.026] GetProcessHeap () returned 0x630000 [0073.026] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0073.026] GetProcessHeap () returned 0x630000 [0073.026] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0073.026] GetProcessHeap () returned 0x630000 [0073.026] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.026] GetProcessHeap () returned 0x630000 [0073.026] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0073.026] GetProcessHeap () returned 0x630000 [0073.027] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.027] GetProcessHeap () returned 0x630000 [0073.027] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.027] GetProcessHeap () returned 0x630000 [0073.027] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e970 [0073.027] GetProcessHeap () returned 0x630000 [0073.027] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0073.027] GetProcessHeap () returned 0x630000 [0073.027] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0073.027] GetProcessHeap () returned 0x630000 [0073.027] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0073.027] GetProcessHeap () returned 0x630000 [0073.027] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.027] GetProcessHeap () returned 0x630000 [0073.027] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.027] GetProcessHeap () returned 0x630000 [0073.027] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0073.027] GetProcessHeap () returned 0x630000 [0073.027] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0073.027] GetProcessHeap () returned 0x630000 [0073.027] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.027] GetProcessHeap () returned 0x630000 [0073.027] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.027] GetProcessHeap () returned 0x630000 [0073.027] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.027] GetProcessHeap () returned 0x630000 [0073.027] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.027] GetProcessHeap () returned 0x630000 [0073.027] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.027] GetProcessHeap () returned 0x630000 [0073.027] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.027] GetProcessHeap () returned 0x630000 [0073.027] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.027] GetProcessHeap () returned 0x630000 [0073.027] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.027] GetProcessHeap () returned 0x630000 [0073.027] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.027] GetProcessHeap () returned 0x630000 [0073.027] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.027] GetProcessHeap () returned 0x630000 [0073.028] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.028] GetProcessHeap () returned 0x630000 [0073.028] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.028] GetProcessHeap () returned 0x630000 [0073.028] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.028] GetProcessHeap () returned 0x630000 [0073.028] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.028] GetProcessHeap () returned 0x630000 [0073.028] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.028] GetProcessHeap () returned 0x630000 [0073.028] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.028] GetProcessHeap () returned 0x630000 [0073.028] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0073.028] GetProcessHeap () returned 0x630000 [0073.028] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0073.028] GetProcessHeap () returned 0x630000 [0073.028] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.028] GetProcessHeap () returned 0x630000 [0073.028] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.028] GetProcessHeap () returned 0x630000 [0073.028] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.028] GetProcessHeap () returned 0x630000 [0073.028] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.028] GetProcessHeap () returned 0x630000 [0073.028] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.028] GetProcessHeap () returned 0x630000 [0073.028] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.028] GetProcessHeap () returned 0x630000 [0073.028] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.028] GetProcessHeap () returned 0x630000 [0073.028] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.028] GetProcessHeap () returned 0x630000 [0073.028] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0073.028] GetProcessHeap () returned 0x630000 [0073.028] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0073.028] GetProcessHeap () returned 0x630000 [0073.028] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.028] GetProcessHeap () returned 0x630000 [0073.028] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.029] GetProcessHeap () returned 0x630000 [0073.029] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0073.029] GetProcessHeap () returned 0x630000 [0073.029] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0073.029] GetProcessHeap () returned 0x630000 [0073.029] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.029] GetProcessHeap () returned 0x630000 [0073.029] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.029] GetProcessHeap () returned 0x630000 [0073.029] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.029] GetProcessHeap () returned 0x630000 [0073.029] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.029] GetProcessHeap () returned 0x630000 [0073.029] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.029] GetProcessHeap () returned 0x630000 [0073.029] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.029] GetProcessHeap () returned 0x630000 [0073.029] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.029] GetProcessHeap () returned 0x630000 [0073.029] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.029] GetProcessHeap () returned 0x630000 [0073.029] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.029] GetProcessHeap () returned 0x630000 [0073.029] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.029] GetProcessHeap () returned 0x630000 [0073.029] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0073.029] GetProcessHeap () returned 0x630000 [0073.029] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0073.029] GetProcessHeap () returned 0x630000 [0073.029] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.029] GetProcessHeap () returned 0x630000 [0073.029] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.029] GetProcessHeap () returned 0x630000 [0073.029] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.029] GetProcessHeap () returned 0x630000 [0073.029] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.029] GetProcessHeap () returned 0x630000 [0073.029] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0073.030] GetProcessHeap () returned 0x630000 [0073.030] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0073.030] GetProcessHeap () returned 0x630000 [0073.030] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0073.030] GetProcessHeap () returned 0x630000 [0073.030] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0073.030] GetProcessHeap () returned 0x630000 [0073.030] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0073.030] GetProcessHeap () returned 0x630000 [0073.030] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0073.030] GetProcessHeap () returned 0x630000 [0073.030] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.033] GetProcessHeap () returned 0x630000 [0073.033] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.033] GetProcessHeap () returned 0x630000 [0073.033] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.033] GetProcessHeap () returned 0x630000 [0073.033] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.033] GetProcessHeap () returned 0x630000 [0073.033] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.033] GetProcessHeap () returned 0x630000 [0073.033] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.033] GetProcessHeap () returned 0x630000 [0073.033] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.033] GetProcessHeap () returned 0x630000 [0073.033] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.033] GetProcessHeap () returned 0x630000 [0073.033] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.033] GetProcessHeap () returned 0x630000 [0073.033] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.033] GetProcessHeap () returned 0x630000 [0073.033] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0073.034] GetProcessHeap () returned 0x630000 [0073.034] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0073.034] GetProcessHeap () returned 0x630000 [0073.034] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.034] GetProcessHeap () returned 0x630000 [0073.034] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.034] GetProcessHeap () returned 0x630000 [0073.034] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.034] GetProcessHeap () returned 0x630000 [0073.034] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.034] GetProcessHeap () returned 0x630000 [0073.034] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0073.034] GetProcessHeap () returned 0x630000 [0073.034] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0073.034] GetProcessHeap () returned 0x630000 [0073.034] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.034] GetProcessHeap () returned 0x630000 [0073.034] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.034] GetProcessHeap () returned 0x630000 [0073.034] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.034] GetProcessHeap () returned 0x630000 [0073.034] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.034] GetProcessHeap () returned 0x630000 [0073.034] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0073.034] GetProcessHeap () returned 0x630000 [0073.034] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0073.034] GetProcessHeap () returned 0x630000 [0073.034] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0073.034] GetProcessHeap () returned 0x630000 [0073.034] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0073.034] GetProcessHeap () returned 0x630000 [0073.034] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0073.034] GetProcessHeap () returned 0x630000 [0073.034] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0073.034] GetProcessHeap () returned 0x630000 [0073.034] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0073.035] GetProcessHeap () returned 0x630000 [0073.035] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0073.035] GetProcessHeap () returned 0x630000 [0073.035] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0073.035] GetProcessHeap () returned 0x630000 [0073.035] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e2b0 | out: hHeap=0x630000) returned 1 [0073.035] GetProcessHeap () returned 0x630000 [0073.035] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0073.035] GetProcessHeap () returned 0x630000 [0073.035] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0073.035] GetProcessHeap () returned 0x630000 [0073.035] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0073.035] WriteFile (in: hFile=0x230, lpBuffer=0x671cd0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x671cd0*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0073.037] GetProcessHeap () returned 0x630000 [0073.037] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671cd0, Size=0x30) returned 0x671cd0 [0073.037] GetProcessHeap () returned 0x630000 [0073.037] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0073.037] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0073.037] GetProcessHeap () returned 0x630000 [0073.037] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xba5b) returned 0x671d08 [0073.037] ReadFile (in: hFile=0x230, lpBuffer=0x671d08, nNumberOfBytesToRead=0xba5b, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671d08*, lpNumberOfBytesRead=0x243d7e8*=0xba5b, lpOverlapped=0x0) returned 1 [0073.037] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0073.038] WriteFile (in: hFile=0x230, lpBuffer=0x671d08*, nNumberOfBytesToWrite=0xba5b, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671d08*, lpNumberOfBytesWritten=0x243d7e4*=0xba5b, lpOverlapped=0x0) returned 1 [0073.039] GetProcessHeap () returned 0x630000 [0073.039] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671d08 | out: hHeap=0x630000) returned 1 [0073.039] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0073.039] WriteFile (in: hFile=0x230, lpBuffer=0x671cd0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x671cd0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0073.040] CloseHandle (hObject=0x230) returned 1 [0073.040] GetProcessHeap () returned 0x630000 [0073.040] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0073.040] GetProcessHeap () returned 0x630000 [0073.040] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655670 | out: hHeap=0x630000) returned 1 [0073.040] GetProcessHeap () returned 0x630000 [0073.040] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0073.041] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\Dent9cAt3lCAps.odp" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\Dent9cAt3lCAps.odp") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\Dent9cAt3lCAps.odp" [0073.041] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\Dent9cAt3lCAps.odp", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\Dent9cAt3lCAps.odp.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\Dent9cAt3lCAps.odp.happythreechoose" [0073.041] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\Dent9cAt3lCAps.odp" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\dent9cat3lcaps.odp"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\Dent9cAt3lCAps.odp.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\dent9cat3lcaps.odp.happythreechoose"), dwFlags=0x1) returned 1 [0073.041] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\Dent9cAt3lCAps.odp" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P") returned 1 [0073.041] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\") returned="" [0073.041] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\Decryption INFO.html" [0073.041] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\decryption info.html")) returned 0xffffffff [0073.041] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0073.042] GetProcessHeap () returned 0x630000 [0073.042] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6555f8 [0073.042] GetProcessHeap () returned 0x630000 [0073.042] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0073.049] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.059] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.059] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.059] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.059] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.059] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.059] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.059] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.059] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.059] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.059] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.060] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.060] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.063] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.063] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.063] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.063] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.063] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.064] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.064] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.064] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.064] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.064] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.064] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.064] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.064] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.064] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.064] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.064] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.064] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.064] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.065] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.065] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.065] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.065] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.065] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.065] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.067] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.067] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.067] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.067] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.067] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.067] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.067] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.067] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.067] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.067] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.067] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.067] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.068] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.068] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.068] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.068] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.068] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.068] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.068] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.068] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.068] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.068] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.068] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.068] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.068] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.068] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.069] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.069] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.069] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.069] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.069] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.069] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.069] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.069] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.069] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.069] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.069] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.069] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.069] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.070] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.070] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.070] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.070] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.070] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.070] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.070] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.070] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.070] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.070] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.070] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.070] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.070] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.071] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.071] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.071] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.071] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.071] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.071] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.071] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.071] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.071] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.071] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.071] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.071] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.071] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.071] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.072] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.072] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.072] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.072] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.072] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.072] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.072] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.072] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.072] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.072] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.072] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.072] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.073] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.073] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.073] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.073] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.073] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.073] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.073] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.073] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.073] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.073] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.073] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.073] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.073] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.073] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.074] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.074] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.074] GetProcessHeap () returned 0x630000 [0073.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6555f8 | out: hHeap=0x630000) returned 1 [0073.074] GetProcessHeap () returned 0x630000 [0073.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0073.074] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0073.074] GetProcessHeap () returned 0x630000 [0073.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655aa8 [0073.074] GetProcessHeap () returned 0x630000 [0073.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0073.081] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.081] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.081] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.082] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.082] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.082] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.082] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.082] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.082] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.082] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.082] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.082] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.082] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.082] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.082] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.082] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.082] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.083] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.083] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.083] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.083] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.083] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.083] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.083] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.083] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.083] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.083] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.083] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.083] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.083] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.084] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.084] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.084] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.084] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.084] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.084] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.084] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.084] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.084] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.084] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.084] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.084] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.084] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.084] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.085] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.085] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.085] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.085] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.085] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.085] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.085] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.085] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.085] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.085] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.085] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.085] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.085] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.085] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.086] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.086] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.086] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.086] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.086] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.086] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.086] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.086] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.086] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.086] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.086] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.086] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.086] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.087] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.087] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.087] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.087] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.087] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.087] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.087] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.087] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.087] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.087] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.087] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.087] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.088] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.088] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.088] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.088] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.088] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.088] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.088] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.088] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.088] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.088] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.088] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.088] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.088] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.089] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.089] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.089] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.089] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.089] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.089] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.089] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.089] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.089] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.089] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.089] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.089] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.089] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.090] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.090] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.090] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.090] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.090] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.090] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.090] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.090] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.090] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.091] GetProcessHeap () returned 0x630000 [0073.410] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655aa8 | out: hHeap=0x630000) returned 1 [0073.410] GetProcessHeap () returned 0x630000 [0073.410] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0073.410] CloseHandle (hObject=0x230) returned 1 [0073.410] GetProcessHeap () returned 0x630000 [0073.411] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645c58 | out: hHeap=0x630000) returned 1 [0073.411] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6891400, ftCreationTime.dwHighDateTime=0x1d5cb8e, ftLastAccessTime.dwLowDateTime=0x5070f160, ftLastAccessTime.dwHighDateTime=0x1d5d2cf, ftLastWriteTime.dwLowDateTime=0x5070f160, ftLastWriteTime.dwHighDateTime=0x1d5d2cf, nFileSizeHigh=0x0, nFileSizeLow=0x151a6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="fdZzH_GLXvKC7pRH.xls", cAlternateFileName="FDZZH_~1.XLS")) returned 1 [0073.411] lstrcmpiW (lpString1="fdZzH_GLXvKC7pRH.xls", lpString2=".") returned 1 [0073.411] lstrcmpiW (lpString1="fdZzH_GLXvKC7pRH.xls", lpString2="..") returned 1 [0073.411] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\", lpString2="fdZzH_GLXvKC7pRH.xls" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\fdZzH_GLXvKC7pRH.xls") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\fdZzH_GLXvKC7pRH.xls" [0073.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdZzH_GLXvKC7pRH.xls", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0073.411] GetProcessHeap () returned 0x630000 [0073.411] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x15) returned 0x645d98 [0073.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fdZzH_GLXvKC7pRH.xls", cchWideChar=-1, lpMultiByteStr=0x645d98, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fdZzH_GLXvKC7pRH.xls", lpUsedDefaultChar=0x0) returned 21 [0073.411] lstrlenA (lpString="fdZzH_GLXvKC7pRH.xls") returned 20 [0073.411] lstrlenA (lpString=".happythreechoose") returned 17 [0073.411] lstrlenA (lpString=".happythreechoose") returned 17 [0073.411] lstrlenA (lpString="fdZzH_GLXvKC7pRH.xls") returned 20 [0073.411] lstrcmpiA (lpString1="zH_GLXvKC7pRH.xls", lpString2=".happythreechoose") returned 1 [0073.411] lstrcmpiW (lpString1="fdZzH_GLXvKC7pRH.xls", lpString2="Decryption INFO.html") returned 1 [0073.411] lstrcmpiW (lpString1="fdZzH_GLXvKC7pRH.xls", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0073.411] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0073.411] lstrcmpiW (lpString1="fdZzH_GLXvKC7pRH.xls", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0073.411] GetProcessHeap () returned 0x630000 [0073.411] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0073.411] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\fdZzH_GLXvKC7pRH.xls" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\fdzzh_glxvkc7prh.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0073.411] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=86438) returned 1 [0073.411] GetProcessHeap () returned 0x630000 [0073.412] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655aa8 [0073.412] GetProcessHeap () returned 0x630000 [0073.412] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0073.412] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\fdZzH_GLXvKC7pRH.xls") returned 64 [0073.412] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0073.412] GetProcessHeap () returned 0x630000 [0073.412] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0073.412] GetProcessHeap () returned 0x630000 [0073.412] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38a) returned 0x671d08 [0073.412] lstrlenA (lpString="rsa_encrypt") returned 11 [0073.412] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0073.412] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0073.412] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0073.412] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0073.412] GetProcessHeap () returned 0x630000 [0073.412] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0073.412] lstrlenA (lpString="010001") returned 6 [0073.412] GetProcessHeap () returned 0x630000 [0073.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0073.413] GetProcessHeap () returned 0x630000 [0073.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0073.413] GetProcessHeap () returned 0x630000 [0073.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ebb0 [0073.413] GetProcessHeap () returned 0x630000 [0073.413] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0073.413] GetProcessHeap () returned 0x630000 [0073.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0073.413] GetProcessHeap () returned 0x630000 [0073.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657328 [0073.413] GetProcessHeap () returned 0x630000 [0073.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a348 [0073.413] GetProcessHeap () returned 0x630000 [0073.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0073.413] GetProcessHeap () returned 0x630000 [0073.413] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.413] GetProcessHeap () returned 0x630000 [0073.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0073.413] GetProcessHeap () returned 0x630000 [0073.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0073.413] GetProcessHeap () returned 0x630000 [0073.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656a68 [0073.413] GetProcessHeap () returned 0x630000 [0073.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0073.413] GetProcessHeap () returned 0x630000 [0073.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0073.413] GetProcessHeap () returned 0x630000 [0073.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e2b0 [0073.413] GetProcessHeap () returned 0x630000 [0073.413] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0073.413] GetProcessHeap () returned 0x630000 [0073.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0073.413] GetProcessHeap () returned 0x630000 [0073.413] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e2b0 | out: hHeap=0x630000) returned 1 [0073.413] GetProcessHeap () returned 0x630000 [0073.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.413] GetProcessHeap () returned 0x630000 [0073.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0073.413] GetProcessHeap () returned 0x630000 [0073.414] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0073.414] GetProcessHeap () returned 0x630000 [0073.414] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.414] GetProcessHeap () returned 0x630000 [0073.414] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.414] GetProcessHeap () returned 0x630000 [0073.414] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.414] GetProcessHeap () returned 0x630000 [0073.414] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e970 [0073.414] GetProcessHeap () returned 0x630000 [0073.414] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0073.414] GetProcessHeap () returned 0x630000 [0073.414] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0073.414] GetProcessHeap () returned 0x630000 [0073.414] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0073.414] GetProcessHeap () returned 0x630000 [0073.414] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.414] GetProcessHeap () returned 0x630000 [0073.414] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.414] GetProcessHeap () returned 0x630000 [0073.414] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.414] GetProcessHeap () returned 0x630000 [0073.414] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.414] GetProcessHeap () returned 0x630000 [0073.414] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.414] GetProcessHeap () returned 0x630000 [0073.414] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.414] GetProcessHeap () returned 0x630000 [0073.414] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0073.414] GetProcessHeap () returned 0x630000 [0073.414] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0073.414] GetProcessHeap () returned 0x630000 [0073.414] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.414] GetProcessHeap () returned 0x630000 [0073.414] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.414] GetProcessHeap () returned 0x630000 [0073.414] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.414] GetProcessHeap () returned 0x630000 [0073.414] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.414] GetProcessHeap () returned 0x630000 [0073.415] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.415] GetProcessHeap () returned 0x630000 [0073.415] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.415] GetProcessHeap () returned 0x630000 [0073.415] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0073.415] GetProcessHeap () returned 0x630000 [0073.415] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0073.415] GetProcessHeap () returned 0x630000 [0073.415] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0073.415] GetProcessHeap () returned 0x630000 [0073.415] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0073.415] GetProcessHeap () returned 0x630000 [0073.415] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.415] GetProcessHeap () returned 0x630000 [0073.415] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.415] GetProcessHeap () returned 0x630000 [0073.415] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.415] GetProcessHeap () returned 0x630000 [0073.415] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.415] GetProcessHeap () returned 0x630000 [0073.415] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.415] GetProcessHeap () returned 0x630000 [0073.415] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.415] GetProcessHeap () returned 0x630000 [0073.415] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0073.415] GetProcessHeap () returned 0x630000 [0073.415] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0073.415] GetProcessHeap () returned 0x630000 [0073.415] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.415] GetProcessHeap () returned 0x630000 [0073.415] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.415] GetProcessHeap () returned 0x630000 [0073.415] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.415] GetProcessHeap () returned 0x630000 [0073.415] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.415] GetProcessHeap () returned 0x630000 [0073.415] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.415] GetProcessHeap () returned 0x630000 [0073.415] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.416] GetProcessHeap () returned 0x630000 [0073.416] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.416] GetProcessHeap () returned 0x630000 [0073.416] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.416] GetProcessHeap () returned 0x630000 [0073.416] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0073.416] GetProcessHeap () returned 0x630000 [0073.416] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0073.416] GetProcessHeap () returned 0x630000 [0073.416] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.416] GetProcessHeap () returned 0x630000 [0073.416] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.416] GetProcessHeap () returned 0x630000 [0073.416] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.416] GetProcessHeap () returned 0x630000 [0073.416] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.416] GetProcessHeap () returned 0x630000 [0073.416] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.416] GetProcessHeap () returned 0x630000 [0073.416] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.416] GetProcessHeap () returned 0x630000 [0073.416] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.416] GetProcessHeap () returned 0x630000 [0073.416] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.416] GetProcessHeap () returned 0x630000 [0073.416] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0073.416] GetProcessHeap () returned 0x630000 [0073.416] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0073.416] GetProcessHeap () returned 0x630000 [0073.416] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.416] GetProcessHeap () returned 0x630000 [0073.416] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.416] GetProcessHeap () returned 0x630000 [0073.416] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.416] GetProcessHeap () returned 0x630000 [0073.416] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.416] GetProcessHeap () returned 0x630000 [0073.416] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0073.416] GetProcessHeap () returned 0x630000 [0073.416] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0073.416] GetProcessHeap () returned 0x630000 [0073.417] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.417] GetProcessHeap () returned 0x630000 [0073.417] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.417] GetProcessHeap () returned 0x630000 [0073.417] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.417] GetProcessHeap () returned 0x630000 [0073.417] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.417] GetProcessHeap () returned 0x630000 [0073.417] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.417] GetProcessHeap () returned 0x630000 [0073.417] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.417] GetProcessHeap () returned 0x630000 [0073.417] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.417] GetProcessHeap () returned 0x630000 [0073.417] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.417] GetProcessHeap () returned 0x630000 [0073.417] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0073.417] GetProcessHeap () returned 0x630000 [0073.417] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0073.417] GetProcessHeap () returned 0x630000 [0073.417] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.417] GetProcessHeap () returned 0x630000 [0073.417] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.417] GetProcessHeap () returned 0x630000 [0073.417] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.417] GetProcessHeap () returned 0x630000 [0073.417] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.417] GetProcessHeap () returned 0x630000 [0073.417] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.417] GetProcessHeap () returned 0x630000 [0073.417] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.417] GetProcessHeap () returned 0x630000 [0073.417] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0073.417] GetProcessHeap () returned 0x630000 [0073.417] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0073.417] GetProcessHeap () returned 0x630000 [0073.417] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.417] GetProcessHeap () returned 0x630000 [0073.417] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.417] GetProcessHeap () returned 0x630000 [0073.417] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0073.417] GetProcessHeap () returned 0x630000 [0073.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0073.418] GetProcessHeap () returned 0x630000 [0073.418] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.418] GetProcessHeap () returned 0x630000 [0073.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.418] GetProcessHeap () returned 0x630000 [0073.418] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.418] GetProcessHeap () returned 0x630000 [0073.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.418] GetProcessHeap () returned 0x630000 [0073.418] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.418] GetProcessHeap () returned 0x630000 [0073.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.418] GetProcessHeap () returned 0x630000 [0073.418] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.418] GetProcessHeap () returned 0x630000 [0073.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.418] GetProcessHeap () returned 0x630000 [0073.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0073.418] GetProcessHeap () returned 0x630000 [0073.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0073.418] GetProcessHeap () returned 0x630000 [0073.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0073.418] GetProcessHeap () returned 0x630000 [0073.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0073.418] GetProcessHeap () returned 0x630000 [0073.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0073.418] GetProcessHeap () returned 0x630000 [0073.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0073.418] GetProcessHeap () returned 0x630000 [0073.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0073.418] GetProcessHeap () returned 0x630000 [0073.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0073.418] GetProcessHeap () returned 0x630000 [0073.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0073.418] GetProcessHeap () returned 0x630000 [0073.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.418] GetProcessHeap () returned 0x630000 [0073.419] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0073.419] WriteFile (in: hFile=0x230, lpBuffer=0x671d08*, nNumberOfBytesToWrite=0x38a, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x671d08*, lpNumberOfBytesWritten=0x243d864*=0x38a, lpOverlapped=0x0) returned 1 [0073.661] GetProcessHeap () returned 0x630000 [0073.661] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671d08, Size=0x30) returned 0x671d08 [0073.661] GetProcessHeap () returned 0x630000 [0073.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0073.661] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0073.661] GetProcessHeap () returned 0x630000 [0073.661] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x151b0) returned 0x671d40 [0073.662] ReadFile (in: hFile=0x230, lpBuffer=0x671d40, nNumberOfBytesToRead=0x151b0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671d40*, lpNumberOfBytesRead=0x243d7e8*=0x151b0, lpOverlapped=0x0) returned 1 [0073.663] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0073.663] WriteFile (in: hFile=0x230, lpBuffer=0x671d40*, nNumberOfBytesToWrite=0x151b0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671d40*, lpNumberOfBytesWritten=0x243d7e4*=0x151b0, lpOverlapped=0x0) returned 1 [0073.664] GetProcessHeap () returned 0x630000 [0073.664] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671d40 | out: hHeap=0x630000) returned 1 [0073.666] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0073.666] WriteFile (in: hFile=0x230, lpBuffer=0x671d08*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x671d08*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0073.667] CloseHandle (hObject=0x230) returned 1 [0073.667] GetProcessHeap () returned 0x630000 [0073.667] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0073.667] GetProcessHeap () returned 0x630000 [0073.667] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655aa8 | out: hHeap=0x630000) returned 1 [0073.667] GetProcessHeap () returned 0x630000 [0073.667] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0073.667] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\fdZzH_GLXvKC7pRH.xls" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\fdZzH_GLXvKC7pRH.xls") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\fdZzH_GLXvKC7pRH.xls" [0073.667] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\fdZzH_GLXvKC7pRH.xls", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\fdZzH_GLXvKC7pRH.xls.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\fdZzH_GLXvKC7pRH.xls.happythreechoose" [0073.667] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\fdZzH_GLXvKC7pRH.xls" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\fdzzh_glxvkc7prh.xls"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\fdZzH_GLXvKC7pRH.xls.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\fdzzh_glxvkc7prh.xls.happythreechoose"), dwFlags=0x1) returned 1 [0073.668] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\fdZzH_GLXvKC7pRH.xls" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P") returned 1 [0073.668] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\") returned="" [0073.668] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\Decryption INFO.html" [0073.668] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\decryption info.html")) returned 0x20 [0073.668] GetProcessHeap () returned 0x630000 [0073.668] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645d98 | out: hHeap=0x630000) returned 1 [0073.668] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93884d60, ftCreationTime.dwHighDateTime=0x1d5cfa3, ftLastAccessTime.dwLowDateTime=0xc75279b0, ftLastAccessTime.dwHighDateTime=0x1d5d316, ftLastWriteTime.dwLowDateTime=0xc75279b0, ftLastWriteTime.dwHighDateTime=0x1d5d316, nFileSizeHigh=0x0, nFileSizeLow=0x1828a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FpYz8x_D.ots", cAlternateFileName="")) returned 1 [0073.668] lstrcmpiW (lpString1="FpYz8x_D.ots", lpString2=".") returned 1 [0073.668] lstrcmpiW (lpString1="FpYz8x_D.ots", lpString2="..") returned 1 [0073.668] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\", lpString2="FpYz8x_D.ots" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\FpYz8x_D.ots") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\FpYz8x_D.ots" [0073.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FpYz8x_D.ots", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0073.668] GetProcessHeap () returned 0x630000 [0073.668] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd) returned 0x64c9f0 [0073.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FpYz8x_D.ots", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FpYz8x_D.ots", lpUsedDefaultChar=0x0) returned 13 [0073.668] lstrlenA (lpString="FpYz8x_D.ots") returned 12 [0073.668] lstrlenA (lpString=".happythreechoose") returned 17 [0073.668] lstrcmpiW (lpString1="FpYz8x_D.ots", lpString2="Decryption INFO.html") returned 1 [0073.669] lstrcmpiW (lpString1="FpYz8x_D.ots", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0073.669] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0073.669] lstrcmpiW (lpString1="FpYz8x_D.ots", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0073.669] GetProcessHeap () returned 0x630000 [0073.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0073.669] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\FpYz8x_D.ots" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\fpyz8x_d.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0073.669] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=98954) returned 1 [0073.669] GetProcessHeap () returned 0x630000 [0073.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655850 [0073.669] GetProcessHeap () returned 0x630000 [0073.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0073.669] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\FpYz8x_D.ots") returned 56 [0073.669] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0073.669] GetProcessHeap () returned 0x630000 [0073.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0073.669] GetProcessHeap () returned 0x630000 [0073.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x386) returned 0x671d40 [0073.671] lstrlenA (lpString="rsa_encrypt") returned 11 [0073.671] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0073.671] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0073.671] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0073.671] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0073.671] GetProcessHeap () returned 0x630000 [0073.671] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0073.671] lstrlenA (lpString="010001") returned 6 [0073.671] GetProcessHeap () returned 0x630000 [0073.671] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a298 [0073.671] GetProcessHeap () returned 0x630000 [0073.671] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0073.671] GetProcessHeap () returned 0x630000 [0073.671] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0073.671] GetProcessHeap () returned 0x630000 [0073.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0073.672] GetProcessHeap () returned 0x630000 [0073.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e8e0 [0073.672] GetProcessHeap () returned 0x630000 [0073.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656ec8 [0073.672] GetProcessHeap () returned 0x630000 [0073.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0073.672] GetProcessHeap () returned 0x630000 [0073.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0073.672] GetProcessHeap () returned 0x630000 [0073.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.672] GetProcessHeap () returned 0x630000 [0073.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0073.672] GetProcessHeap () returned 0x630000 [0073.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0073.672] GetProcessHeap () returned 0x630000 [0073.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656fe0 [0073.672] GetProcessHeap () returned 0x630000 [0073.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.672] GetProcessHeap () returned 0x630000 [0073.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0073.672] GetProcessHeap () returned 0x630000 [0073.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ebb0 [0073.672] GetProcessHeap () returned 0x630000 [0073.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0073.672] GetProcessHeap () returned 0x630000 [0073.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0073.672] GetProcessHeap () returned 0x630000 [0073.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0073.672] GetProcessHeap () returned 0x630000 [0073.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.672] GetProcessHeap () returned 0x630000 [0073.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cfd0 [0073.672] GetProcessHeap () returned 0x630000 [0073.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.672] GetProcessHeap () returned 0x630000 [0073.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.672] GetProcessHeap () returned 0x630000 [0073.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.672] GetProcessHeap () returned 0x630000 [0073.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.673] GetProcessHeap () returned 0x630000 [0073.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65dda0 [0073.673] GetProcessHeap () returned 0x630000 [0073.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cfd0 | out: hHeap=0x630000) returned 1 [0073.673] GetProcessHeap () returned 0x630000 [0073.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0073.673] GetProcessHeap () returned 0x630000 [0073.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0073.673] GetProcessHeap () returned 0x630000 [0073.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.673] GetProcessHeap () returned 0x630000 [0073.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.673] GetProcessHeap () returned 0x630000 [0073.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.673] GetProcessHeap () returned 0x630000 [0073.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.673] GetProcessHeap () returned 0x630000 [0073.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.673] GetProcessHeap () returned 0x630000 [0073.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.673] GetProcessHeap () returned 0x630000 [0073.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.673] GetProcessHeap () returned 0x630000 [0073.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.673] GetProcessHeap () returned 0x630000 [0073.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0073.673] GetProcessHeap () returned 0x630000 [0073.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0073.673] GetProcessHeap () returned 0x630000 [0073.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.673] GetProcessHeap () returned 0x630000 [0073.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.673] GetProcessHeap () returned 0x630000 [0073.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0073.673] GetProcessHeap () returned 0x630000 [0073.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0073.673] GetProcessHeap () returned 0x630000 [0073.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.674] GetProcessHeap () returned 0x630000 [0073.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.674] GetProcessHeap () returned 0x630000 [0073.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.674] GetProcessHeap () returned 0x630000 [0073.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.674] GetProcessHeap () returned 0x630000 [0073.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.674] GetProcessHeap () returned 0x630000 [0073.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.674] GetProcessHeap () returned 0x630000 [0073.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.674] GetProcessHeap () returned 0x630000 [0073.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.674] GetProcessHeap () returned 0x630000 [0073.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.674] GetProcessHeap () returned 0x630000 [0073.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.674] GetProcessHeap () returned 0x630000 [0073.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.674] GetProcessHeap () returned 0x630000 [0073.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.674] GetProcessHeap () returned 0x630000 [0073.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0073.674] GetProcessHeap () returned 0x630000 [0073.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0073.674] GetProcessHeap () returned 0x630000 [0073.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.674] GetProcessHeap () returned 0x630000 [0073.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.674] GetProcessHeap () returned 0x630000 [0073.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.674] GetProcessHeap () returned 0x630000 [0073.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.674] GetProcessHeap () returned 0x630000 [0073.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.674] GetProcessHeap () returned 0x630000 [0073.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.675] GetProcessHeap () returned 0x630000 [0073.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.675] GetProcessHeap () returned 0x630000 [0073.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.675] GetProcessHeap () returned 0x630000 [0073.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.675] GetProcessHeap () returned 0x630000 [0073.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.675] GetProcessHeap () returned 0x630000 [0073.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.675] GetProcessHeap () returned 0x630000 [0073.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.675] GetProcessHeap () returned 0x630000 [0073.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0073.675] GetProcessHeap () returned 0x630000 [0073.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0073.675] GetProcessHeap () returned 0x630000 [0073.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.675] GetProcessHeap () returned 0x630000 [0073.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.675] GetProcessHeap () returned 0x630000 [0073.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0073.675] GetProcessHeap () returned 0x630000 [0073.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0073.675] GetProcessHeap () returned 0x630000 [0073.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0073.675] GetProcessHeap () returned 0x630000 [0073.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0073.675] GetProcessHeap () returned 0x630000 [0073.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0073.675] GetProcessHeap () returned 0x630000 [0073.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0073.675] GetProcessHeap () returned 0x630000 [0073.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.675] GetProcessHeap () returned 0x630000 [0073.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.675] GetProcessHeap () returned 0x630000 [0073.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.675] GetProcessHeap () returned 0x630000 [0073.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.676] GetProcessHeap () returned 0x630000 [0073.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.676] GetProcessHeap () returned 0x630000 [0073.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.676] GetProcessHeap () returned 0x630000 [0073.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0073.676] GetProcessHeap () returned 0x630000 [0073.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0073.676] GetProcessHeap () returned 0x630000 [0073.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.676] GetProcessHeap () returned 0x630000 [0073.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.676] GetProcessHeap () returned 0x630000 [0073.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0073.676] GetProcessHeap () returned 0x630000 [0073.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0073.676] GetProcessHeap () returned 0x630000 [0073.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.676] GetProcessHeap () returned 0x630000 [0073.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.676] GetProcessHeap () returned 0x630000 [0073.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.676] GetProcessHeap () returned 0x630000 [0073.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.676] GetProcessHeap () returned 0x630000 [0073.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.676] GetProcessHeap () returned 0x630000 [0073.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.676] GetProcessHeap () returned 0x630000 [0073.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.676] GetProcessHeap () returned 0x630000 [0073.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.676] GetProcessHeap () returned 0x630000 [0073.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.676] GetProcessHeap () returned 0x630000 [0073.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.676] GetProcessHeap () returned 0x630000 [0073.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.676] GetProcessHeap () returned 0x630000 [0073.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.677] GetProcessHeap () returned 0x630000 [0073.677] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.677] GetProcessHeap () returned 0x630000 [0073.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.677] GetProcessHeap () returned 0x630000 [0073.677] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0073.677] GetProcessHeap () returned 0x630000 [0073.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0073.677] GetProcessHeap () returned 0x630000 [0073.677] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0073.677] GetProcessHeap () returned 0x630000 [0073.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0073.677] GetProcessHeap () returned 0x630000 [0073.677] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.677] GetProcessHeap () returned 0x630000 [0073.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.677] GetProcessHeap () returned 0x630000 [0073.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0073.677] GetProcessHeap () returned 0x630000 [0073.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0073.677] GetProcessHeap () returned 0x630000 [0073.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0073.677] GetProcessHeap () returned 0x630000 [0073.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0073.677] GetProcessHeap () returned 0x630000 [0073.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0073.677] GetProcessHeap () returned 0x630000 [0073.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0073.677] GetProcessHeap () returned 0x630000 [0073.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0073.677] GetProcessHeap () returned 0x630000 [0073.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0073.677] GetProcessHeap () returned 0x630000 [0073.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0073.677] GetProcessHeap () returned 0x630000 [0073.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0073.678] GetProcessHeap () returned 0x630000 [0073.678] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0073.678] WriteFile (in: hFile=0x230, lpBuffer=0x671d40*, nNumberOfBytesToWrite=0x386, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x671d40*, lpNumberOfBytesWritten=0x243d864*=0x386, lpOverlapped=0x0) returned 1 [0073.681] GetProcessHeap () returned 0x630000 [0073.682] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671d40, Size=0x30) returned 0x671d40 [0073.682] GetProcessHeap () returned 0x630000 [0073.682] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0073.682] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0073.682] GetProcessHeap () returned 0x630000 [0073.682] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18290) returned 0x671d78 [0073.683] ReadFile (in: hFile=0x230, lpBuffer=0x671d78, nNumberOfBytesToRead=0x18290, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671d78*, lpNumberOfBytesRead=0x243d7e8*=0x18290, lpOverlapped=0x0) returned 1 [0073.684] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0073.684] WriteFile (in: hFile=0x230, lpBuffer=0x671d78*, nNumberOfBytesToWrite=0x18290, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671d78*, lpNumberOfBytesWritten=0x243d7e4*=0x18290, lpOverlapped=0x0) returned 1 [0073.687] GetProcessHeap () returned 0x630000 [0073.687] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671d78 | out: hHeap=0x630000) returned 1 [0073.687] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0073.687] WriteFile (in: hFile=0x230, lpBuffer=0x671d40*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x671d40*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0073.688] CloseHandle (hObject=0x230) returned 1 [0073.689] GetProcessHeap () returned 0x630000 [0073.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0073.689] GetProcessHeap () returned 0x630000 [0073.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655850 | out: hHeap=0x630000) returned 1 [0073.689] GetProcessHeap () returned 0x630000 [0073.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0073.689] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\FpYz8x_D.ots" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\FpYz8x_D.ots") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\FpYz8x_D.ots" [0073.689] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\FpYz8x_D.ots", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\FpYz8x_D.ots.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\FpYz8x_D.ots.happythreechoose" [0073.689] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\FpYz8x_D.ots" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\fpyz8x_d.ots"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\FpYz8x_D.ots.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\fpyz8x_d.ots.happythreechoose"), dwFlags=0x1) returned 1 [0073.690] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\FpYz8x_D.ots" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P") returned 1 [0073.690] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\") returned="" [0073.690] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\Decryption INFO.html" [0073.690] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\decryption info.html")) returned 0x20 [0073.690] GetProcessHeap () returned 0x630000 [0073.690] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0073.690] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63d877f0, ftCreationTime.dwHighDateTime=0x1d5c7d5, ftLastAccessTime.dwLowDateTime=0x17bc0880, ftLastAccessTime.dwHighDateTime=0x1d5cd59, ftLastWriteTime.dwLowDateTime=0x17bc0880, ftLastWriteTime.dwHighDateTime=0x1d5cd59, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="YyeJ", cAlternateFileName="")) returned 1 [0073.690] lstrcmpiW (lpString1="YyeJ", lpString2=".") returned 1 [0073.690] lstrcmpiW (lpString1="YyeJ", lpString2="..") returned 1 [0073.690] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\", lpString2="YyeJ" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ" [0073.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="YyeJ", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0073.690] GetProcessHeap () returned 0x630000 [0073.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5) returned 0x65a258 [0073.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="YyeJ", cchWideChar=-1, lpMultiByteStr=0x65a258, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="YyeJ", lpUsedDefaultChar=0x0) returned 5 [0073.690] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YyeJ", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 3 [0073.690] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YyeJ", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0073.690] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YyeJ", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0073.690] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YyeJ", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 3 [0073.690] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YyeJ", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 3 [0073.690] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YyeJ", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0073.690] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YyeJ", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0073.690] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YyeJ", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 3 [0073.691] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YyeJ", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 3 [0073.691] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YyeJ", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 3 [0073.691] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YyeJ", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 3 [0073.691] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YyeJ", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 3 [0073.691] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YyeJ", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 3 [0073.691] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YyeJ", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 3 [0073.691] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YyeJ", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 3 [0073.691] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YyeJ", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 3 [0073.691] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YyeJ", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 3 [0073.691] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YyeJ", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 3 [0073.691] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YyeJ", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0073.691] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YyeJ", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0073.691] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YyeJ", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0073.691] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YyeJ", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0073.691] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YyeJ", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0073.691] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YyeJ", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0073.691] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YyeJ", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 3 [0073.691] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YyeJ", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 3 [0073.691] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YyeJ", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0073.691] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YyeJ", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0073.691] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YyeJ", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 3 [0073.691] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YyeJ", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 3 [0073.691] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YyeJ", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 3 [0073.691] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YyeJ", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0073.691] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YyeJ", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0073.691] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YyeJ", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0073.691] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YyeJ", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0073.691] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YyeJ", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0073.691] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YyeJ", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0073.691] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YyeJ", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0073.691] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YyeJ", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0073.691] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YyeJ", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 3 [0073.691] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YyeJ", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0073.691] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YyeJ", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 3 [0073.691] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YyeJ", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0073.692] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\" [0073.692] GetProcessHeap () returned 0x630000 [0073.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a268 [0073.692] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\") returned 49 [0073.692] GetProcessHeap () returned 0x630000 [0073.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x64) returned 0x655050 [0073.692] lstrcpyW (in: lpString1=0x655050, lpString2="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\" [0073.692] GetProcessHeap () returned 0x630000 [0073.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.692] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63d877f0, ftCreationTime.dwHighDateTime=0x1d5c7d5, ftLastAccessTime.dwLowDateTime=0x17bc0880, ftLastAccessTime.dwHighDateTime=0x1d5cd59, ftLastWriteTime.dwLowDateTime=0x17bc0880, ftLastWriteTime.dwHighDateTime=0x1d5cd59, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="YyeJ", cAlternateFileName="")) returned 0 [0073.692] FindClose (in: hFindFile=0x648810 | out: hFindFile=0x648810) returned 1 [0073.692] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\" [0073.692] GetProcessHeap () returned 0x630000 [0073.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655050 | out: hHeap=0x630000) returned 1 [0073.692] GetProcessHeap () returned 0x630000 [0073.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.692] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\") returned 49 [0073.692] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\*") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\*" [0073.692] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63d877f0, ftCreationTime.dwHighDateTime=0x1d5c7d5, ftLastAccessTime.dwLowDateTime=0x17bc0880, ftLastAccessTime.dwHighDateTime=0x1d5cd59, ftLastWriteTime.dwLowDateTime=0x17bc0880, ftLastWriteTime.dwHighDateTime=0x1d5cd59, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648b50 [0073.692] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0073.692] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63d877f0, ftCreationTime.dwHighDateTime=0x1d5c7d5, ftLastAccessTime.dwLowDateTime=0x17bc0880, ftLastAccessTime.dwHighDateTime=0x1d5cd59, ftLastWriteTime.dwLowDateTime=0x17bc0880, ftLastWriteTime.dwHighDateTime=0x1d5cd59, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.692] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0073.692] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0073.692] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x350e010, ftCreationTime.dwHighDateTime=0x1d5cc8b, ftLastAccessTime.dwLowDateTime=0xc77f7430, ftLastAccessTime.dwHighDateTime=0x1d5d526, ftLastWriteTime.dwLowDateTime=0xc77f7430, ftLastWriteTime.dwHighDateTime=0x1d5d526, nFileSizeHigh=0x0, nFileSizeLow=0xd92a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cCyBwTZxYDH.pps", cAlternateFileName="CCYBWT~1.PPS")) returned 1 [0073.692] lstrcmpiW (lpString1="cCyBwTZxYDH.pps", lpString2=".") returned 1 [0073.692] lstrcmpiW (lpString1="cCyBwTZxYDH.pps", lpString2="..") returned 1 [0073.692] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\", lpString2="cCyBwTZxYDH.pps" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cCyBwTZxYDH.pps") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cCyBwTZxYDH.pps" [0073.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cCyBwTZxYDH.pps", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0073.693] GetProcessHeap () returned 0x630000 [0073.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x64c9f0 [0073.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cCyBwTZxYDH.pps", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cCyBwTZxYDH.pps", lpUsedDefaultChar=0x0) returned 16 [0073.693] lstrlenA (lpString="cCyBwTZxYDH.pps") returned 15 [0073.693] lstrlenA (lpString=".happythreechoose") returned 17 [0073.693] lstrcmpiW (lpString1="cCyBwTZxYDH.pps", lpString2="Decryption INFO.html") returned -1 [0073.693] lstrcmpiW (lpString1="cCyBwTZxYDH.pps", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0073.693] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0073.693] lstrcmpiW (lpString1="cCyBwTZxYDH.pps", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0073.693] GetProcessHeap () returned 0x630000 [0073.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0073.693] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cCyBwTZxYDH.pps" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\ccybwtzxydh.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0073.693] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=55594) returned 1 [0073.693] GetProcessHeap () returned 0x630000 [0073.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655418 [0073.693] GetProcessHeap () returned 0x630000 [0073.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0073.693] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cCyBwTZxYDH.pps") returned 64 [0073.693] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0073.693] GetProcessHeap () returned 0x630000 [0073.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0073.693] GetProcessHeap () returned 0x630000 [0073.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x386) returned 0x671d78 [0073.693] lstrlenA (lpString="rsa_encrypt") returned 11 [0073.693] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0073.694] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0073.694] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0073.694] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0073.694] GetProcessHeap () returned 0x630000 [0073.694] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0073.694] lstrlenA (lpString="010001") returned 6 [0073.694] GetProcessHeap () returned 0x630000 [0073.694] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2f8 [0073.694] GetProcessHeap () returned 0x630000 [0073.694] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0073.694] GetProcessHeap () returned 0x630000 [0073.694] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e580 [0073.694] GetProcessHeap () returned 0x630000 [0073.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0073.694] GetProcessHeap () returned 0x630000 [0073.694] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0073.694] GetProcessHeap () returned 0x630000 [0073.694] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656b80 [0073.694] GetProcessHeap () returned 0x630000 [0073.694] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a298 [0073.694] GetProcessHeap () returned 0x630000 [0073.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0073.695] GetProcessHeap () returned 0x630000 [0073.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0073.695] GetProcessHeap () returned 0x630000 [0073.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0073.695] GetProcessHeap () returned 0x630000 [0073.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0073.695] GetProcessHeap () returned 0x630000 [0073.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657328 [0073.695] GetProcessHeap () returned 0x630000 [0073.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.695] GetProcessHeap () returned 0x630000 [0073.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0073.695] GetProcessHeap () returned 0x630000 [0073.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea90 [0073.695] GetProcessHeap () returned 0x630000 [0073.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0073.695] GetProcessHeap () returned 0x630000 [0073.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0073.695] GetProcessHeap () returned 0x630000 [0073.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea90 | out: hHeap=0x630000) returned 1 [0073.695] GetProcessHeap () returned 0x630000 [0073.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0073.695] GetProcessHeap () returned 0x630000 [0073.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cf88 [0073.695] GetProcessHeap () returned 0x630000 [0073.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.695] GetProcessHeap () returned 0x630000 [0073.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0073.695] GetProcessHeap () returned 0x630000 [0073.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.695] GetProcessHeap () returned 0x630000 [0073.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.695] GetProcessHeap () returned 0x630000 [0073.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e610 [0073.695] GetProcessHeap () returned 0x630000 [0073.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cf88 | out: hHeap=0x630000) returned 1 [0073.695] GetProcessHeap () returned 0x630000 [0073.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0073.695] GetProcessHeap () returned 0x630000 [0073.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0073.696] GetProcessHeap () returned 0x630000 [0073.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.696] GetProcessHeap () returned 0x630000 [0073.696] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.696] GetProcessHeap () returned 0x630000 [0073.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0073.696] GetProcessHeap () returned 0x630000 [0073.696] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0073.696] GetProcessHeap () returned 0x630000 [0073.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.696] GetProcessHeap () returned 0x630000 [0073.696] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.696] GetProcessHeap () returned 0x630000 [0073.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.696] GetProcessHeap () returned 0x630000 [0073.696] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.696] GetProcessHeap () returned 0x630000 [0073.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.696] GetProcessHeap () returned 0x630000 [0073.696] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.696] GetProcessHeap () returned 0x630000 [0073.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.696] GetProcessHeap () returned 0x630000 [0073.696] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.696] GetProcessHeap () returned 0x630000 [0073.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.696] GetProcessHeap () returned 0x630000 [0073.696] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.696] GetProcessHeap () returned 0x630000 [0073.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.696] GetProcessHeap () returned 0x630000 [0073.696] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.696] GetProcessHeap () returned 0x630000 [0073.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.696] GetProcessHeap () returned 0x630000 [0073.696] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.696] GetProcessHeap () returned 0x630000 [0073.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.696] GetProcessHeap () returned 0x630000 [0073.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.697] GetProcessHeap () returned 0x630000 [0073.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.697] GetProcessHeap () returned 0x630000 [0073.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.697] GetProcessHeap () returned 0x630000 [0073.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.697] GetProcessHeap () returned 0x630000 [0073.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.697] GetProcessHeap () returned 0x630000 [0073.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.697] GetProcessHeap () returned 0x630000 [0073.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.697] GetProcessHeap () returned 0x630000 [0073.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.697] GetProcessHeap () returned 0x630000 [0073.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.697] GetProcessHeap () returned 0x630000 [0073.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.697] GetProcessHeap () returned 0x630000 [0073.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.697] GetProcessHeap () returned 0x630000 [0073.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.697] GetProcessHeap () returned 0x630000 [0073.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.697] GetProcessHeap () returned 0x630000 [0073.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.697] GetProcessHeap () returned 0x630000 [0073.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.697] GetProcessHeap () returned 0x630000 [0073.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.697] GetProcessHeap () returned 0x630000 [0073.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.697] GetProcessHeap () returned 0x630000 [0073.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.697] GetProcessHeap () returned 0x630000 [0073.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.697] GetProcessHeap () returned 0x630000 [0073.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.698] GetProcessHeap () returned 0x630000 [0073.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.698] GetProcessHeap () returned 0x630000 [0073.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.698] GetProcessHeap () returned 0x630000 [0073.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.698] GetProcessHeap () returned 0x630000 [0073.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.698] GetProcessHeap () returned 0x630000 [0073.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.698] GetProcessHeap () returned 0x630000 [0073.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0073.698] GetProcessHeap () returned 0x630000 [0073.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0073.698] GetProcessHeap () returned 0x630000 [0073.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0073.698] GetProcessHeap () returned 0x630000 [0073.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0073.698] GetProcessHeap () returned 0x630000 [0073.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.698] GetProcessHeap () returned 0x630000 [0073.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.698] GetProcessHeap () returned 0x630000 [0073.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.698] GetProcessHeap () returned 0x630000 [0073.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.698] GetProcessHeap () returned 0x630000 [0073.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.698] GetProcessHeap () returned 0x630000 [0073.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.698] GetProcessHeap () returned 0x630000 [0073.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.698] GetProcessHeap () returned 0x630000 [0073.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.698] GetProcessHeap () returned 0x630000 [0073.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.698] GetProcessHeap () returned 0x630000 [0073.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.698] GetProcessHeap () returned 0x630000 [0073.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.699] GetProcessHeap () returned 0x630000 [0073.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.699] GetProcessHeap () returned 0x630000 [0073.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.699] GetProcessHeap () returned 0x630000 [0073.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.699] GetProcessHeap () returned 0x630000 [0073.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.699] GetProcessHeap () returned 0x630000 [0073.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.699] GetProcessHeap () returned 0x630000 [0073.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.699] GetProcessHeap () returned 0x630000 [0073.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.699] GetProcessHeap () returned 0x630000 [0073.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.699] GetProcessHeap () returned 0x630000 [0073.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.699] GetProcessHeap () returned 0x630000 [0073.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.699] GetProcessHeap () returned 0x630000 [0073.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.699] GetProcessHeap () returned 0x630000 [0073.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.699] GetProcessHeap () returned 0x630000 [0073.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.699] GetProcessHeap () returned 0x630000 [0073.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.699] GetProcessHeap () returned 0x630000 [0073.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.699] GetProcessHeap () returned 0x630000 [0073.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.699] GetProcessHeap () returned 0x630000 [0073.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.699] GetProcessHeap () returned 0x630000 [0073.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.699] GetProcessHeap () returned 0x630000 [0073.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.700] GetProcessHeap () returned 0x630000 [0073.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.700] GetProcessHeap () returned 0x630000 [0073.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.700] GetProcessHeap () returned 0x630000 [0073.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.700] GetProcessHeap () returned 0x630000 [0073.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.700] GetProcessHeap () returned 0x630000 [0073.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0073.700] GetProcessHeap () returned 0x630000 [0073.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0073.700] GetProcessHeap () returned 0x630000 [0073.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0073.700] GetProcessHeap () returned 0x630000 [0073.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0073.700] GetProcessHeap () returned 0x630000 [0073.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0073.700] GetProcessHeap () returned 0x630000 [0073.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0073.700] GetProcessHeap () returned 0x630000 [0073.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0073.700] GetProcessHeap () returned 0x630000 [0073.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0073.700] GetProcessHeap () returned 0x630000 [0073.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0073.700] GetProcessHeap () returned 0x630000 [0073.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0073.700] GetProcessHeap () returned 0x630000 [0073.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0073.701] WriteFile (in: hFile=0x230, lpBuffer=0x671d78*, nNumberOfBytesToWrite=0x386, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x671d78*, lpNumberOfBytesWritten=0x243d864*=0x386, lpOverlapped=0x0) returned 1 [0073.703] GetProcessHeap () returned 0x630000 [0073.703] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671d78, Size=0x30) returned 0x671d78 [0073.703] GetProcessHeap () returned 0x630000 [0073.703] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0073.703] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0073.703] GetProcessHeap () returned 0x630000 [0073.703] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd930) returned 0x671db0 [0073.703] ReadFile (in: hFile=0x230, lpBuffer=0x671db0, nNumberOfBytesToRead=0xd930, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671db0*, lpNumberOfBytesRead=0x243d7e8*=0xd930, lpOverlapped=0x0) returned 1 [0073.704] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0073.704] WriteFile (in: hFile=0x230, lpBuffer=0x671db0*, nNumberOfBytesToWrite=0xd930, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671db0*, lpNumberOfBytesWritten=0x243d7e4*=0xd930, lpOverlapped=0x0) returned 1 [0073.705] GetProcessHeap () returned 0x630000 [0073.705] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671db0 | out: hHeap=0x630000) returned 1 [0073.706] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0073.706] WriteFile (in: hFile=0x230, lpBuffer=0x671d78*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x671d78*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0073.708] CloseHandle (hObject=0x230) returned 1 [0073.708] GetProcessHeap () returned 0x630000 [0073.708] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0073.708] GetProcessHeap () returned 0x630000 [0073.708] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655418 | out: hHeap=0x630000) returned 1 [0073.708] GetProcessHeap () returned 0x630000 [0073.708] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0073.708] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cCyBwTZxYDH.pps" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cCyBwTZxYDH.pps") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cCyBwTZxYDH.pps" [0073.708] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cCyBwTZxYDH.pps", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cCyBwTZxYDH.pps.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cCyBwTZxYDH.pps.happythreechoose" [0073.708] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cCyBwTZxYDH.pps" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\ccybwtzxydh.pps"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cCyBwTZxYDH.pps.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\ccybwtzxydh.pps.happythreechoose"), dwFlags=0x1) returned 1 [0073.709] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cCyBwTZxYDH.pps" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ") returned 1 [0073.709] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\") returned="" [0073.709] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\Decryption INFO.html" [0073.709] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\decryption info.html")) returned 0xffffffff [0073.709] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0073.713] GetProcessHeap () returned 0x630000 [0073.713] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655418 [0073.713] GetProcessHeap () returned 0x630000 [0073.713] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0073.720] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.721] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.721] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.721] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.721] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.721] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.721] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.722] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.722] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.722] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.722] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.722] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.722] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.722] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.722] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.722] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.722] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.722] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.722] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.723] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.723] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.723] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.723] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.723] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.723] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.723] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.723] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.723] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.723] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.723] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.723] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.724] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.724] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.724] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.724] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.724] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.724] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.732] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.732] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.732] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.732] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.732] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.732] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.732] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.733] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.733] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.733] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.733] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.733] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.733] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.733] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.733] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.733] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.733] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.733] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.733] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.733] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.734] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.734] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.734] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.734] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.734] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.734] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.734] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.734] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.734] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.734] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.734] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.734] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.734] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.734] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.735] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.735] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.735] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.735] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.735] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.735] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.735] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.735] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.735] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.735] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.735] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.735] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.735] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.736] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.736] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.736] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.736] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.736] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.736] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.736] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.736] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.736] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.736] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.736] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.736] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.736] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.737] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.737] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.737] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.737] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.737] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.737] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.737] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.737] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.737] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.737] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.737] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.737] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.737] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.737] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.738] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.738] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.738] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.738] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.738] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.738] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.738] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.738] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.738] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.738] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.738] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.738] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.738] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.739] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.739] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.739] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.739] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.739] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.739] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.739] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.739] GetProcessHeap () returned 0x630000 [0073.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655418 | out: hHeap=0x630000) returned 1 [0073.739] GetProcessHeap () returned 0x630000 [0073.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0073.739] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0073.739] GetProcessHeap () returned 0x630000 [0073.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655940 [0073.739] GetProcessHeap () returned 0x630000 [0073.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0073.746] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.746] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.746] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.747] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.747] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.747] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.747] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.747] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.747] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.747] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.747] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.747] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.747] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.747] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.748] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.748] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.748] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.748] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.748] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.748] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.748] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.748] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.748] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.748] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.748] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.748] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.748] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.749] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.749] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.749] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.749] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.749] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.749] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.749] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.749] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.749] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.749] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.749] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.749] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.749] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.749] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.750] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.750] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.750] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.750] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.750] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.750] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.750] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.750] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.750] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.750] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.750] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.750] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.752] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.752] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.752] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.752] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.752] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.752] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.752] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.752] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.752] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.752] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.752] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.754] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.754] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.754] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.754] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.754] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.754] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.754] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.754] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.754] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.754] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.754] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.754] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.754] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.755] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.755] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.755] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.755] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.755] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.755] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.755] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.755] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.755] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.755] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.755] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.756] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.756] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.756] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.756] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.756] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.756] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.756] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.756] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.756] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.756] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.756] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.756] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.756] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.756] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.757] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.757] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.757] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.757] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.757] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.757] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.757] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.757] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.757] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.757] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.757] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.757] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.757] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.758] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.758] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.758] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.758] GetProcessHeap () returned 0x630000 [0073.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655940 | out: hHeap=0x630000) returned 1 [0073.758] GetProcessHeap () returned 0x630000 [0073.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0073.759] CloseHandle (hObject=0x230) returned 1 [0073.759] GetProcessHeap () returned 0x630000 [0073.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0073.759] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x25585340, ftCreationTime.dwHighDateTime=0x1d5d0d3, ftLastAccessTime.dwLowDateTime=0xae1cf050, ftLastAccessTime.dwHighDateTime=0x1d5d2ea, ftLastWriteTime.dwLowDateTime=0xae1cf050, ftLastWriteTime.dwHighDateTime=0x1d5d2ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cD_xHxGN", cAlternateFileName="")) returned 1 [0073.759] lstrcmpiW (lpString1="cD_xHxGN", lpString2=".") returned 1 [0073.759] lstrcmpiW (lpString1="cD_xHxGN", lpString2="..") returned 1 [0073.759] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\", lpString2="cD_xHxGN" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN" [0073.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cD_xHxGN", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0073.759] GetProcessHeap () returned 0x630000 [0073.759] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9) returned 0x64c9f0 [0073.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cD_xHxGN", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cD_xHxGN", lpUsedDefaultChar=0x0) returned 9 [0073.759] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="cD_xHxGN", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0073.759] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="cD_xHxGN", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0073.759] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="cD_xHxGN", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0073.759] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="cD_xHxGN", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0073.759] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="cD_xHxGN", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0073.759] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="cD_xHxGN", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0073.759] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="cD_xHxGN", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0073.759] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="cD_xHxGN", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0073.759] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="cD_xHxGN", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0073.759] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="cD_xHxGN", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0073.759] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="cD_xHxGN", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0073.759] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="cD_xHxGN", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0073.759] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="cD_xHxGN", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0073.759] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="cD_xHxGN", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0073.759] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="cD_xHxGN", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0073.759] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="cD_xHxGN", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0073.760] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="cD_xHxGN", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0073.760] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="cD_xHxGN", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0073.760] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="cD_xHxGN", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0073.760] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="cD_xHxGN", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0073.760] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="cD_xHxGN", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0073.760] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="cD_xHxGN", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0073.760] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="cD_xHxGN", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0073.760] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="cD_xHxGN", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0073.760] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="cD_xHxGN", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0073.760] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="cD_xHxGN", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0073.760] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="cD_xHxGN", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0073.760] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="cD_xHxGN", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0073.760] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="cD_xHxGN", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0073.760] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="cD_xHxGN", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0073.760] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="cD_xHxGN", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0073.760] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="cD_xHxGN", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0073.760] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="cD_xHxGN", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0073.760] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="cD_xHxGN", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0073.760] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="cD_xHxGN", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0073.760] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="cD_xHxGN", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0073.760] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="cD_xHxGN", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0073.760] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="cD_xHxGN", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0073.760] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="cD_xHxGN", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0073.760] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="cD_xHxGN", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0073.760] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="cD_xHxGN", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0073.760] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="cD_xHxGN", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0073.760] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="cD_xHxGN", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0073.760] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\" [0073.760] GetProcessHeap () returned 0x630000 [0073.760] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a2f8 [0073.760] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\") returned 58 [0073.760] GetProcessHeap () returned 0x630000 [0073.760] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x76) returned 0x63f290 [0073.760] lstrcpyW (in: lpString1=0x63f290, lpString2="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\" [0073.760] GetProcessHeap () returned 0x630000 [0073.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0073.761] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1579afd0, ftCreationTime.dwHighDateTime=0x1d5d53f, ftLastAccessTime.dwLowDateTime=0x83d4cba0, ftLastAccessTime.dwHighDateTime=0x1d5d22d, ftLastWriteTime.dwLowDateTime=0x83d4cba0, ftLastWriteTime.dwHighDateTime=0x1d5d22d, nFileSizeHigh=0x0, nFileSizeLow=0x37b4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DCfG2qq_xEUd VEbN.xls", cAlternateFileName="DCFG2Q~1.XLS")) returned 1 [0073.761] lstrcmpiW (lpString1="DCfG2qq_xEUd VEbN.xls", lpString2=".") returned 1 [0073.761] lstrcmpiW (lpString1="DCfG2qq_xEUd VEbN.xls", lpString2="..") returned 1 [0073.761] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\", lpString2="DCfG2qq_xEUd VEbN.xls" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\DCfG2qq_xEUd VEbN.xls") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\DCfG2qq_xEUd VEbN.xls" [0073.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DCfG2qq_xEUd VEbN.xls", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0073.761] GetProcessHeap () returned 0x630000 [0073.761] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x645f98 [0073.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DCfG2qq_xEUd VEbN.xls", cchWideChar=-1, lpMultiByteStr=0x645f98, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DCfG2qq_xEUd VEbN.xls", lpUsedDefaultChar=0x0) returned 22 [0073.761] lstrlenA (lpString="DCfG2qq_xEUd VEbN.xls") returned 21 [0073.761] lstrlenA (lpString=".happythreechoose") returned 17 [0073.761] lstrlenA (lpString=".happythreechoose") returned 17 [0073.761] lstrlenA (lpString="DCfG2qq_xEUd VEbN.xls") returned 21 [0073.761] lstrcmpiA (lpString1="2qq_xEUd VEbN.xls", lpString2=".happythreechoose") returned 1 [0073.761] lstrcmpiW (lpString1="DCfG2qq_xEUd VEbN.xls", lpString2="Decryption INFO.html") returned -1 [0073.761] lstrcmpiW (lpString1="DCfG2qq_xEUd VEbN.xls", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0073.761] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0073.761] lstrcmpiW (lpString1="DCfG2qq_xEUd VEbN.xls", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0073.761] GetProcessHeap () returned 0x630000 [0073.761] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0073.761] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\DCfG2qq_xEUd VEbN.xls" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\dcfg2qq_xeud vebn.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0073.761] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=14260) returned 1 [0073.761] GetProcessHeap () returned 0x630000 [0073.761] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6556e8 [0073.761] GetProcessHeap () returned 0x630000 [0073.761] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0073.761] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\DCfG2qq_xEUd VEbN.xls") returned 70 [0073.762] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0073.762] GetProcessHeap () returned 0x630000 [0073.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0073.762] GetProcessHeap () returned 0x630000 [0073.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x671db0 [0073.763] lstrlenA (lpString="rsa_encrypt") returned 11 [0073.763] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0073.799] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0073.799] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0073.799] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0073.799] GetProcessHeap () returned 0x630000 [0073.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0073.799] lstrlenA (lpString="010001") returned 6 [0073.799] GetProcessHeap () returned 0x630000 [0073.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a298 [0073.799] GetProcessHeap () returned 0x630000 [0073.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0073.799] GetProcessHeap () returned 0x630000 [0073.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0073.799] GetProcessHeap () returned 0x630000 [0073.799] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0073.800] GetProcessHeap () returned 0x630000 [0073.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dec0 [0073.800] GetProcessHeap () returned 0x630000 [0073.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657788 [0073.800] GetProcessHeap () returned 0x630000 [0073.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2b8 [0073.800] GetProcessHeap () returned 0x630000 [0073.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0073.800] GetProcessHeap () returned 0x630000 [0073.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.800] GetProcessHeap () returned 0x630000 [0073.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0073.800] GetProcessHeap () returned 0x630000 [0073.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0073.800] GetProcessHeap () returned 0x630000 [0073.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657670 [0073.800] GetProcessHeap () returned 0x630000 [0073.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.800] GetProcessHeap () returned 0x630000 [0073.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0073.800] GetProcessHeap () returned 0x630000 [0073.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0073.800] GetProcessHeap () returned 0x630000 [0073.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0073.800] GetProcessHeap () returned 0x630000 [0073.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0073.800] GetProcessHeap () returned 0x630000 [0073.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0073.800] GetProcessHeap () returned 0x630000 [0073.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.800] GetProcessHeap () returned 0x630000 [0073.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0073.800] GetProcessHeap () returned 0x630000 [0073.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.800] GetProcessHeap () returned 0x630000 [0073.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.800] GetProcessHeap () returned 0x630000 [0073.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.800] GetProcessHeap () returned 0x630000 [0073.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.800] GetProcessHeap () returned 0x630000 [0073.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e4f0 [0073.801] GetProcessHeap () returned 0x630000 [0073.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0073.801] GetProcessHeap () returned 0x630000 [0073.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0073.801] GetProcessHeap () returned 0x630000 [0073.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0073.801] GetProcessHeap () returned 0x630000 [0073.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.801] GetProcessHeap () returned 0x630000 [0073.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.801] GetProcessHeap () returned 0x630000 [0073.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.801] GetProcessHeap () returned 0x630000 [0073.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.801] GetProcessHeap () returned 0x630000 [0073.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.801] GetProcessHeap () returned 0x630000 [0073.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.801] GetProcessHeap () returned 0x630000 [0073.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.801] GetProcessHeap () returned 0x630000 [0073.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.801] GetProcessHeap () returned 0x630000 [0073.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.801] GetProcessHeap () returned 0x630000 [0073.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.801] GetProcessHeap () returned 0x630000 [0073.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.801] GetProcessHeap () returned 0x630000 [0073.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.801] GetProcessHeap () returned 0x630000 [0073.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.801] GetProcessHeap () returned 0x630000 [0073.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.801] GetProcessHeap () returned 0x630000 [0073.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.801] GetProcessHeap () returned 0x630000 [0073.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.801] GetProcessHeap () returned 0x630000 [0073.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.802] GetProcessHeap () returned 0x630000 [0073.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.802] GetProcessHeap () returned 0x630000 [0073.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.802] GetProcessHeap () returned 0x630000 [0073.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.802] GetProcessHeap () returned 0x630000 [0073.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.802] GetProcessHeap () returned 0x630000 [0073.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.802] GetProcessHeap () returned 0x630000 [0073.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.802] GetProcessHeap () returned 0x630000 [0073.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.802] GetProcessHeap () returned 0x630000 [0073.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.802] GetProcessHeap () returned 0x630000 [0073.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.802] GetProcessHeap () returned 0x630000 [0073.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.802] GetProcessHeap () returned 0x630000 [0073.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.802] GetProcessHeap () returned 0x630000 [0073.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.802] GetProcessHeap () returned 0x630000 [0073.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.802] GetProcessHeap () returned 0x630000 [0073.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.802] GetProcessHeap () returned 0x630000 [0073.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.802] GetProcessHeap () returned 0x630000 [0073.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.802] GetProcessHeap () returned 0x630000 [0073.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.802] GetProcessHeap () returned 0x630000 [0073.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.802] GetProcessHeap () returned 0x630000 [0073.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.802] GetProcessHeap () returned 0x630000 [0073.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.803] GetProcessHeap () returned 0x630000 [0073.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.803] GetProcessHeap () returned 0x630000 [0073.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.803] GetProcessHeap () returned 0x630000 [0073.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.803] GetProcessHeap () returned 0x630000 [0073.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.803] GetProcessHeap () returned 0x630000 [0073.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.803] GetProcessHeap () returned 0x630000 [0073.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.803] GetProcessHeap () returned 0x630000 [0073.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.803] GetProcessHeap () returned 0x630000 [0073.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.803] GetProcessHeap () returned 0x630000 [0073.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.803] GetProcessHeap () returned 0x630000 [0073.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.803] GetProcessHeap () returned 0x630000 [0073.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.803] GetProcessHeap () returned 0x630000 [0073.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.803] GetProcessHeap () returned 0x630000 [0073.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.803] GetProcessHeap () returned 0x630000 [0073.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.803] GetProcessHeap () returned 0x630000 [0073.820] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.820] GetProcessHeap () returned 0x630000 [0073.820] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.820] GetProcessHeap () returned 0x630000 [0073.820] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.820] GetProcessHeap () returned 0x630000 [0073.820] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.820] GetProcessHeap () returned 0x630000 [0073.820] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.820] GetProcessHeap () returned 0x630000 [0073.820] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.820] GetProcessHeap () returned 0x630000 [0073.820] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.820] GetProcessHeap () returned 0x630000 [0073.820] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.820] GetProcessHeap () returned 0x630000 [0073.820] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.820] GetProcessHeap () returned 0x630000 [0073.821] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.821] GetProcessHeap () returned 0x630000 [0073.821] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.821] GetProcessHeap () returned 0x630000 [0073.821] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.821] GetProcessHeap () returned 0x630000 [0073.821] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.821] GetProcessHeap () returned 0x630000 [0073.821] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.821] GetProcessHeap () returned 0x630000 [0073.821] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.821] GetProcessHeap () returned 0x630000 [0073.821] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.821] GetProcessHeap () returned 0x630000 [0073.821] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.821] GetProcessHeap () returned 0x630000 [0073.821] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.821] GetProcessHeap () returned 0x630000 [0073.821] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.821] GetProcessHeap () returned 0x630000 [0073.821] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.821] GetProcessHeap () returned 0x630000 [0073.821] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.821] GetProcessHeap () returned 0x630000 [0073.821] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.821] GetProcessHeap () returned 0x630000 [0073.821] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.821] GetProcessHeap () returned 0x630000 [0073.821] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.821] GetProcessHeap () returned 0x630000 [0073.821] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.821] GetProcessHeap () returned 0x630000 [0073.821] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.821] GetProcessHeap () returned 0x630000 [0073.821] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.821] GetProcessHeap () returned 0x630000 [0073.821] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.821] GetProcessHeap () returned 0x630000 [0073.821] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.821] GetProcessHeap () returned 0x630000 [0073.821] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.822] GetProcessHeap () returned 0x630000 [0073.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.822] GetProcessHeap () returned 0x630000 [0073.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0073.822] GetProcessHeap () returned 0x630000 [0073.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0073.822] GetProcessHeap () returned 0x630000 [0073.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0073.822] GetProcessHeap () returned 0x630000 [0073.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0073.822] GetProcessHeap () returned 0x630000 [0073.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0073.822] GetProcessHeap () returned 0x630000 [0073.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0073.822] GetProcessHeap () returned 0x630000 [0073.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0073.822] GetProcessHeap () returned 0x630000 [0073.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0073.822] GetProcessHeap () returned 0x630000 [0073.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0073.822] GetProcessHeap () returned 0x630000 [0073.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0073.822] GetProcessHeap () returned 0x630000 [0073.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0073.822] WriteFile (in: hFile=0x230, lpBuffer=0x671db0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x671db0*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0073.830] GetProcessHeap () returned 0x630000 [0073.830] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671db0, Size=0x30) returned 0x671db0 [0073.830] GetProcessHeap () returned 0x630000 [0073.830] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0073.830] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0073.830] GetProcessHeap () returned 0x630000 [0073.830] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x37b4) returned 0x671de8 [0073.830] ReadFile (in: hFile=0x230, lpBuffer=0x671de8, nNumberOfBytesToRead=0x37b4, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671de8*, lpNumberOfBytesRead=0x243d7e8*=0x37b4, lpOverlapped=0x0) returned 1 [0073.830] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0073.830] WriteFile (in: hFile=0x230, lpBuffer=0x671de8*, nNumberOfBytesToWrite=0x37b4, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671de8*, lpNumberOfBytesWritten=0x243d7e4*=0x37b4, lpOverlapped=0x0) returned 1 [0073.832] GetProcessHeap () returned 0x630000 [0073.832] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671de8 | out: hHeap=0x630000) returned 1 [0073.832] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0073.832] WriteFile (in: hFile=0x230, lpBuffer=0x671db0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x671db0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0073.833] CloseHandle (hObject=0x230) returned 1 [0073.833] GetProcessHeap () returned 0x630000 [0073.833] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0073.833] GetProcessHeap () returned 0x630000 [0073.833] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6556e8 | out: hHeap=0x630000) returned 1 [0073.833] GetProcessHeap () returned 0x630000 [0073.833] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0073.833] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\DCfG2qq_xEUd VEbN.xls" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\DCfG2qq_xEUd VEbN.xls") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\DCfG2qq_xEUd VEbN.xls" [0073.833] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\DCfG2qq_xEUd VEbN.xls", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\DCfG2qq_xEUd VEbN.xls.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\DCfG2qq_xEUd VEbN.xls.happythreechoose" [0073.833] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\DCfG2qq_xEUd VEbN.xls" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\dcfg2qq_xeud vebn.xls"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\DCfG2qq_xEUd VEbN.xls.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\dcfg2qq_xeud vebn.xls.happythreechoose"), dwFlags=0x1) returned 1 [0073.834] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\DCfG2qq_xEUd VEbN.xls" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ") returned 1 [0073.834] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\") returned="" [0073.834] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\Decryption INFO.html" [0073.834] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\decryption info.html")) returned 0x20 [0073.834] GetProcessHeap () returned 0x630000 [0073.834] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645f98 | out: hHeap=0x630000) returned 1 [0073.834] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x436bd140, ftCreationTime.dwHighDateTime=0x1d5d61e, ftLastAccessTime.dwLowDateTime=0xf9ded000, ftLastAccessTime.dwHighDateTime=0x1d5cf50, ftLastWriteTime.dwLowDateTime=0xf9ded000, ftLastWriteTime.dwHighDateTime=0x1d5cf50, nFileSizeHigh=0x0, nFileSizeLow=0x11f04, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OJFSpFAJ23jcm L.xlsx", cAlternateFileName="OJFSPF~1.XLS")) returned 1 [0073.834] lstrcmpiW (lpString1="OJFSpFAJ23jcm L.xlsx", lpString2=".") returned 1 [0073.834] lstrcmpiW (lpString1="OJFSpFAJ23jcm L.xlsx", lpString2="..") returned 1 [0073.834] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\", lpString2="OJFSpFAJ23jcm L.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\OJFSpFAJ23jcm L.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\OJFSpFAJ23jcm L.xlsx" [0073.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="OJFSpFAJ23jcm L.xlsx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0073.834] GetProcessHeap () returned 0x630000 [0073.834] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x15) returned 0x645e58 [0073.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="OJFSpFAJ23jcm L.xlsx", cchWideChar=-1, lpMultiByteStr=0x645e58, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OJFSpFAJ23jcm L.xlsx", lpUsedDefaultChar=0x0) returned 21 [0073.834] lstrlenA (lpString="OJFSpFAJ23jcm L.xlsx") returned 20 [0073.835] lstrlenA (lpString=".happythreechoose") returned 17 [0073.835] lstrlenA (lpString=".happythreechoose") returned 17 [0073.835] lstrlenA (lpString="OJFSpFAJ23jcm L.xlsx") returned 20 [0073.835] lstrcmpiA (lpString1="SpFAJ23jcm L.xlsx", lpString2=".happythreechoose") returned 1 [0073.835] lstrcmpiW (lpString1="OJFSpFAJ23jcm L.xlsx", lpString2="Decryption INFO.html") returned 1 [0073.835] lstrcmpiW (lpString1="OJFSpFAJ23jcm L.xlsx", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0073.835] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0073.835] lstrcmpiW (lpString1="OJFSpFAJ23jcm L.xlsx", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0073.835] GetProcessHeap () returned 0x630000 [0073.835] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0073.835] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\OJFSpFAJ23jcm L.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\ojfspfaj23jcm l.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0073.835] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=73476) returned 1 [0073.835] GetProcessHeap () returned 0x630000 [0073.835] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6559b8 [0073.835] GetProcessHeap () returned 0x630000 [0073.835] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0073.835] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\OJFSpFAJ23jcm L.xlsx") returned 69 [0073.835] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0073.835] GetProcessHeap () returned 0x630000 [0073.835] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0073.835] GetProcessHeap () returned 0x630000 [0073.835] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38c) returned 0x671de8 [0073.835] lstrlenA (lpString="rsa_encrypt") returned 11 [0073.835] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0073.836] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0073.836] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0073.836] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0073.836] GetProcessHeap () returned 0x630000 [0073.836] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0073.836] lstrlenA (lpString="010001") returned 6 [0073.836] GetProcessHeap () returned 0x630000 [0073.836] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a348 [0073.836] GetProcessHeap () returned 0x630000 [0073.836] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0073.836] GetProcessHeap () returned 0x630000 [0073.836] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e850 [0073.836] GetProcessHeap () returned 0x630000 [0073.836] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0073.836] GetProcessHeap () returned 0x630000 [0073.836] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e4f0 [0073.836] GetProcessHeap () returned 0x630000 [0073.836] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656950 [0073.836] GetProcessHeap () returned 0x630000 [0073.836] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0073.836] GetProcessHeap () returned 0x630000 [0073.836] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0073.836] GetProcessHeap () returned 0x630000 [0073.836] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0073.836] GetProcessHeap () returned 0x630000 [0073.836] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0073.836] GetProcessHeap () returned 0x630000 [0073.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0073.837] GetProcessHeap () returned 0x630000 [0073.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657670 [0073.837] GetProcessHeap () returned 0x630000 [0073.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.837] GetProcessHeap () returned 0x630000 [0073.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0073.837] GetProcessHeap () returned 0x630000 [0073.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65eb20 [0073.837] GetProcessHeap () returned 0x630000 [0073.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0073.837] GetProcessHeap () returned 0x630000 [0073.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0073.837] GetProcessHeap () returned 0x630000 [0073.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0073.837] GetProcessHeap () returned 0x630000 [0073.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.837] GetProcessHeap () returned 0x630000 [0073.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0073.837] GetProcessHeap () returned 0x630000 [0073.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.837] GetProcessHeap () returned 0x630000 [0073.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.837] GetProcessHeap () returned 0x630000 [0073.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.837] GetProcessHeap () returned 0x630000 [0073.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.837] GetProcessHeap () returned 0x630000 [0073.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e220 [0073.837] GetProcessHeap () returned 0x630000 [0073.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0073.837] GetProcessHeap () returned 0x630000 [0073.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0073.837] GetProcessHeap () returned 0x630000 [0073.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0073.837] GetProcessHeap () returned 0x630000 [0073.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.837] GetProcessHeap () returned 0x630000 [0073.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.837] GetProcessHeap () returned 0x630000 [0073.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.837] GetProcessHeap () returned 0x630000 [0073.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.838] GetProcessHeap () returned 0x630000 [0073.838] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.838] GetProcessHeap () returned 0x630000 [0073.838] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.838] GetProcessHeap () returned 0x630000 [0073.838] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.838] GetProcessHeap () returned 0x630000 [0073.838] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.838] GetProcessHeap () returned 0x630000 [0073.838] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.838] GetProcessHeap () returned 0x630000 [0073.838] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.838] GetProcessHeap () returned 0x630000 [0073.838] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.838] GetProcessHeap () returned 0x630000 [0073.838] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.838] GetProcessHeap () returned 0x630000 [0073.838] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.838] GetProcessHeap () returned 0x630000 [0073.838] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.838] GetProcessHeap () returned 0x630000 [0073.838] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.838] GetProcessHeap () returned 0x630000 [0073.838] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.838] GetProcessHeap () returned 0x630000 [0073.838] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.838] GetProcessHeap () returned 0x630000 [0073.838] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.838] GetProcessHeap () returned 0x630000 [0073.838] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0073.838] GetProcessHeap () returned 0x630000 [0073.838] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0073.838] GetProcessHeap () returned 0x630000 [0073.838] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.838] GetProcessHeap () returned 0x630000 [0073.838] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.838] GetProcessHeap () returned 0x630000 [0073.838] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.838] GetProcessHeap () returned 0x630000 [0073.838] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.839] GetProcessHeap () returned 0x630000 [0073.839] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.839] GetProcessHeap () returned 0x630000 [0073.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.839] GetProcessHeap () returned 0x630000 [0073.839] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.839] GetProcessHeap () returned 0x630000 [0073.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.839] GetProcessHeap () returned 0x630000 [0073.839] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.839] GetProcessHeap () returned 0x630000 [0073.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.839] GetProcessHeap () returned 0x630000 [0073.839] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.839] GetProcessHeap () returned 0x630000 [0073.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.839] GetProcessHeap () returned 0x630000 [0073.839] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0073.839] GetProcessHeap () returned 0x630000 [0073.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0073.839] GetProcessHeap () returned 0x630000 [0073.839] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0073.839] GetProcessHeap () returned 0x630000 [0073.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0073.839] GetProcessHeap () returned 0x630000 [0073.839] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0073.839] GetProcessHeap () returned 0x630000 [0073.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0073.839] GetProcessHeap () returned 0x630000 [0073.839] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0073.839] GetProcessHeap () returned 0x630000 [0073.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0073.839] GetProcessHeap () returned 0x630000 [0073.839] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.839] GetProcessHeap () returned 0x630000 [0073.839] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.839] GetProcessHeap () returned 0x630000 [0073.839] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.840] GetProcessHeap () returned 0x630000 [0073.840] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.840] GetProcessHeap () returned 0x630000 [0073.840] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.840] GetProcessHeap () returned 0x630000 [0073.840] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.842] GetProcessHeap () returned 0x630000 [0073.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.842] GetProcessHeap () returned 0x630000 [0073.842] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.842] GetProcessHeap () returned 0x630000 [0073.842] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.842] GetProcessHeap () returned 0x630000 [0073.842] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.843] GetProcessHeap () returned 0x630000 [0073.843] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.843] GetProcessHeap () returned 0x630000 [0073.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.843] GetProcessHeap () returned 0x630000 [0073.843] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.843] GetProcessHeap () returned 0x630000 [0073.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.843] GetProcessHeap () returned 0x630000 [0073.843] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.843] GetProcessHeap () returned 0x630000 [0073.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.843] GetProcessHeap () returned 0x630000 [0073.843] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.843] GetProcessHeap () returned 0x630000 [0073.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.843] GetProcessHeap () returned 0x630000 [0073.843] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.843] GetProcessHeap () returned 0x630000 [0073.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.843] GetProcessHeap () returned 0x630000 [0073.843] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.843] GetProcessHeap () returned 0x630000 [0073.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.843] GetProcessHeap () returned 0x630000 [0073.843] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.843] GetProcessHeap () returned 0x630000 [0073.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.843] GetProcessHeap () returned 0x630000 [0073.843] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.843] GetProcessHeap () returned 0x630000 [0073.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.843] GetProcessHeap () returned 0x630000 [0073.843] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.843] GetProcessHeap () returned 0x630000 [0073.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.843] GetProcessHeap () returned 0x630000 [0073.843] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.843] GetProcessHeap () returned 0x630000 [0073.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.844] GetProcessHeap () returned 0x630000 [0073.844] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.844] GetProcessHeap () returned 0x630000 [0073.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.844] GetProcessHeap () returned 0x630000 [0073.844] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.844] GetProcessHeap () returned 0x630000 [0073.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.844] GetProcessHeap () returned 0x630000 [0073.844] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.844] GetProcessHeap () returned 0x630000 [0073.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.844] GetProcessHeap () returned 0x630000 [0073.844] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0073.844] GetProcessHeap () returned 0x630000 [0073.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0073.844] GetProcessHeap () returned 0x630000 [0073.844] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.844] GetProcessHeap () returned 0x630000 [0073.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.844] GetProcessHeap () returned 0x630000 [0073.844] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.844] GetProcessHeap () returned 0x630000 [0073.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.844] GetProcessHeap () returned 0x630000 [0073.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0073.844] GetProcessHeap () returned 0x630000 [0073.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0073.844] GetProcessHeap () returned 0x630000 [0073.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0073.844] GetProcessHeap () returned 0x630000 [0073.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0073.844] GetProcessHeap () returned 0x630000 [0073.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0073.844] GetProcessHeap () returned 0x630000 [0073.844] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0073.844] GetProcessHeap () returned 0x630000 [0073.845] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0073.845] GetProcessHeap () returned 0x630000 [0073.845] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0073.845] GetProcessHeap () returned 0x630000 [0073.845] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0073.845] GetProcessHeap () returned 0x630000 [0073.845] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.845] GetProcessHeap () returned 0x630000 [0073.845] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0073.845] WriteFile (in: hFile=0x230, lpBuffer=0x671de8*, nNumberOfBytesToWrite=0x38c, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x671de8*, lpNumberOfBytesWritten=0x243d864*=0x38c, lpOverlapped=0x0) returned 1 [0073.847] GetProcessHeap () returned 0x630000 [0073.847] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671de8, Size=0x30) returned 0x671de8 [0073.847] GetProcessHeap () returned 0x630000 [0073.847] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0073.848] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0073.848] GetProcessHeap () returned 0x630000 [0073.848] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11f10) returned 0x671e20 [0073.849] ReadFile (in: hFile=0x230, lpBuffer=0x671e20, nNumberOfBytesToRead=0x11f10, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671e20*, lpNumberOfBytesRead=0x243d7e8*=0x11f10, lpOverlapped=0x0) returned 1 [0073.849] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0073.849] WriteFile (in: hFile=0x230, lpBuffer=0x671e20*, nNumberOfBytesToWrite=0x11f10, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671e20*, lpNumberOfBytesWritten=0x243d7e4*=0x11f10, lpOverlapped=0x0) returned 1 [0073.851] GetProcessHeap () returned 0x630000 [0073.851] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671e20 | out: hHeap=0x630000) returned 1 [0073.851] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0073.851] WriteFile (in: hFile=0x230, lpBuffer=0x671de8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x671de8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0073.852] CloseHandle (hObject=0x230) returned 1 [0073.852] GetProcessHeap () returned 0x630000 [0073.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0073.852] GetProcessHeap () returned 0x630000 [0073.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6559b8 | out: hHeap=0x630000) returned 1 [0073.852] GetProcessHeap () returned 0x630000 [0073.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0073.852] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\OJFSpFAJ23jcm L.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\OJFSpFAJ23jcm L.xlsx") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\OJFSpFAJ23jcm L.xlsx" [0073.852] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\OJFSpFAJ23jcm L.xlsx", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\OJFSpFAJ23jcm L.xlsx.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\OJFSpFAJ23jcm L.xlsx.happythreechoose" [0073.852] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\OJFSpFAJ23jcm L.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\ojfspfaj23jcm l.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\OJFSpFAJ23jcm L.xlsx.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\ojfspfaj23jcm l.xlsx.happythreechoose"), dwFlags=0x1) returned 1 [0073.853] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\OJFSpFAJ23jcm L.xlsx" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ") returned 1 [0073.853] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\") returned="" [0073.853] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\Decryption INFO.html" [0073.853] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\decryption info.html")) returned 0x20 [0073.853] GetProcessHeap () returned 0x630000 [0073.853] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645e58 | out: hHeap=0x630000) returned 1 [0073.853] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf84ea20, ftCreationTime.dwHighDateTime=0x1d5ce90, ftLastAccessTime.dwLowDateTime=0xc6a8a90, ftLastAccessTime.dwHighDateTime=0x1d5cee1, ftLastWriteTime.dwLowDateTime=0xc6a8a90, ftLastWriteTime.dwHighDateTime=0x1d5cee1, nFileSizeHigh=0x0, nFileSizeLow=0x12c1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="p4jl5ff7Nm.rtf", cAlternateFileName="P4JL5F~1.RTF")) returned 1 [0073.853] lstrcmpiW (lpString1="p4jl5ff7Nm.rtf", lpString2=".") returned 1 [0073.853] lstrcmpiW (lpString1="p4jl5ff7Nm.rtf", lpString2="..") returned 1 [0073.853] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\", lpString2="p4jl5ff7Nm.rtf" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\p4jl5ff7Nm.rtf") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\p4jl5ff7Nm.rtf" [0073.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="p4jl5ff7Nm.rtf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0073.853] GetProcessHeap () returned 0x630000 [0073.853] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0073.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="p4jl5ff7Nm.rtf", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="p4jl5ff7Nm.rtf", lpUsedDefaultChar=0x0) returned 15 [0073.853] lstrlenA (lpString="p4jl5ff7Nm.rtf") returned 14 [0073.853] lstrlenA (lpString=".happythreechoose") returned 17 [0073.853] lstrcmpiW (lpString1="p4jl5ff7Nm.rtf", lpString2="Decryption INFO.html") returned 1 [0073.853] lstrcmpiW (lpString1="p4jl5ff7Nm.rtf", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0073.853] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0073.853] lstrcmpiW (lpString1="p4jl5ff7Nm.rtf", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0073.853] GetProcessHeap () returned 0x630000 [0073.853] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f10 [0073.853] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\p4jl5ff7Nm.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\p4jl5ff7nm.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0073.854] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=4801) returned 1 [0073.854] GetProcessHeap () returned 0x630000 [0073.854] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655670 [0073.854] GetProcessHeap () returned 0x630000 [0073.854] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0073.854] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\p4jl5ff7Nm.rtf") returned 63 [0073.854] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0073.854] GetProcessHeap () returned 0x630000 [0073.854] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0073.854] GetProcessHeap () returned 0x630000 [0073.854] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38f) returned 0x671e20 [0073.854] lstrlenA (lpString="rsa_encrypt") returned 11 [0073.854] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0073.854] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0073.854] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0073.855] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0073.855] GetProcessHeap () returned 0x630000 [0073.855] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0073.855] lstrlenA (lpString="010001") returned 6 [0073.855] GetProcessHeap () returned 0x630000 [0073.855] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a348 [0073.855] GetProcessHeap () returned 0x630000 [0073.855] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0073.855] GetProcessHeap () returned 0x630000 [0073.855] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e850 [0073.855] GetProcessHeap () returned 0x630000 [0073.855] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0073.855] GetProcessHeap () returned 0x630000 [0073.855] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0073.855] GetProcessHeap () returned 0x630000 [0073.855] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657558 [0073.855] GetProcessHeap () returned 0x630000 [0073.855] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0073.855] GetProcessHeap () returned 0x630000 [0073.855] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0073.855] GetProcessHeap () returned 0x630000 [0073.855] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.855] GetProcessHeap () returned 0x630000 [0073.855] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0073.855] GetProcessHeap () returned 0x630000 [0073.855] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0073.855] GetProcessHeap () returned 0x630000 [0073.855] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656a68 [0073.855] GetProcessHeap () returned 0x630000 [0073.855] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0073.855] GetProcessHeap () returned 0x630000 [0073.855] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0073.855] GetProcessHeap () returned 0x630000 [0073.855] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e8e0 [0073.855] GetProcessHeap () returned 0x630000 [0073.855] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0073.855] GetProcessHeap () returned 0x630000 [0073.855] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0073.855] GetProcessHeap () returned 0x630000 [0073.856] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0073.856] GetProcessHeap () returned 0x630000 [0073.856] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.856] GetProcessHeap () returned 0x630000 [0073.856] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65d048 [0073.856] GetProcessHeap () returned 0x630000 [0073.856] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0073.856] GetProcessHeap () returned 0x630000 [0073.856] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.856] GetProcessHeap () returned 0x630000 [0073.856] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.856] GetProcessHeap () returned 0x630000 [0073.856] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.856] GetProcessHeap () returned 0x630000 [0073.856] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e100 [0073.856] GetProcessHeap () returned 0x630000 [0073.856] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65d048 | out: hHeap=0x630000) returned 1 [0073.856] GetProcessHeap () returned 0x630000 [0073.856] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0073.856] GetProcessHeap () returned 0x630000 [0073.856] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0073.856] GetProcessHeap () returned 0x630000 [0073.856] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.856] GetProcessHeap () returned 0x630000 [0073.856] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.856] GetProcessHeap () returned 0x630000 [0073.856] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.856] GetProcessHeap () returned 0x630000 [0073.856] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.856] GetProcessHeap () returned 0x630000 [0073.856] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.856] GetProcessHeap () returned 0x630000 [0073.856] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.856] GetProcessHeap () returned 0x630000 [0073.856] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.856] GetProcessHeap () returned 0x630000 [0073.856] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.856] GetProcessHeap () returned 0x630000 [0073.856] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.856] GetProcessHeap () returned 0x630000 [0073.856] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.857] GetProcessHeap () returned 0x630000 [0073.857] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.857] GetProcessHeap () returned 0x630000 [0073.857] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.857] GetProcessHeap () returned 0x630000 [0073.857] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.857] GetProcessHeap () returned 0x630000 [0073.857] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.857] GetProcessHeap () returned 0x630000 [0073.857] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.857] GetProcessHeap () returned 0x630000 [0073.857] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.857] GetProcessHeap () returned 0x630000 [0073.857] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.857] GetProcessHeap () returned 0x630000 [0073.857] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.857] GetProcessHeap () returned 0x630000 [0073.857] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.857] GetProcessHeap () returned 0x630000 [0073.857] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.857] GetProcessHeap () returned 0x630000 [0073.857] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.857] GetProcessHeap () returned 0x630000 [0073.857] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.857] GetProcessHeap () returned 0x630000 [0073.857] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.857] GetProcessHeap () returned 0x630000 [0073.857] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.857] GetProcessHeap () returned 0x630000 [0073.857] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.857] GetProcessHeap () returned 0x630000 [0073.857] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.857] GetProcessHeap () returned 0x630000 [0073.857] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.857] GetProcessHeap () returned 0x630000 [0073.857] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.857] GetProcessHeap () returned 0x630000 [0073.858] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.858] GetProcessHeap () returned 0x630000 [0073.858] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.858] GetProcessHeap () returned 0x630000 [0073.858] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.858] GetProcessHeap () returned 0x630000 [0073.858] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.858] GetProcessHeap () returned 0x630000 [0073.858] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.858] GetProcessHeap () returned 0x630000 [0073.858] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.858] GetProcessHeap () returned 0x630000 [0073.858] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.858] GetProcessHeap () returned 0x630000 [0073.858] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.858] GetProcessHeap () returned 0x630000 [0073.858] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.858] GetProcessHeap () returned 0x630000 [0073.858] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.858] GetProcessHeap () returned 0x630000 [0073.858] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.858] GetProcessHeap () returned 0x630000 [0073.858] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.858] GetProcessHeap () returned 0x630000 [0073.858] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.858] GetProcessHeap () returned 0x630000 [0073.858] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.858] GetProcessHeap () returned 0x630000 [0073.858] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.858] GetProcessHeap () returned 0x630000 [0073.858] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.858] GetProcessHeap () returned 0x630000 [0073.858] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.858] GetProcessHeap () returned 0x630000 [0073.858] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.858] GetProcessHeap () returned 0x630000 [0073.858] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.858] GetProcessHeap () returned 0x630000 [0073.858] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.859] GetProcessHeap () returned 0x630000 [0073.859] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.859] GetProcessHeap () returned 0x630000 [0073.859] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.859] GetProcessHeap () returned 0x630000 [0073.859] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.859] GetProcessHeap () returned 0x630000 [0073.859] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.859] GetProcessHeap () returned 0x630000 [0073.859] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.859] GetProcessHeap () returned 0x630000 [0073.859] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.859] GetProcessHeap () returned 0x630000 [0073.859] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.859] GetProcessHeap () returned 0x630000 [0073.859] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.859] GetProcessHeap () returned 0x630000 [0073.859] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.859] GetProcessHeap () returned 0x630000 [0073.859] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.859] GetProcessHeap () returned 0x630000 [0073.859] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.859] GetProcessHeap () returned 0x630000 [0073.859] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.859] GetProcessHeap () returned 0x630000 [0073.859] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.859] GetProcessHeap () returned 0x630000 [0073.859] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.859] GetProcessHeap () returned 0x630000 [0073.859] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.859] GetProcessHeap () returned 0x630000 [0073.859] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.859] GetProcessHeap () returned 0x630000 [0073.859] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0073.859] GetProcessHeap () returned 0x630000 [0073.859] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0073.859] GetProcessHeap () returned 0x630000 [0073.859] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.859] GetProcessHeap () returned 0x630000 [0073.860] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.860] GetProcessHeap () returned 0x630000 [0073.860] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.860] GetProcessHeap () returned 0x630000 [0073.860] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.860] GetProcessHeap () returned 0x630000 [0073.860] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.860] GetProcessHeap () returned 0x630000 [0073.860] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.860] GetProcessHeap () returned 0x630000 [0073.860] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.860] GetProcessHeap () returned 0x630000 [0073.860] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.860] GetProcessHeap () returned 0x630000 [0073.860] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0073.860] GetProcessHeap () returned 0x630000 [0073.860] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0073.860] GetProcessHeap () returned 0x630000 [0073.860] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.860] GetProcessHeap () returned 0x630000 [0073.860] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.860] GetProcessHeap () returned 0x630000 [0073.860] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.860] GetProcessHeap () returned 0x630000 [0073.860] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.860] GetProcessHeap () returned 0x630000 [0073.860] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.860] GetProcessHeap () returned 0x630000 [0073.860] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.860] GetProcessHeap () returned 0x630000 [0073.860] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0073.860] GetProcessHeap () returned 0x630000 [0073.860] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0073.860] GetProcessHeap () returned 0x630000 [0073.860] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0073.860] GetProcessHeap () returned 0x630000 [0073.860] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0073.860] GetProcessHeap () returned 0x630000 [0073.860] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0073.861] GetProcessHeap () returned 0x630000 [0073.861] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0073.861] GetProcessHeap () returned 0x630000 [0073.861] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0073.861] GetProcessHeap () returned 0x630000 [0073.861] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0073.861] GetProcessHeap () returned 0x630000 [0073.861] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0073.861] GetProcessHeap () returned 0x630000 [0073.861] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.861] GetProcessHeap () returned 0x630000 [0073.861] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0073.861] WriteFile (in: hFile=0x230, lpBuffer=0x671e20*, nNumberOfBytesToWrite=0x38f, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x671e20*, lpNumberOfBytesWritten=0x243d864*=0x38f, lpOverlapped=0x0) returned 1 [0073.862] GetProcessHeap () returned 0x630000 [0073.862] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671e20, Size=0x30) returned 0x671e20 [0073.862] GetProcessHeap () returned 0x630000 [0073.862] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0073.862] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0073.863] GetProcessHeap () returned 0x630000 [0073.863] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12d0) returned 0x671e58 [0073.863] ReadFile (in: hFile=0x230, lpBuffer=0x671e58, nNumberOfBytesToRead=0x12d0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671e58*, lpNumberOfBytesRead=0x243d7e8*=0x12d0, lpOverlapped=0x0) returned 1 [0073.863] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0073.863] WriteFile (in: hFile=0x230, lpBuffer=0x671e58*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671e58*, lpNumberOfBytesWritten=0x243d7e4*=0x12d0, lpOverlapped=0x0) returned 1 [0073.864] GetProcessHeap () returned 0x630000 [0073.864] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671e58 | out: hHeap=0x630000) returned 1 [0073.864] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0073.865] WriteFile (in: hFile=0x230, lpBuffer=0x671e20*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x671e20*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0073.865] CloseHandle (hObject=0x230) returned 1 [0073.868] GetProcessHeap () returned 0x630000 [0073.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f10 | out: hHeap=0x630000) returned 1 [0073.868] GetProcessHeap () returned 0x630000 [0073.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655670 | out: hHeap=0x630000) returned 1 [0073.868] GetProcessHeap () returned 0x630000 [0073.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0073.868] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\p4jl5ff7Nm.rtf" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\p4jl5ff7Nm.rtf") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\p4jl5ff7Nm.rtf" [0073.868] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\p4jl5ff7Nm.rtf", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\p4jl5ff7Nm.rtf.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\p4jl5ff7Nm.rtf.happythreechoose" [0073.868] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\p4jl5ff7Nm.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\p4jl5ff7nm.rtf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\p4jl5ff7Nm.rtf.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\p4jl5ff7nm.rtf.happythreechoose"), dwFlags=0x1) returned 1 [0073.869] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\p4jl5ff7Nm.rtf" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ") returned 1 [0073.869] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\") returned="" [0073.869] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\Decryption INFO.html" [0073.869] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\decryption info.html")) returned 0x20 [0073.869] GetProcessHeap () returned 0x630000 [0073.869] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0073.869] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38249350, ftCreationTime.dwHighDateTime=0x1d5d4c3, ftLastAccessTime.dwLowDateTime=0x47c948c0, ftLastAccessTime.dwHighDateTime=0x1d5c909, ftLastWriteTime.dwLowDateTime=0x47c948c0, ftLastWriteTime.dwHighDateTime=0x1d5c909, nFileSizeHigh=0x0, nFileSizeLow=0x5b65, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Vlex.doc", cAlternateFileName="")) returned 1 [0073.869] lstrcmpiW (lpString1="Vlex.doc", lpString2=".") returned 1 [0073.869] lstrcmpiW (lpString1="Vlex.doc", lpString2="..") returned 1 [0073.869] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\", lpString2="Vlex.doc" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\Vlex.doc") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\Vlex.doc" [0073.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Vlex.doc", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0073.869] GetProcessHeap () returned 0x630000 [0073.869] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9) returned 0x64ca20 [0073.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Vlex.doc", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Vlex.doc", lpUsedDefaultChar=0x0) returned 9 [0073.869] lstrlenA (lpString="Vlex.doc") returned 8 [0073.869] lstrlenA (lpString=".happythreechoose") returned 17 [0073.869] lstrcmpiW (lpString1="Vlex.doc", lpString2="Decryption INFO.html") returned 1 [0073.869] lstrcmpiW (lpString1="Vlex.doc", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0073.869] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0073.869] lstrcmpiW (lpString1="Vlex.doc", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0073.869] GetProcessHeap () returned 0x630000 [0073.869] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0073.869] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\Vlex.doc" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\vlex.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0073.870] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=23397) returned 1 [0073.870] GetProcessHeap () returned 0x630000 [0073.870] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655850 [0073.870] GetProcessHeap () returned 0x630000 [0073.870] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0073.870] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\Vlex.doc") returned 57 [0073.870] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0073.870] GetProcessHeap () returned 0x630000 [0073.870] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0073.870] GetProcessHeap () returned 0x630000 [0073.870] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38b) returned 0x671e58 [0073.870] lstrlenA (lpString="rsa_encrypt") returned 11 [0073.870] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0073.870] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0073.871] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0073.871] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0073.871] GetProcessHeap () returned 0x630000 [0073.871] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0073.871] lstrlenA (lpString="010001") returned 6 [0073.871] GetProcessHeap () returned 0x630000 [0073.871] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a348 [0073.871] GetProcessHeap () returned 0x630000 [0073.871] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0073.871] GetProcessHeap () returned 0x630000 [0073.871] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65df50 [0073.871] GetProcessHeap () returned 0x630000 [0073.871] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0073.871] GetProcessHeap () returned 0x630000 [0073.871] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e190 [0073.871] GetProcessHeap () returned 0x630000 [0073.871] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657670 [0073.871] GetProcessHeap () returned 0x630000 [0073.871] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0073.871] GetProcessHeap () returned 0x630000 [0073.871] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0073.871] GetProcessHeap () returned 0x630000 [0073.871] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.871] GetProcessHeap () returned 0x630000 [0073.871] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0073.871] GetProcessHeap () returned 0x630000 [0073.871] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0073.871] GetProcessHeap () returned 0x630000 [0073.871] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656fe0 [0073.871] GetProcessHeap () returned 0x630000 [0073.871] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.871] GetProcessHeap () returned 0x630000 [0073.871] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0073.871] GetProcessHeap () returned 0x630000 [0073.871] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0073.871] GetProcessHeap () returned 0x630000 [0073.871] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0073.871] GetProcessHeap () returned 0x630000 [0073.871] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0073.871] GetProcessHeap () returned 0x630000 [0073.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0073.872] GetProcessHeap () returned 0x630000 [0073.872] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.872] GetProcessHeap () returned 0x630000 [0073.872] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65d078 [0073.872] GetProcessHeap () returned 0x630000 [0073.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.872] GetProcessHeap () returned 0x630000 [0073.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.872] GetProcessHeap () returned 0x630000 [0073.872] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.872] GetProcessHeap () returned 0x630000 [0073.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.872] GetProcessHeap () returned 0x630000 [0073.872] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ea00 [0073.872] GetProcessHeap () returned 0x630000 [0073.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65d078 | out: hHeap=0x630000) returned 1 [0073.872] GetProcessHeap () returned 0x630000 [0073.872] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0073.872] GetProcessHeap () returned 0x630000 [0073.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0073.872] GetProcessHeap () returned 0x630000 [0073.872] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0073.872] GetProcessHeap () returned 0x630000 [0073.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0073.872] GetProcessHeap () returned 0x630000 [0073.872] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.872] GetProcessHeap () returned 0x630000 [0073.873] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.873] GetProcessHeap () returned 0x630000 [0073.873] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0073.873] GetProcessHeap () returned 0x630000 [0073.873] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0073.873] GetProcessHeap () returned 0x630000 [0073.873] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.873] GetProcessHeap () returned 0x630000 [0073.873] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.873] GetProcessHeap () returned 0x630000 [0073.873] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.873] GetProcessHeap () returned 0x630000 [0073.873] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.873] GetProcessHeap () returned 0x630000 [0073.873] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.873] GetProcessHeap () returned 0x630000 [0073.873] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.873] GetProcessHeap () returned 0x630000 [0073.873] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.874] GetProcessHeap () returned 0x630000 [0073.874] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.874] GetProcessHeap () returned 0x630000 [0073.874] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.874] GetProcessHeap () returned 0x630000 [0073.874] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.874] GetProcessHeap () returned 0x630000 [0073.874] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0073.874] GetProcessHeap () returned 0x630000 [0073.874] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0073.874] GetProcessHeap () returned 0x630000 [0073.874] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.874] GetProcessHeap () returned 0x630000 [0073.874] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.874] GetProcessHeap () returned 0x630000 [0073.874] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.874] GetProcessHeap () returned 0x630000 [0073.874] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.874] GetProcessHeap () returned 0x630000 [0073.874] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.874] GetProcessHeap () returned 0x630000 [0073.874] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.874] GetProcessHeap () returned 0x630000 [0073.874] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.874] GetProcessHeap () returned 0x630000 [0073.874] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.874] GetProcessHeap () returned 0x630000 [0073.874] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.874] GetProcessHeap () returned 0x630000 [0073.874] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.874] GetProcessHeap () returned 0x630000 [0073.874] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.874] GetProcessHeap () returned 0x630000 [0073.874] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.874] GetProcessHeap () returned 0x630000 [0073.874] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.874] GetProcessHeap () returned 0x630000 [0073.874] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.874] GetProcessHeap () returned 0x630000 [0073.874] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.875] GetProcessHeap () returned 0x630000 [0073.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.875] GetProcessHeap () returned 0x630000 [0073.875] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.875] GetProcessHeap () returned 0x630000 [0073.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.875] GetProcessHeap () returned 0x630000 [0073.875] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.875] GetProcessHeap () returned 0x630000 [0073.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.875] GetProcessHeap () returned 0x630000 [0073.875] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.875] GetProcessHeap () returned 0x630000 [0073.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.875] GetProcessHeap () returned 0x630000 [0073.875] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0073.875] GetProcessHeap () returned 0x630000 [0073.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0073.875] GetProcessHeap () returned 0x630000 [0073.875] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.875] GetProcessHeap () returned 0x630000 [0073.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.875] GetProcessHeap () returned 0x630000 [0073.875] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0073.875] GetProcessHeap () returned 0x630000 [0073.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0073.875] GetProcessHeap () returned 0x630000 [0073.875] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.875] GetProcessHeap () returned 0x630000 [0073.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.875] GetProcessHeap () returned 0x630000 [0073.875] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.875] GetProcessHeap () returned 0x630000 [0073.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.875] GetProcessHeap () returned 0x630000 [0073.875] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.875] GetProcessHeap () returned 0x630000 [0073.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.875] GetProcessHeap () returned 0x630000 [0073.875] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.876] GetProcessHeap () returned 0x630000 [0073.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.876] GetProcessHeap () returned 0x630000 [0073.876] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.876] GetProcessHeap () returned 0x630000 [0073.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.876] GetProcessHeap () returned 0x630000 [0073.876] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.876] GetProcessHeap () returned 0x630000 [0073.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.876] GetProcessHeap () returned 0x630000 [0073.876] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.876] GetProcessHeap () returned 0x630000 [0073.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.876] GetProcessHeap () returned 0x630000 [0073.876] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.876] GetProcessHeap () returned 0x630000 [0073.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.876] GetProcessHeap () returned 0x630000 [0073.876] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.876] GetProcessHeap () returned 0x630000 [0073.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.876] GetProcessHeap () returned 0x630000 [0073.876] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0073.876] GetProcessHeap () returned 0x630000 [0073.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0073.876] GetProcessHeap () returned 0x630000 [0073.876] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.876] GetProcessHeap () returned 0x630000 [0073.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.876] GetProcessHeap () returned 0x630000 [0073.876] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0073.876] GetProcessHeap () returned 0x630000 [0073.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0073.876] GetProcessHeap () returned 0x630000 [0073.876] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.876] GetProcessHeap () returned 0x630000 [0073.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.876] GetProcessHeap () returned 0x630000 [0073.876] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.876] GetProcessHeap () returned 0x630000 [0073.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.877] GetProcessHeap () returned 0x630000 [0073.877] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.877] GetProcessHeap () returned 0x630000 [0073.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.877] GetProcessHeap () returned 0x630000 [0073.877] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.877] GetProcessHeap () returned 0x630000 [0073.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.877] GetProcessHeap () returned 0x630000 [0073.877] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.877] GetProcessHeap () returned 0x630000 [0073.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.877] GetProcessHeap () returned 0x630000 [0073.877] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0073.877] GetProcessHeap () returned 0x630000 [0073.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.877] GetProcessHeap () returned 0x630000 [0073.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0073.877] GetProcessHeap () returned 0x630000 [0073.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0073.877] GetProcessHeap () returned 0x630000 [0073.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0073.877] GetProcessHeap () returned 0x630000 [0073.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0073.877] GetProcessHeap () returned 0x630000 [0073.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0073.877] GetProcessHeap () returned 0x630000 [0073.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0073.877] GetProcessHeap () returned 0x630000 [0073.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0073.877] GetProcessHeap () returned 0x630000 [0073.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0073.877] GetProcessHeap () returned 0x630000 [0073.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0073.877] GetProcessHeap () returned 0x630000 [0073.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.877] GetProcessHeap () returned 0x630000 [0073.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0073.878] WriteFile (in: hFile=0x230, lpBuffer=0x671e58*, nNumberOfBytesToWrite=0x38b, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x671e58*, lpNumberOfBytesWritten=0x243d864*=0x38b, lpOverlapped=0x0) returned 1 [0073.879] GetProcessHeap () returned 0x630000 [0073.879] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671e58, Size=0x30) returned 0x671e58 [0073.879] GetProcessHeap () returned 0x630000 [0073.879] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0073.880] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0073.880] GetProcessHeap () returned 0x630000 [0073.880] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5b70) returned 0x671e90 [0073.880] ReadFile (in: hFile=0x230, lpBuffer=0x671e90, nNumberOfBytesToRead=0x5b70, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671e90*, lpNumberOfBytesRead=0x243d7e8*=0x5b70, lpOverlapped=0x0) returned 1 [0073.880] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0073.880] WriteFile (in: hFile=0x230, lpBuffer=0x671e90*, nNumberOfBytesToWrite=0x5b70, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671e90*, lpNumberOfBytesWritten=0x243d7e4*=0x5b70, lpOverlapped=0x0) returned 1 [0073.881] GetProcessHeap () returned 0x630000 [0073.881] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671e90 | out: hHeap=0x630000) returned 1 [0073.881] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0073.881] WriteFile (in: hFile=0x230, lpBuffer=0x671e58*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x671e58*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0073.882] CloseHandle (hObject=0x230) returned 1 [0073.882] GetProcessHeap () returned 0x630000 [0073.882] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0073.882] GetProcessHeap () returned 0x630000 [0073.882] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655850 | out: hHeap=0x630000) returned 1 [0073.882] GetProcessHeap () returned 0x630000 [0073.882] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0073.882] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\Vlex.doc" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\Vlex.doc") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\Vlex.doc" [0073.883] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\Vlex.doc", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\Vlex.doc.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\Vlex.doc.happythreechoose" [0073.883] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\Vlex.doc" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\vlex.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\Vlex.doc.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\vlex.doc.happythreechoose"), dwFlags=0x1) returned 1 [0073.883] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\Vlex.doc" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ") returned 1 [0073.883] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\") returned="" [0073.883] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\Decryption INFO.html" [0073.883] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\decryption info.html")) returned 0x20 [0073.883] GetProcessHeap () returned 0x630000 [0073.883] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0073.883] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd6a6e0, ftCreationTime.dwHighDateTime=0x1d5ccf0, ftLastAccessTime.dwLowDateTime=0x4db53be0, ftLastAccessTime.dwHighDateTime=0x1d5ce31, ftLastWriteTime.dwLowDateTime=0x4db53be0, ftLastWriteTime.dwHighDateTime=0x1d5ce31, nFileSizeHigh=0x0, nFileSizeLow=0x10e8a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="W6N7f5.rtf", cAlternateFileName="")) returned 1 [0073.883] lstrcmpiW (lpString1="W6N7f5.rtf", lpString2=".") returned 1 [0073.883] lstrcmpiW (lpString1="W6N7f5.rtf", lpString2="..") returned 1 [0073.883] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\", lpString2="W6N7f5.rtf" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\W6N7f5.rtf") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\W6N7f5.rtf" [0073.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="W6N7f5.rtf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0073.884] GetProcessHeap () returned 0x630000 [0073.884] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb) returned 0x64c9f0 [0073.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="W6N7f5.rtf", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="W6N7f5.rtf", lpUsedDefaultChar=0x0) returned 11 [0073.884] lstrlenA (lpString="W6N7f5.rtf") returned 10 [0073.884] lstrlenA (lpString=".happythreechoose") returned 17 [0073.884] lstrcmpiW (lpString1="W6N7f5.rtf", lpString2="Decryption INFO.html") returned 1 [0073.884] lstrcmpiW (lpString1="W6N7f5.rtf", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0073.884] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0073.884] lstrcmpiW (lpString1="W6N7f5.rtf", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0073.884] GetProcessHeap () returned 0x630000 [0073.884] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0073.884] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\W6N7f5.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\w6n7f5.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0073.884] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=69258) returned 1 [0073.884] GetProcessHeap () returned 0x630000 [0073.884] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655670 [0073.884] GetProcessHeap () returned 0x630000 [0073.884] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0073.884] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\W6N7f5.rtf") returned 59 [0073.884] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0073.884] GetProcessHeap () returned 0x630000 [0073.884] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0073.884] GetProcessHeap () returned 0x630000 [0073.884] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x386) returned 0x671e90 [0073.884] lstrlenA (lpString="rsa_encrypt") returned 11 [0073.884] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0073.885] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0073.885] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0073.885] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0073.885] GetProcessHeap () returned 0x630000 [0073.885] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0073.885] lstrlenA (lpString="010001") returned 6 [0073.885] GetProcessHeap () returned 0x630000 [0073.885] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0073.885] GetProcessHeap () returned 0x630000 [0073.885] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0073.885] GetProcessHeap () returned 0x630000 [0073.885] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dfe0 [0073.885] GetProcessHeap () returned 0x630000 [0073.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0073.885] GetProcessHeap () returned 0x630000 [0073.885] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dec0 [0073.885] GetProcessHeap () returned 0x630000 [0073.885] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656b80 [0073.885] GetProcessHeap () returned 0x630000 [0073.885] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2b8 [0073.885] GetProcessHeap () returned 0x630000 [0073.885] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0073.885] GetProcessHeap () returned 0x630000 [0073.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.886] GetProcessHeap () returned 0x630000 [0073.886] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0073.886] GetProcessHeap () returned 0x630000 [0073.886] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0073.886] GetProcessHeap () returned 0x630000 [0073.886] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657328 [0073.886] GetProcessHeap () returned 0x630000 [0073.886] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.886] GetProcessHeap () returned 0x630000 [0073.886] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0073.886] GetProcessHeap () returned 0x630000 [0073.886] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e610 [0073.886] GetProcessHeap () returned 0x630000 [0073.886] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0073.886] GetProcessHeap () returned 0x630000 [0073.886] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0073.886] GetProcessHeap () returned 0x630000 [0073.886] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0073.886] GetProcessHeap () returned 0x630000 [0073.886] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.886] GetProcessHeap () returned 0x630000 [0073.886] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cdf0 [0073.886] GetProcessHeap () returned 0x630000 [0073.886] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.886] GetProcessHeap () returned 0x630000 [0073.886] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.886] GetProcessHeap () returned 0x630000 [0073.886] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.886] GetProcessHeap () returned 0x630000 [0073.886] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.886] GetProcessHeap () returned 0x630000 [0073.886] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ea90 [0073.886] GetProcessHeap () returned 0x630000 [0073.886] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cdf0 | out: hHeap=0x630000) returned 1 [0073.886] GetProcessHeap () returned 0x630000 [0073.886] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0073.886] GetProcessHeap () returned 0x630000 [0073.886] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea90 | out: hHeap=0x630000) returned 1 [0073.886] GetProcessHeap () returned 0x630000 [0073.886] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.886] GetProcessHeap () returned 0x630000 [0073.886] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.887] GetProcessHeap () returned 0x630000 [0073.887] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.887] GetProcessHeap () returned 0x630000 [0073.887] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.887] GetProcessHeap () returned 0x630000 [0073.887] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0073.887] GetProcessHeap () returned 0x630000 [0073.887] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0073.887] GetProcessHeap () returned 0x630000 [0073.887] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.887] GetProcessHeap () returned 0x630000 [0073.887] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.887] GetProcessHeap () returned 0x630000 [0073.887] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0073.887] GetProcessHeap () returned 0x630000 [0073.887] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0073.887] GetProcessHeap () returned 0x630000 [0073.887] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.887] GetProcessHeap () returned 0x630000 [0073.887] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.887] GetProcessHeap () returned 0x630000 [0073.887] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.887] GetProcessHeap () returned 0x630000 [0073.887] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.887] GetProcessHeap () returned 0x630000 [0073.887] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.887] GetProcessHeap () returned 0x630000 [0073.887] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.887] GetProcessHeap () returned 0x630000 [0073.887] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.887] GetProcessHeap () returned 0x630000 [0073.887] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.887] GetProcessHeap () returned 0x630000 [0073.887] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0073.887] GetProcessHeap () returned 0x630000 [0073.887] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0073.887] GetProcessHeap () returned 0x630000 [0073.887] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.887] GetProcessHeap () returned 0x630000 [0073.887] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.887] GetProcessHeap () returned 0x630000 [0073.888] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.888] GetProcessHeap () returned 0x630000 [0073.888] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.888] GetProcessHeap () returned 0x630000 [0073.888] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.888] GetProcessHeap () returned 0x630000 [0073.888] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.888] GetProcessHeap () returned 0x630000 [0073.888] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.888] GetProcessHeap () returned 0x630000 [0073.888] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.888] GetProcessHeap () returned 0x630000 [0073.888] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0073.888] GetProcessHeap () returned 0x630000 [0073.888] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0073.888] GetProcessHeap () returned 0x630000 [0073.888] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.888] GetProcessHeap () returned 0x630000 [0073.888] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.888] GetProcessHeap () returned 0x630000 [0073.888] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.888] GetProcessHeap () returned 0x630000 [0073.888] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.888] GetProcessHeap () returned 0x630000 [0073.888] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.888] GetProcessHeap () returned 0x630000 [0073.888] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.888] GetProcessHeap () returned 0x630000 [0073.888] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.888] GetProcessHeap () returned 0x630000 [0073.888] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.888] GetProcessHeap () returned 0x630000 [0073.888] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.888] GetProcessHeap () returned 0x630000 [0073.888] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.888] GetProcessHeap () returned 0x630000 [0073.889] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.889] GetProcessHeap () returned 0x630000 [0073.889] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.889] GetProcessHeap () returned 0x630000 [0073.889] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.889] GetProcessHeap () returned 0x630000 [0073.889] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.889] GetProcessHeap () returned 0x630000 [0073.889] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.889] GetProcessHeap () returned 0x630000 [0073.889] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.889] GetProcessHeap () returned 0x630000 [0073.889] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.889] GetProcessHeap () returned 0x630000 [0073.889] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.889] GetProcessHeap () returned 0x630000 [0073.889] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.889] GetProcessHeap () returned 0x630000 [0073.889] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.889] GetProcessHeap () returned 0x630000 [0073.889] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.889] GetProcessHeap () returned 0x630000 [0073.889] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.889] GetProcessHeap () returned 0x630000 [0073.889] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.889] GetProcessHeap () returned 0x630000 [0073.889] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.889] GetProcessHeap () returned 0x630000 [0073.889] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.889] GetProcessHeap () returned 0x630000 [0073.889] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.889] GetProcessHeap () returned 0x630000 [0073.889] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.889] GetProcessHeap () returned 0x630000 [0073.889] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.889] GetProcessHeap () returned 0x630000 [0073.889] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.889] GetProcessHeap () returned 0x630000 [0073.889] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.889] GetProcessHeap () returned 0x630000 [0073.890] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0073.890] GetProcessHeap () returned 0x630000 [0073.890] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0073.890] GetProcessHeap () returned 0x630000 [0073.890] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.890] GetProcessHeap () returned 0x630000 [0073.890] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.890] GetProcessHeap () returned 0x630000 [0073.890] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.890] GetProcessHeap () returned 0x630000 [0073.890] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.890] GetProcessHeap () returned 0x630000 [0073.890] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.890] GetProcessHeap () returned 0x630000 [0073.890] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.890] GetProcessHeap () returned 0x630000 [0073.890] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.890] GetProcessHeap () returned 0x630000 [0073.890] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.890] GetProcessHeap () returned 0x630000 [0073.890] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.890] GetProcessHeap () returned 0x630000 [0073.890] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.890] GetProcessHeap () returned 0x630000 [0073.890] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.890] GetProcessHeap () returned 0x630000 [0073.890] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.890] GetProcessHeap () returned 0x630000 [0073.890] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.890] GetProcessHeap () returned 0x630000 [0073.890] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.890] GetProcessHeap () returned 0x630000 [0073.890] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.890] GetProcessHeap () returned 0x630000 [0073.890] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.890] GetProcessHeap () returned 0x630000 [0073.890] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.890] GetProcessHeap () returned 0x630000 [0073.890] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.890] GetProcessHeap () returned 0x630000 [0073.891] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.891] GetProcessHeap () returned 0x630000 [0073.891] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.891] GetProcessHeap () returned 0x630000 [0073.891] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0073.891] GetProcessHeap () returned 0x630000 [0073.891] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0073.891] GetProcessHeap () returned 0x630000 [0073.891] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0073.891] GetProcessHeap () returned 0x630000 [0073.891] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0073.891] GetProcessHeap () returned 0x630000 [0073.891] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0073.891] GetProcessHeap () returned 0x630000 [0073.891] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0073.891] GetProcessHeap () returned 0x630000 [0073.891] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0073.891] GetProcessHeap () returned 0x630000 [0073.891] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0073.891] GetProcessHeap () returned 0x630000 [0073.891] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0073.891] GetProcessHeap () returned 0x630000 [0073.891] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.891] GetProcessHeap () returned 0x630000 [0073.891] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0073.891] WriteFile (in: hFile=0x230, lpBuffer=0x671e90*, nNumberOfBytesToWrite=0x386, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x671e90*, lpNumberOfBytesWritten=0x243d864*=0x386, lpOverlapped=0x0) returned 1 [0073.893] GetProcessHeap () returned 0x630000 [0073.893] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671e90, Size=0x30) returned 0x671e90 [0073.893] GetProcessHeap () returned 0x630000 [0073.893] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0073.893] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0073.893] GetProcessHeap () returned 0x630000 [0073.893] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10e90) returned 0x671ec8 [0073.893] ReadFile (in: hFile=0x230, lpBuffer=0x671ec8, nNumberOfBytesToRead=0x10e90, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671ec8*, lpNumberOfBytesRead=0x243d7e8*=0x10e90, lpOverlapped=0x0) returned 1 [0073.894] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0073.894] WriteFile (in: hFile=0x230, lpBuffer=0x671ec8*, nNumberOfBytesToWrite=0x10e90, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671ec8*, lpNumberOfBytesWritten=0x243d7e4*=0x10e90, lpOverlapped=0x0) returned 1 [0073.895] GetProcessHeap () returned 0x630000 [0073.895] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671ec8 | out: hHeap=0x630000) returned 1 [0073.897] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0073.897] WriteFile (in: hFile=0x230, lpBuffer=0x671e90*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x671e90*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0073.897] CloseHandle (hObject=0x230) returned 1 [0073.898] GetProcessHeap () returned 0x630000 [0073.898] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0073.898] GetProcessHeap () returned 0x630000 [0073.898] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655670 | out: hHeap=0x630000) returned 1 [0073.898] GetProcessHeap () returned 0x630000 [0073.898] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0073.898] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\W6N7f5.rtf" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\W6N7f5.rtf") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\W6N7f5.rtf" [0073.898] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\W6N7f5.rtf", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\W6N7f5.rtf.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\W6N7f5.rtf.happythreechoose" [0073.898] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\W6N7f5.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\w6n7f5.rtf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\W6N7f5.rtf.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\w6n7f5.rtf.happythreechoose"), dwFlags=0x1) returned 1 [0073.899] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\W6N7f5.rtf" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ") returned 1 [0073.899] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\") returned="" [0073.899] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\Decryption INFO.html" [0073.899] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\decryption info.html")) returned 0x20 [0073.899] GetProcessHeap () returned 0x630000 [0073.899] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0073.899] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2828d030, ftCreationTime.dwHighDateTime=0x1d5d5e8, ftLastAccessTime.dwLowDateTime=0xf3145c20, ftLastAccessTime.dwHighDateTime=0x1d5d48e, ftLastWriteTime.dwLowDateTime=0xf3145c20, ftLastWriteTime.dwHighDateTime=0x1d5d48e, nFileSizeHigh=0x0, nFileSizeLow=0xec99, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WRPipGMpYkP.pptx", cAlternateFileName="WRPIPG~1.PPT")) returned 1 [0073.899] lstrcmpiW (lpString1="WRPipGMpYkP.pptx", lpString2=".") returned 1 [0073.899] lstrcmpiW (lpString1="WRPipGMpYkP.pptx", lpString2="..") returned 1 [0073.899] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\", lpString2="WRPipGMpYkP.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\WRPipGMpYkP.pptx") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\WRPipGMpYkP.pptx" [0073.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WRPipGMpYkP.pptx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0073.899] GetProcessHeap () returned 0x630000 [0073.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11) returned 0x645c58 [0073.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WRPipGMpYkP.pptx", cchWideChar=-1, lpMultiByteStr=0x645c58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WRPipGMpYkP.pptx", lpUsedDefaultChar=0x0) returned 17 [0073.899] lstrlenA (lpString="WRPipGMpYkP.pptx") returned 16 [0073.899] lstrlenA (lpString=".happythreechoose") returned 17 [0073.899] lstrcmpiW (lpString1="WRPipGMpYkP.pptx", lpString2="Decryption INFO.html") returned 1 [0073.899] lstrcmpiW (lpString1="WRPipGMpYkP.pptx", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0073.899] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0073.899] lstrcmpiW (lpString1="WRPipGMpYkP.pptx", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0073.899] GetProcessHeap () returned 0x630000 [0073.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x652000 [0073.899] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\WRPipGMpYkP.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\wrpipgmpykp.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0073.899] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=60569) returned 1 [0073.899] GetProcessHeap () returned 0x630000 [0073.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655940 [0073.900] GetProcessHeap () returned 0x630000 [0073.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0073.900] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\WRPipGMpYkP.pptx") returned 65 [0073.900] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0073.900] GetProcessHeap () returned 0x630000 [0073.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0073.900] GetProcessHeap () returned 0x630000 [0073.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x671ec8 [0073.905] lstrlenA (lpString="rsa_encrypt") returned 11 [0073.905] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0073.905] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0073.905] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0073.905] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0073.905] GetProcessHeap () returned 0x630000 [0073.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0073.905] lstrlenA (lpString="010001") returned 6 [0073.905] GetProcessHeap () returned 0x630000 [0073.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0073.905] GetProcessHeap () returned 0x630000 [0073.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0073.905] GetProcessHeap () returned 0x630000 [0073.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e6a0 [0073.905] GetProcessHeap () returned 0x630000 [0073.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0073.906] GetProcessHeap () returned 0x630000 [0073.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e970 [0073.906] GetProcessHeap () returned 0x630000 [0073.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656c98 [0073.906] GetProcessHeap () returned 0x630000 [0073.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0073.906] GetProcessHeap () returned 0x630000 [0073.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0073.906] GetProcessHeap () returned 0x630000 [0073.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.906] GetProcessHeap () returned 0x630000 [0073.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0073.906] GetProcessHeap () returned 0x630000 [0073.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0073.906] GetProcessHeap () returned 0x630000 [0073.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656db0 [0073.906] GetProcessHeap () returned 0x630000 [0073.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.906] GetProcessHeap () returned 0x630000 [0073.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0073.906] GetProcessHeap () returned 0x630000 [0073.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e730 [0073.906] GetProcessHeap () returned 0x630000 [0073.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0073.906] GetProcessHeap () returned 0x630000 [0073.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0073.906] GetProcessHeap () returned 0x630000 [0073.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0073.906] GetProcessHeap () returned 0x630000 [0073.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.906] GetProcessHeap () returned 0x630000 [0073.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0073.906] GetProcessHeap () returned 0x630000 [0073.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.906] GetProcessHeap () returned 0x630000 [0073.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.906] GetProcessHeap () returned 0x630000 [0073.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.906] GetProcessHeap () returned 0x630000 [0073.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.906] GetProcessHeap () returned 0x630000 [0073.907] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e610 [0073.907] GetProcessHeap () returned 0x630000 [0073.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0073.907] GetProcessHeap () returned 0x630000 [0073.907] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0073.907] GetProcessHeap () returned 0x630000 [0073.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0073.907] GetProcessHeap () returned 0x630000 [0073.907] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.907] GetProcessHeap () returned 0x630000 [0073.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.907] GetProcessHeap () returned 0x630000 [0073.907] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.907] GetProcessHeap () returned 0x630000 [0073.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.907] GetProcessHeap () returned 0x630000 [0073.907] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.907] GetProcessHeap () returned 0x630000 [0073.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.907] GetProcessHeap () returned 0x630000 [0073.907] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.907] GetProcessHeap () returned 0x630000 [0073.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.907] GetProcessHeap () returned 0x630000 [0073.907] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0073.907] GetProcessHeap () returned 0x630000 [0073.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0073.907] GetProcessHeap () returned 0x630000 [0073.907] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.907] GetProcessHeap () returned 0x630000 [0073.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.907] GetProcessHeap () returned 0x630000 [0073.907] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.907] GetProcessHeap () returned 0x630000 [0073.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.908] GetProcessHeap () returned 0x630000 [0073.908] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.908] GetProcessHeap () returned 0x630000 [0073.908] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.908] GetProcessHeap () returned 0x630000 [0073.908] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.908] GetProcessHeap () returned 0x630000 [0073.908] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.908] GetProcessHeap () returned 0x630000 [0073.908] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.908] GetProcessHeap () returned 0x630000 [0073.908] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.908] GetProcessHeap () returned 0x630000 [0073.908] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.908] GetProcessHeap () returned 0x630000 [0073.908] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.908] GetProcessHeap () returned 0x630000 [0073.908] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.908] GetProcessHeap () returned 0x630000 [0073.908] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.908] GetProcessHeap () returned 0x630000 [0073.908] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0073.908] GetProcessHeap () returned 0x630000 [0073.908] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0073.908] GetProcessHeap () returned 0x630000 [0073.908] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.908] GetProcessHeap () returned 0x630000 [0073.908] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.908] GetProcessHeap () returned 0x630000 [0073.908] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.908] GetProcessHeap () returned 0x630000 [0073.908] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.908] GetProcessHeap () returned 0x630000 [0073.909] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.909] GetProcessHeap () returned 0x630000 [0073.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.909] GetProcessHeap () returned 0x630000 [0073.909] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.909] GetProcessHeap () returned 0x630000 [0073.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.909] GetProcessHeap () returned 0x630000 [0073.909] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0073.909] GetProcessHeap () returned 0x630000 [0073.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0073.909] GetProcessHeap () returned 0x630000 [0073.909] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.909] GetProcessHeap () returned 0x630000 [0073.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.909] GetProcessHeap () returned 0x630000 [0073.909] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.909] GetProcessHeap () returned 0x630000 [0073.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.909] GetProcessHeap () returned 0x630000 [0073.909] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.909] GetProcessHeap () returned 0x630000 [0073.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.909] GetProcessHeap () returned 0x630000 [0073.909] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0073.909] GetProcessHeap () returned 0x630000 [0073.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0073.909] GetProcessHeap () returned 0x630000 [0073.909] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.909] GetProcessHeap () returned 0x630000 [0073.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.909] GetProcessHeap () returned 0x630000 [0073.909] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.909] GetProcessHeap () returned 0x630000 [0073.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.909] GetProcessHeap () returned 0x630000 [0073.909] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.909] GetProcessHeap () returned 0x630000 [0073.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.910] GetProcessHeap () returned 0x630000 [0073.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.910] GetProcessHeap () returned 0x630000 [0073.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.910] GetProcessHeap () returned 0x630000 [0073.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.910] GetProcessHeap () returned 0x630000 [0073.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.910] GetProcessHeap () returned 0x630000 [0073.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.910] GetProcessHeap () returned 0x630000 [0073.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.910] GetProcessHeap () returned 0x630000 [0073.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.910] GetProcessHeap () returned 0x630000 [0073.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.910] GetProcessHeap () returned 0x630000 [0073.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.910] GetProcessHeap () returned 0x630000 [0073.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.910] GetProcessHeap () returned 0x630000 [0073.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.910] GetProcessHeap () returned 0x630000 [0073.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.910] GetProcessHeap () returned 0x630000 [0073.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.910] GetProcessHeap () returned 0x630000 [0073.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.910] GetProcessHeap () returned 0x630000 [0073.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.910] GetProcessHeap () returned 0x630000 [0073.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.910] GetProcessHeap () returned 0x630000 [0073.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.910] GetProcessHeap () returned 0x630000 [0073.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.910] GetProcessHeap () returned 0x630000 [0073.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.910] GetProcessHeap () returned 0x630000 [0073.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.911] GetProcessHeap () returned 0x630000 [0073.911] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.911] GetProcessHeap () returned 0x630000 [0073.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.911] GetProcessHeap () returned 0x630000 [0073.911] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.911] GetProcessHeap () returned 0x630000 [0073.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.911] GetProcessHeap () returned 0x630000 [0073.911] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.911] GetProcessHeap () returned 0x630000 [0073.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.911] GetProcessHeap () returned 0x630000 [0073.911] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.911] GetProcessHeap () returned 0x630000 [0073.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.911] GetProcessHeap () returned 0x630000 [0073.911] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.911] GetProcessHeap () returned 0x630000 [0073.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.911] GetProcessHeap () returned 0x630000 [0073.911] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.911] GetProcessHeap () returned 0x630000 [0073.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.911] GetProcessHeap () returned 0x630000 [0073.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0073.911] GetProcessHeap () returned 0x630000 [0073.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0073.911] GetProcessHeap () returned 0x630000 [0073.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0073.911] GetProcessHeap () returned 0x630000 [0073.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0073.911] GetProcessHeap () returned 0x630000 [0073.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0073.911] GetProcessHeap () returned 0x630000 [0073.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0073.912] GetProcessHeap () returned 0x630000 [0073.912] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0073.912] GetProcessHeap () returned 0x630000 [0073.912] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e6a0 | out: hHeap=0x630000) returned 1 [0073.912] GetProcessHeap () returned 0x630000 [0073.912] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0073.912] GetProcessHeap () returned 0x630000 [0073.912] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.912] GetProcessHeap () returned 0x630000 [0073.912] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0073.912] WriteFile (in: hFile=0x230, lpBuffer=0x671ec8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x671ec8*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0073.915] GetProcessHeap () returned 0x630000 [0073.915] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671ec8, Size=0x30) returned 0x671ec8 [0073.915] GetProcessHeap () returned 0x630000 [0073.915] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0073.915] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0073.915] GetProcessHeap () returned 0x630000 [0073.915] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xec99) returned 0x671f00 [0073.916] ReadFile (in: hFile=0x230, lpBuffer=0x671f00, nNumberOfBytesToRead=0xec99, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671f00*, lpNumberOfBytesRead=0x243d7e8*=0xec99, lpOverlapped=0x0) returned 1 [0073.917] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0073.917] WriteFile (in: hFile=0x230, lpBuffer=0x671f00*, nNumberOfBytesToWrite=0xec99, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671f00*, lpNumberOfBytesWritten=0x243d7e4*=0xec99, lpOverlapped=0x0) returned 1 [0073.921] GetProcessHeap () returned 0x630000 [0073.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671f00 | out: hHeap=0x630000) returned 1 [0073.922] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0073.922] WriteFile (in: hFile=0x230, lpBuffer=0x671ec8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x671ec8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0073.924] CloseHandle (hObject=0x230) returned 1 [0073.924] GetProcessHeap () returned 0x630000 [0073.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x652000 | out: hHeap=0x630000) returned 1 [0073.924] GetProcessHeap () returned 0x630000 [0073.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655940 | out: hHeap=0x630000) returned 1 [0073.924] GetProcessHeap () returned 0x630000 [0073.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0073.924] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\WRPipGMpYkP.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\WRPipGMpYkP.pptx") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\WRPipGMpYkP.pptx" [0073.924] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\WRPipGMpYkP.pptx", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\WRPipGMpYkP.pptx.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\WRPipGMpYkP.pptx.happythreechoose" [0073.924] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\WRPipGMpYkP.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\wrpipgmpykp.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\WRPipGMpYkP.pptx.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\wrpipgmpykp.pptx.happythreechoose"), dwFlags=0x1) returned 1 [0073.925] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\WRPipGMpYkP.pptx" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ") returned 1 [0073.925] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\") returned="" [0073.925] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\Decryption INFO.html" [0073.925] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\decryption info.html")) returned 0x20 [0073.925] GetProcessHeap () returned 0x630000 [0073.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645c58 | out: hHeap=0x630000) returned 1 [0073.925] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4b678d0, ftCreationTime.dwHighDateTime=0x1d5cc3c, ftLastAccessTime.dwLowDateTime=0xf926ace0, ftLastAccessTime.dwHighDateTime=0x1d5cb19, ftLastWriteTime.dwLowDateTime=0xf926ace0, ftLastWriteTime.dwHighDateTime=0x1d5cb19, nFileSizeHigh=0x0, nFileSizeLow=0x4186, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="xdGoot-fXC_I.ppt", cAlternateFileName="XDGOOT~1.PPT")) returned 1 [0073.925] lstrcmpiW (lpString1="xdGoot-fXC_I.ppt", lpString2=".") returned 1 [0073.925] lstrcmpiW (lpString1="xdGoot-fXC_I.ppt", lpString2="..") returned 1 [0073.925] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\", lpString2="xdGoot-fXC_I.ppt" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\xdGoot-fXC_I.ppt") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\xdGoot-fXC_I.ppt" [0073.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="xdGoot-fXC_I.ppt", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0073.925] GetProcessHeap () returned 0x630000 [0073.925] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11) returned 0x645d18 [0073.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="xdGoot-fXC_I.ppt", cchWideChar=-1, lpMultiByteStr=0x645d18, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xdGoot-fXC_I.ppt", lpUsedDefaultChar=0x0) returned 17 [0073.925] lstrlenA (lpString="xdGoot-fXC_I.ppt") returned 16 [0073.925] lstrlenA (lpString=".happythreechoose") returned 17 [0073.925] lstrcmpiW (lpString1="xdGoot-fXC_I.ppt", lpString2="Decryption INFO.html") returned 1 [0073.925] lstrcmpiW (lpString1="xdGoot-fXC_I.ppt", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0073.925] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0073.925] lstrcmpiW (lpString1="xdGoot-fXC_I.ppt", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0073.925] GetProcessHeap () returned 0x630000 [0073.925] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0073.925] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\xdGoot-fXC_I.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\xdgoot-fxc_i.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0073.926] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=16774) returned 1 [0073.926] GetProcessHeap () returned 0x630000 [0073.926] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6556e8 [0073.926] GetProcessHeap () returned 0x630000 [0073.926] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0073.926] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\xdGoot-fXC_I.ppt") returned 65 [0073.926] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0073.926] GetProcessHeap () returned 0x630000 [0073.926] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0073.926] GetProcessHeap () returned 0x630000 [0073.926] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38a) returned 0x671f00 [0073.926] lstrlenA (lpString="rsa_encrypt") returned 11 [0073.926] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0073.926] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0073.927] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0073.927] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0073.927] GetProcessHeap () returned 0x630000 [0073.927] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0073.927] lstrlenA (lpString="010001") returned 6 [0073.927] GetProcessHeap () returned 0x630000 [0073.927] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0073.927] GetProcessHeap () returned 0x630000 [0073.927] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0073.927] GetProcessHeap () returned 0x630000 [0073.927] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e610 [0073.927] GetProcessHeap () returned 0x630000 [0073.927] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0073.927] GetProcessHeap () returned 0x630000 [0073.927] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ebb0 [0073.927] GetProcessHeap () returned 0x630000 [0073.927] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657788 [0073.927] GetProcessHeap () returned 0x630000 [0073.927] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0073.927] GetProcessHeap () returned 0x630000 [0073.927] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0073.927] GetProcessHeap () returned 0x630000 [0073.927] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.927] GetProcessHeap () returned 0x630000 [0073.927] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0073.927] GetProcessHeap () returned 0x630000 [0073.927] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0073.927] GetProcessHeap () returned 0x630000 [0073.927] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656c98 [0073.927] GetProcessHeap () returned 0x630000 [0073.927] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.927] GetProcessHeap () returned 0x630000 [0073.927] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0073.927] GetProcessHeap () returned 0x630000 [0073.927] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e190 [0073.927] GetProcessHeap () returned 0x630000 [0073.927] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0073.927] GetProcessHeap () returned 0x630000 [0073.927] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0073.927] GetProcessHeap () returned 0x630000 [0073.928] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0073.928] GetProcessHeap () returned 0x630000 [0073.928] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.928] GetProcessHeap () returned 0x630000 [0073.928] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0073.928] GetProcessHeap () returned 0x630000 [0073.928] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.928] GetProcessHeap () returned 0x630000 [0073.928] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.928] GetProcessHeap () returned 0x630000 [0073.928] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.928] GetProcessHeap () returned 0x630000 [0073.928] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.928] GetProcessHeap () returned 0x630000 [0073.928] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e4f0 [0073.928] GetProcessHeap () returned 0x630000 [0073.928] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0073.928] GetProcessHeap () returned 0x630000 [0073.928] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0073.928] GetProcessHeap () returned 0x630000 [0073.928] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0073.928] GetProcessHeap () returned 0x630000 [0073.928] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.928] GetProcessHeap () returned 0x630000 [0073.928] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.928] GetProcessHeap () returned 0x630000 [0073.928] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.928] GetProcessHeap () returned 0x630000 [0073.928] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.928] GetProcessHeap () returned 0x630000 [0073.928] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0073.928] GetProcessHeap () returned 0x630000 [0073.928] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0073.928] GetProcessHeap () returned 0x630000 [0073.928] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.928] GetProcessHeap () returned 0x630000 [0073.928] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.928] GetProcessHeap () returned 0x630000 [0073.928] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.928] GetProcessHeap () returned 0x630000 [0073.928] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.929] GetProcessHeap () returned 0x630000 [0073.929] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.929] GetProcessHeap () returned 0x630000 [0073.929] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.929] GetProcessHeap () returned 0x630000 [0073.929] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.929] GetProcessHeap () returned 0x630000 [0073.929] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.929] GetProcessHeap () returned 0x630000 [0073.929] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.929] GetProcessHeap () returned 0x630000 [0073.929] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.929] GetProcessHeap () returned 0x630000 [0073.929] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.929] GetProcessHeap () returned 0x630000 [0073.929] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.929] GetProcessHeap () returned 0x630000 [0073.929] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0073.929] GetProcessHeap () returned 0x630000 [0073.929] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0073.929] GetProcessHeap () returned 0x630000 [0073.929] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.929] GetProcessHeap () returned 0x630000 [0073.929] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.929] GetProcessHeap () returned 0x630000 [0073.929] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.929] GetProcessHeap () returned 0x630000 [0073.929] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.929] GetProcessHeap () returned 0x630000 [0073.929] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.929] GetProcessHeap () returned 0x630000 [0073.929] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.929] GetProcessHeap () returned 0x630000 [0073.929] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.929] GetProcessHeap () returned 0x630000 [0073.929] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.929] GetProcessHeap () returned 0x630000 [0073.929] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.929] GetProcessHeap () returned 0x630000 [0073.929] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.930] GetProcessHeap () returned 0x630000 [0073.930] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.930] GetProcessHeap () returned 0x630000 [0073.930] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.930] GetProcessHeap () returned 0x630000 [0073.930] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.930] GetProcessHeap () returned 0x630000 [0073.930] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.930] GetProcessHeap () returned 0x630000 [0073.930] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0073.930] GetProcessHeap () returned 0x630000 [0073.930] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0073.930] GetProcessHeap () returned 0x630000 [0073.930] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.930] GetProcessHeap () returned 0x630000 [0073.930] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.930] GetProcessHeap () returned 0x630000 [0073.930] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.930] GetProcessHeap () returned 0x630000 [0073.930] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.930] GetProcessHeap () returned 0x630000 [0073.930] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.930] GetProcessHeap () returned 0x630000 [0073.930] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.930] GetProcessHeap () returned 0x630000 [0073.930] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.930] GetProcessHeap () returned 0x630000 [0073.930] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.930] GetProcessHeap () returned 0x630000 [0073.930] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.930] GetProcessHeap () returned 0x630000 [0073.930] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.930] GetProcessHeap () returned 0x630000 [0073.930] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.930] GetProcessHeap () returned 0x630000 [0073.930] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.930] GetProcessHeap () returned 0x630000 [0073.930] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.930] GetProcessHeap () returned 0x630000 [0073.930] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.931] GetProcessHeap () returned 0x630000 [0073.931] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.931] GetProcessHeap () returned 0x630000 [0073.931] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.931] GetProcessHeap () returned 0x630000 [0073.931] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.931] GetProcessHeap () returned 0x630000 [0073.931] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.931] GetProcessHeap () returned 0x630000 [0073.931] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.931] GetProcessHeap () returned 0x630000 [0073.931] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.931] GetProcessHeap () returned 0x630000 [0073.931] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.931] GetProcessHeap () returned 0x630000 [0073.931] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.931] GetProcessHeap () returned 0x630000 [0073.931] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0073.931] GetProcessHeap () returned 0x630000 [0073.931] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0073.931] GetProcessHeap () returned 0x630000 [0073.931] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.931] GetProcessHeap () returned 0x630000 [0073.931] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.931] GetProcessHeap () returned 0x630000 [0073.931] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.931] GetProcessHeap () returned 0x630000 [0073.931] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.931] GetProcessHeap () returned 0x630000 [0073.931] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.931] GetProcessHeap () returned 0x630000 [0073.931] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.931] GetProcessHeap () returned 0x630000 [0073.931] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.931] GetProcessHeap () returned 0x630000 [0073.931] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.931] GetProcessHeap () returned 0x630000 [0073.931] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.931] GetProcessHeap () returned 0x630000 [0073.931] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.932] GetProcessHeap () returned 0x630000 [0073.932] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.932] GetProcessHeap () returned 0x630000 [0073.932] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.932] GetProcessHeap () returned 0x630000 [0073.932] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.932] GetProcessHeap () returned 0x630000 [0073.932] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.932] GetProcessHeap () returned 0x630000 [0073.932] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.932] GetProcessHeap () returned 0x630000 [0073.932] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.932] GetProcessHeap () returned 0x630000 [0073.932] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.932] GetProcessHeap () returned 0x630000 [0073.932] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.932] GetProcessHeap () returned 0x630000 [0073.932] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0073.932] GetProcessHeap () returned 0x630000 [0073.932] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0073.932] GetProcessHeap () returned 0x630000 [0073.932] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.932] GetProcessHeap () returned 0x630000 [0073.932] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.932] GetProcessHeap () returned 0x630000 [0073.932] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0073.932] GetProcessHeap () returned 0x630000 [0073.932] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0073.932] GetProcessHeap () returned 0x630000 [0073.932] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0073.932] GetProcessHeap () returned 0x630000 [0073.932] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0073.932] GetProcessHeap () returned 0x630000 [0073.932] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0073.932] GetProcessHeap () returned 0x630000 [0073.932] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0073.932] GetProcessHeap () returned 0x630000 [0073.932] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0073.933] GetProcessHeap () returned 0x630000 [0073.933] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0073.933] GetProcessHeap () returned 0x630000 [0073.933] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0073.933] GetProcessHeap () returned 0x630000 [0073.933] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.933] GetProcessHeap () returned 0x630000 [0073.933] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0073.933] WriteFile (in: hFile=0x230, lpBuffer=0x671f00*, nNumberOfBytesToWrite=0x38a, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x671f00*, lpNumberOfBytesWritten=0x243d864*=0x38a, lpOverlapped=0x0) returned 1 [0073.935] GetProcessHeap () returned 0x630000 [0073.935] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671f00, Size=0x30) returned 0x671f00 [0073.935] GetProcessHeap () returned 0x630000 [0073.935] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0073.935] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0073.935] GetProcessHeap () returned 0x630000 [0073.935] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4190) returned 0x671f38 [0073.936] ReadFile (in: hFile=0x230, lpBuffer=0x671f38, nNumberOfBytesToRead=0x4190, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671f38*, lpNumberOfBytesRead=0x243d7e8*=0x4190, lpOverlapped=0x0) returned 1 [0073.936] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0073.936] WriteFile (in: hFile=0x230, lpBuffer=0x671f38*, nNumberOfBytesToWrite=0x4190, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671f38*, lpNumberOfBytesWritten=0x243d7e4*=0x4190, lpOverlapped=0x0) returned 1 [0073.937] GetProcessHeap () returned 0x630000 [0073.937] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671f38 | out: hHeap=0x630000) returned 1 [0073.937] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0073.937] WriteFile (in: hFile=0x230, lpBuffer=0x671f00*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x671f00*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0073.938] CloseHandle (hObject=0x230) returned 1 [0073.938] GetProcessHeap () returned 0x630000 [0073.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0073.938] GetProcessHeap () returned 0x630000 [0073.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6556e8 | out: hHeap=0x630000) returned 1 [0073.939] GetProcessHeap () returned 0x630000 [0073.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0073.939] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\xdGoot-fXC_I.ppt" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\xdGoot-fXC_I.ppt") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\xdGoot-fXC_I.ppt" [0073.939] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\xdGoot-fXC_I.ppt", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\xdGoot-fXC_I.ppt.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\xdGoot-fXC_I.ppt.happythreechoose" [0073.939] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\xdGoot-fXC_I.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\xdgoot-fxc_i.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\xdGoot-fXC_I.ppt.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\xdgoot-fxc_i.ppt.happythreechoose"), dwFlags=0x1) returned 1 [0073.939] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\xdGoot-fXC_I.ppt" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ") returned 1 [0073.939] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\") returned="" [0073.939] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\Decryption INFO.html" [0073.939] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\decryption info.html")) returned 0x20 [0073.939] GetProcessHeap () returned 0x630000 [0073.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645d18 | out: hHeap=0x630000) returned 1 [0073.939] FindNextFileW (in: hFindFile=0x648b50, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4b678d0, ftCreationTime.dwHighDateTime=0x1d5cc3c, ftLastAccessTime.dwLowDateTime=0xf926ace0, ftLastAccessTime.dwHighDateTime=0x1d5cb19, ftLastWriteTime.dwLowDateTime=0xf926ace0, ftLastWriteTime.dwHighDateTime=0x1d5cb19, nFileSizeHigh=0x0, nFileSizeLow=0x4186, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="xdGoot-fXC_I.ppt", cAlternateFileName="XDGOOT~1.PPT")) returned 0 [0073.939] FindClose (in: hFindFile=0x648b50 | out: hFindFile=0x648b50) returned 1 [0073.939] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\" [0073.939] GetProcessHeap () returned 0x630000 [0073.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63f290 | out: hHeap=0x630000) returned 1 [0073.940] GetProcessHeap () returned 0x630000 [0073.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0073.940] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\") returned 58 [0073.940] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\*") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\*" [0073.940] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x25585340, ftCreationTime.dwHighDateTime=0x1d5d0d3, ftLastAccessTime.dwLowDateTime=0xae1cf050, ftLastAccessTime.dwHighDateTime=0x1d5d2ea, ftLastWriteTime.dwLowDateTime=0xae1cf050, ftLastWriteTime.dwHighDateTime=0x1d5d2ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648810 [0073.940] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0073.940] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x25585340, ftCreationTime.dwHighDateTime=0x1d5d0d3, ftLastAccessTime.dwLowDateTime=0xae1cf050, ftLastAccessTime.dwHighDateTime=0x1d5d2ea, ftLastWriteTime.dwLowDateTime=0xae1cf050, ftLastWriteTime.dwHighDateTime=0x1d5d2ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.940] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0073.940] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0073.940] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a71cfb0, ftCreationTime.dwHighDateTime=0x1d5d800, ftLastAccessTime.dwLowDateTime=0xfcb59c70, ftLastAccessTime.dwHighDateTime=0x1d5d48f, ftLastWriteTime.dwLowDateTime=0xfcb59c70, ftLastWriteTime.dwHighDateTime=0x1d5d48f, nFileSizeHigh=0x0, nFileSizeLow=0x197e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SML5f-cFB.pps", cAlternateFileName="SML5F-~1.PPS")) returned 1 [0073.940] lstrcmpiW (lpString1="SML5f-cFB.pps", lpString2=".") returned 1 [0073.940] lstrcmpiW (lpString1="SML5f-cFB.pps", lpString2="..") returned 1 [0073.940] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\", lpString2="SML5f-cFB.pps" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\SML5f-cFB.pps") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\SML5f-cFB.pps" [0073.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SML5f-cFB.pps", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0073.940] GetProcessHeap () returned 0x630000 [0073.940] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x64c9f0 [0073.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SML5f-cFB.pps", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SML5f-cFB.pps", lpUsedDefaultChar=0x0) returned 14 [0073.940] lstrlenA (lpString="SML5f-cFB.pps") returned 13 [0073.940] lstrlenA (lpString=".happythreechoose") returned 17 [0073.940] lstrcmpiW (lpString1="SML5f-cFB.pps", lpString2="Decryption INFO.html") returned 1 [0073.940] lstrcmpiW (lpString1="SML5f-cFB.pps", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0073.940] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0073.940] lstrcmpiW (lpString1="SML5f-cFB.pps", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0073.940] GetProcessHeap () returned 0x630000 [0073.940] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0073.940] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\SML5f-cFB.pps" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\cd_xhxgn\\sml5f-cfb.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0073.941] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=6526) returned 1 [0073.941] GetProcessHeap () returned 0x630000 [0073.941] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655b20 [0073.941] GetProcessHeap () returned 0x630000 [0073.941] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0073.941] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\SML5f-cFB.pps") returned 71 [0073.941] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0073.941] GetProcessHeap () returned 0x630000 [0073.941] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0073.941] GetProcessHeap () returned 0x630000 [0073.941] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x382) returned 0x671f38 [0073.941] lstrlenA (lpString="rsa_encrypt") returned 11 [0073.941] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0073.941] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0073.941] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0073.941] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0073.941] GetProcessHeap () returned 0x630000 [0073.941] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0073.942] lstrlenA (lpString="010001") returned 6 [0073.942] GetProcessHeap () returned 0x630000 [0073.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0073.942] GetProcessHeap () returned 0x630000 [0073.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0073.942] GetProcessHeap () returned 0x630000 [0073.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e340 [0073.942] GetProcessHeap () returned 0x630000 [0073.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0073.942] GetProcessHeap () returned 0x630000 [0073.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea00 [0073.942] GetProcessHeap () returned 0x630000 [0073.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656fe0 [0073.942] GetProcessHeap () returned 0x630000 [0073.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a348 [0073.942] GetProcessHeap () returned 0x630000 [0073.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0073.942] GetProcessHeap () returned 0x630000 [0073.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.942] GetProcessHeap () returned 0x630000 [0073.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0073.942] GetProcessHeap () returned 0x630000 [0073.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0073.942] GetProcessHeap () returned 0x630000 [0073.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657440 [0073.942] GetProcessHeap () returned 0x630000 [0073.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.942] GetProcessHeap () returned 0x630000 [0073.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0073.942] GetProcessHeap () returned 0x630000 [0073.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e3d0 [0073.942] GetProcessHeap () returned 0x630000 [0073.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0073.942] GetProcessHeap () returned 0x630000 [0073.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0073.942] GetProcessHeap () returned 0x630000 [0073.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0073.942] GetProcessHeap () returned 0x630000 [0073.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0073.942] GetProcessHeap () returned 0x630000 [0073.943] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65ce50 [0073.943] GetProcessHeap () returned 0x630000 [0073.943] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.943] GetProcessHeap () returned 0x630000 [0073.943] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0073.943] GetProcessHeap () returned 0x630000 [0073.943] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.943] GetProcessHeap () returned 0x630000 [0073.943] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.943] GetProcessHeap () returned 0x630000 [0073.943] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e3d0 [0073.943] GetProcessHeap () returned 0x630000 [0073.943] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ce50 | out: hHeap=0x630000) returned 1 [0073.943] GetProcessHeap () returned 0x630000 [0073.943] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0073.943] GetProcessHeap () returned 0x630000 [0073.943] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0073.943] GetProcessHeap () returned 0x630000 [0073.943] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.943] GetProcessHeap () returned 0x630000 [0073.943] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.943] GetProcessHeap () returned 0x630000 [0073.943] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.943] GetProcessHeap () returned 0x630000 [0073.943] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.943] GetProcessHeap () returned 0x630000 [0073.943] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0073.943] GetProcessHeap () returned 0x630000 [0073.943] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0073.943] GetProcessHeap () returned 0x630000 [0073.943] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.943] GetProcessHeap () returned 0x630000 [0073.943] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.943] GetProcessHeap () returned 0x630000 [0073.943] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.943] GetProcessHeap () returned 0x630000 [0073.943] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.943] GetProcessHeap () returned 0x630000 [0073.943] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.943] GetProcessHeap () returned 0x630000 [0073.944] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.944] GetProcessHeap () returned 0x630000 [0073.944] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.944] GetProcessHeap () returned 0x630000 [0073.944] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.944] GetProcessHeap () returned 0x630000 [0073.944] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.944] GetProcessHeap () returned 0x630000 [0073.944] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.944] GetProcessHeap () returned 0x630000 [0073.944] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.944] GetProcessHeap () returned 0x630000 [0073.944] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.944] GetProcessHeap () returned 0x630000 [0073.944] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0073.944] GetProcessHeap () returned 0x630000 [0073.944] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0073.944] GetProcessHeap () returned 0x630000 [0073.944] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.944] GetProcessHeap () returned 0x630000 [0073.944] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.944] GetProcessHeap () returned 0x630000 [0073.944] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.944] GetProcessHeap () returned 0x630000 [0073.944] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.944] GetProcessHeap () returned 0x630000 [0073.944] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.944] GetProcessHeap () returned 0x630000 [0073.944] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.944] GetProcessHeap () returned 0x630000 [0073.944] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.944] GetProcessHeap () returned 0x630000 [0073.944] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.944] GetProcessHeap () returned 0x630000 [0073.944] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0073.944] GetProcessHeap () returned 0x630000 [0073.944] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0073.945] GetProcessHeap () returned 0x630000 [0073.945] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0073.945] GetProcessHeap () returned 0x630000 [0073.945] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0073.945] GetProcessHeap () returned 0x630000 [0073.945] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0073.945] GetProcessHeap () returned 0x630000 [0073.945] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0073.945] GetProcessHeap () returned 0x630000 [0073.945] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.945] GetProcessHeap () returned 0x630000 [0073.945] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.945] GetProcessHeap () returned 0x630000 [0073.945] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0073.945] GetProcessHeap () returned 0x630000 [0073.945] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0073.945] GetProcessHeap () returned 0x630000 [0073.945] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.945] GetProcessHeap () returned 0x630000 [0073.945] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.945] GetProcessHeap () returned 0x630000 [0073.945] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.945] GetProcessHeap () returned 0x630000 [0073.945] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.945] GetProcessHeap () returned 0x630000 [0073.945] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.945] GetProcessHeap () returned 0x630000 [0073.945] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.945] GetProcessHeap () returned 0x630000 [0073.945] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.945] GetProcessHeap () returned 0x630000 [0073.945] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.945] GetProcessHeap () returned 0x630000 [0073.945] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0073.945] GetProcessHeap () returned 0x630000 [0073.945] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0073.945] GetProcessHeap () returned 0x630000 [0073.945] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0073.945] GetProcessHeap () returned 0x630000 [0073.945] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0073.945] GetProcessHeap () returned 0x630000 [0073.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.946] GetProcessHeap () returned 0x630000 [0073.946] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.946] GetProcessHeap () returned 0x630000 [0073.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.946] GetProcessHeap () returned 0x630000 [0073.946] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.946] GetProcessHeap () returned 0x630000 [0073.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.946] GetProcessHeap () returned 0x630000 [0073.946] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.946] GetProcessHeap () returned 0x630000 [0073.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.946] GetProcessHeap () returned 0x630000 [0073.946] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.946] GetProcessHeap () returned 0x630000 [0073.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.946] GetProcessHeap () returned 0x630000 [0073.946] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.946] GetProcessHeap () returned 0x630000 [0073.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.946] GetProcessHeap () returned 0x630000 [0073.946] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.946] GetProcessHeap () returned 0x630000 [0073.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0073.946] GetProcessHeap () returned 0x630000 [0073.946] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0073.946] GetProcessHeap () returned 0x630000 [0073.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.946] GetProcessHeap () returned 0x630000 [0073.946] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.946] GetProcessHeap () returned 0x630000 [0073.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.946] GetProcessHeap () returned 0x630000 [0073.946] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.946] GetProcessHeap () returned 0x630000 [0073.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.946] GetProcessHeap () returned 0x630000 [0073.946] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.946] GetProcessHeap () returned 0x630000 [0073.947] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.947] GetProcessHeap () returned 0x630000 [0073.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.947] GetProcessHeap () returned 0x630000 [0073.947] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0073.947] GetProcessHeap () returned 0x630000 [0073.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0073.947] GetProcessHeap () returned 0x630000 [0073.947] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0073.947] GetProcessHeap () returned 0x630000 [0073.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0073.947] GetProcessHeap () returned 0x630000 [0073.947] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.947] GetProcessHeap () returned 0x630000 [0073.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.947] GetProcessHeap () returned 0x630000 [0073.947] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0073.947] GetProcessHeap () returned 0x630000 [0073.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0073.947] GetProcessHeap () returned 0x630000 [0073.947] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.947] GetProcessHeap () returned 0x630000 [0073.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.947] GetProcessHeap () returned 0x630000 [0073.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0073.947] GetProcessHeap () returned 0x630000 [0073.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0073.947] GetProcessHeap () returned 0x630000 [0073.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0073.947] GetProcessHeap () returned 0x630000 [0073.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0073.947] GetProcessHeap () returned 0x630000 [0073.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0073.947] GetProcessHeap () returned 0x630000 [0073.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0073.947] GetProcessHeap () returned 0x630000 [0073.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0073.947] GetProcessHeap () returned 0x630000 [0073.947] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0073.948] GetProcessHeap () returned 0x630000 [0073.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0073.948] GetProcessHeap () returned 0x630000 [0073.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0073.948] GetProcessHeap () returned 0x630000 [0073.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0073.948] WriteFile (in: hFile=0x230, lpBuffer=0x671f38*, nNumberOfBytesToWrite=0x382, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x671f38*, lpNumberOfBytesWritten=0x243d864*=0x382, lpOverlapped=0x0) returned 1 [0073.952] GetProcessHeap () returned 0x630000 [0073.952] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671f38, Size=0x30) returned 0x671f38 [0073.952] GetProcessHeap () returned 0x630000 [0073.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0073.952] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0073.952] GetProcessHeap () returned 0x630000 [0073.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1980) returned 0x671f70 [0073.952] ReadFile (in: hFile=0x230, lpBuffer=0x671f70, nNumberOfBytesToRead=0x1980, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671f70*, lpNumberOfBytesRead=0x243d7e8*=0x1980, lpOverlapped=0x0) returned 1 [0073.952] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0073.952] WriteFile (in: hFile=0x230, lpBuffer=0x671f70*, nNumberOfBytesToWrite=0x1980, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671f70*, lpNumberOfBytesWritten=0x243d7e4*=0x1980, lpOverlapped=0x0) returned 1 [0073.953] GetProcessHeap () returned 0x630000 [0073.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671f70 | out: hHeap=0x630000) returned 1 [0073.953] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0073.953] WriteFile (in: hFile=0x230, lpBuffer=0x671f38*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x671f38*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0073.954] CloseHandle (hObject=0x230) returned 1 [0073.954] GetProcessHeap () returned 0x630000 [0073.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0073.955] GetProcessHeap () returned 0x630000 [0073.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655b20 | out: hHeap=0x630000) returned 1 [0073.955] GetProcessHeap () returned 0x630000 [0073.955] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0073.955] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\SML5f-cFB.pps" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\SML5f-cFB.pps") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\SML5f-cFB.pps" [0073.955] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\SML5f-cFB.pps", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\SML5f-cFB.pps.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\SML5f-cFB.pps.happythreechoose" [0073.955] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\SML5f-cFB.pps" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\cd_xhxgn\\sml5f-cfb.pps"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\SML5f-cFB.pps.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\cd_xhxgn\\sml5f-cfb.pps.happythreechoose"), dwFlags=0x1) returned 1 [0073.955] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\SML5f-cFB.pps" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN") returned 1 [0073.955] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\") returned="" [0073.955] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\Decryption INFO.html" [0073.955] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\cd_xhxgn\\decryption info.html")) returned 0xffffffff [0073.955] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\cd_xhxgn\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0073.956] GetProcessHeap () returned 0x630000 [0073.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655850 [0073.956] GetProcessHeap () returned 0x630000 [0073.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0073.963] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.964] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.964] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.964] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.964] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.964] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.964] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.964] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.964] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.964] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.965] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.965] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.965] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.965] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.965] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.965] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.965] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.965] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.965] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.965] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.965] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.966] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.966] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.966] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.966] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.966] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.966] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.966] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.966] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.967] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.967] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.967] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.967] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.967] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.967] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.967] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.967] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.968] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.968] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.968] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.968] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.968] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.968] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.968] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.968] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.968] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.968] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.968] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.969] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.969] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.969] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.969] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.969] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.969] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.969] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.969] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.969] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.969] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.969] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.969] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.969] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.969] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.970] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.970] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.970] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.970] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.970] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.970] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.970] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.970] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.970] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.970] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.970] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.970] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.970] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.971] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.971] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.971] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.971] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.971] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.971] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.971] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.971] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.971] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.971] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.971] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.971] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.971] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.972] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.972] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.972] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.972] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.972] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.972] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.972] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.972] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.972] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.972] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.972] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.972] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.972] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.973] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.973] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.973] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.973] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.973] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.973] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.973] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.973] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.973] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.973] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.973] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.973] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.973] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.974] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.974] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.974] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.974] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.974] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.974] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.974] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.974] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.974] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.974] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.974] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.974] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.974] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.974] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.975] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.975] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.975] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.975] GetProcessHeap () returned 0x630000 [0073.975] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655850 | out: hHeap=0x630000) returned 1 [0073.975] GetProcessHeap () returned 0x630000 [0073.975] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0073.975] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0073.975] GetProcessHeap () returned 0x630000 [0073.975] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6559b8 [0073.975] GetProcessHeap () returned 0x630000 [0073.975] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0073.982] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.982] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.982] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.982] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.982] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.982] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.982] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.983] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.983] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.983] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.983] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.983] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.983] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.983] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.983] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.983] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.983] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.983] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.983] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.983] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.984] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.984] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.984] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.984] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.984] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.984] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.984] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.984] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.984] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.984] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.984] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.984] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.984] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.984] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.985] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.985] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.985] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.985] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.985] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.985] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.985] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.985] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.985] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.985] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.985] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.985] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.985] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.986] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.986] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.986] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.986] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.986] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.986] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.986] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.986] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.986] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.986] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.986] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.986] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.986] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.987] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.987] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.987] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.987] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.987] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.987] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.987] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.987] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.987] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.987] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.987] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.987] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.987] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.988] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.988] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.988] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.988] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.988] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.988] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.988] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.988] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.988] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.988] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.988] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.988] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.989] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.989] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.989] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.989] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.989] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.989] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.989] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.989] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.989] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.989] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.989] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.989] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.989] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.990] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.990] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.990] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.990] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.990] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.990] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.990] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.990] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.990] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.990] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.990] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.990] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.990] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.991] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.991] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.991] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.991] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.991] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.991] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.991] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0073.992] GetProcessHeap () returned 0x630000 [0073.992] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6559b8 | out: hHeap=0x630000) returned 1 [0073.992] GetProcessHeap () returned 0x630000 [0073.992] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0073.992] CloseHandle (hObject=0x230) returned 1 [0073.992] GetProcessHeap () returned 0x630000 [0073.992] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0073.992] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0c752e0, ftCreationTime.dwHighDateTime=0x1d5d27a, ftLastAccessTime.dwLowDateTime=0xb2c9f2f0, ftLastAccessTime.dwHighDateTime=0x1d5c83c, ftLastWriteTime.dwLowDateTime=0xb2c9f2f0, ftLastWriteTime.dwHighDateTime=0x1d5c83c, nFileSizeHigh=0x0, nFileSizeLow=0x119be, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="yGQsAC6s1NcZ.odp", cAlternateFileName="YGQSAC~1.ODP")) returned 1 [0073.992] lstrcmpiW (lpString1="yGQsAC6s1NcZ.odp", lpString2=".") returned 1 [0073.992] lstrcmpiW (lpString1="yGQsAC6s1NcZ.odp", lpString2="..") returned 1 [0073.992] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\", lpString2="yGQsAC6s1NcZ.odp" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\yGQsAC6s1NcZ.odp") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\yGQsAC6s1NcZ.odp" [0073.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="yGQsAC6s1NcZ.odp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0073.992] GetProcessHeap () returned 0x630000 [0073.992] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11) returned 0x645d18 [0073.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="yGQsAC6s1NcZ.odp", cchWideChar=-1, lpMultiByteStr=0x645d18, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yGQsAC6s1NcZ.odp", lpUsedDefaultChar=0x0) returned 17 [0073.992] lstrlenA (lpString="yGQsAC6s1NcZ.odp") returned 16 [0073.992] lstrlenA (lpString=".happythreechoose") returned 17 [0073.992] lstrcmpiW (lpString1="yGQsAC6s1NcZ.odp", lpString2="Decryption INFO.html") returned 1 [0073.992] lstrcmpiW (lpString1="yGQsAC6s1NcZ.odp", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0073.992] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0073.992] lstrcmpiW (lpString1="yGQsAC6s1NcZ.odp", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0073.992] GetProcessHeap () returned 0x630000 [0073.992] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x652000 [0073.992] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\yGQsAC6s1NcZ.odp" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\cd_xhxgn\\ygqsac6s1ncz.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0073.993] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=72126) returned 1 [0073.993] GetProcessHeap () returned 0x630000 [0073.993] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655418 [0073.993] GetProcessHeap () returned 0x630000 [0073.993] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0073.993] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\yGQsAC6s1NcZ.odp") returned 74 [0073.993] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0073.993] GetProcessHeap () returned 0x630000 [0073.993] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0073.993] GetProcessHeap () returned 0x630000 [0073.993] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x382) returned 0x671f70 [0073.993] lstrlenA (lpString="rsa_encrypt") returned 11 [0073.993] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0073.994] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0073.994] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0073.994] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0073.994] GetProcessHeap () returned 0x630000 [0073.994] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0073.994] lstrlenA (lpString="010001") returned 6 [0073.994] GetProcessHeap () returned 0x630000 [0073.994] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0073.994] GetProcessHeap () returned 0x630000 [0073.994] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0073.994] GetProcessHeap () returned 0x630000 [0073.994] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0073.994] GetProcessHeap () returned 0x630000 [0073.994] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0073.994] GetProcessHeap () returned 0x630000 [0073.994] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e610 [0073.994] GetProcessHeap () returned 0x630000 [0073.994] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656db0 [0073.994] GetProcessHeap () returned 0x630000 [0073.994] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0073.994] GetProcessHeap () returned 0x630000 [0073.994] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0073.994] GetProcessHeap () returned 0x630000 [0073.994] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.994] GetProcessHeap () returned 0x630000 [0073.994] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0073.994] GetProcessHeap () returned 0x630000 [0073.994] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0073.994] GetProcessHeap () returned 0x630000 [0073.994] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657558 [0073.994] GetProcessHeap () returned 0x630000 [0073.994] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.994] GetProcessHeap () returned 0x630000 [0073.994] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0073.994] GetProcessHeap () returned 0x630000 [0073.995] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65eb20 [0073.995] GetProcessHeap () returned 0x630000 [0073.995] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0073.995] GetProcessHeap () returned 0x630000 [0073.995] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0073.995] GetProcessHeap () returned 0x630000 [0073.995] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0073.995] GetProcessHeap () returned 0x630000 [0073.995] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0073.995] GetProcessHeap () returned 0x630000 [0073.995] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0073.995] GetProcessHeap () returned 0x630000 [0073.995] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.995] GetProcessHeap () returned 0x630000 [0073.995] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0073.995] GetProcessHeap () returned 0x630000 [0073.995] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.995] GetProcessHeap () returned 0x630000 [0073.995] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.995] GetProcessHeap () returned 0x630000 [0073.995] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e2b0 [0073.995] GetProcessHeap () returned 0x630000 [0073.995] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0073.995] GetProcessHeap () returned 0x630000 [0073.995] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0073.995] GetProcessHeap () returned 0x630000 [0073.995] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e2b0 | out: hHeap=0x630000) returned 1 [0073.995] GetProcessHeap () returned 0x630000 [0073.995] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0073.995] GetProcessHeap () returned 0x630000 [0073.995] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0073.995] GetProcessHeap () returned 0x630000 [0073.995] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0073.995] GetProcessHeap () returned 0x630000 [0073.995] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0073.995] GetProcessHeap () returned 0x630000 [0073.995] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.995] GetProcessHeap () returned 0x630000 [0073.995] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.995] GetProcessHeap () returned 0x630000 [0073.996] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.996] GetProcessHeap () returned 0x630000 [0073.996] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.996] GetProcessHeap () returned 0x630000 [0073.996] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.996] GetProcessHeap () returned 0x630000 [0073.996] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.996] GetProcessHeap () returned 0x630000 [0073.996] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0073.996] GetProcessHeap () returned 0x630000 [0073.996] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0073.996] GetProcessHeap () returned 0x630000 [0073.996] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0073.996] GetProcessHeap () returned 0x630000 [0073.996] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0073.996] GetProcessHeap () returned 0x630000 [0073.996] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.996] GetProcessHeap () returned 0x630000 [0073.996] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.996] GetProcessHeap () returned 0x630000 [0073.996] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.996] GetProcessHeap () returned 0x630000 [0073.996] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.996] GetProcessHeap () returned 0x630000 [0073.996] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.996] GetProcessHeap () returned 0x630000 [0073.996] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.996] GetProcessHeap () returned 0x630000 [0073.996] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0073.996] GetProcessHeap () returned 0x630000 [0073.996] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0073.996] GetProcessHeap () returned 0x630000 [0073.996] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.996] GetProcessHeap () returned 0x630000 [0073.996] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.996] GetProcessHeap () returned 0x630000 [0073.996] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.996] GetProcessHeap () returned 0x630000 [0073.997] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.997] GetProcessHeap () returned 0x630000 [0073.997] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.997] GetProcessHeap () returned 0x630000 [0073.997] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.997] GetProcessHeap () returned 0x630000 [0073.997] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0073.997] GetProcessHeap () returned 0x630000 [0073.997] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0073.997] GetProcessHeap () returned 0x630000 [0073.997] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0073.997] GetProcessHeap () returned 0x630000 [0073.997] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0073.997] GetProcessHeap () returned 0x630000 [0073.997] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0073.997] GetProcessHeap () returned 0x630000 [0073.997] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0073.997] GetProcessHeap () returned 0x630000 [0073.997] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.997] GetProcessHeap () returned 0x630000 [0073.997] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0073.997] GetProcessHeap () returned 0x630000 [0073.997] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0073.997] GetProcessHeap () returned 0x630000 [0073.997] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0074.074] GetProcessHeap () returned 0x630000 [0074.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0074.074] GetProcessHeap () returned 0x630000 [0074.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0074.074] GetProcessHeap () returned 0x630000 [0074.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.074] GetProcessHeap () returned 0x630000 [0074.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.074] GetProcessHeap () returned 0x630000 [0074.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.074] GetProcessHeap () returned 0x630000 [0074.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.074] GetProcessHeap () returned 0x630000 [0074.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.074] GetProcessHeap () returned 0x630000 [0074.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.074] GetProcessHeap () returned 0x630000 [0074.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.074] GetProcessHeap () returned 0x630000 [0074.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.074] GetProcessHeap () returned 0x630000 [0074.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0074.074] GetProcessHeap () returned 0x630000 [0074.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0074.074] GetProcessHeap () returned 0x630000 [0074.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0074.074] GetProcessHeap () returned 0x630000 [0074.074] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0074.074] GetProcessHeap () returned 0x630000 [0074.074] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0074.074] GetProcessHeap () returned 0x630000 [0074.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0074.075] GetProcessHeap () returned 0x630000 [0074.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.075] GetProcessHeap () returned 0x630000 [0074.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.075] GetProcessHeap () returned 0x630000 [0074.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0074.075] GetProcessHeap () returned 0x630000 [0074.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0074.075] GetProcessHeap () returned 0x630000 [0074.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.075] GetProcessHeap () returned 0x630000 [0074.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.075] GetProcessHeap () returned 0x630000 [0074.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.075] GetProcessHeap () returned 0x630000 [0074.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.075] GetProcessHeap () returned 0x630000 [0074.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.075] GetProcessHeap () returned 0x630000 [0074.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.075] GetProcessHeap () returned 0x630000 [0074.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0074.075] GetProcessHeap () returned 0x630000 [0074.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0074.075] GetProcessHeap () returned 0x630000 [0074.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.075] GetProcessHeap () returned 0x630000 [0074.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.075] GetProcessHeap () returned 0x630000 [0074.075] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.075] GetProcessHeap () returned 0x630000 [0074.075] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.076] GetProcessHeap () returned 0x630000 [0074.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.076] GetProcessHeap () returned 0x630000 [0074.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.076] GetProcessHeap () returned 0x630000 [0074.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.076] GetProcessHeap () returned 0x630000 [0074.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.076] GetProcessHeap () returned 0x630000 [0074.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0074.076] GetProcessHeap () returned 0x630000 [0074.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0074.076] GetProcessHeap () returned 0x630000 [0074.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.076] GetProcessHeap () returned 0x630000 [0074.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.076] GetProcessHeap () returned 0x630000 [0074.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.076] GetProcessHeap () returned 0x630000 [0074.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.076] GetProcessHeap () returned 0x630000 [0074.076] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.076] GetProcessHeap () returned 0x630000 [0074.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.076] GetProcessHeap () returned 0x630000 [0074.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0074.076] GetProcessHeap () returned 0x630000 [0074.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0074.076] GetProcessHeap () returned 0x630000 [0074.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0074.076] GetProcessHeap () returned 0x630000 [0074.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0074.076] GetProcessHeap () returned 0x630000 [0074.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0074.076] GetProcessHeap () returned 0x630000 [0074.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0074.076] GetProcessHeap () returned 0x630000 [0074.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0074.077] GetProcessHeap () returned 0x630000 [0074.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0074.077] GetProcessHeap () returned 0x630000 [0074.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0074.077] GetProcessHeap () returned 0x630000 [0074.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.077] GetProcessHeap () returned 0x630000 [0074.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0074.077] WriteFile (in: hFile=0x230, lpBuffer=0x671f70*, nNumberOfBytesToWrite=0x382, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x671f70*, lpNumberOfBytesWritten=0x243d864*=0x382, lpOverlapped=0x0) returned 1 [0074.079] GetProcessHeap () returned 0x630000 [0074.079] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671f70, Size=0x30) returned 0x671f70 [0074.079] GetProcessHeap () returned 0x630000 [0074.079] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0074.079] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.079] GetProcessHeap () returned 0x630000 [0074.079] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x119c0) returned 0x671fa8 [0074.080] ReadFile (in: hFile=0x230, lpBuffer=0x671fa8, nNumberOfBytesToRead=0x119c0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671fa8*, lpNumberOfBytesRead=0x243d7e8*=0x119c0, lpOverlapped=0x0) returned 1 [0074.080] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.081] WriteFile (in: hFile=0x230, lpBuffer=0x671fa8*, nNumberOfBytesToWrite=0x119c0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671fa8*, lpNumberOfBytesWritten=0x243d7e4*=0x119c0, lpOverlapped=0x0) returned 1 [0074.082] GetProcessHeap () returned 0x630000 [0074.082] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671fa8 | out: hHeap=0x630000) returned 1 [0074.082] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.082] WriteFile (in: hFile=0x230, lpBuffer=0x671f70*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x671f70*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0074.083] CloseHandle (hObject=0x230) returned 1 [0074.083] GetProcessHeap () returned 0x630000 [0074.083] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x652000 | out: hHeap=0x630000) returned 1 [0074.083] GetProcessHeap () returned 0x630000 [0074.083] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655418 | out: hHeap=0x630000) returned 1 [0074.083] GetProcessHeap () returned 0x630000 [0074.083] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.083] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\yGQsAC6s1NcZ.odp" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\yGQsAC6s1NcZ.odp") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\yGQsAC6s1NcZ.odp" [0074.083] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\yGQsAC6s1NcZ.odp", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\yGQsAC6s1NcZ.odp.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\yGQsAC6s1NcZ.odp.happythreechoose" [0074.084] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\yGQsAC6s1NcZ.odp" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\cd_xhxgn\\ygqsac6s1ncz.odp"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\yGQsAC6s1NcZ.odp.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\cd_xhxgn\\ygqsac6s1ncz.odp.happythreechoose"), dwFlags=0x1) returned 1 [0074.084] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\yGQsAC6s1NcZ.odp" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN") returned 1 [0074.084] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\") returned="" [0074.084] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\Decryption INFO.html" [0074.084] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\cd_xhxgn\\decryption info.html")) returned 0x20 [0074.084] GetProcessHeap () returned 0x630000 [0074.084] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645d18 | out: hHeap=0x630000) returned 1 [0074.084] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bb9b290, ftCreationTime.dwHighDateTime=0x1d5d70e, ftLastAccessTime.dwLowDateTime=0x491b1260, ftLastAccessTime.dwHighDateTime=0x1d5d036, ftLastWriteTime.dwLowDateTime=0x491b1260, ftLastWriteTime.dwHighDateTime=0x1d5d036, nFileSizeHigh=0x0, nFileSizeLow=0xddca, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_EBuSJTcwQ.csv", cAlternateFileName="_EBUSJ~1.CSV")) returned 1 [0074.084] lstrcmpiW (lpString1="_EBuSJTcwQ.csv", lpString2=".") returned 1 [0074.084] lstrcmpiW (lpString1="_EBuSJTcwQ.csv", lpString2="..") returned 1 [0074.085] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\", lpString2="_EBuSJTcwQ.csv" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\_EBuSJTcwQ.csv") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\_EBuSJTcwQ.csv" [0074.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="_EBuSJTcwQ.csv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0074.085] GetProcessHeap () returned 0x630000 [0074.085] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0074.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="_EBuSJTcwQ.csv", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_EBuSJTcwQ.csv", lpUsedDefaultChar=0x0) returned 15 [0074.085] lstrlenA (lpString="_EBuSJTcwQ.csv") returned 14 [0074.085] lstrlenA (lpString=".happythreechoose") returned 17 [0074.085] lstrcmpiW (lpString1="_EBuSJTcwQ.csv", lpString2="Decryption INFO.html") returned -1 [0074.085] lstrcmpiW (lpString1="_EBuSJTcwQ.csv", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned -1 [0074.085] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0074.085] lstrcmpiW (lpString1="_EBuSJTcwQ.csv", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0074.085] GetProcessHeap () returned 0x630000 [0074.085] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0074.085] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\_EBuSJTcwQ.csv" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\cd_xhxgn\\_ebusjtcwq.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0074.085] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=56778) returned 1 [0074.085] GetProcessHeap () returned 0x630000 [0074.085] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655508 [0074.085] GetProcessHeap () returned 0x630000 [0074.085] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.085] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\_EBuSJTcwQ.csv") returned 72 [0074.085] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.085] GetProcessHeap () returned 0x630000 [0074.085] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0074.085] GetProcessHeap () returned 0x630000 [0074.085] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x386) returned 0x671fa8 [0074.085] lstrlenA (lpString="rsa_encrypt") returned 11 [0074.085] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0074.086] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0074.086] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0074.086] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0074.086] GetProcessHeap () returned 0x630000 [0074.086] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0074.086] lstrlenA (lpString="010001") returned 6 [0074.086] GetProcessHeap () returned 0x630000 [0074.086] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0074.086] GetProcessHeap () returned 0x630000 [0074.086] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.086] GetProcessHeap () returned 0x630000 [0074.086] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ebb0 [0074.086] GetProcessHeap () returned 0x630000 [0074.086] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0074.086] GetProcessHeap () returned 0x630000 [0074.086] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e4f0 [0074.086] GetProcessHeap () returned 0x630000 [0074.086] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656c98 [0074.086] GetProcessHeap () returned 0x630000 [0074.087] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2f8 [0074.087] GetProcessHeap () returned 0x630000 [0074.087] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0074.087] GetProcessHeap () returned 0x630000 [0074.087] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.087] GetProcessHeap () returned 0x630000 [0074.087] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0074.087] GetProcessHeap () returned 0x630000 [0074.087] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.087] GetProcessHeap () returned 0x630000 [0074.087] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657440 [0074.087] GetProcessHeap () returned 0x630000 [0074.087] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.087] GetProcessHeap () returned 0x630000 [0074.087] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0074.087] GetProcessHeap () returned 0x630000 [0074.087] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e340 [0074.087] GetProcessHeap () returned 0x630000 [0074.087] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0074.087] GetProcessHeap () returned 0x630000 [0074.087] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0074.087] GetProcessHeap () returned 0x630000 [0074.087] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0074.087] GetProcessHeap () returned 0x630000 [0074.087] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.087] GetProcessHeap () returned 0x630000 [0074.087] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cec8 [0074.087] GetProcessHeap () returned 0x630000 [0074.087] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.087] GetProcessHeap () returned 0x630000 [0074.087] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.087] GetProcessHeap () returned 0x630000 [0074.087] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.087] GetProcessHeap () returned 0x630000 [0074.087] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.087] GetProcessHeap () returned 0x630000 [0074.087] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ecd0 [0074.087] GetProcessHeap () returned 0x630000 [0074.087] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cec8 | out: hHeap=0x630000) returned 1 [0074.087] GetProcessHeap () returned 0x630000 [0074.087] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0074.088] GetProcessHeap () returned 0x630000 [0074.088] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ecd0 | out: hHeap=0x630000) returned 1 [0074.088] GetProcessHeap () returned 0x630000 [0074.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.088] GetProcessHeap () returned 0x630000 [0074.088] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.088] GetProcessHeap () returned 0x630000 [0074.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.088] GetProcessHeap () returned 0x630000 [0074.088] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.088] GetProcessHeap () returned 0x630000 [0074.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.088] GetProcessHeap () returned 0x630000 [0074.088] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.088] GetProcessHeap () returned 0x630000 [0074.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.088] GetProcessHeap () returned 0x630000 [0074.088] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.088] GetProcessHeap () returned 0x630000 [0074.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.088] GetProcessHeap () returned 0x630000 [0074.088] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.088] GetProcessHeap () returned 0x630000 [0074.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.088] GetProcessHeap () returned 0x630000 [0074.088] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.088] GetProcessHeap () returned 0x630000 [0074.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.088] GetProcessHeap () returned 0x630000 [0074.088] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.088] GetProcessHeap () returned 0x630000 [0074.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0074.088] GetProcessHeap () returned 0x630000 [0074.088] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0074.088] GetProcessHeap () returned 0x630000 [0074.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.088] GetProcessHeap () returned 0x630000 [0074.088] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.088] GetProcessHeap () returned 0x630000 [0074.089] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0074.089] GetProcessHeap () returned 0x630000 [0074.089] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0074.089] GetProcessHeap () returned 0x630000 [0074.089] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0074.089] GetProcessHeap () returned 0x630000 [0074.089] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0074.089] GetProcessHeap () returned 0x630000 [0074.089] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.089] GetProcessHeap () returned 0x630000 [0074.089] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.089] GetProcessHeap () returned 0x630000 [0074.089] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.089] GetProcessHeap () returned 0x630000 [0074.089] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.089] GetProcessHeap () returned 0x630000 [0074.089] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.089] GetProcessHeap () returned 0x630000 [0074.089] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.089] GetProcessHeap () returned 0x630000 [0074.089] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.089] GetProcessHeap () returned 0x630000 [0074.089] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.089] GetProcessHeap () returned 0x630000 [0074.089] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.089] GetProcessHeap () returned 0x630000 [0074.089] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.089] GetProcessHeap () returned 0x630000 [0074.089] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.089] GetProcessHeap () returned 0x630000 [0074.089] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.089] GetProcessHeap () returned 0x630000 [0074.089] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.089] GetProcessHeap () returned 0x630000 [0074.089] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.089] GetProcessHeap () returned 0x630000 [0074.089] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.089] GetProcessHeap () returned 0x630000 [0074.089] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.090] GetProcessHeap () returned 0x630000 [0074.090] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.090] GetProcessHeap () returned 0x630000 [0074.090] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.090] GetProcessHeap () returned 0x630000 [0074.090] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.090] GetProcessHeap () returned 0x630000 [0074.090] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.090] GetProcessHeap () returned 0x630000 [0074.090] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.090] GetProcessHeap () returned 0x630000 [0074.090] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.090] GetProcessHeap () returned 0x630000 [0074.090] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.090] GetProcessHeap () returned 0x630000 [0074.090] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.090] GetProcessHeap () returned 0x630000 [0074.090] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.090] GetProcessHeap () returned 0x630000 [0074.090] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.090] GetProcessHeap () returned 0x630000 [0074.090] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.090] GetProcessHeap () returned 0x630000 [0074.090] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.090] GetProcessHeap () returned 0x630000 [0074.090] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.090] GetProcessHeap () returned 0x630000 [0074.090] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.090] GetProcessHeap () returned 0x630000 [0074.090] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.090] GetProcessHeap () returned 0x630000 [0074.090] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.090] GetProcessHeap () returned 0x630000 [0074.090] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.090] GetProcessHeap () returned 0x630000 [0074.090] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.090] GetProcessHeap () returned 0x630000 [0074.090] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.091] GetProcessHeap () returned 0x630000 [0074.091] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.091] GetProcessHeap () returned 0x630000 [0074.091] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.091] GetProcessHeap () returned 0x630000 [0074.091] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.091] GetProcessHeap () returned 0x630000 [0074.091] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.091] GetProcessHeap () returned 0x630000 [0074.091] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.091] GetProcessHeap () returned 0x630000 [0074.091] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.091] GetProcessHeap () returned 0x630000 [0074.091] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.091] GetProcessHeap () returned 0x630000 [0074.091] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.091] GetProcessHeap () returned 0x630000 [0074.091] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.091] GetProcessHeap () returned 0x630000 [0074.091] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.091] GetProcessHeap () returned 0x630000 [0074.091] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.091] GetProcessHeap () returned 0x630000 [0074.091] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0074.091] GetProcessHeap () returned 0x630000 [0074.091] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0074.091] GetProcessHeap () returned 0x630000 [0074.091] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.091] GetProcessHeap () returned 0x630000 [0074.091] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.092] GetProcessHeap () returned 0x630000 [0074.092] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0074.092] GetProcessHeap () returned 0x630000 [0074.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0074.092] GetProcessHeap () returned 0x630000 [0074.092] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.092] GetProcessHeap () returned 0x630000 [0074.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.092] GetProcessHeap () returned 0x630000 [0074.092] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.092] GetProcessHeap () returned 0x630000 [0074.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.092] GetProcessHeap () returned 0x630000 [0074.092] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.092] GetProcessHeap () returned 0x630000 [0074.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.092] GetProcessHeap () returned 0x630000 [0074.092] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0074.092] GetProcessHeap () returned 0x630000 [0074.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0074.092] GetProcessHeap () returned 0x630000 [0074.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0074.092] GetProcessHeap () returned 0x630000 [0074.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0074.092] GetProcessHeap () returned 0x630000 [0074.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0074.092] GetProcessHeap () returned 0x630000 [0074.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0074.092] GetProcessHeap () returned 0x630000 [0074.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0074.092] GetProcessHeap () returned 0x630000 [0074.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0074.092] GetProcessHeap () returned 0x630000 [0074.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0074.092] GetProcessHeap () returned 0x630000 [0074.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0074.093] GetProcessHeap () returned 0x630000 [0074.093] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0074.093] GetProcessHeap () returned 0x630000 [0074.093] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.093] GetProcessHeap () returned 0x630000 [0074.093] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0074.093] WriteFile (in: hFile=0x230, lpBuffer=0x671fa8*, nNumberOfBytesToWrite=0x386, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x671fa8*, lpNumberOfBytesWritten=0x243d864*=0x386, lpOverlapped=0x0) returned 1 [0074.095] GetProcessHeap () returned 0x630000 [0074.095] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671fa8, Size=0x30) returned 0x671fa8 [0074.095] GetProcessHeap () returned 0x630000 [0074.095] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0074.095] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.095] GetProcessHeap () returned 0x630000 [0074.095] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xddd0) returned 0x671fe0 [0074.095] ReadFile (in: hFile=0x230, lpBuffer=0x671fe0, nNumberOfBytesToRead=0xddd0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x671fe0*, lpNumberOfBytesRead=0x243d7e8*=0xddd0, lpOverlapped=0x0) returned 1 [0074.096] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.096] WriteFile (in: hFile=0x230, lpBuffer=0x671fe0*, nNumberOfBytesToWrite=0xddd0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x671fe0*, lpNumberOfBytesWritten=0x243d7e4*=0xddd0, lpOverlapped=0x0) returned 1 [0074.097] GetProcessHeap () returned 0x630000 [0074.097] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x671fe0 | out: hHeap=0x630000) returned 1 [0074.099] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.099] WriteFile (in: hFile=0x230, lpBuffer=0x671fa8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x671fa8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0074.100] CloseHandle (hObject=0x230) returned 1 [0074.100] GetProcessHeap () returned 0x630000 [0074.100] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0074.100] GetProcessHeap () returned 0x630000 [0074.100] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655508 | out: hHeap=0x630000) returned 1 [0074.100] GetProcessHeap () returned 0x630000 [0074.100] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.100] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\_EBuSJTcwQ.csv" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\_EBuSJTcwQ.csv") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\_EBuSJTcwQ.csv" [0074.100] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\_EBuSJTcwQ.csv", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\_EBuSJTcwQ.csv.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\_EBuSJTcwQ.csv.happythreechoose" [0074.100] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\_EBuSJTcwQ.csv" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\cd_xhxgn\\_ebusjtcwq.csv"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\_EBuSJTcwQ.csv.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\cd_xhxgn\\_ebusjtcwq.csv.happythreechoose"), dwFlags=0x1) returned 1 [0074.101] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\_EBuSJTcwQ.csv" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN") returned 1 [0074.101] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\") returned="" [0074.101] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\Decryption INFO.html" [0074.101] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SBPS k\\JghA00WX0P\\YyeJ\\cD_xHxGN\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\sbps k\\jgha00wx0p\\yyej\\cd_xhxgn\\decryption info.html")) returned 0x20 [0074.101] GetProcessHeap () returned 0x630000 [0074.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0074.101] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bb9b290, ftCreationTime.dwHighDateTime=0x1d5d70e, ftLastAccessTime.dwLowDateTime=0x491b1260, ftLastAccessTime.dwHighDateTime=0x1d5d036, ftLastWriteTime.dwLowDateTime=0x491b1260, ftLastWriteTime.dwHighDateTime=0x1d5d036, nFileSizeHigh=0x0, nFileSizeLow=0xddca, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_EBuSJTcwQ.csv", cAlternateFileName="_EBUSJ~1.CSV")) returned 0 [0074.101] FindClose (in: hFindFile=0x648810 | out: hFindFile=0x648810) returned 1 [0074.101] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\" [0074.101] GetProcessHeap () returned 0x630000 [0074.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653e70 | out: hHeap=0x630000) returned 1 [0074.101] GetProcessHeap () returned 0x630000 [0074.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.101] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\") returned 40 [0074.101] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\*") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\*" [0074.101] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648bd0 [0074.103] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0074.103] FindNextFileW (in: hFindFile=0x648bd0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa87f514a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddc1fe1e, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.103] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0074.103] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0074.103] FindNextFileW (in: hFindFile=0x648bd0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddbf9d33, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 1 [0074.103] lstrcmpiW (lpString1="kkcie@kdj.kd.pst", lpString2=".") returned 1 [0074.103] lstrcmpiW (lpString1="kkcie@kdj.kd.pst", lpString2="..") returned 1 [0074.103] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\", lpString2="kkcie@kdj.kd.pst" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" [0074.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kkcie@kdj.kd.pst", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0074.103] GetProcessHeap () returned 0x630000 [0074.103] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11) returned 0x645e78 [0074.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kkcie@kdj.kd.pst", cchWideChar=-1, lpMultiByteStr=0x645e78, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kkcie@kdj.kd.pst", lpUsedDefaultChar=0x0) returned 17 [0074.103] lstrlenA (lpString="kkcie@kdj.kd.pst") returned 16 [0074.103] lstrlenA (lpString=".happythreechoose") returned 17 [0074.103] lstrcmpiW (lpString1="kkcie@kdj.kd.pst", lpString2="Decryption INFO.html") returned 1 [0074.104] lstrcmpiW (lpString1="kkcie@kdj.kd.pst", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0074.104] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0074.104] lstrcmpiW (lpString1="kkcie@kdj.kd.pst", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0074.104] GetProcessHeap () returned 0x630000 [0074.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0074.104] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0074.104] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=271360) returned 1 [0074.104] GetProcessHeap () returned 0x630000 [0074.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6556e8 [0074.104] GetProcessHeap () returned 0x630000 [0074.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.104] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst") returned 56 [0074.104] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.104] GetProcessHeap () returned 0x630000 [0074.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0074.104] GetProcessHeap () returned 0x630000 [0074.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x671fe0 [0074.105] lstrlenA (lpString="rsa_encrypt") returned 11 [0074.105] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0074.106] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0074.106] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0074.106] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0074.106] GetProcessHeap () returned 0x630000 [0074.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0074.106] lstrlenA (lpString="010001") returned 6 [0074.106] GetProcessHeap () returned 0x630000 [0074.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0074.106] GetProcessHeap () returned 0x630000 [0074.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.106] GetProcessHeap () returned 0x630000 [0074.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e100 [0074.106] GetProcessHeap () returned 0x630000 [0074.106] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0074.106] GetProcessHeap () returned 0x630000 [0074.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e8e0 [0074.106] GetProcessHeap () returned 0x630000 [0074.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657210 [0074.106] GetProcessHeap () returned 0x630000 [0074.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2f8 [0074.106] GetProcessHeap () returned 0x630000 [0074.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0074.106] GetProcessHeap () returned 0x630000 [0074.106] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.106] GetProcessHeap () returned 0x630000 [0074.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0074.106] GetProcessHeap () returned 0x630000 [0074.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.106] GetProcessHeap () returned 0x630000 [0074.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657670 [0074.107] GetProcessHeap () returned 0x630000 [0074.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.107] GetProcessHeap () returned 0x630000 [0074.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0074.107] GetProcessHeap () returned 0x630000 [0074.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e340 [0074.107] GetProcessHeap () returned 0x630000 [0074.107] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0074.107] GetProcessHeap () returned 0x630000 [0074.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0074.107] GetProcessHeap () returned 0x630000 [0074.107] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0074.107] GetProcessHeap () returned 0x630000 [0074.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.107] GetProcessHeap () returned 0x630000 [0074.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0074.107] GetProcessHeap () returned 0x630000 [0074.107] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.107] GetProcessHeap () returned 0x630000 [0074.107] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.107] GetProcessHeap () returned 0x630000 [0074.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.107] GetProcessHeap () returned 0x630000 [0074.107] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.107] GetProcessHeap () returned 0x630000 [0074.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ea90 [0074.107] GetProcessHeap () returned 0x630000 [0074.107] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0074.107] GetProcessHeap () returned 0x630000 [0074.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0074.107] GetProcessHeap () returned 0x630000 [0074.107] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea90 | out: hHeap=0x630000) returned 1 [0074.108] GetProcessHeap () returned 0x630000 [0074.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.108] GetProcessHeap () returned 0x630000 [0074.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.108] GetProcessHeap () returned 0x630000 [0074.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0074.108] GetProcessHeap () returned 0x630000 [0074.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0074.108] GetProcessHeap () returned 0x630000 [0074.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.108] GetProcessHeap () returned 0x630000 [0074.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.108] GetProcessHeap () returned 0x630000 [0074.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.108] GetProcessHeap () returned 0x630000 [0074.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.108] GetProcessHeap () returned 0x630000 [0074.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.108] GetProcessHeap () returned 0x630000 [0074.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.108] GetProcessHeap () returned 0x630000 [0074.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0074.108] GetProcessHeap () returned 0x630000 [0074.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0074.108] GetProcessHeap () returned 0x630000 [0074.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.108] GetProcessHeap () returned 0x630000 [0074.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.108] GetProcessHeap () returned 0x630000 [0074.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.108] GetProcessHeap () returned 0x630000 [0074.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.108] GetProcessHeap () returned 0x630000 [0074.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.108] GetProcessHeap () returned 0x630000 [0074.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.108] GetProcessHeap () returned 0x630000 [0074.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.108] GetProcessHeap () returned 0x630000 [0074.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.109] GetProcessHeap () returned 0x630000 [0074.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.109] GetProcessHeap () returned 0x630000 [0074.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.109] GetProcessHeap () returned 0x630000 [0074.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.109] GetProcessHeap () returned 0x630000 [0074.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.109] GetProcessHeap () returned 0x630000 [0074.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.109] GetProcessHeap () returned 0x630000 [0074.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.109] GetProcessHeap () returned 0x630000 [0074.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0074.109] GetProcessHeap () returned 0x630000 [0074.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0074.109] GetProcessHeap () returned 0x630000 [0074.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.109] GetProcessHeap () returned 0x630000 [0074.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.109] GetProcessHeap () returned 0x630000 [0074.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.109] GetProcessHeap () returned 0x630000 [0074.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.109] GetProcessHeap () returned 0x630000 [0074.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.109] GetProcessHeap () returned 0x630000 [0074.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.109] GetProcessHeap () returned 0x630000 [0074.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0074.109] GetProcessHeap () returned 0x630000 [0074.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0074.109] GetProcessHeap () returned 0x630000 [0074.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.109] GetProcessHeap () returned 0x630000 [0074.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.109] GetProcessHeap () returned 0x630000 [0074.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.110] GetProcessHeap () returned 0x630000 [0074.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.110] GetProcessHeap () returned 0x630000 [0074.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.110] GetProcessHeap () returned 0x630000 [0074.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.110] GetProcessHeap () returned 0x630000 [0074.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.110] GetProcessHeap () returned 0x630000 [0074.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.110] GetProcessHeap () returned 0x630000 [0074.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.110] GetProcessHeap () returned 0x630000 [0074.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.110] GetProcessHeap () returned 0x630000 [0074.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.110] GetProcessHeap () returned 0x630000 [0074.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.110] GetProcessHeap () returned 0x630000 [0074.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.110] GetProcessHeap () returned 0x630000 [0074.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.110] GetProcessHeap () returned 0x630000 [0074.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.110] GetProcessHeap () returned 0x630000 [0074.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.110] GetProcessHeap () returned 0x630000 [0074.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.110] GetProcessHeap () returned 0x630000 [0074.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.110] GetProcessHeap () returned 0x630000 [0074.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.110] GetProcessHeap () returned 0x630000 [0074.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.110] GetProcessHeap () returned 0x630000 [0074.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.110] GetProcessHeap () returned 0x630000 [0074.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.110] GetProcessHeap () returned 0x630000 [0074.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.111] GetProcessHeap () returned 0x630000 [0074.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.111] GetProcessHeap () returned 0x630000 [0074.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.111] GetProcessHeap () returned 0x630000 [0074.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.111] GetProcessHeap () returned 0x630000 [0074.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.111] GetProcessHeap () returned 0x630000 [0074.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.111] GetProcessHeap () returned 0x630000 [0074.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.111] GetProcessHeap () returned 0x630000 [0074.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.111] GetProcessHeap () returned 0x630000 [0074.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.111] GetProcessHeap () returned 0x630000 [0074.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.111] GetProcessHeap () returned 0x630000 [0074.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.111] GetProcessHeap () returned 0x630000 [0074.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.111] GetProcessHeap () returned 0x630000 [0074.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0074.111] GetProcessHeap () returned 0x630000 [0074.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0074.111] GetProcessHeap () returned 0x630000 [0074.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.111] GetProcessHeap () returned 0x630000 [0074.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.111] GetProcessHeap () returned 0x630000 [0074.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.111] GetProcessHeap () returned 0x630000 [0074.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.111] GetProcessHeap () returned 0x630000 [0074.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0074.111] GetProcessHeap () returned 0x630000 [0074.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0074.112] GetProcessHeap () returned 0x630000 [0074.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0074.112] GetProcessHeap () returned 0x630000 [0074.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0074.112] GetProcessHeap () returned 0x630000 [0074.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.112] GetProcessHeap () returned 0x630000 [0074.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.112] GetProcessHeap () returned 0x630000 [0074.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0074.112] GetProcessHeap () returned 0x630000 [0074.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0074.112] GetProcessHeap () returned 0x630000 [0074.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0074.112] GetProcessHeap () returned 0x630000 [0074.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0074.112] GetProcessHeap () returned 0x630000 [0074.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0074.112] GetProcessHeap () returned 0x630000 [0074.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0074.112] GetProcessHeap () returned 0x630000 [0074.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0074.112] GetProcessHeap () returned 0x630000 [0074.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0074.112] GetProcessHeap () returned 0x630000 [0074.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0074.112] GetProcessHeap () returned 0x630000 [0074.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.112] GetProcessHeap () returned 0x630000 [0074.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0074.112] WriteFile (in: hFile=0x230, lpBuffer=0x671fe0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x671fe0*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0074.115] GetProcessHeap () returned 0x630000 [0074.115] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x671fe0, Size=0x30) returned 0x671fe0 [0074.115] GetProcessHeap () returned 0x630000 [0074.115] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0074.115] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.115] GetProcessHeap () returned 0x630000 [0074.115] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x42400) returned 0x672018 [0074.120] ReadFile (in: hFile=0x230, lpBuffer=0x672018, nNumberOfBytesToRead=0x42400, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x672018*, lpNumberOfBytesRead=0x243d7e8*=0x42400, lpOverlapped=0x0) returned 1 [0074.123] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.123] WriteFile (in: hFile=0x230, lpBuffer=0x672018*, nNumberOfBytesToWrite=0x42400, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x672018*, lpNumberOfBytesWritten=0x243d7e4*=0x42400, lpOverlapped=0x0) returned 1 [0074.140] GetProcessHeap () returned 0x630000 [0074.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672018 | out: hHeap=0x630000) returned 1 [0074.140] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.140] WriteFile (in: hFile=0x230, lpBuffer=0x671fe0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x671fe0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0074.141] CloseHandle (hObject=0x230) returned 1 [0074.141] GetProcessHeap () returned 0x630000 [0074.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0074.141] GetProcessHeap () returned 0x630000 [0074.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6556e8 | out: hHeap=0x630000) returned 1 [0074.141] GetProcessHeap () returned 0x630000 [0074.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.141] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" [0074.141] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst.happythreechoose" [0074.141] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst.happythreechoose"), dwFlags=0x1) returned 1 [0074.142] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\Outlook Files") returned 1 [0074.142] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\Outlook Files" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\") returned="" [0074.142] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\Decryption INFO.html" [0074.142] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\decryption info.html")) returned 0xffffffff [0074.142] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0074.142] GetProcessHeap () returned 0x630000 [0074.142] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6555f8 [0074.142] GetProcessHeap () returned 0x630000 [0074.142] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.149] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.150] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.150] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.150] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.150] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.150] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.151] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.151] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.151] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.151] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.151] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.151] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.151] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.151] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.151] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.151] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.151] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.151] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.151] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.152] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.152] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.152] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.152] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.152] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.152] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.152] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.152] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.152] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.152] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.152] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.152] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.153] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.153] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.153] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.153] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.153] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.153] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.154] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.154] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.154] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.154] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.154] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.154] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.154] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.154] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.154] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.154] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.155] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.155] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.155] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.155] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.155] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.155] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.155] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.155] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.155] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.155] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.155] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.155] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.155] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.155] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.156] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.156] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.156] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.156] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.156] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.156] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.156] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.156] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.156] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.156] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.156] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.156] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.156] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.157] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.157] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.157] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.157] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.157] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.157] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.157] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.157] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.157] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.157] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.157] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.157] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.157] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.157] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.158] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.158] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.158] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.158] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.158] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.158] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.158] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.158] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.158] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.158] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.158] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.158] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.158] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.158] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.159] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.159] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.159] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.159] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.159] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.159] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.159] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.159] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.159] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.159] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.159] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.159] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.159] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.160] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.160] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.160] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.160] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.160] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.160] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.160] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.160] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.160] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.160] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.160] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.160] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.160] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.160] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.161] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.161] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.161] GetProcessHeap () returned 0x630000 [0074.161] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6555f8 | out: hHeap=0x630000) returned 1 [0074.161] GetProcessHeap () returned 0x630000 [0074.161] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0074.161] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0074.161] GetProcessHeap () returned 0x630000 [0074.161] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655508 [0074.161] GetProcessHeap () returned 0x630000 [0074.161] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.168] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.168] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.168] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.168] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.168] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.168] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.168] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.168] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.168] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.169] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.169] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.169] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.169] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.169] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.169] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.169] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.169] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.169] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.169] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.169] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.170] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.170] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.170] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.170] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.170] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.170] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.170] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.170] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.170] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.170] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.170] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.170] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.170] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.170] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.171] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.171] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.171] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.171] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.171] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.171] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.171] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.171] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.171] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.171] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.171] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.171] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.171] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.171] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.172] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.172] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.172] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.172] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.172] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.172] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.172] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.172] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.172] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.172] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.172] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.172] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.172] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.173] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.173] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.173] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.173] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.173] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.173] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.173] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.173] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.173] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.173] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.173] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.173] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.173] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.174] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.174] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.174] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.174] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.174] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.174] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.174] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.174] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.174] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.174] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.174] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.174] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.175] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.175] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.175] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.175] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.175] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.175] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.175] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.175] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.175] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.175] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.175] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.175] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.175] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.175] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.176] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.176] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.176] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.176] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.176] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.176] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.176] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.176] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.176] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.176] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.176] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.176] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.176] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.176] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.177] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.177] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.177] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.177] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.178] GetProcessHeap () returned 0x630000 [0074.178] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655508 | out: hHeap=0x630000) returned 1 [0074.178] GetProcessHeap () returned 0x630000 [0074.178] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0074.178] CloseHandle (hObject=0x230) returned 1 [0074.178] GetProcessHeap () returned 0x630000 [0074.178] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645e78 | out: hHeap=0x630000) returned 1 [0074.178] FindNextFileW (in: hFindFile=0x648bd0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddbf9d33, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 0 [0074.178] FindClose (in: hFindFile=0x648bd0 | out: hFindFile=0x648bd0) returned 1 [0074.178] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\Documents\\My Videos\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Videos\\") returned="C:\\Users\\FD1HVy\\Documents\\My Videos\\" [0074.178] GetProcessHeap () returned 0x630000 [0074.178] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65f010 | out: hHeap=0x630000) returned 1 [0074.178] GetProcessHeap () returned 0x630000 [0074.178] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.178] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\My Videos\\") returned 36 [0074.178] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Videos\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Videos\\*") returned="C:\\Users\\FD1HVy\\Documents\\My Videos\\*" [0074.178] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Videos\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xddbf9d33, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 0xffffffff [0074.178] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\Documents\\My Shapes\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\" [0074.178] GetProcessHeap () returned 0x630000 [0074.178] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eda8 | out: hHeap=0x630000) returned 1 [0074.178] GetProcessHeap () returned 0x630000 [0074.179] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.179] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\My Shapes\\") returned 36 [0074.179] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\*") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\*" [0074.179] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648810 [0074.182] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0074.182] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.182] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0074.182] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0074.182] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0074.182] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0074.182] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0074.182] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini" [0074.182] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0074.182] GetProcessHeap () returned 0x630000 [0074.182] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0074.182] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0074.182] lstrlenA (lpString="desktop.ini") returned 11 [0074.182] lstrlenA (lpString=".happythreechoose") returned 17 [0074.182] lstrcmpiW (lpString1="desktop.ini", lpString2="Decryption INFO.html") returned 1 [0074.182] lstrcmpiW (lpString1="desktop.ini", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0074.183] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0074.183] lstrcmpiW (lpString1="desktop.ini", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0074.183] GetProcessHeap () returned 0x630000 [0074.183] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0074.183] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0074.183] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=216) returned 1 [0074.183] GetProcessHeap () returned 0x630000 [0074.183] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6559b8 [0074.183] GetProcessHeap () returned 0x630000 [0074.183] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.183] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini") returned 47 [0074.183] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.183] GetProcessHeap () returned 0x630000 [0074.183] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0074.183] GetProcessHeap () returned 0x630000 [0074.183] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x388) returned 0x672018 [0074.183] lstrlenA (lpString="rsa_encrypt") returned 11 [0074.183] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0074.184] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0074.184] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0074.184] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0074.184] GetProcessHeap () returned 0x630000 [0074.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0074.184] lstrlenA (lpString="010001") returned 6 [0074.184] GetProcessHeap () returned 0x630000 [0074.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2b8 [0074.184] GetProcessHeap () returned 0x630000 [0074.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.184] GetProcessHeap () returned 0x630000 [0074.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e8e0 [0074.184] GetProcessHeap () returned 0x630000 [0074.184] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.184] GetProcessHeap () returned 0x630000 [0074.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e340 [0074.184] GetProcessHeap () returned 0x630000 [0074.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657558 [0074.184] GetProcessHeap () returned 0x630000 [0074.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a348 [0074.184] GetProcessHeap () returned 0x630000 [0074.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0074.184] GetProcessHeap () returned 0x630000 [0074.184] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0074.184] GetProcessHeap () returned 0x630000 [0074.184] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0074.184] GetProcessHeap () returned 0x630000 [0074.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.185] GetProcessHeap () returned 0x630000 [0074.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657670 [0074.185] GetProcessHeap () returned 0x630000 [0074.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.185] GetProcessHeap () returned 0x630000 [0074.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0074.185] GetProcessHeap () returned 0x630000 [0074.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e730 [0074.185] GetProcessHeap () returned 0x630000 [0074.185] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.185] GetProcessHeap () returned 0x630000 [0074.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0074.185] GetProcessHeap () returned 0x630000 [0074.185] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0074.185] GetProcessHeap () returned 0x630000 [0074.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.185] GetProcessHeap () returned 0x630000 [0074.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cf88 [0074.185] GetProcessHeap () returned 0x630000 [0074.185] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.185] GetProcessHeap () returned 0x630000 [0074.185] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.185] GetProcessHeap () returned 0x630000 [0074.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.185] GetProcessHeap () returned 0x630000 [0074.185] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.185] GetProcessHeap () returned 0x630000 [0074.185] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e850 [0074.185] GetProcessHeap () returned 0x630000 [0074.185] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cf88 | out: hHeap=0x630000) returned 1 [0074.185] GetProcessHeap () returned 0x630000 [0074.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0074.186] GetProcessHeap () returned 0x630000 [0074.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0074.186] GetProcessHeap () returned 0x630000 [0074.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.186] GetProcessHeap () returned 0x630000 [0074.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.186] GetProcessHeap () returned 0x630000 [0074.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.186] GetProcessHeap () returned 0x630000 [0074.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.186] GetProcessHeap () returned 0x630000 [0074.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.186] GetProcessHeap () returned 0x630000 [0074.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.186] GetProcessHeap () returned 0x630000 [0074.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.186] GetProcessHeap () returned 0x630000 [0074.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.186] GetProcessHeap () returned 0x630000 [0074.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.186] GetProcessHeap () returned 0x630000 [0074.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.186] GetProcessHeap () returned 0x630000 [0074.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.186] GetProcessHeap () returned 0x630000 [0074.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.186] GetProcessHeap () returned 0x630000 [0074.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.186] GetProcessHeap () returned 0x630000 [0074.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.186] GetProcessHeap () returned 0x630000 [0074.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.186] GetProcessHeap () returned 0x630000 [0074.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.186] GetProcessHeap () returned 0x630000 [0074.186] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.187] GetProcessHeap () returned 0x630000 [0074.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.187] GetProcessHeap () returned 0x630000 [0074.187] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.187] GetProcessHeap () returned 0x630000 [0074.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.187] GetProcessHeap () returned 0x630000 [0074.187] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.187] GetProcessHeap () returned 0x630000 [0074.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.187] GetProcessHeap () returned 0x630000 [0074.187] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.187] GetProcessHeap () returned 0x630000 [0074.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.187] GetProcessHeap () returned 0x630000 [0074.187] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.187] GetProcessHeap () returned 0x630000 [0074.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.187] GetProcessHeap () returned 0x630000 [0074.187] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.187] GetProcessHeap () returned 0x630000 [0074.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.187] GetProcessHeap () returned 0x630000 [0074.187] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.187] GetProcessHeap () returned 0x630000 [0074.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.187] GetProcessHeap () returned 0x630000 [0074.187] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.187] GetProcessHeap () returned 0x630000 [0074.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.187] GetProcessHeap () returned 0x630000 [0074.187] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.187] GetProcessHeap () returned 0x630000 [0074.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.187] GetProcessHeap () returned 0x630000 [0074.187] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.187] GetProcessHeap () returned 0x630000 [0074.187] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.188] GetProcessHeap () returned 0x630000 [0074.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.188] GetProcessHeap () returned 0x630000 [0074.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.188] GetProcessHeap () returned 0x630000 [0074.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.188] GetProcessHeap () returned 0x630000 [0074.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.188] GetProcessHeap () returned 0x630000 [0074.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.188] GetProcessHeap () returned 0x630000 [0074.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.188] GetProcessHeap () returned 0x630000 [0074.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.188] GetProcessHeap () returned 0x630000 [0074.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.188] GetProcessHeap () returned 0x630000 [0074.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.188] GetProcessHeap () returned 0x630000 [0074.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.188] GetProcessHeap () returned 0x630000 [0074.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.188] GetProcessHeap () returned 0x630000 [0074.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.188] GetProcessHeap () returned 0x630000 [0074.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.188] GetProcessHeap () returned 0x630000 [0074.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.188] GetProcessHeap () returned 0x630000 [0074.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.188] GetProcessHeap () returned 0x630000 [0074.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.188] GetProcessHeap () returned 0x630000 [0074.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.188] GetProcessHeap () returned 0x630000 [0074.188] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.188] GetProcessHeap () returned 0x630000 [0074.188] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.188] GetProcessHeap () returned 0x630000 [0074.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.189] GetProcessHeap () returned 0x630000 [0074.189] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.189] GetProcessHeap () returned 0x630000 [0074.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.189] GetProcessHeap () returned 0x630000 [0074.189] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.189] GetProcessHeap () returned 0x630000 [0074.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.189] GetProcessHeap () returned 0x630000 [0074.189] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.189] GetProcessHeap () returned 0x630000 [0074.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.189] GetProcessHeap () returned 0x630000 [0074.189] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.189] GetProcessHeap () returned 0x630000 [0074.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.189] GetProcessHeap () returned 0x630000 [0074.189] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.189] GetProcessHeap () returned 0x630000 [0074.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.189] GetProcessHeap () returned 0x630000 [0074.189] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.189] GetProcessHeap () returned 0x630000 [0074.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.189] GetProcessHeap () returned 0x630000 [0074.189] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.189] GetProcessHeap () returned 0x630000 [0074.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.189] GetProcessHeap () returned 0x630000 [0074.189] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.189] GetProcessHeap () returned 0x630000 [0074.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.189] GetProcessHeap () returned 0x630000 [0074.189] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.189] GetProcessHeap () returned 0x630000 [0074.189] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.189] GetProcessHeap () returned 0x630000 [0074.189] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.189] GetProcessHeap () returned 0x630000 [0074.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.190] GetProcessHeap () returned 0x630000 [0074.190] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.190] GetProcessHeap () returned 0x630000 [0074.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.190] GetProcessHeap () returned 0x630000 [0074.190] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.190] GetProcessHeap () returned 0x630000 [0074.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.190] GetProcessHeap () returned 0x630000 [0074.190] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.190] GetProcessHeap () returned 0x630000 [0074.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.190] GetProcessHeap () returned 0x630000 [0074.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0074.190] GetProcessHeap () returned 0x630000 [0074.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0074.190] GetProcessHeap () returned 0x630000 [0074.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0074.190] GetProcessHeap () returned 0x630000 [0074.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0074.190] GetProcessHeap () returned 0x630000 [0074.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0074.190] GetProcessHeap () returned 0x630000 [0074.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0074.190] GetProcessHeap () returned 0x630000 [0074.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0074.190] GetProcessHeap () returned 0x630000 [0074.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0074.190] GetProcessHeap () returned 0x630000 [0074.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0074.190] GetProcessHeap () returned 0x630000 [0074.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0074.190] GetProcessHeap () returned 0x630000 [0074.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0074.190] WriteFile (in: hFile=0x230, lpBuffer=0x672018*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672018*, lpNumberOfBytesWritten=0x243d864*=0x388, lpOverlapped=0x0) returned 1 [0074.194] GetProcessHeap () returned 0x630000 [0074.195] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x672018, Size=0x30) returned 0x672018 [0074.195] GetProcessHeap () returned 0x630000 [0074.195] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0074.195] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.195] GetProcessHeap () returned 0x630000 [0074.195] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe0) returned 0x641ca8 [0074.195] ReadFile (in: hFile=0x230, lpBuffer=0x641ca8, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x641ca8*, lpNumberOfBytesRead=0x243d7e8*=0xe0, lpOverlapped=0x0) returned 1 [0074.195] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.195] WriteFile (in: hFile=0x230, lpBuffer=0x641ca8*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x641ca8*, lpNumberOfBytesWritten=0x243d7e4*=0xe0, lpOverlapped=0x0) returned 1 [0074.196] GetProcessHeap () returned 0x630000 [0074.196] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x641ca8 | out: hHeap=0x630000) returned 1 [0074.196] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.196] WriteFile (in: hFile=0x230, lpBuffer=0x672018*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672018*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0074.197] CloseHandle (hObject=0x230) returned 1 [0074.197] GetProcessHeap () returned 0x630000 [0074.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0074.197] GetProcessHeap () returned 0x630000 [0074.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6559b8 | out: hHeap=0x630000) returned 1 [0074.197] GetProcessHeap () returned 0x630000 [0074.197] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0074.197] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini" [0074.197] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini.happythreechoose" [0074.197] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\desktop.ini.happythreechoose"), dwFlags=0x1) returned 1 [0074.199] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\My Shapes\\desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\My Shapes") returned 1 [0074.199] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\My Shapes" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\My Shapes\\") returned="" [0074.199] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Decryption INFO.html" [0074.199] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\decryption info.html")) returned 0xffffffff [0074.199] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0074.199] GetProcessHeap () returned 0x630000 [0074.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655b20 [0074.199] GetProcessHeap () returned 0x630000 [0074.200] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.207] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.208] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.208] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.208] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.208] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.208] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.208] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.208] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.208] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.208] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.208] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.208] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.208] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.209] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.209] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.209] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.209] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.209] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.209] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.209] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.209] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.209] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.209] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.209] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.209] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.210] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.210] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.210] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.210] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.210] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.210] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.210] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.210] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.210] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.210] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.210] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.210] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.211] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.211] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.211] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.211] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.211] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.211] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.211] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.211] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.212] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.212] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.212] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.212] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.212] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.212] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.212] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.212] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.212] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.212] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.212] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.212] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.212] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.213] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.213] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.213] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.213] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.213] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.213] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.213] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.213] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.213] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.213] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.213] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.213] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.213] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.213] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.214] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.214] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.214] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.214] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.214] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.214] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.214] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.214] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.214] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.214] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.214] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.214] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.214] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.215] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.215] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.215] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.215] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.215] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.215] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.215] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.215] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.215] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.215] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.215] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.215] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.215] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.215] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.216] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.216] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.216] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.216] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.216] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.216] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.216] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.216] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.216] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.216] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.216] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.217] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.217] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.217] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.217] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.217] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.217] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.217] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.217] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.217] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.217] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.217] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.217] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.217] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.217] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.218] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.218] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.218] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.218] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.218] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.218] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.218] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.218] GetProcessHeap () returned 0x630000 [0074.218] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655b20 | out: hHeap=0x630000) returned 1 [0074.218] GetProcessHeap () returned 0x630000 [0074.218] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0074.218] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0074.218] GetProcessHeap () returned 0x630000 [0074.218] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6556e8 [0074.218] GetProcessHeap () returned 0x630000 [0074.218] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.225] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.225] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.225] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.225] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.225] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.226] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.226] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.226] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.226] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.226] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.226] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.226] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.226] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.226] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.226] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.226] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.226] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.226] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.226] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.227] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.227] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.227] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.227] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.227] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.227] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.227] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.227] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.227] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.227] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.227] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.227] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.227] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.228] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.228] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.228] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.228] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.228] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.228] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.228] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.228] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.228] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.228] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.228] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.228] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.228] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.228] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.229] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.229] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.229] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.229] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.229] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.229] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.229] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.229] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.229] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.229] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.229] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.229] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.229] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.229] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.230] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.230] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.230] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.230] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.230] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.230] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.230] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.230] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.230] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.230] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.230] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.230] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.230] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.231] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.231] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.231] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.231] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.231] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.231] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.231] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.231] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.231] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.231] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.231] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.231] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.232] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.232] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.238] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.238] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.238] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.238] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.238] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.238] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.238] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.238] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.238] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.238] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.238] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.238] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.238] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.239] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.239] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.239] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.239] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.239] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.239] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.239] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.239] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.239] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.239] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.239] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.239] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.239] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.240] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.240] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.240] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.240] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.240] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.241] GetProcessHeap () returned 0x630000 [0074.241] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6556e8 | out: hHeap=0x630000) returned 1 [0074.241] GetProcessHeap () returned 0x630000 [0074.241] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0074.241] CloseHandle (hObject=0x230) returned 1 [0074.241] GetProcessHeap () returned 0x630000 [0074.241] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0074.241] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1a0f60e, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1a0f60e, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites.vssx", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0074.241] lstrcmpiW (lpString1="Favorites.vssx", lpString2=".") returned 1 [0074.241] lstrcmpiW (lpString1="Favorites.vssx", lpString2="..") returned 1 [0074.241] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\", lpString2="Favorites.vssx" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx" [0074.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Favorites.vssx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0074.241] GetProcessHeap () returned 0x630000 [0074.241] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0074.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Favorites.vssx", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Favorites.vssx", lpUsedDefaultChar=0x0) returned 15 [0074.241] lstrlenA (lpString="Favorites.vssx") returned 14 [0074.241] lstrlenA (lpString=".happythreechoose") returned 17 [0074.241] lstrcmpiW (lpString1="Favorites.vssx", lpString2="Decryption INFO.html") returned 1 [0074.241] lstrcmpiW (lpString1="Favorites.vssx", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0074.241] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0074.241] lstrcmpiW (lpString1="Favorites.vssx", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0074.241] GetProcessHeap () returned 0x630000 [0074.241] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0074.241] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\Favorites.vssx" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\favorites.vssx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0074.242] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=0) returned 1 [0074.242] CloseHandle (hObject=0x230) returned 1 [0074.242] GetProcessHeap () returned 0x630000 [0074.242] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0074.242] GetProcessHeap () returned 0x630000 [0074.242] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0074.242] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1 [0074.242] lstrcmpiW (lpString1="_private", lpString2=".") returned 1 [0074.242] lstrcmpiW (lpString1="_private", lpString2="..") returned 1 [0074.242] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\", lpString2="_private" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private" [0074.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="_private", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0074.242] GetProcessHeap () returned 0x630000 [0074.242] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9) returned 0x64c9f0 [0074.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="_private", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_private", lpUsedDefaultChar=0x0) returned 9 [0074.242] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0074.242] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0074.242] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0074.242] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0074.242] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0074.242] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0074.242] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0074.242] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0074.242] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0074.242] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0074.242] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0074.242] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0074.242] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0074.242] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0074.242] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0074.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0074.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0074.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0074.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0074.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0074.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0074.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0074.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0074.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 1 [0074.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0074.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0074.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 1 [0074.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0074.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0074.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0074.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0074.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 1 [0074.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0074.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0074.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0074.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0074.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0074.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0074.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0074.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0074.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0074.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0074.243] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="_private", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0074.243] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\" [0074.243] GetProcessHeap () returned 0x630000 [0074.243] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a408 [0074.243] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\") returned 45 [0074.243] GetProcessHeap () returned 0x630000 [0074.243] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5c) returned 0x63e830 [0074.243] lstrcpyW (in: lpString1=0x63e830, lpString2="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\" [0074.244] GetProcessHeap () returned 0x630000 [0074.244] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0074.244] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 0 [0074.244] FindClose (in: hFindFile=0x648810 | out: hFindFile=0x648810) returned 1 [0074.244] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\" [0074.244] GetProcessHeap () returned 0x630000 [0074.244] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0074.244] GetProcessHeap () returned 0x630000 [0074.244] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.244] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\") returned 45 [0074.244] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\*") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\*" [0074.244] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648810 [0074.245] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0074.245] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xd44481c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.245] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0074.245] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0074.245] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0074.245] lstrcmpiW (lpString1="folder.ico", lpString2=".") returned 1 [0074.245] lstrcmpiW (lpString1="folder.ico", lpString2="..") returned 1 [0074.245] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\", lpString2="folder.ico" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico" [0074.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="folder.ico", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0074.245] GetProcessHeap () returned 0x630000 [0074.245] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb) returned 0x64c9f0 [0074.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="folder.ico", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="folder.ico", lpUsedDefaultChar=0x0) returned 11 [0074.245] lstrlenA (lpString="folder.ico") returned 10 [0074.245] lstrlenA (lpString=".happythreechoose") returned 17 [0074.245] lstrcmpiW (lpString1="folder.ico", lpString2="Decryption INFO.html") returned 1 [0074.245] lstrcmpiW (lpString1="folder.ico", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0074.245] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0074.245] lstrcmpiW (lpString1="folder.ico", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0074.245] GetProcessHeap () returned 0x630000 [0074.245] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0074.245] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\folder.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0074.245] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=29926) returned 1 [0074.245] GetProcessHeap () returned 0x630000 [0074.245] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655418 [0074.246] GetProcessHeap () returned 0x630000 [0074.246] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.246] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico") returned 55 [0074.246] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.246] GetProcessHeap () returned 0x630000 [0074.246] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0074.246] GetProcessHeap () returned 0x630000 [0074.246] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x672050 [0074.246] lstrlenA (lpString="rsa_encrypt") returned 11 [0074.246] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0074.246] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0074.246] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0074.246] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0074.246] GetProcessHeap () returned 0x630000 [0074.246] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0074.246] lstrlenA (lpString="010001") returned 6 [0074.246] GetProcessHeap () returned 0x630000 [0074.247] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0074.247] GetProcessHeap () returned 0x630000 [0074.247] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.247] GetProcessHeap () returned 0x630000 [0074.247] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0074.247] GetProcessHeap () returned 0x630000 [0074.247] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.247] GetProcessHeap () returned 0x630000 [0074.247] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e7c0 [0074.247] GetProcessHeap () returned 0x630000 [0074.247] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657328 [0074.247] GetProcessHeap () returned 0x630000 [0074.247] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2f8 [0074.247] GetProcessHeap () returned 0x630000 [0074.247] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0074.247] GetProcessHeap () returned 0x630000 [0074.247] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.247] GetProcessHeap () returned 0x630000 [0074.247] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0074.247] GetProcessHeap () returned 0x630000 [0074.247] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.247] GetProcessHeap () returned 0x630000 [0074.247] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x6570f8 [0074.247] GetProcessHeap () returned 0x630000 [0074.247] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.247] GetProcessHeap () returned 0x630000 [0074.247] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0074.247] GetProcessHeap () returned 0x630000 [0074.248] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e970 [0074.248] GetProcessHeap () returned 0x630000 [0074.248] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.248] GetProcessHeap () returned 0x630000 [0074.248] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0074.248] GetProcessHeap () returned 0x630000 [0074.248] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0074.248] GetProcessHeap () returned 0x630000 [0074.248] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.248] GetProcessHeap () returned 0x630000 [0074.248] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65d0c0 [0074.248] GetProcessHeap () returned 0x630000 [0074.248] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.248] GetProcessHeap () returned 0x630000 [0074.248] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.248] GetProcessHeap () returned 0x630000 [0074.248] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.248] GetProcessHeap () returned 0x630000 [0074.248] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.248] GetProcessHeap () returned 0x630000 [0074.248] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e850 [0074.248] GetProcessHeap () returned 0x630000 [0074.248] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65d0c0 | out: hHeap=0x630000) returned 1 [0074.248] GetProcessHeap () returned 0x630000 [0074.248] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0074.248] GetProcessHeap () returned 0x630000 [0074.248] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0074.248] GetProcessHeap () returned 0x630000 [0074.248] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.248] GetProcessHeap () returned 0x630000 [0074.248] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.248] GetProcessHeap () returned 0x630000 [0074.248] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.248] GetProcessHeap () returned 0x630000 [0074.248] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.248] GetProcessHeap () returned 0x630000 [0074.248] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.248] GetProcessHeap () returned 0x630000 [0074.248] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.248] GetProcessHeap () returned 0x630000 [0074.248] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.249] GetProcessHeap () returned 0x630000 [0074.249] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.249] GetProcessHeap () returned 0x630000 [0074.249] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.249] GetProcessHeap () returned 0x630000 [0074.249] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.249] GetProcessHeap () returned 0x630000 [0074.249] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0074.249] GetProcessHeap () returned 0x630000 [0074.249] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0074.249] GetProcessHeap () returned 0x630000 [0074.249] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.249] GetProcessHeap () returned 0x630000 [0074.249] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.249] GetProcessHeap () returned 0x630000 [0074.249] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.249] GetProcessHeap () returned 0x630000 [0074.249] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.249] GetProcessHeap () returned 0x630000 [0074.249] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.249] GetProcessHeap () returned 0x630000 [0074.249] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.249] GetProcessHeap () returned 0x630000 [0074.249] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.249] GetProcessHeap () returned 0x630000 [0074.249] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.249] GetProcessHeap () returned 0x630000 [0074.249] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.249] GetProcessHeap () returned 0x630000 [0074.249] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.249] GetProcessHeap () returned 0x630000 [0074.249] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.249] GetProcessHeap () returned 0x630000 [0074.249] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.249] GetProcessHeap () returned 0x630000 [0074.249] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.249] GetProcessHeap () returned 0x630000 [0074.249] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.249] GetProcessHeap () returned 0x630000 [0074.250] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.250] GetProcessHeap () returned 0x630000 [0074.250] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.250] GetProcessHeap () returned 0x630000 [0074.250] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.250] GetProcessHeap () returned 0x630000 [0074.250] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.250] GetProcessHeap () returned 0x630000 [0074.250] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0074.250] GetProcessHeap () returned 0x630000 [0074.250] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0074.250] GetProcessHeap () returned 0x630000 [0074.250] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.250] GetProcessHeap () returned 0x630000 [0074.250] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.250] GetProcessHeap () returned 0x630000 [0074.250] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.250] GetProcessHeap () returned 0x630000 [0074.250] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.250] GetProcessHeap () returned 0x630000 [0074.250] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.250] GetProcessHeap () returned 0x630000 [0074.250] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.250] GetProcessHeap () returned 0x630000 [0074.250] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.250] GetProcessHeap () returned 0x630000 [0074.250] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.250] GetProcessHeap () returned 0x630000 [0074.250] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.250] GetProcessHeap () returned 0x630000 [0074.250] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.250] GetProcessHeap () returned 0x630000 [0074.250] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.250] GetProcessHeap () returned 0x630000 [0074.250] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.250] GetProcessHeap () returned 0x630000 [0074.250] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.250] GetProcessHeap () returned 0x630000 [0074.250] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.251] GetProcessHeap () returned 0x630000 [0074.251] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.251] GetProcessHeap () returned 0x630000 [0074.251] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.251] GetProcessHeap () returned 0x630000 [0074.251] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.251] GetProcessHeap () returned 0x630000 [0074.251] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.251] GetProcessHeap () returned 0x630000 [0074.251] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.251] GetProcessHeap () returned 0x630000 [0074.251] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.251] GetProcessHeap () returned 0x630000 [0074.251] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.251] GetProcessHeap () returned 0x630000 [0074.251] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.251] GetProcessHeap () returned 0x630000 [0074.251] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.251] GetProcessHeap () returned 0x630000 [0074.251] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.251] GetProcessHeap () returned 0x630000 [0074.251] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.251] GetProcessHeap () returned 0x630000 [0074.251] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.251] GetProcessHeap () returned 0x630000 [0074.251] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.251] GetProcessHeap () returned 0x630000 [0074.251] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.251] GetProcessHeap () returned 0x630000 [0074.251] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.251] GetProcessHeap () returned 0x630000 [0074.251] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.251] GetProcessHeap () returned 0x630000 [0074.251] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.251] GetProcessHeap () returned 0x630000 [0074.251] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.251] GetProcessHeap () returned 0x630000 [0074.251] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.251] GetProcessHeap () returned 0x630000 [0074.251] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.252] GetProcessHeap () returned 0x630000 [0074.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.252] GetProcessHeap () returned 0x630000 [0074.252] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.252] GetProcessHeap () returned 0x630000 [0074.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.252] GetProcessHeap () returned 0x630000 [0074.252] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.252] GetProcessHeap () returned 0x630000 [0074.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.252] GetProcessHeap () returned 0x630000 [0074.252] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.252] GetProcessHeap () returned 0x630000 [0074.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.252] GetProcessHeap () returned 0x630000 [0074.252] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.252] GetProcessHeap () returned 0x630000 [0074.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.252] GetProcessHeap () returned 0x630000 [0074.252] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.252] GetProcessHeap () returned 0x630000 [0074.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.252] GetProcessHeap () returned 0x630000 [0074.252] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.252] GetProcessHeap () returned 0x630000 [0074.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.252] GetProcessHeap () returned 0x630000 [0074.252] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.252] GetProcessHeap () returned 0x630000 [0074.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.252] GetProcessHeap () returned 0x630000 [0074.252] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.252] GetProcessHeap () returned 0x630000 [0074.252] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0074.252] GetProcessHeap () returned 0x630000 [0074.252] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0074.252] GetProcessHeap () returned 0x630000 [0074.252] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0074.252] GetProcessHeap () returned 0x630000 [0074.252] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0074.253] GetProcessHeap () returned 0x630000 [0074.253] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0074.253] GetProcessHeap () returned 0x630000 [0074.253] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e7c0 | out: hHeap=0x630000) returned 1 [0074.253] GetProcessHeap () returned 0x630000 [0074.253] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0074.253] GetProcessHeap () returned 0x630000 [0074.253] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0074.253] GetProcessHeap () returned 0x630000 [0074.253] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0074.253] GetProcessHeap () returned 0x630000 [0074.253] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.253] GetProcessHeap () returned 0x630000 [0074.253] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0074.253] WriteFile (in: hFile=0x230, lpBuffer=0x672050*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672050*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0074.272] GetProcessHeap () returned 0x630000 [0074.272] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x672050, Size=0x30) returned 0x672050 [0074.272] GetProcessHeap () returned 0x630000 [0074.272] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0074.272] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.272] GetProcessHeap () returned 0x630000 [0074.272] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x74e6) returned 0x672088 [0074.272] ReadFile (in: hFile=0x230, lpBuffer=0x672088, nNumberOfBytesToRead=0x74e6, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x672088*, lpNumberOfBytesRead=0x243d7e8*=0x74e6, lpOverlapped=0x0) returned 1 [0074.273] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.273] WriteFile (in: hFile=0x230, lpBuffer=0x672088*, nNumberOfBytesToWrite=0x74e6, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x672088*, lpNumberOfBytesWritten=0x243d7e4*=0x74e6, lpOverlapped=0x0) returned 1 [0074.275] GetProcessHeap () returned 0x630000 [0074.275] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672088 | out: hHeap=0x630000) returned 1 [0074.275] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.275] WriteFile (in: hFile=0x230, lpBuffer=0x672050*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672050*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0074.275] CloseHandle (hObject=0x230) returned 1 [0074.276] GetProcessHeap () returned 0x630000 [0074.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0074.276] GetProcessHeap () returned 0x630000 [0074.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655418 | out: hHeap=0x630000) returned 1 [0074.276] GetProcessHeap () returned 0x630000 [0074.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0074.276] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico" [0074.276] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico.happythreechoose") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico.happythreechoose" [0074.276] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\folder.ico"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico.happythreechoose" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\folder.ico.happythreechoose"), dwFlags=0x1) returned 1 [0074.277] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\folder.ico" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private") returned 1 [0074.277] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private" | out: pszPath="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\") returned="" [0074.277] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\Decryption INFO.html" [0074.277] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\decryption info.html")) returned 0xffffffff [0074.277] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\My Shapes\\_private\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\documents\\my shapes\\_private\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0074.277] GetProcessHeap () returned 0x630000 [0074.277] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6557d8 [0074.277] GetProcessHeap () returned 0x630000 [0074.277] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.285] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.286] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.286] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.286] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.286] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.286] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.286] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.286] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.286] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.287] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.287] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.287] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.287] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.287] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.287] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.287] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.287] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.287] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.287] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.287] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.287] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.287] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.288] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.288] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.288] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.288] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.288] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.288] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.288] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.288] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.288] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.288] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.288] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.289] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.289] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.289] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.289] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.290] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.290] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.290] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.290] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.290] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.290] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.290] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.290] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.290] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.290] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.291] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.291] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.291] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.291] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.291] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.291] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.291] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.291] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.291] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.291] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.291] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.291] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.291] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.291] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.292] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.292] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.292] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.292] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.292] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.292] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.292] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.292] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.292] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.292] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.292] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.292] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.292] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.293] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.293] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.293] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.293] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.293] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.293] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.293] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.293] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.293] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.293] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.293] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.293] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.293] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.294] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.294] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.294] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.294] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.294] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.294] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.294] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.294] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.294] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.294] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.295] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.295] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.295] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.295] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.295] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.295] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.295] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.295] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.295] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.295] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.295] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.295] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.295] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.295] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.296] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.296] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.296] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.296] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.296] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.296] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.296] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.296] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.296] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.296] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.296] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.296] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.296] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.296] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.297] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.297] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.297] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.297] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.297] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.297] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.297] GetProcessHeap () returned 0x630000 [0074.297] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6557d8 | out: hHeap=0x630000) returned 1 [0074.297] GetProcessHeap () returned 0x630000 [0074.297] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0074.297] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0074.297] GetProcessHeap () returned 0x630000 [0074.297] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6559b8 [0074.297] GetProcessHeap () returned 0x630000 [0074.297] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.304] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.304] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.304] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.304] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.304] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.305] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.305] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.305] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.305] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.305] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.305] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.305] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.305] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.305] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.305] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.305] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.305] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.305] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.306] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.306] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.306] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.306] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.306] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.306] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.306] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.306] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.306] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.306] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.306] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.306] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.306] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.306] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.307] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.307] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.307] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.307] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.307] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.307] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.307] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.307] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.307] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.307] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.307] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.307] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.307] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.307] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.308] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.308] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.308] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.308] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.308] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.308] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.308] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.308] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.308] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.308] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.308] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.308] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.308] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.309] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.309] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.309] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.309] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.309] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.309] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.309] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.309] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.309] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.309] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.309] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.309] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.309] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.309] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.310] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.310] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.312] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.312] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.312] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.312] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.312] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.312] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.312] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.312] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.312] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.312] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.313] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.313] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.313] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.313] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.313] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.313] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.313] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.313] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.313] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.313] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.313] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.313] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.313] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.314] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.314] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.314] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.314] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.314] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.314] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.314] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.314] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.314] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.314] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.314] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.314] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.314] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.315] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.315] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.315] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.315] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.315] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.315] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.315] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.316] GetProcessHeap () returned 0x630000 [0074.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6559b8 | out: hHeap=0x630000) returned 1 [0074.316] GetProcessHeap () returned 0x630000 [0074.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0074.316] CloseHandle (hObject=0x230) returned 1 [0074.316] GetProcessHeap () returned 0x630000 [0074.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0074.316] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 0 [0074.316] FindClose (in: hFindFile=0x648810 | out: hFindFile=0x648810) returned 1 [0074.316] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\Documents\\My Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Pictures\\") returned="C:\\Users\\FD1HVy\\Documents\\My Pictures\\" [0074.316] GetProcessHeap () returned 0x630000 [0074.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ef60 | out: hHeap=0x630000) returned 1 [0074.316] GetProcessHeap () returned 0x630000 [0074.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.316] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\My Pictures\\") returned 38 [0074.316] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Pictures\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Pictures\\*") returned="C:\\Users\\FD1HVy\\Documents\\My Pictures\\*" [0074.316] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Pictures\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 0xffffffff [0074.317] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\Documents\\My Music\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Music\\") returned="C:\\Users\\FD1HVy\\Documents\\My Music\\" [0074.317] GetProcessHeap () returned 0x630000 [0074.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65fa20 | out: hHeap=0x630000) returned 1 [0074.317] GetProcessHeap () returned 0x630000 [0074.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.317] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\My Music\\") returned 35 [0074.317] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents\\My Music\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\My Music\\*") returned="C:\\Users\\FD1HVy\\Documents\\My Music\\*" [0074.317] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\My Music\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xc1bc4716, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bea8c6, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 0xffffffff [0074.317] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0074.317] GetProcessHeap () returned 0x630000 [0074.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x648a90 | out: hHeap=0x630000) returned 1 [0074.317] GetProcessHeap () returned 0x630000 [0074.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.317] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\") returned 24 [0074.317] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\*") returned="C:\\Users\\FD1HVy\\Desktop\\*" [0074.317] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3a7a7482, ftLastAccessTime.dwHighDateTime=0x1d5dbe3, ftLastWriteTime.dwLowDateTime=0x3a7a7482, ftLastWriteTime.dwHighDateTime=0x1d5dbe3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648810 [0074.317] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0074.317] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3a7a7482, ftLastAccessTime.dwHighDateTime=0x1d5dbe3, ftLastWriteTime.dwLowDateTime=0x3a7a7482, ftLastWriteTime.dwHighDateTime=0x1d5dbe3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.317] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0074.317] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0074.317] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37b49f0, ftCreationTime.dwHighDateTime=0x1d5d6ad, ftLastAccessTime.dwLowDateTime=0xc71fabb0, ftLastAccessTime.dwHighDateTime=0x1d5d7bd, ftLastWriteTime.dwLowDateTime=0xc71fabb0, ftLastWriteTime.dwHighDateTime=0x1d5d7bd, nFileSizeHigh=0x0, nFileSizeLow=0xe087, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-7i2lwkr_U.flv", cAlternateFileName="-7I2LW~1.FLV")) returned 1 [0074.317] lstrcmpiW (lpString1="-7i2lwkr_U.flv", lpString2=".") returned 1 [0074.317] lstrcmpiW (lpString1="-7i2lwkr_U.flv", lpString2="..") returned 1 [0074.317] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="-7i2lwkr_U.flv" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\-7i2lwkr_U.flv") returned="C:\\Users\\FD1HVy\\Desktop\\-7i2lwkr_U.flv" [0074.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="-7i2lwkr_U.flv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0074.317] GetProcessHeap () returned 0x630000 [0074.318] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0074.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="-7i2lwkr_U.flv", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-7i2lwkr_U.flv", lpUsedDefaultChar=0x0) returned 15 [0074.318] lstrlenA (lpString="-7i2lwkr_U.flv") returned 14 [0074.318] lstrlenA (lpString=".happythreechoose") returned 17 [0074.318] lstrcmpiW (lpString1="-7i2lwkr_U.flv", lpString2="Decryption INFO.html") returned -1 [0074.318] lstrcmpiW (lpString1="-7i2lwkr_U.flv", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0074.318] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0074.318] lstrcmpiW (lpString1="-7i2lwkr_U.flv", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0074.318] GetProcessHeap () returned 0x630000 [0074.318] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f10 [0074.318] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-7i2lwkr_U.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\-7i2lwkr_u.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0074.318] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=57479) returned 1 [0074.318] GetProcessHeap () returned 0x630000 [0074.318] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655760 [0074.318] GetProcessHeap () returned 0x630000 [0074.318] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.318] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\-7i2lwkr_U.flv") returned 38 [0074.318] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.318] GetProcessHeap () returned 0x630000 [0074.318] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0074.318] GetProcessHeap () returned 0x630000 [0074.318] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x672088 [0074.318] lstrlenA (lpString="rsa_encrypt") returned 11 [0074.318] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0074.319] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0074.319] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0074.319] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0074.319] GetProcessHeap () returned 0x630000 [0074.319] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0074.319] lstrlenA (lpString="010001") returned 6 [0074.319] GetProcessHeap () returned 0x630000 [0074.319] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0074.319] GetProcessHeap () returned 0x630000 [0074.319] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.319] GetProcessHeap () returned 0x630000 [0074.319] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ec40 [0074.319] GetProcessHeap () returned 0x630000 [0074.319] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.319] GetProcessHeap () returned 0x630000 [0074.319] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e4f0 [0074.319] GetProcessHeap () returned 0x630000 [0074.319] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657558 [0074.319] GetProcessHeap () returned 0x630000 [0074.319] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0074.319] GetProcessHeap () returned 0x630000 [0074.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0074.320] GetProcessHeap () returned 0x630000 [0074.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.320] GetProcessHeap () returned 0x630000 [0074.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0074.320] GetProcessHeap () returned 0x630000 [0074.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.320] GetProcessHeap () returned 0x630000 [0074.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656fe0 [0074.320] GetProcessHeap () returned 0x630000 [0074.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.320] GetProcessHeap () returned 0x630000 [0074.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0074.320] GetProcessHeap () returned 0x630000 [0074.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e610 [0074.320] GetProcessHeap () returned 0x630000 [0074.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.320] GetProcessHeap () returned 0x630000 [0074.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0074.320] GetProcessHeap () returned 0x630000 [0074.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0074.320] GetProcessHeap () returned 0x630000 [0074.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.320] GetProcessHeap () returned 0x630000 [0074.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cfb8 [0074.320] GetProcessHeap () returned 0x630000 [0074.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.320] GetProcessHeap () returned 0x630000 [0074.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.320] GetProcessHeap () returned 0x630000 [0074.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.320] GetProcessHeap () returned 0x630000 [0074.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.320] GetProcessHeap () returned 0x630000 [0074.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e3d0 [0074.320] GetProcessHeap () returned 0x630000 [0074.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cfb8 | out: hHeap=0x630000) returned 1 [0074.320] GetProcessHeap () returned 0x630000 [0074.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0074.320] GetProcessHeap () returned 0x630000 [0074.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0074.320] GetProcessHeap () returned 0x630000 [0074.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.321] GetProcessHeap () returned 0x630000 [0074.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.321] GetProcessHeap () returned 0x630000 [0074.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.321] GetProcessHeap () returned 0x630000 [0074.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.321] GetProcessHeap () returned 0x630000 [0074.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.321] GetProcessHeap () returned 0x630000 [0074.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.321] GetProcessHeap () returned 0x630000 [0074.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.321] GetProcessHeap () returned 0x630000 [0074.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.321] GetProcessHeap () returned 0x630000 [0074.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.321] GetProcessHeap () returned 0x630000 [0074.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.321] GetProcessHeap () returned 0x630000 [0074.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.321] GetProcessHeap () returned 0x630000 [0074.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.321] GetProcessHeap () returned 0x630000 [0074.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.321] GetProcessHeap () returned 0x630000 [0074.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.321] GetProcessHeap () returned 0x630000 [0074.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.321] GetProcessHeap () returned 0x630000 [0074.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.321] GetProcessHeap () returned 0x630000 [0074.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.321] GetProcessHeap () returned 0x630000 [0074.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.321] GetProcessHeap () returned 0x630000 [0074.321] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.321] GetProcessHeap () returned 0x630000 [0074.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.322] GetProcessHeap () returned 0x630000 [0074.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.322] GetProcessHeap () returned 0x630000 [0074.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.322] GetProcessHeap () returned 0x630000 [0074.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.322] GetProcessHeap () returned 0x630000 [0074.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.322] GetProcessHeap () returned 0x630000 [0074.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.322] GetProcessHeap () returned 0x630000 [0074.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.322] GetProcessHeap () returned 0x630000 [0074.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.322] GetProcessHeap () returned 0x630000 [0074.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.322] GetProcessHeap () returned 0x630000 [0074.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.322] GetProcessHeap () returned 0x630000 [0074.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.322] GetProcessHeap () returned 0x630000 [0074.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.322] GetProcessHeap () returned 0x630000 [0074.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.322] GetProcessHeap () returned 0x630000 [0074.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.322] GetProcessHeap () returned 0x630000 [0074.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.322] GetProcessHeap () returned 0x630000 [0074.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.322] GetProcessHeap () returned 0x630000 [0074.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.322] GetProcessHeap () returned 0x630000 [0074.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.322] GetProcessHeap () returned 0x630000 [0074.322] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.322] GetProcessHeap () returned 0x630000 [0074.322] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.322] GetProcessHeap () returned 0x630000 [0074.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.323] GetProcessHeap () returned 0x630000 [0074.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.323] GetProcessHeap () returned 0x630000 [0074.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.323] GetProcessHeap () returned 0x630000 [0074.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.323] GetProcessHeap () returned 0x630000 [0074.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.323] GetProcessHeap () returned 0x630000 [0074.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.323] GetProcessHeap () returned 0x630000 [0074.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.323] GetProcessHeap () returned 0x630000 [0074.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.323] GetProcessHeap () returned 0x630000 [0074.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.323] GetProcessHeap () returned 0x630000 [0074.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0074.323] GetProcessHeap () returned 0x630000 [0074.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0074.323] GetProcessHeap () returned 0x630000 [0074.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.323] GetProcessHeap () returned 0x630000 [0074.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.323] GetProcessHeap () returned 0x630000 [0074.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.323] GetProcessHeap () returned 0x630000 [0074.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.323] GetProcessHeap () returned 0x630000 [0074.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.323] GetProcessHeap () returned 0x630000 [0074.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.323] GetProcessHeap () returned 0x630000 [0074.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.323] GetProcessHeap () returned 0x630000 [0074.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.323] GetProcessHeap () returned 0x630000 [0074.323] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.323] GetProcessHeap () returned 0x630000 [0074.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.324] GetProcessHeap () returned 0x630000 [0074.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.324] GetProcessHeap () returned 0x630000 [0074.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.324] GetProcessHeap () returned 0x630000 [0074.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.324] GetProcessHeap () returned 0x630000 [0074.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.324] GetProcessHeap () returned 0x630000 [0074.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.324] GetProcessHeap () returned 0x630000 [0074.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.324] GetProcessHeap () returned 0x630000 [0074.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.324] GetProcessHeap () returned 0x630000 [0074.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.324] GetProcessHeap () returned 0x630000 [0074.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.324] GetProcessHeap () returned 0x630000 [0074.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.324] GetProcessHeap () returned 0x630000 [0074.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.324] GetProcessHeap () returned 0x630000 [0074.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.324] GetProcessHeap () returned 0x630000 [0074.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.324] GetProcessHeap () returned 0x630000 [0074.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.324] GetProcessHeap () returned 0x630000 [0074.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.324] GetProcessHeap () returned 0x630000 [0074.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.324] GetProcessHeap () returned 0x630000 [0074.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.324] GetProcessHeap () returned 0x630000 [0074.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.324] GetProcessHeap () returned 0x630000 [0074.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.325] GetProcessHeap () returned 0x630000 [0074.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.325] GetProcessHeap () returned 0x630000 [0074.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.325] GetProcessHeap () returned 0x630000 [0074.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.325] GetProcessHeap () returned 0x630000 [0074.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0074.325] GetProcessHeap () returned 0x630000 [0074.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0074.325] GetProcessHeap () returned 0x630000 [0074.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0074.325] GetProcessHeap () returned 0x630000 [0074.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0074.325] GetProcessHeap () returned 0x630000 [0074.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0074.325] GetProcessHeap () returned 0x630000 [0074.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0074.325] GetProcessHeap () returned 0x630000 [0074.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0074.325] GetProcessHeap () returned 0x630000 [0074.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ec40 | out: hHeap=0x630000) returned 1 [0074.325] GetProcessHeap () returned 0x630000 [0074.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0074.325] GetProcessHeap () returned 0x630000 [0074.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.325] GetProcessHeap () returned 0x630000 [0074.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0074.325] WriteFile (in: hFile=0x230, lpBuffer=0x672088*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672088*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0074.328] GetProcessHeap () returned 0x630000 [0074.328] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x672088, Size=0x30) returned 0x672088 [0074.328] GetProcessHeap () returned 0x630000 [0074.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0074.328] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.328] GetProcessHeap () returned 0x630000 [0074.328] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe087) returned 0x6720c0 [0074.328] ReadFile (in: hFile=0x230, lpBuffer=0x6720c0, nNumberOfBytesToRead=0xe087, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x6720c0*, lpNumberOfBytesRead=0x243d7e8*=0xe087, lpOverlapped=0x0) returned 1 [0074.328] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.329] WriteFile (in: hFile=0x230, lpBuffer=0x6720c0*, nNumberOfBytesToWrite=0xe087, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x6720c0*, lpNumberOfBytesWritten=0x243d7e4*=0xe087, lpOverlapped=0x0) returned 1 [0074.330] GetProcessHeap () returned 0x630000 [0074.330] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6720c0 | out: hHeap=0x630000) returned 1 [0074.331] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.332] WriteFile (in: hFile=0x230, lpBuffer=0x672088*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672088*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0074.332] CloseHandle (hObject=0x230) returned 1 [0074.333] GetProcessHeap () returned 0x630000 [0074.333] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f10 | out: hHeap=0x630000) returned 1 [0074.333] GetProcessHeap () returned 0x630000 [0074.333] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655760 | out: hHeap=0x630000) returned 1 [0074.333] GetProcessHeap () returned 0x630000 [0074.333] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0074.333] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\-7i2lwkr_U.flv" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\-7i2lwkr_U.flv") returned="C:\\Users\\FD1HVy\\Desktop\\-7i2lwkr_U.flv" [0074.333] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\-7i2lwkr_U.flv", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\-7i2lwkr_U.flv.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\-7i2lwkr_U.flv.happythreechoose" [0074.333] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\-7i2lwkr_U.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\-7i2lwkr_u.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\-7i2lwkr_U.flv.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\-7i2lwkr_u.flv.happythreechoose"), dwFlags=0x1) returned 1 [0074.334] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\-7i2lwkr_U.flv" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0074.334] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned="" [0074.334] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" [0074.334] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\decryption info.html")) returned 0xffffffff [0074.334] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0074.335] GetProcessHeap () returned 0x630000 [0074.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6555f8 [0074.335] GetProcessHeap () returned 0x630000 [0074.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.342] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.343] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.343] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.343] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.343] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.343] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.343] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.343] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.344] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.344] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.344] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.344] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.344] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.344] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.344] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.344] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.344] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.344] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.344] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.344] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.344] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.344] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.345] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.345] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.345] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.345] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.345] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.345] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.345] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.345] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.345] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.345] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.345] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.345] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.345] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.346] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.346] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.375] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.375] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.375] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.376] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.376] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.376] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.376] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.376] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.376] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.376] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.376] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.376] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.376] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.376] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.376] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.376] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.376] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.376] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.377] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.377] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.377] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.377] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.377] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.377] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.377] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.377] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.377] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.377] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.377] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.377] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.377] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.377] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.378] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.378] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.378] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.378] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.378] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.378] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.378] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.378] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.378] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.378] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.378] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.378] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.378] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.378] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.379] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.379] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.379] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.379] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.379] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.379] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.379] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.379] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.379] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.379] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.379] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.379] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.379] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.379] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.379] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.380] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.380] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.380] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.380] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.380] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.380] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.380] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.380] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.380] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.380] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.380] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.380] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.380] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.380] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.381] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.381] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.381] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.381] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.381] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.381] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.381] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.381] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.381] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.381] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.381] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.381] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.381] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.381] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.381] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.382] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.382] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.382] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.382] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.382] GetProcessHeap () returned 0x630000 [0074.382] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6555f8 | out: hHeap=0x630000) returned 1 [0074.382] GetProcessHeap () returned 0x630000 [0074.382] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0074.382] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0074.382] GetProcessHeap () returned 0x630000 [0074.382] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655760 [0074.382] GetProcessHeap () returned 0x630000 [0074.382] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.389] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.389] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.389] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.389] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.389] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.390] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.390] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.390] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.390] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.390] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.390] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.390] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.390] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.390] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.390] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.390] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.390] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.390] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.390] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.390] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.391] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.391] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.391] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.391] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.391] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.391] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.391] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.391] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.391] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.391] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.391] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.391] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.391] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.391] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.392] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.392] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.392] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.392] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.392] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.392] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.392] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.392] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.392] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.392] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.392] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.392] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.392] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.392] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.392] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.393] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.393] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.393] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.393] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.393] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.393] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.393] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.393] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.393] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.393] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.393] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.393] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.393] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.393] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.394] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.394] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.394] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.394] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.394] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.394] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.394] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.394] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.394] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.394] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.394] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.394] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.394] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.394] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.394] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.395] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.395] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.395] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.395] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.395] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.395] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.395] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.395] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.395] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.395] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.395] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.395] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.396] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.396] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.396] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.396] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.396] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.396] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.396] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.396] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.396] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.396] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.396] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.396] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.396] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.396] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.396] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.397] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.397] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.397] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.397] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.397] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.397] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.397] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.397] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.397] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.397] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.397] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.397] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.397] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0074.398] GetProcessHeap () returned 0x630000 [0074.398] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655760 | out: hHeap=0x630000) returned 1 [0074.398] GetProcessHeap () returned 0x630000 [0074.398] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0074.398] CloseHandle (hObject=0x230) returned 1 [0074.398] GetProcessHeap () returned 0x630000 [0074.398] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0074.398] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87ff120, ftCreationTime.dwHighDateTime=0x1d5d1ed, ftLastAccessTime.dwLowDateTime=0xbdf20040, ftLastAccessTime.dwHighDateTime=0x1d5d4f4, ftLastWriteTime.dwLowDateTime=0xbdf20040, ftLastWriteTime.dwHighDateTime=0x1d5d4f4, nFileSizeHigh=0x0, nFileSizeLow=0x8fd6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0ooHY_.mp4", cAlternateFileName="")) returned 1 [0074.398] lstrcmpiW (lpString1="0ooHY_.mp4", lpString2=".") returned 1 [0074.399] lstrcmpiW (lpString1="0ooHY_.mp4", lpString2="..") returned 1 [0074.399] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="0ooHY_.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\0ooHY_.mp4") returned="C:\\Users\\FD1HVy\\Desktop\\0ooHY_.mp4" [0074.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="0ooHY_.mp4", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0074.399] GetProcessHeap () returned 0x630000 [0074.399] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb) returned 0x64c9f0 [0074.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="0ooHY_.mp4", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ooHY_.mp4", lpUsedDefaultChar=0x0) returned 11 [0074.399] lstrlenA (lpString="0ooHY_.mp4") returned 10 [0074.399] lstrlenA (lpString=".happythreechoose") returned 17 [0074.399] lstrcmpiW (lpString1="0ooHY_.mp4", lpString2="Decryption INFO.html") returned -1 [0074.399] lstrcmpiW (lpString1="0ooHY_.mp4", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned -1 [0074.399] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0074.399] lstrcmpiW (lpString1="0ooHY_.mp4", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0074.399] GetProcessHeap () returned 0x630000 [0074.399] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0074.399] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\0ooHY_.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\0oohy_.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0074.399] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=36822) returned 1 [0074.399] GetProcessHeap () returned 0x630000 [0074.399] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6558c8 [0074.399] GetProcessHeap () returned 0x630000 [0074.399] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.399] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\0ooHY_.mp4") returned 34 [0074.399] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.399] GetProcessHeap () returned 0x630000 [0074.399] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0074.400] GetProcessHeap () returned 0x630000 [0074.400] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38a) returned 0x6720c0 [0074.401] lstrlenA (lpString="rsa_encrypt") returned 11 [0074.401] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0074.401] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0074.401] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0074.401] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0074.401] GetProcessHeap () returned 0x630000 [0074.401] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0074.401] lstrlenA (lpString="010001") returned 6 [0074.401] GetProcessHeap () returned 0x630000 [0074.401] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0074.401] GetProcessHeap () returned 0x630000 [0074.401] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.401] GetProcessHeap () returned 0x630000 [0074.401] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e970 [0074.401] GetProcessHeap () returned 0x630000 [0074.401] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.401] GetProcessHeap () returned 0x630000 [0074.402] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e610 [0074.402] GetProcessHeap () returned 0x630000 [0074.402] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656a68 [0074.402] GetProcessHeap () returned 0x630000 [0074.402] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0074.402] GetProcessHeap () returned 0x630000 [0074.402] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0074.402] GetProcessHeap () returned 0x630000 [0074.402] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.402] GetProcessHeap () returned 0x630000 [0074.402] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0074.402] GetProcessHeap () returned 0x630000 [0074.402] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.402] GetProcessHeap () returned 0x630000 [0074.402] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656950 [0074.402] GetProcessHeap () returned 0x630000 [0074.402] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.402] GetProcessHeap () returned 0x630000 [0074.402] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0074.402] GetProcessHeap () returned 0x630000 [0074.402] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0074.402] GetProcessHeap () returned 0x630000 [0074.402] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.402] GetProcessHeap () returned 0x630000 [0074.402] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0074.402] GetProcessHeap () returned 0x630000 [0074.402] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0074.402] GetProcessHeap () returned 0x630000 [0074.402] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.402] GetProcessHeap () returned 0x630000 [0074.402] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65ce38 [0074.402] GetProcessHeap () returned 0x630000 [0074.402] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.402] GetProcessHeap () returned 0x630000 [0074.402] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.402] GetProcessHeap () returned 0x630000 [0074.402] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.402] GetProcessHeap () returned 0x630000 [0074.402] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.402] GetProcessHeap () returned 0x630000 [0074.402] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ecd0 [0074.402] GetProcessHeap () returned 0x630000 [0074.403] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ce38 | out: hHeap=0x630000) returned 1 [0074.403] GetProcessHeap () returned 0x630000 [0074.403] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0074.403] GetProcessHeap () returned 0x630000 [0074.403] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ecd0 | out: hHeap=0x630000) returned 1 [0074.403] GetProcessHeap () returned 0x630000 [0074.403] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.403] GetProcessHeap () returned 0x630000 [0074.403] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.403] GetProcessHeap () returned 0x630000 [0074.403] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.403] GetProcessHeap () returned 0x630000 [0074.403] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.403] GetProcessHeap () returned 0x630000 [0074.403] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.403] GetProcessHeap () returned 0x630000 [0074.403] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.403] GetProcessHeap () returned 0x630000 [0074.403] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.403] GetProcessHeap () returned 0x630000 [0074.403] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.403] GetProcessHeap () returned 0x630000 [0074.403] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.403] GetProcessHeap () returned 0x630000 [0074.403] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.403] GetProcessHeap () returned 0x630000 [0074.403] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.403] GetProcessHeap () returned 0x630000 [0074.403] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.403] GetProcessHeap () returned 0x630000 [0074.403] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.403] GetProcessHeap () returned 0x630000 [0074.403] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.403] GetProcessHeap () returned 0x630000 [0074.403] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.403] GetProcessHeap () returned 0x630000 [0074.404] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.404] GetProcessHeap () returned 0x630000 [0074.404] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0074.404] GetProcessHeap () returned 0x630000 [0074.404] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0074.404] GetProcessHeap () returned 0x630000 [0074.404] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.404] GetProcessHeap () returned 0x630000 [0074.404] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.404] GetProcessHeap () returned 0x630000 [0074.404] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.404] GetProcessHeap () returned 0x630000 [0074.404] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.404] GetProcessHeap () returned 0x630000 [0074.404] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.404] GetProcessHeap () returned 0x630000 [0074.404] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.404] GetProcessHeap () returned 0x630000 [0074.404] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.404] GetProcessHeap () returned 0x630000 [0074.404] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.404] GetProcessHeap () returned 0x630000 [0074.404] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.404] GetProcessHeap () returned 0x630000 [0074.404] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.404] GetProcessHeap () returned 0x630000 [0074.404] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.404] GetProcessHeap () returned 0x630000 [0074.404] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.404] GetProcessHeap () returned 0x630000 [0074.404] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.404] GetProcessHeap () returned 0x630000 [0074.405] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.405] GetProcessHeap () returned 0x630000 [0074.405] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.405] GetProcessHeap () returned 0x630000 [0074.405] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.405] GetProcessHeap () returned 0x630000 [0074.405] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.405] GetProcessHeap () returned 0x630000 [0074.405] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.405] GetProcessHeap () returned 0x630000 [0074.405] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.405] GetProcessHeap () returned 0x630000 [0074.405] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.405] GetProcessHeap () returned 0x630000 [0074.405] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0074.405] GetProcessHeap () returned 0x630000 [0074.405] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0074.405] GetProcessHeap () returned 0x630000 [0074.405] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.405] GetProcessHeap () returned 0x630000 [0074.405] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.405] GetProcessHeap () returned 0x630000 [0074.405] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.405] GetProcessHeap () returned 0x630000 [0074.405] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.405] GetProcessHeap () returned 0x630000 [0074.405] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.405] GetProcessHeap () returned 0x630000 [0074.405] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.405] GetProcessHeap () returned 0x630000 [0074.405] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.405] GetProcessHeap () returned 0x630000 [0074.405] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.405] GetProcessHeap () returned 0x630000 [0074.405] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.405] GetProcessHeap () returned 0x630000 [0074.405] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.405] GetProcessHeap () returned 0x630000 [0074.405] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.405] GetProcessHeap () returned 0x630000 [0074.406] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.406] GetProcessHeap () returned 0x630000 [0074.406] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.406] GetProcessHeap () returned 0x630000 [0074.406] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.406] GetProcessHeap () returned 0x630000 [0074.406] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.406] GetProcessHeap () returned 0x630000 [0074.406] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.406] GetProcessHeap () returned 0x630000 [0074.406] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.406] GetProcessHeap () returned 0x630000 [0074.406] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.406] GetProcessHeap () returned 0x630000 [0074.406] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.406] GetProcessHeap () returned 0x630000 [0074.406] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.406] GetProcessHeap () returned 0x630000 [0074.406] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.406] GetProcessHeap () returned 0x630000 [0074.406] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.406] GetProcessHeap () returned 0x630000 [0074.406] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.406] GetProcessHeap () returned 0x630000 [0074.406] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.406] GetProcessHeap () returned 0x630000 [0074.406] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.406] GetProcessHeap () returned 0x630000 [0074.406] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.406] GetProcessHeap () returned 0x630000 [0074.406] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.406] GetProcessHeap () returned 0x630000 [0074.406] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.407] GetProcessHeap () returned 0x630000 [0074.407] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.407] GetProcessHeap () returned 0x630000 [0074.407] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.407] GetProcessHeap () returned 0x630000 [0074.407] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.407] GetProcessHeap () returned 0x630000 [0074.407] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.407] GetProcessHeap () returned 0x630000 [0074.407] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.407] GetProcessHeap () returned 0x630000 [0074.407] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.407] GetProcessHeap () returned 0x630000 [0074.407] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.407] GetProcessHeap () returned 0x630000 [0074.407] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.407] GetProcessHeap () returned 0x630000 [0074.407] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.407] GetProcessHeap () returned 0x630000 [0074.407] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.407] GetProcessHeap () returned 0x630000 [0074.407] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.407] GetProcessHeap () returned 0x630000 [0074.407] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.407] GetProcessHeap () returned 0x630000 [0074.407] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.407] GetProcessHeap () returned 0x630000 [0074.407] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.407] GetProcessHeap () returned 0x630000 [0074.407] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0074.407] GetProcessHeap () returned 0x630000 [0074.407] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0074.408] GetProcessHeap () returned 0x630000 [0074.408] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0074.408] GetProcessHeap () returned 0x630000 [0074.408] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0074.408] GetProcessHeap () returned 0x630000 [0074.408] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0074.408] GetProcessHeap () returned 0x630000 [0074.408] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0074.408] GetProcessHeap () returned 0x630000 [0074.408] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0074.408] GetProcessHeap () returned 0x630000 [0074.408] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0074.408] GetProcessHeap () returned 0x630000 [0074.408] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0074.408] GetProcessHeap () returned 0x630000 [0074.408] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.408] GetProcessHeap () returned 0x630000 [0074.408] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0074.408] WriteFile (in: hFile=0x230, lpBuffer=0x6720c0*, nNumberOfBytesToWrite=0x38a, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6720c0*, lpNumberOfBytesWritten=0x243d864*=0x38a, lpOverlapped=0x0) returned 1 [0074.411] GetProcessHeap () returned 0x630000 [0074.411] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6720c0, Size=0x30) returned 0x6720c0 [0074.411] GetProcessHeap () returned 0x630000 [0074.411] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0074.411] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.411] GetProcessHeap () returned 0x630000 [0074.411] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8fe0) returned 0x6720f8 [0074.412] ReadFile (in: hFile=0x230, lpBuffer=0x6720f8, nNumberOfBytesToRead=0x8fe0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x6720f8*, lpNumberOfBytesRead=0x243d7e8*=0x8fe0, lpOverlapped=0x0) returned 1 [0074.412] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.412] WriteFile (in: hFile=0x230, lpBuffer=0x6720f8*, nNumberOfBytesToWrite=0x8fe0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x6720f8*, lpNumberOfBytesWritten=0x243d7e4*=0x8fe0, lpOverlapped=0x0) returned 1 [0074.413] GetProcessHeap () returned 0x630000 [0074.413] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6720f8 | out: hHeap=0x630000) returned 1 [0074.414] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.414] WriteFile (in: hFile=0x230, lpBuffer=0x6720c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6720c0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0074.414] CloseHandle (hObject=0x230) returned 1 [0074.415] GetProcessHeap () returned 0x630000 [0074.415] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0074.415] GetProcessHeap () returned 0x630000 [0074.415] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6558c8 | out: hHeap=0x630000) returned 1 [0074.415] GetProcessHeap () returned 0x630000 [0074.415] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0074.415] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\0ooHY_.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\0ooHY_.mp4") returned="C:\\Users\\FD1HVy\\Desktop\\0ooHY_.mp4" [0074.415] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\0ooHY_.mp4", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\0ooHY_.mp4.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\0ooHY_.mp4.happythreechoose" [0074.415] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\0ooHY_.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\0oohy_.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\0ooHY_.mp4.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\0oohy_.mp4.happythreechoose"), dwFlags=0x1) returned 1 [0074.416] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\0ooHY_.mp4" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0074.416] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned="" [0074.416] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" [0074.416] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\decryption info.html")) returned 0x20 [0074.416] GetProcessHeap () returned 0x630000 [0074.416] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0074.416] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37af72d0, ftCreationTime.dwHighDateTime=0x1d5d551, ftLastAccessTime.dwLowDateTime=0x44c84e70, ftLastAccessTime.dwHighDateTime=0x1d5d5e6, ftLastWriteTime.dwLowDateTime=0x44c84e70, ftLastWriteTime.dwHighDateTime=0x1d5d5e6, nFileSizeHigh=0x0, nFileSizeLow=0xd6df, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1xE5TU.png", cAlternateFileName="")) returned 1 [0074.416] lstrcmpiW (lpString1="1xE5TU.png", lpString2=".") returned 1 [0074.416] lstrcmpiW (lpString1="1xE5TU.png", lpString2="..") returned 1 [0074.416] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="1xE5TU.png" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\1xE5TU.png") returned="C:\\Users\\FD1HVy\\Desktop\\1xE5TU.png" [0074.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1xE5TU.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0074.416] GetProcessHeap () returned 0x630000 [0074.416] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb) returned 0x64c9f0 [0074.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1xE5TU.png", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1xE5TU.png", lpUsedDefaultChar=0x0) returned 11 [0074.416] lstrlenA (lpString="1xE5TU.png") returned 10 [0074.416] lstrlenA (lpString=".happythreechoose") returned 17 [0074.416] lstrcmpiW (lpString1="1xE5TU.png", lpString2="Decryption INFO.html") returned -1 [0074.416] lstrcmpiW (lpString1="1xE5TU.png", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned -1 [0074.416] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0074.416] lstrcmpiW (lpString1="1xE5TU.png", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0074.416] GetProcessHeap () returned 0x630000 [0074.417] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0074.417] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\1xE5TU.png" (normalized: "c:\\users\\fd1hvy\\desktop\\1xe5tu.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0074.417] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=55007) returned 1 [0074.417] GetProcessHeap () returned 0x630000 [0074.417] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655580 [0074.417] GetProcessHeap () returned 0x630000 [0074.417] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.417] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\1xE5TU.png") returned 34 [0074.417] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.417] GetProcessHeap () returned 0x630000 [0074.417] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0074.417] GetProcessHeap () returned 0x630000 [0074.417] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x381) returned 0x6720f8 [0074.417] lstrlenA (lpString="rsa_encrypt") returned 11 [0074.417] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0074.418] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0074.418] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0074.418] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0074.418] GetProcessHeap () returned 0x630000 [0074.418] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0074.418] lstrlenA (lpString="010001") returned 6 [0074.418] GetProcessHeap () returned 0x630000 [0074.418] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0074.418] GetProcessHeap () returned 0x630000 [0074.418] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.418] GetProcessHeap () returned 0x630000 [0074.418] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e190 [0074.418] GetProcessHeap () returned 0x630000 [0074.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.418] GetProcessHeap () returned 0x630000 [0074.418] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea90 [0074.418] GetProcessHeap () returned 0x630000 [0074.418] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656db0 [0074.418] GetProcessHeap () returned 0x630000 [0074.418] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a318 [0074.418] GetProcessHeap () returned 0x630000 [0074.418] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0074.418] GetProcessHeap () returned 0x630000 [0074.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.418] GetProcessHeap () returned 0x630000 [0074.418] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0074.418] GetProcessHeap () returned 0x630000 [0074.418] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.418] GetProcessHeap () returned 0x630000 [0074.418] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657210 [0074.418] GetProcessHeap () returned 0x630000 [0074.418] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.418] GetProcessHeap () returned 0x630000 [0074.418] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0074.418] GetProcessHeap () returned 0x630000 [0074.418] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e730 [0074.419] GetProcessHeap () returned 0x630000 [0074.419] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.419] GetProcessHeap () returned 0x630000 [0074.419] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0074.419] GetProcessHeap () returned 0x630000 [0074.419] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0074.419] GetProcessHeap () returned 0x630000 [0074.419] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.419] GetProcessHeap () returned 0x630000 [0074.419] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cd60 [0074.419] GetProcessHeap () returned 0x630000 [0074.419] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.419] GetProcessHeap () returned 0x630000 [0074.419] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.419] GetProcessHeap () returned 0x630000 [0074.419] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0074.419] GetProcessHeap () returned 0x630000 [0074.419] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0074.419] GetProcessHeap () returned 0x630000 [0074.419] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65eb20 [0074.419] GetProcessHeap () returned 0x630000 [0074.419] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cd60 | out: hHeap=0x630000) returned 1 [0074.419] GetProcessHeap () returned 0x630000 [0074.419] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0074.419] GetProcessHeap () returned 0x630000 [0074.419] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0074.419] GetProcessHeap () returned 0x630000 [0074.419] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.419] GetProcessHeap () returned 0x630000 [0074.419] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.419] GetProcessHeap () returned 0x630000 [0074.419] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.419] GetProcessHeap () returned 0x630000 [0074.419] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.419] GetProcessHeap () returned 0x630000 [0074.419] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.419] GetProcessHeap () returned 0x630000 [0074.420] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.420] GetProcessHeap () returned 0x630000 [0074.420] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.420] GetProcessHeap () returned 0x630000 [0074.420] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.420] GetProcessHeap () returned 0x630000 [0074.420] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.420] GetProcessHeap () returned 0x630000 [0074.420] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.420] GetProcessHeap () returned 0x630000 [0074.420] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.420] GetProcessHeap () returned 0x630000 [0074.420] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.420] GetProcessHeap () returned 0x630000 [0074.420] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0074.420] GetProcessHeap () returned 0x630000 [0074.420] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0074.420] GetProcessHeap () returned 0x630000 [0074.420] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.420] GetProcessHeap () returned 0x630000 [0074.420] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.420] GetProcessHeap () returned 0x630000 [0074.420] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.420] GetProcessHeap () returned 0x630000 [0074.420] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.420] GetProcessHeap () returned 0x630000 [0074.420] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.420] GetProcessHeap () returned 0x630000 [0074.420] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.420] GetProcessHeap () returned 0x630000 [0074.420] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.420] GetProcessHeap () returned 0x630000 [0074.420] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.420] GetProcessHeap () returned 0x630000 [0074.420] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.420] GetProcessHeap () returned 0x630000 [0074.420] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.420] GetProcessHeap () returned 0x630000 [0074.420] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.420] GetProcessHeap () returned 0x630000 [0074.421] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.421] GetProcessHeap () returned 0x630000 [0074.421] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.421] GetProcessHeap () returned 0x630000 [0074.421] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.421] GetProcessHeap () returned 0x630000 [0074.421] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.421] GetProcessHeap () returned 0x630000 [0074.421] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.421] GetProcessHeap () returned 0x630000 [0074.421] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.421] GetProcessHeap () returned 0x630000 [0074.421] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.421] GetProcessHeap () returned 0x630000 [0074.421] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.421] GetProcessHeap () returned 0x630000 [0074.421] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.421] GetProcessHeap () returned 0x630000 [0074.421] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.421] GetProcessHeap () returned 0x630000 [0074.421] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.421] GetProcessHeap () returned 0x630000 [0074.421] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.421] GetProcessHeap () returned 0x630000 [0074.421] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.421] GetProcessHeap () returned 0x630000 [0074.421] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.421] GetProcessHeap () returned 0x630000 [0074.421] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.421] GetProcessHeap () returned 0x630000 [0074.421] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.421] GetProcessHeap () returned 0x630000 [0074.421] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.421] GetProcessHeap () returned 0x630000 [0074.421] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.421] GetProcessHeap () returned 0x630000 [0074.421] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.421] GetProcessHeap () returned 0x630000 [0074.421] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.422] GetProcessHeap () returned 0x630000 [0074.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.422] GetProcessHeap () returned 0x630000 [0074.422] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.422] GetProcessHeap () returned 0x630000 [0074.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.422] GetProcessHeap () returned 0x630000 [0074.422] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.422] GetProcessHeap () returned 0x630000 [0074.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.422] GetProcessHeap () returned 0x630000 [0074.422] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.422] GetProcessHeap () returned 0x630000 [0074.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.422] GetProcessHeap () returned 0x630000 [0074.422] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.422] GetProcessHeap () returned 0x630000 [0074.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.422] GetProcessHeap () returned 0x630000 [0074.422] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.422] GetProcessHeap () returned 0x630000 [0074.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.422] GetProcessHeap () returned 0x630000 [0074.422] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.422] GetProcessHeap () returned 0x630000 [0074.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.422] GetProcessHeap () returned 0x630000 [0074.422] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.422] GetProcessHeap () returned 0x630000 [0074.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.422] GetProcessHeap () returned 0x630000 [0074.422] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.422] GetProcessHeap () returned 0x630000 [0074.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.422] GetProcessHeap () returned 0x630000 [0074.422] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.422] GetProcessHeap () returned 0x630000 [0074.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.422] GetProcessHeap () returned 0x630000 [0074.422] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.423] GetProcessHeap () returned 0x630000 [0074.423] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.423] GetProcessHeap () returned 0x630000 [0074.423] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.423] GetProcessHeap () returned 0x630000 [0074.423] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.423] GetProcessHeap () returned 0x630000 [0074.423] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.423] GetProcessHeap () returned 0x630000 [0074.423] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.423] GetProcessHeap () returned 0x630000 [0074.423] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.423] GetProcessHeap () returned 0x630000 [0074.423] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.423] GetProcessHeap () returned 0x630000 [0074.423] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.423] GetProcessHeap () returned 0x630000 [0074.423] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.423] GetProcessHeap () returned 0x630000 [0074.423] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.423] GetProcessHeap () returned 0x630000 [0074.423] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.423] GetProcessHeap () returned 0x630000 [0074.423] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.423] GetProcessHeap () returned 0x630000 [0074.423] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.423] GetProcessHeap () returned 0x630000 [0074.423] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.423] GetProcessHeap () returned 0x630000 [0074.423] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.423] GetProcessHeap () returned 0x630000 [0074.423] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.423] GetProcessHeap () returned 0x630000 [0074.423] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.423] GetProcessHeap () returned 0x630000 [0074.423] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0074.423] GetProcessHeap () returned 0x630000 [0074.423] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0074.423] GetProcessHeap () returned 0x630000 [0074.423] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0074.424] GetProcessHeap () returned 0x630000 [0074.424] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0074.424] GetProcessHeap () returned 0x630000 [0074.424] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0074.424] GetProcessHeap () returned 0x630000 [0074.424] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea90 | out: hHeap=0x630000) returned 1 [0074.424] GetProcessHeap () returned 0x630000 [0074.424] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0074.424] GetProcessHeap () returned 0x630000 [0074.424] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0074.424] GetProcessHeap () returned 0x630000 [0074.424] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0074.424] GetProcessHeap () returned 0x630000 [0074.424] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.424] GetProcessHeap () returned 0x630000 [0074.424] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0074.424] WriteFile (in: hFile=0x230, lpBuffer=0x6720f8*, nNumberOfBytesToWrite=0x381, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6720f8*, lpNumberOfBytesWritten=0x243d864*=0x381, lpOverlapped=0x0) returned 1 [0074.425] GetProcessHeap () returned 0x630000 [0074.426] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6720f8, Size=0x30) returned 0x6720f8 [0074.426] GetProcessHeap () returned 0x630000 [0074.426] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0074.426] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.426] GetProcessHeap () returned 0x630000 [0074.426] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd6e0) returned 0x672130 [0074.426] ReadFile (in: hFile=0x230, lpBuffer=0x672130, nNumberOfBytesToRead=0xd6e0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x672130*, lpNumberOfBytesRead=0x243d7e8*=0xd6e0, lpOverlapped=0x0) returned 1 [0074.426] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.427] WriteFile (in: hFile=0x230, lpBuffer=0x672130*, nNumberOfBytesToWrite=0xd6e0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x672130*, lpNumberOfBytesWritten=0x243d7e4*=0xd6e0, lpOverlapped=0x0) returned 1 [0074.429] GetProcessHeap () returned 0x630000 [0074.429] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672130 | out: hHeap=0x630000) returned 1 [0074.430] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.430] WriteFile (in: hFile=0x230, lpBuffer=0x6720f8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6720f8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0074.433] CloseHandle (hObject=0x230) returned 1 [0074.434] GetProcessHeap () returned 0x630000 [0074.434] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0074.434] GetProcessHeap () returned 0x630000 [0074.434] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655580 | out: hHeap=0x630000) returned 1 [0074.434] GetProcessHeap () returned 0x630000 [0074.434] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0074.434] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\1xE5TU.png" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\1xE5TU.png") returned="C:\\Users\\FD1HVy\\Desktop\\1xE5TU.png" [0074.434] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\1xE5TU.png", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\1xE5TU.png.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\1xE5TU.png.happythreechoose" [0074.434] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\1xE5TU.png" (normalized: "c:\\users\\fd1hvy\\desktop\\1xe5tu.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\1xE5TU.png.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\1xe5tu.png.happythreechoose"), dwFlags=0x1) returned 1 [0074.435] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\1xE5TU.png" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0074.435] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned="" [0074.435] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" [0074.435] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\decryption info.html")) returned 0x20 [0074.435] GetProcessHeap () returned 0x630000 [0074.436] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0074.436] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac1cc920, ftCreationTime.dwHighDateTime=0x1d5d690, ftLastAccessTime.dwLowDateTime=0x1f40dd40, ftLastAccessTime.dwHighDateTime=0x1d5c7cf, ftLastWriteTime.dwLowDateTime=0x1f40dd40, ftLastWriteTime.dwHighDateTime=0x1d5c7cf, nFileSizeHigh=0x0, nFileSizeLow=0x4a9c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5J5Fcxp5CQm.mp3", cAlternateFileName="5J5FCX~1.MP3")) returned 1 [0074.436] lstrcmpiW (lpString1="5J5Fcxp5CQm.mp3", lpString2=".") returned 1 [0074.436] lstrcmpiW (lpString1="5J5Fcxp5CQm.mp3", lpString2="..") returned 1 [0074.436] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="5J5Fcxp5CQm.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\5J5Fcxp5CQm.mp3") returned="C:\\Users\\FD1HVy\\Desktop\\5J5Fcxp5CQm.mp3" [0074.436] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="5J5Fcxp5CQm.mp3", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0074.436] GetProcessHeap () returned 0x630000 [0074.436] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x64c9f0 [0074.436] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="5J5Fcxp5CQm.mp3", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5J5Fcxp5CQm.mp3", lpUsedDefaultChar=0x0) returned 16 [0074.436] lstrlenA (lpString="5J5Fcxp5CQm.mp3") returned 15 [0074.436] lstrlenA (lpString=".happythreechoose") returned 17 [0074.436] lstrcmpiW (lpString1="5J5Fcxp5CQm.mp3", lpString2="Decryption INFO.html") returned -1 [0074.436] lstrcmpiW (lpString1="5J5Fcxp5CQm.mp3", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0074.436] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0074.436] lstrcmpiW (lpString1="5J5Fcxp5CQm.mp3", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0074.436] GetProcessHeap () returned 0x630000 [0074.436] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0074.436] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\5J5Fcxp5CQm.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\5j5fcxp5cqm.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0074.436] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=19100) returned 1 [0074.436] GetProcessHeap () returned 0x630000 [0074.436] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655a30 [0074.436] GetProcessHeap () returned 0x630000 [0074.437] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.437] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\5J5Fcxp5CQm.mp3") returned 39 [0074.437] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.437] GetProcessHeap () returned 0x630000 [0074.437] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0074.437] GetProcessHeap () returned 0x630000 [0074.437] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x384) returned 0x672130 [0074.438] lstrlenA (lpString="rsa_encrypt") returned 11 [0074.438] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0074.439] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0074.439] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0074.439] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0074.439] GetProcessHeap () returned 0x630000 [0074.439] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0074.439] lstrlenA (lpString="010001") returned 6 [0074.439] GetProcessHeap () returned 0x630000 [0074.439] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0074.439] GetProcessHeap () returned 0x630000 [0074.439] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.439] GetProcessHeap () returned 0x630000 [0074.439] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e970 [0074.439] GetProcessHeap () returned 0x630000 [0074.439] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.439] GetProcessHeap () returned 0x630000 [0074.439] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0074.439] GetProcessHeap () returned 0x630000 [0074.439] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657558 [0074.439] GetProcessHeap () returned 0x630000 [0074.439] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a318 [0074.439] GetProcessHeap () returned 0x630000 [0074.439] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0074.439] GetProcessHeap () returned 0x630000 [0074.439] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.440] GetProcessHeap () returned 0x630000 [0074.440] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0074.440] GetProcessHeap () returned 0x630000 [0074.440] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.440] GetProcessHeap () returned 0x630000 [0074.440] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657328 [0074.440] GetProcessHeap () returned 0x630000 [0074.440] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.440] GetProcessHeap () returned 0x630000 [0074.440] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0074.440] GetProcessHeap () returned 0x630000 [0074.440] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea00 [0074.440] GetProcessHeap () returned 0x630000 [0074.440] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.440] GetProcessHeap () returned 0x630000 [0074.440] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0074.440] GetProcessHeap () returned 0x630000 [0074.440] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0074.440] GetProcessHeap () returned 0x630000 [0074.440] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.440] GetProcessHeap () returned 0x630000 [0074.440] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65ce38 [0074.440] GetProcessHeap () returned 0x630000 [0074.440] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.440] GetProcessHeap () returned 0x630000 [0074.440] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.440] GetProcessHeap () returned 0x630000 [0074.440] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.440] GetProcessHeap () returned 0x630000 [0074.440] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.440] GetProcessHeap () returned 0x630000 [0074.440] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e2b0 [0074.440] GetProcessHeap () returned 0x630000 [0074.440] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ce38 | out: hHeap=0x630000) returned 1 [0074.440] GetProcessHeap () returned 0x630000 [0074.440] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0074.440] GetProcessHeap () returned 0x630000 [0074.440] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e2b0 | out: hHeap=0x630000) returned 1 [0074.440] GetProcessHeap () returned 0x630000 [0074.440] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.440] GetProcessHeap () returned 0x630000 [0074.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.441] GetProcessHeap () returned 0x630000 [0074.441] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0074.441] GetProcessHeap () returned 0x630000 [0074.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0074.441] GetProcessHeap () returned 0x630000 [0074.441] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.441] GetProcessHeap () returned 0x630000 [0074.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.441] GetProcessHeap () returned 0x630000 [0074.441] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.441] GetProcessHeap () returned 0x630000 [0074.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.441] GetProcessHeap () returned 0x630000 [0074.441] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.441] GetProcessHeap () returned 0x630000 [0074.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.441] GetProcessHeap () returned 0x630000 [0074.441] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.441] GetProcessHeap () returned 0x630000 [0074.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.441] GetProcessHeap () returned 0x630000 [0074.441] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.441] GetProcessHeap () returned 0x630000 [0074.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.441] GetProcessHeap () returned 0x630000 [0074.441] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.441] GetProcessHeap () returned 0x630000 [0074.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.441] GetProcessHeap () returned 0x630000 [0074.441] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.441] GetProcessHeap () returned 0x630000 [0074.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.441] GetProcessHeap () returned 0x630000 [0074.441] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.441] GetProcessHeap () returned 0x630000 [0074.441] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.441] GetProcessHeap () returned 0x630000 [0074.441] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.441] GetProcessHeap () returned 0x630000 [0074.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.442] GetProcessHeap () returned 0x630000 [0074.442] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.442] GetProcessHeap () returned 0x630000 [0074.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.442] GetProcessHeap () returned 0x630000 [0074.442] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.442] GetProcessHeap () returned 0x630000 [0074.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.442] GetProcessHeap () returned 0x630000 [0074.442] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.442] GetProcessHeap () returned 0x630000 [0074.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.442] GetProcessHeap () returned 0x630000 [0074.442] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.442] GetProcessHeap () returned 0x630000 [0074.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.442] GetProcessHeap () returned 0x630000 [0074.442] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.442] GetProcessHeap () returned 0x630000 [0074.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.442] GetProcessHeap () returned 0x630000 [0074.442] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.442] GetProcessHeap () returned 0x630000 [0074.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.442] GetProcessHeap () returned 0x630000 [0074.442] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.442] GetProcessHeap () returned 0x630000 [0074.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.442] GetProcessHeap () returned 0x630000 [0074.442] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.442] GetProcessHeap () returned 0x630000 [0074.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.442] GetProcessHeap () returned 0x630000 [0074.442] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.442] GetProcessHeap () returned 0x630000 [0074.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.442] GetProcessHeap () returned 0x630000 [0074.443] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.443] GetProcessHeap () returned 0x630000 [0074.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.443] GetProcessHeap () returned 0x630000 [0074.443] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.443] GetProcessHeap () returned 0x630000 [0074.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.443] GetProcessHeap () returned 0x630000 [0074.443] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.443] GetProcessHeap () returned 0x630000 [0074.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.443] GetProcessHeap () returned 0x630000 [0074.443] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.443] GetProcessHeap () returned 0x630000 [0074.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.443] GetProcessHeap () returned 0x630000 [0074.443] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.443] GetProcessHeap () returned 0x630000 [0074.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.443] GetProcessHeap () returned 0x630000 [0074.443] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.443] GetProcessHeap () returned 0x630000 [0074.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.443] GetProcessHeap () returned 0x630000 [0074.443] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.443] GetProcessHeap () returned 0x630000 [0074.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.443] GetProcessHeap () returned 0x630000 [0074.443] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.443] GetProcessHeap () returned 0x630000 [0074.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.443] GetProcessHeap () returned 0x630000 [0074.443] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.443] GetProcessHeap () returned 0x630000 [0074.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.443] GetProcessHeap () returned 0x630000 [0074.443] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.443] GetProcessHeap () returned 0x630000 [0074.443] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.443] GetProcessHeap () returned 0x630000 [0074.444] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.444] GetProcessHeap () returned 0x630000 [0074.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.444] GetProcessHeap () returned 0x630000 [0074.444] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.444] GetProcessHeap () returned 0x630000 [0074.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.444] GetProcessHeap () returned 0x630000 [0074.444] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.444] GetProcessHeap () returned 0x630000 [0074.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.444] GetProcessHeap () returned 0x630000 [0074.444] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.444] GetProcessHeap () returned 0x630000 [0074.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.444] GetProcessHeap () returned 0x630000 [0074.444] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.444] GetProcessHeap () returned 0x630000 [0074.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.444] GetProcessHeap () returned 0x630000 [0074.444] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.444] GetProcessHeap () returned 0x630000 [0074.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.444] GetProcessHeap () returned 0x630000 [0074.444] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0074.444] GetProcessHeap () returned 0x630000 [0074.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0074.444] GetProcessHeap () returned 0x630000 [0074.444] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.444] GetProcessHeap () returned 0x630000 [0074.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.444] GetProcessHeap () returned 0x630000 [0074.444] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.444] GetProcessHeap () returned 0x630000 [0074.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.444] GetProcessHeap () returned 0x630000 [0074.444] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.444] GetProcessHeap () returned 0x630000 [0074.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.445] GetProcessHeap () returned 0x630000 [0074.445] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.445] GetProcessHeap () returned 0x630000 [0074.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.445] GetProcessHeap () returned 0x630000 [0074.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0074.445] GetProcessHeap () returned 0x630000 [0074.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0074.445] GetProcessHeap () returned 0x630000 [0074.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0074.445] GetProcessHeap () returned 0x630000 [0074.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0074.445] GetProcessHeap () returned 0x630000 [0074.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0074.445] GetProcessHeap () returned 0x630000 [0074.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0074.445] GetProcessHeap () returned 0x630000 [0074.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0074.445] GetProcessHeap () returned 0x630000 [0074.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0074.445] GetProcessHeap () returned 0x630000 [0074.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0074.445] GetProcessHeap () returned 0x630000 [0074.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.445] GetProcessHeap () returned 0x630000 [0074.445] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0074.445] WriteFile (in: hFile=0x230, lpBuffer=0x672130*, nNumberOfBytesToWrite=0x384, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672130*, lpNumberOfBytesWritten=0x243d864*=0x384, lpOverlapped=0x0) returned 1 [0074.447] GetProcessHeap () returned 0x630000 [0074.447] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x672130, Size=0x30) returned 0x672130 [0074.447] GetProcessHeap () returned 0x630000 [0074.447] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0074.447] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.448] GetProcessHeap () returned 0x630000 [0074.448] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4aa0) returned 0x672168 [0074.448] ReadFile (in: hFile=0x230, lpBuffer=0x672168, nNumberOfBytesToRead=0x4aa0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x672168*, lpNumberOfBytesRead=0x243d7e8*=0x4aa0, lpOverlapped=0x0) returned 1 [0074.448] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.448] WriteFile (in: hFile=0x230, lpBuffer=0x672168*, nNumberOfBytesToWrite=0x4aa0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x672168*, lpNumberOfBytesWritten=0x243d7e4*=0x4aa0, lpOverlapped=0x0) returned 1 [0074.450] GetProcessHeap () returned 0x630000 [0074.450] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672168 | out: hHeap=0x630000) returned 1 [0074.450] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.450] WriteFile (in: hFile=0x230, lpBuffer=0x672130*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672130*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0074.451] CloseHandle (hObject=0x230) returned 1 [0074.452] GetProcessHeap () returned 0x630000 [0074.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0074.452] GetProcessHeap () returned 0x630000 [0074.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655a30 | out: hHeap=0x630000) returned 1 [0074.452] GetProcessHeap () returned 0x630000 [0074.452] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0074.452] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\5J5Fcxp5CQm.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\5J5Fcxp5CQm.mp3") returned="C:\\Users\\FD1HVy\\Desktop\\5J5Fcxp5CQm.mp3" [0074.452] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\5J5Fcxp5CQm.mp3", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\5J5Fcxp5CQm.mp3.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\5J5Fcxp5CQm.mp3.happythreechoose" [0074.452] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\5J5Fcxp5CQm.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\5j5fcxp5cqm.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\5J5Fcxp5CQm.mp3.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\5j5fcxp5cqm.mp3.happythreechoose"), dwFlags=0x1) returned 1 [0074.453] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\5J5Fcxp5CQm.mp3" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0074.453] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned="" [0074.453] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" [0074.453] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\decryption info.html")) returned 0x20 [0074.453] GetProcessHeap () returned 0x630000 [0074.453] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0074.453] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47f30350, ftCreationTime.dwHighDateTime=0x1d5c976, ftLastAccessTime.dwLowDateTime=0x13a76070, ftLastAccessTime.dwHighDateTime=0x1d5d766, ftLastWriteTime.dwLowDateTime=0x13a76070, ftLastWriteTime.dwHighDateTime=0x1d5d766, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="6uhgnxQGWG", cAlternateFileName="6UHGNX~1")) returned 1 [0074.453] lstrcmpiW (lpString1="6uhgnxQGWG", lpString2=".") returned 1 [0074.453] lstrcmpiW (lpString1="6uhgnxQGWG", lpString2="..") returned 1 [0074.453] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="6uhgnxQGWG" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG" [0074.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="6uhgnxQGWG", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0074.453] GetProcessHeap () returned 0x630000 [0074.453] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb) returned 0x64c9f0 [0074.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="6uhgnxQGWG", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6uhgnxQGWG", lpUsedDefaultChar=0x0) returned 11 [0074.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6uhgnxQGWG", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0074.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6uhgnxQGWG", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0074.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6uhgnxQGWG", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0074.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6uhgnxQGWG", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0074.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6uhgnxQGWG", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0074.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6uhgnxQGWG", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0074.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6uhgnxQGWG", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0074.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6uhgnxQGWG", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0074.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6uhgnxQGWG", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0074.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6uhgnxQGWG", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0074.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6uhgnxQGWG", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0074.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6uhgnxQGWG", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0074.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6uhgnxQGWG", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0074.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6uhgnxQGWG", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0074.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6uhgnxQGWG", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0074.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6uhgnxQGWG", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0074.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6uhgnxQGWG", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0074.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6uhgnxQGWG", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0074.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6uhgnxQGWG", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0074.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6uhgnxQGWG", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0074.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6uhgnxQGWG", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0074.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6uhgnxQGWG", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0074.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6uhgnxQGWG", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0074.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6uhgnxQGWG", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 1 [0074.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6uhgnxQGWG", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0074.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6uhgnxQGWG", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0074.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6uhgnxQGWG", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 1 [0074.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6uhgnxQGWG", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0074.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6uhgnxQGWG", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0074.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6uhgnxQGWG", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0074.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6uhgnxQGWG", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0074.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6uhgnxQGWG", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 1 [0074.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6uhgnxQGWG", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0074.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6uhgnxQGWG", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0074.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6uhgnxQGWG", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0074.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6uhgnxQGWG", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0074.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6uhgnxQGWG", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0074.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6uhgnxQGWG", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0074.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6uhgnxQGWG", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0074.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6uhgnxQGWG", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0074.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6uhgnxQGWG", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0074.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6uhgnxQGWG", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0074.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="6uhgnxQGWG", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0074.454] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\" [0074.454] GetProcessHeap () returned 0x630000 [0074.455] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a2b8 [0074.455] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\") returned 35 [0074.455] GetProcessHeap () returned 0x630000 [0074.455] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x48) returned 0x65fcf0 [0074.455] lstrcpyW (in: lpString1=0x65fcf0, lpString2="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\" [0074.455] GetProcessHeap () returned 0x630000 [0074.455] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0074.455] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d9991e0, ftCreationTime.dwHighDateTime=0x1d5d25b, ftLastAccessTime.dwLowDateTime=0x25ef0e40, ftLastAccessTime.dwHighDateTime=0x1d5d2f2, ftLastWriteTime.dwLowDateTime=0x25ef0e40, ftLastWriteTime.dwHighDateTime=0x1d5d2f2, nFileSizeHigh=0x0, nFileSizeLow=0xad7c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="aCOyQNykhfx.gif", cAlternateFileName="ACOYQN~1.GIF")) returned 1 [0074.455] lstrcmpiW (lpString1="aCOyQNykhfx.gif", lpString2=".") returned 1 [0074.455] lstrcmpiW (lpString1="aCOyQNykhfx.gif", lpString2="..") returned 1 [0074.455] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="aCOyQNykhfx.gif" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\aCOyQNykhfx.gif") returned="C:\\Users\\FD1HVy\\Desktop\\aCOyQNykhfx.gif" [0074.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aCOyQNykhfx.gif", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0074.455] GetProcessHeap () returned 0x630000 [0074.455] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x64c9f0 [0074.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aCOyQNykhfx.gif", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aCOyQNykhfx.gif", lpUsedDefaultChar=0x0) returned 16 [0074.455] lstrlenA (lpString="aCOyQNykhfx.gif") returned 15 [0074.455] lstrlenA (lpString=".happythreechoose") returned 17 [0074.455] lstrcmpiW (lpString1="aCOyQNykhfx.gif", lpString2="Decryption INFO.html") returned -1 [0074.455] lstrcmpiW (lpString1="aCOyQNykhfx.gif", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0074.455] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0074.455] lstrcmpiW (lpString1="aCOyQNykhfx.gif", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0074.455] GetProcessHeap () returned 0x630000 [0074.455] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f10 [0074.455] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\aCOyQNykhfx.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\acoyqnykhfx.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0074.455] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=44412) returned 1 [0074.455] GetProcessHeap () returned 0x630000 [0074.455] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655aa8 [0074.455] GetProcessHeap () returned 0x630000 [0074.455] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.455] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\aCOyQNykhfx.gif") returned 39 [0074.455] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.456] GetProcessHeap () returned 0x630000 [0074.456] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0074.456] GetProcessHeap () returned 0x630000 [0074.456] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x672168 [0074.456] lstrlenA (lpString="rsa_encrypt") returned 11 [0074.456] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0074.456] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0074.456] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0074.456] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0074.456] GetProcessHeap () returned 0x630000 [0074.456] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0074.456] lstrlenA (lpString="010001") returned 6 [0074.456] GetProcessHeap () returned 0x630000 [0074.456] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0074.456] GetProcessHeap () returned 0x630000 [0074.456] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.457] GetProcessHeap () returned 0x630000 [0074.457] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e460 [0074.457] GetProcessHeap () returned 0x630000 [0074.457] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.457] GetProcessHeap () returned 0x630000 [0074.457] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e4f0 [0074.457] GetProcessHeap () returned 0x630000 [0074.457] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x6570f8 [0074.457] GetProcessHeap () returned 0x630000 [0074.457] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0074.457] GetProcessHeap () returned 0x630000 [0074.457] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0074.457] GetProcessHeap () returned 0x630000 [0074.457] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.457] GetProcessHeap () returned 0x630000 [0074.457] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0074.457] GetProcessHeap () returned 0x630000 [0074.457] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.457] GetProcessHeap () returned 0x630000 [0074.457] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656fe0 [0074.457] GetProcessHeap () returned 0x630000 [0074.457] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.457] GetProcessHeap () returned 0x630000 [0074.457] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0074.457] GetProcessHeap () returned 0x630000 [0074.457] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e970 [0074.457] GetProcessHeap () returned 0x630000 [0074.457] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.457] GetProcessHeap () returned 0x630000 [0074.457] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0074.457] GetProcessHeap () returned 0x630000 [0074.457] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0074.457] GetProcessHeap () returned 0x630000 [0074.457] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.457] GetProcessHeap () returned 0x630000 [0074.457] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cee0 [0074.457] GetProcessHeap () returned 0x630000 [0074.457] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.457] GetProcessHeap () returned 0x630000 [0074.457] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.457] GetProcessHeap () returned 0x630000 [0074.457] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.458] GetProcessHeap () returned 0x630000 [0074.458] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.458] GetProcessHeap () returned 0x630000 [0074.458] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e850 [0074.458] GetProcessHeap () returned 0x630000 [0074.458] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cee0 | out: hHeap=0x630000) returned 1 [0074.458] GetProcessHeap () returned 0x630000 [0074.458] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0074.458] GetProcessHeap () returned 0x630000 [0074.458] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0074.458] GetProcessHeap () returned 0x630000 [0074.458] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.458] GetProcessHeap () returned 0x630000 [0074.458] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.458] GetProcessHeap () returned 0x630000 [0074.458] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.458] GetProcessHeap () returned 0x630000 [0074.458] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.458] GetProcessHeap () returned 0x630000 [0074.458] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.458] GetProcessHeap () returned 0x630000 [0074.458] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.458] GetProcessHeap () returned 0x630000 [0074.458] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.458] GetProcessHeap () returned 0x630000 [0074.458] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.458] GetProcessHeap () returned 0x630000 [0074.458] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.458] GetProcessHeap () returned 0x630000 [0074.458] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.458] GetProcessHeap () returned 0x630000 [0074.458] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.458] GetProcessHeap () returned 0x630000 [0074.458] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.458] GetProcessHeap () returned 0x630000 [0074.458] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.458] GetProcessHeap () returned 0x630000 [0074.458] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.458] GetProcessHeap () returned 0x630000 [0074.458] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.459] GetProcessHeap () returned 0x630000 [0074.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.459] GetProcessHeap () returned 0x630000 [0074.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.459] GetProcessHeap () returned 0x630000 [0074.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.459] GetProcessHeap () returned 0x630000 [0074.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.459] GetProcessHeap () returned 0x630000 [0074.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.459] GetProcessHeap () returned 0x630000 [0074.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.459] GetProcessHeap () returned 0x630000 [0074.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.459] GetProcessHeap () returned 0x630000 [0074.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.459] GetProcessHeap () returned 0x630000 [0074.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.459] GetProcessHeap () returned 0x630000 [0074.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.459] GetProcessHeap () returned 0x630000 [0074.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.459] GetProcessHeap () returned 0x630000 [0074.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.459] GetProcessHeap () returned 0x630000 [0074.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.459] GetProcessHeap () returned 0x630000 [0074.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.459] GetProcessHeap () returned 0x630000 [0074.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.459] GetProcessHeap () returned 0x630000 [0074.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.459] GetProcessHeap () returned 0x630000 [0074.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.459] GetProcessHeap () returned 0x630000 [0074.459] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.459] GetProcessHeap () returned 0x630000 [0074.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.459] GetProcessHeap () returned 0x630000 [0074.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.460] GetProcessHeap () returned 0x630000 [0074.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.460] GetProcessHeap () returned 0x630000 [0074.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.460] GetProcessHeap () returned 0x630000 [0074.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.460] GetProcessHeap () returned 0x630000 [0074.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.460] GetProcessHeap () returned 0x630000 [0074.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.460] GetProcessHeap () returned 0x630000 [0074.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.460] GetProcessHeap () returned 0x630000 [0074.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.460] GetProcessHeap () returned 0x630000 [0074.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.460] GetProcessHeap () returned 0x630000 [0074.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.460] GetProcessHeap () returned 0x630000 [0074.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.460] GetProcessHeap () returned 0x630000 [0074.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.460] GetProcessHeap () returned 0x630000 [0074.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.460] GetProcessHeap () returned 0x630000 [0074.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.460] GetProcessHeap () returned 0x630000 [0074.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.460] GetProcessHeap () returned 0x630000 [0074.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.460] GetProcessHeap () returned 0x630000 [0074.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.460] GetProcessHeap () returned 0x630000 [0074.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.460] GetProcessHeap () returned 0x630000 [0074.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.460] GetProcessHeap () returned 0x630000 [0074.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.461] GetProcessHeap () returned 0x630000 [0074.461] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.461] GetProcessHeap () returned 0x630000 [0074.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.461] GetProcessHeap () returned 0x630000 [0074.461] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.461] GetProcessHeap () returned 0x630000 [0074.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.461] GetProcessHeap () returned 0x630000 [0074.461] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.461] GetProcessHeap () returned 0x630000 [0074.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.461] GetProcessHeap () returned 0x630000 [0074.461] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.461] GetProcessHeap () returned 0x630000 [0074.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.461] GetProcessHeap () returned 0x630000 [0074.461] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.461] GetProcessHeap () returned 0x630000 [0074.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.461] GetProcessHeap () returned 0x630000 [0074.461] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.461] GetProcessHeap () returned 0x630000 [0074.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.461] GetProcessHeap () returned 0x630000 [0074.461] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.461] GetProcessHeap () returned 0x630000 [0074.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.461] GetProcessHeap () returned 0x630000 [0074.461] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.461] GetProcessHeap () returned 0x630000 [0074.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.461] GetProcessHeap () returned 0x630000 [0074.461] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.461] GetProcessHeap () returned 0x630000 [0074.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.461] GetProcessHeap () returned 0x630000 [0074.461] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.461] GetProcessHeap () returned 0x630000 [0074.461] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.461] GetProcessHeap () returned 0x630000 [0074.462] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.462] GetProcessHeap () returned 0x630000 [0074.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.462] GetProcessHeap () returned 0x630000 [0074.462] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.462] GetProcessHeap () returned 0x630000 [0074.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.462] GetProcessHeap () returned 0x630000 [0074.462] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.462] GetProcessHeap () returned 0x630000 [0074.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.462] GetProcessHeap () returned 0x630000 [0074.462] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.462] GetProcessHeap () returned 0x630000 [0074.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.462] GetProcessHeap () returned 0x630000 [0074.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0074.462] GetProcessHeap () returned 0x630000 [0074.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0074.462] GetProcessHeap () returned 0x630000 [0074.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0074.462] GetProcessHeap () returned 0x630000 [0074.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0074.462] GetProcessHeap () returned 0x630000 [0074.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0074.462] GetProcessHeap () returned 0x630000 [0074.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0074.462] GetProcessHeap () returned 0x630000 [0074.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0074.462] GetProcessHeap () returned 0x630000 [0074.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e460 | out: hHeap=0x630000) returned 1 [0074.462] GetProcessHeap () returned 0x630000 [0074.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0074.462] GetProcessHeap () returned 0x630000 [0074.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.462] GetProcessHeap () returned 0x630000 [0074.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0074.462] WriteFile (in: hFile=0x230, lpBuffer=0x672168*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672168*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0074.464] GetProcessHeap () returned 0x630000 [0074.464] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x672168, Size=0x30) returned 0x672168 [0074.464] GetProcessHeap () returned 0x630000 [0074.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0074.464] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.464] GetProcessHeap () returned 0x630000 [0074.465] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xad7c) returned 0x6721a0 [0074.465] ReadFile (in: hFile=0x230, lpBuffer=0x6721a0, nNumberOfBytesToRead=0xad7c, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x6721a0*, lpNumberOfBytesRead=0x243d7e8*=0xad7c, lpOverlapped=0x0) returned 1 [0074.466] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.466] WriteFile (in: hFile=0x230, lpBuffer=0x6721a0*, nNumberOfBytesToWrite=0xad7c, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x6721a0*, lpNumberOfBytesWritten=0x243d7e4*=0xad7c, lpOverlapped=0x0) returned 1 [0074.467] GetProcessHeap () returned 0x630000 [0074.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6721a0 | out: hHeap=0x630000) returned 1 [0074.469] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.469] WriteFile (in: hFile=0x230, lpBuffer=0x672168*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672168*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0074.470] CloseHandle (hObject=0x230) returned 1 [0074.470] GetProcessHeap () returned 0x630000 [0074.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f10 | out: hHeap=0x630000) returned 1 [0074.470] GetProcessHeap () returned 0x630000 [0074.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655aa8 | out: hHeap=0x630000) returned 1 [0074.470] GetProcessHeap () returned 0x630000 [0074.470] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0074.470] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\aCOyQNykhfx.gif" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\aCOyQNykhfx.gif") returned="C:\\Users\\FD1HVy\\Desktop\\aCOyQNykhfx.gif" [0074.470] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\aCOyQNykhfx.gif", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\aCOyQNykhfx.gif.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\aCOyQNykhfx.gif.happythreechoose" [0074.470] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\aCOyQNykhfx.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\acoyqnykhfx.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\aCOyQNykhfx.gif.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\acoyqnykhfx.gif.happythreechoose"), dwFlags=0x1) returned 1 [0074.471] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\aCOyQNykhfx.gif" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0074.471] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned="" [0074.471] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" [0074.471] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\decryption info.html")) returned 0x20 [0074.471] GetProcessHeap () returned 0x630000 [0074.471] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0074.471] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d321000, ftCreationTime.dwHighDateTime=0x1d5d3da, ftLastAccessTime.dwLowDateTime=0x141409a0, ftLastAccessTime.dwHighDateTime=0x1d5d13f, ftLastWriteTime.dwLowDateTime=0x141409a0, ftLastWriteTime.dwHighDateTime=0x1d5d13f, nFileSizeHigh=0x0, nFileSizeLow=0xf402, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bMwxeVaHwK- AdUV26GT.csv", cAlternateFileName="BMWXEV~1.CSV")) returned 1 [0074.471] lstrcmpiW (lpString1="bMwxeVaHwK- AdUV26GT.csv", lpString2=".") returned 1 [0074.471] lstrcmpiW (lpString1="bMwxeVaHwK- AdUV26GT.csv", lpString2="..") returned 1 [0074.471] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="bMwxeVaHwK- AdUV26GT.csv" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\bMwxeVaHwK- AdUV26GT.csv") returned="C:\\Users\\FD1HVy\\Desktop\\bMwxeVaHwK- AdUV26GT.csv" [0074.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bMwxeVaHwK- AdUV26GT.csv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0074.471] GetProcessHeap () returned 0x630000 [0074.471] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x19) returned 0x652000 [0074.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bMwxeVaHwK- AdUV26GT.csv", cchWideChar=-1, lpMultiByteStr=0x652000, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bMwxeVaHwK- AdUV26GT.csv", lpUsedDefaultChar=0x0) returned 25 [0074.471] lstrlenA (lpString="bMwxeVaHwK- AdUV26GT.csv") returned 24 [0074.471] lstrlenA (lpString=".happythreechoose") returned 17 [0074.471] lstrlenA (lpString=".happythreechoose") returned 17 [0074.471] lstrlenA (lpString="bMwxeVaHwK- AdUV26GT.csv") returned 24 [0074.471] lstrcmpiA (lpString1="HwK- AdUV26GT.csv", lpString2=".happythreechoose") returned 1 [0074.472] lstrcmpiW (lpString1="bMwxeVaHwK- AdUV26GT.csv", lpString2="Decryption INFO.html") returned -1 [0074.472] lstrcmpiW (lpString1="bMwxeVaHwK- AdUV26GT.csv", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0074.472] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0074.472] lstrcmpiW (lpString1="bMwxeVaHwK- AdUV26GT.csv", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0074.472] GetProcessHeap () returned 0x630000 [0074.472] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0074.472] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\bMwxeVaHwK- AdUV26GT.csv" (normalized: "c:\\users\\fd1hvy\\desktop\\bmwxevahwk- aduv26gt.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0074.472] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=62466) returned 1 [0074.472] GetProcessHeap () returned 0x630000 [0074.472] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655b20 [0074.472] GetProcessHeap () returned 0x630000 [0074.472] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.472] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\bMwxeVaHwK- AdUV26GT.csv") returned 48 [0074.472] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.472] GetProcessHeap () returned 0x630000 [0074.472] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0074.472] GetProcessHeap () returned 0x630000 [0074.472] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x6721a0 [0074.473] lstrlenA (lpString="rsa_encrypt") returned 11 [0074.473] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0074.474] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0074.474] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0074.474] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0074.474] GetProcessHeap () returned 0x630000 [0074.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0074.474] lstrlenA (lpString="010001") returned 6 [0074.474] GetProcessHeap () returned 0x630000 [0074.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2f8 [0074.474] GetProcessHeap () returned 0x630000 [0074.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.474] GetProcessHeap () returned 0x630000 [0074.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0074.474] GetProcessHeap () returned 0x630000 [0074.474] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.474] GetProcessHeap () returned 0x630000 [0074.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0074.474] GetProcessHeap () returned 0x630000 [0074.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656db0 [0074.474] GetProcessHeap () returned 0x630000 [0074.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0074.474] GetProcessHeap () returned 0x630000 [0074.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0074.474] GetProcessHeap () returned 0x630000 [0074.474] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.474] GetProcessHeap () returned 0x630000 [0074.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0074.474] GetProcessHeap () returned 0x630000 [0074.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.474] GetProcessHeap () returned 0x630000 [0074.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657558 [0074.474] GetProcessHeap () returned 0x630000 [0074.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.474] GetProcessHeap () returned 0x630000 [0074.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0074.474] GetProcessHeap () returned 0x630000 [0074.475] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65eb20 [0074.475] GetProcessHeap () returned 0x630000 [0074.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.475] GetProcessHeap () returned 0x630000 [0074.475] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0074.475] GetProcessHeap () returned 0x630000 [0074.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0074.475] GetProcessHeap () returned 0x630000 [0074.475] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.475] GetProcessHeap () returned 0x630000 [0074.475] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0074.475] GetProcessHeap () returned 0x630000 [0074.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.475] GetProcessHeap () returned 0x630000 [0074.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.475] GetProcessHeap () returned 0x630000 [0074.475] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.475] GetProcessHeap () returned 0x630000 [0074.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.475] GetProcessHeap () returned 0x630000 [0074.475] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e850 [0074.475] GetProcessHeap () returned 0x630000 [0074.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0074.475] GetProcessHeap () returned 0x630000 [0074.475] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0074.475] GetProcessHeap () returned 0x630000 [0074.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0074.475] GetProcessHeap () returned 0x630000 [0074.475] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.475] GetProcessHeap () returned 0x630000 [0074.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.475] GetProcessHeap () returned 0x630000 [0074.475] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.475] GetProcessHeap () returned 0x630000 [0074.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.475] GetProcessHeap () returned 0x630000 [0074.475] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.475] GetProcessHeap () returned 0x630000 [0074.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.475] GetProcessHeap () returned 0x630000 [0074.475] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.475] GetProcessHeap () returned 0x630000 [0074.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.476] GetProcessHeap () returned 0x630000 [0074.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.476] GetProcessHeap () returned 0x630000 [0074.476] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.476] GetProcessHeap () returned 0x630000 [0074.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.476] GetProcessHeap () returned 0x630000 [0074.476] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.476] GetProcessHeap () returned 0x630000 [0074.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.476] GetProcessHeap () returned 0x630000 [0074.476] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.476] GetProcessHeap () returned 0x630000 [0074.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.476] GetProcessHeap () returned 0x630000 [0074.476] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.476] GetProcessHeap () returned 0x630000 [0074.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.476] GetProcessHeap () returned 0x630000 [0074.476] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.476] GetProcessHeap () returned 0x630000 [0074.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.476] GetProcessHeap () returned 0x630000 [0074.476] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.476] GetProcessHeap () returned 0x630000 [0074.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.476] GetProcessHeap () returned 0x630000 [0074.476] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.476] GetProcessHeap () returned 0x630000 [0074.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.476] GetProcessHeap () returned 0x630000 [0074.476] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.476] GetProcessHeap () returned 0x630000 [0074.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.476] GetProcessHeap () returned 0x630000 [0074.476] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.476] GetProcessHeap () returned 0x630000 [0074.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.477] GetProcessHeap () returned 0x630000 [0074.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.477] GetProcessHeap () returned 0x630000 [0074.477] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.477] GetProcessHeap () returned 0x630000 [0074.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.477] GetProcessHeap () returned 0x630000 [0074.477] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.477] GetProcessHeap () returned 0x630000 [0074.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.477] GetProcessHeap () returned 0x630000 [0074.477] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.477] GetProcessHeap () returned 0x630000 [0074.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.477] GetProcessHeap () returned 0x630000 [0074.477] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.477] GetProcessHeap () returned 0x630000 [0074.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.477] GetProcessHeap () returned 0x630000 [0074.477] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.477] GetProcessHeap () returned 0x630000 [0074.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.477] GetProcessHeap () returned 0x630000 [0074.477] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.477] GetProcessHeap () returned 0x630000 [0074.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.477] GetProcessHeap () returned 0x630000 [0074.477] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.477] GetProcessHeap () returned 0x630000 [0074.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.477] GetProcessHeap () returned 0x630000 [0074.477] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.477] GetProcessHeap () returned 0x630000 [0074.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.477] GetProcessHeap () returned 0x630000 [0074.477] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.477] GetProcessHeap () returned 0x630000 [0074.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.477] GetProcessHeap () returned 0x630000 [0074.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.478] GetProcessHeap () returned 0x630000 [0074.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.478] GetProcessHeap () returned 0x630000 [0074.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.478] GetProcessHeap () returned 0x630000 [0074.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.478] GetProcessHeap () returned 0x630000 [0074.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.478] GetProcessHeap () returned 0x630000 [0074.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.478] GetProcessHeap () returned 0x630000 [0074.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.478] GetProcessHeap () returned 0x630000 [0074.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.478] GetProcessHeap () returned 0x630000 [0074.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.478] GetProcessHeap () returned 0x630000 [0074.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.478] GetProcessHeap () returned 0x630000 [0074.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.478] GetProcessHeap () returned 0x630000 [0074.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.478] GetProcessHeap () returned 0x630000 [0074.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.478] GetProcessHeap () returned 0x630000 [0074.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.478] GetProcessHeap () returned 0x630000 [0074.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0074.478] GetProcessHeap () returned 0x630000 [0074.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0074.478] GetProcessHeap () returned 0x630000 [0074.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.478] GetProcessHeap () returned 0x630000 [0074.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.478] GetProcessHeap () returned 0x630000 [0074.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.478] GetProcessHeap () returned 0x630000 [0074.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.478] GetProcessHeap () returned 0x630000 [0074.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.479] GetProcessHeap () returned 0x630000 [0074.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.479] GetProcessHeap () returned 0x630000 [0074.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.479] GetProcessHeap () returned 0x630000 [0074.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.479] GetProcessHeap () returned 0x630000 [0074.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.479] GetProcessHeap () returned 0x630000 [0074.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.479] GetProcessHeap () returned 0x630000 [0074.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.479] GetProcessHeap () returned 0x630000 [0074.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.479] GetProcessHeap () returned 0x630000 [0074.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.479] GetProcessHeap () returned 0x630000 [0074.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.479] GetProcessHeap () returned 0x630000 [0074.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.479] GetProcessHeap () returned 0x630000 [0074.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.479] GetProcessHeap () returned 0x630000 [0074.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.479] GetProcessHeap () returned 0x630000 [0074.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.479] GetProcessHeap () returned 0x630000 [0074.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.479] GetProcessHeap () returned 0x630000 [0074.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.479] GetProcessHeap () returned 0x630000 [0074.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0074.479] GetProcessHeap () returned 0x630000 [0074.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0074.479] GetProcessHeap () returned 0x630000 [0074.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0074.479] GetProcessHeap () returned 0x630000 [0074.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0074.480] GetProcessHeap () returned 0x630000 [0074.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0074.480] GetProcessHeap () returned 0x630000 [0074.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0074.480] GetProcessHeap () returned 0x630000 [0074.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0074.480] GetProcessHeap () returned 0x630000 [0074.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0074.480] GetProcessHeap () returned 0x630000 [0074.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0074.480] GetProcessHeap () returned 0x630000 [0074.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.480] GetProcessHeap () returned 0x630000 [0074.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0074.480] WriteFile (in: hFile=0x230, lpBuffer=0x6721a0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6721a0*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0074.486] GetProcessHeap () returned 0x630000 [0074.486] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6721a0, Size=0x30) returned 0x6721a0 [0074.486] GetProcessHeap () returned 0x630000 [0074.486] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0074.486] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.486] GetProcessHeap () returned 0x630000 [0074.486] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf402) returned 0x6721d8 [0074.487] ReadFile (in: hFile=0x230, lpBuffer=0x6721d8, nNumberOfBytesToRead=0xf402, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x6721d8*, lpNumberOfBytesRead=0x243d7e8*=0xf402, lpOverlapped=0x0) returned 1 [0074.488] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.488] WriteFile (in: hFile=0x230, lpBuffer=0x6721d8*, nNumberOfBytesToWrite=0xf402, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x6721d8*, lpNumberOfBytesWritten=0x243d7e4*=0xf402, lpOverlapped=0x0) returned 1 [0074.490] GetProcessHeap () returned 0x630000 [0074.490] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6721d8 | out: hHeap=0x630000) returned 1 [0074.490] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.490] WriteFile (in: hFile=0x230, lpBuffer=0x6721a0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6721a0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0074.491] CloseHandle (hObject=0x230) returned 1 [0074.492] GetProcessHeap () returned 0x630000 [0074.492] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0074.492] GetProcessHeap () returned 0x630000 [0074.492] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655b20 | out: hHeap=0x630000) returned 1 [0074.492] GetProcessHeap () returned 0x630000 [0074.492] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0074.492] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\bMwxeVaHwK- AdUV26GT.csv" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\bMwxeVaHwK- AdUV26GT.csv") returned="C:\\Users\\FD1HVy\\Desktop\\bMwxeVaHwK- AdUV26GT.csv" [0074.492] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\bMwxeVaHwK- AdUV26GT.csv", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\bMwxeVaHwK- AdUV26GT.csv.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\bMwxeVaHwK- AdUV26GT.csv.happythreechoose" [0074.492] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\bMwxeVaHwK- AdUV26GT.csv" (normalized: "c:\\users\\fd1hvy\\desktop\\bmwxevahwk- aduv26gt.csv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\bMwxeVaHwK- AdUV26GT.csv.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\bmwxevahwk- aduv26gt.csv.happythreechoose"), dwFlags=0x1) returned 1 [0074.493] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\bMwxeVaHwK- AdUV26GT.csv" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0074.493] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned="" [0074.493] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" [0074.493] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\decryption info.html")) returned 0x20 [0074.493] GetProcessHeap () returned 0x630000 [0074.494] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x652000 | out: hHeap=0x630000) returned 1 [0074.494] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7387e4e0, ftCreationTime.dwHighDateTime=0x1d5d77c, ftLastAccessTime.dwLowDateTime=0xed53c50, ftLastAccessTime.dwHighDateTime=0x1d5d7d1, ftLastWriteTime.dwLowDateTime=0xed53c50, ftLastWriteTime.dwHighDateTime=0x1d5d7d1, nFileSizeHigh=0x0, nFileSizeLow=0x9dd8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="brtE.mkv", cAlternateFileName="")) returned 1 [0074.494] lstrcmpiW (lpString1="brtE.mkv", lpString2=".") returned 1 [0074.494] lstrcmpiW (lpString1="brtE.mkv", lpString2="..") returned 1 [0074.494] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="brtE.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\brtE.mkv") returned="C:\\Users\\FD1HVy\\Desktop\\brtE.mkv" [0074.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brtE.mkv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0074.494] GetProcessHeap () returned 0x630000 [0074.494] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9) returned 0x64c9f0 [0074.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="brtE.mkv", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="brtE.mkv", lpUsedDefaultChar=0x0) returned 9 [0074.494] lstrlenA (lpString="brtE.mkv") returned 8 [0074.494] lstrlenA (lpString=".happythreechoose") returned 17 [0074.494] lstrcmpiW (lpString1="brtE.mkv", lpString2="Decryption INFO.html") returned -1 [0074.494] lstrcmpiW (lpString1="brtE.mkv", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0074.494] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0074.494] lstrcmpiW (lpString1="brtE.mkv", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0074.494] GetProcessHeap () returned 0x630000 [0074.494] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0074.494] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\brtE.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\brte.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0074.494] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=40408) returned 1 [0074.494] GetProcessHeap () returned 0x630000 [0074.494] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6557d8 [0074.495] GetProcessHeap () returned 0x630000 [0074.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.495] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\brtE.mkv") returned 32 [0074.495] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.495] GetProcessHeap () returned 0x630000 [0074.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0074.495] GetProcessHeap () returned 0x630000 [0074.495] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x388) returned 0x6721d8 [0074.495] lstrlenA (lpString="rsa_encrypt") returned 11 [0074.495] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0074.496] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0074.496] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0074.496] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0074.496] GetProcessHeap () returned 0x630000 [0074.496] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0074.496] lstrlenA (lpString="010001") returned 6 [0074.496] GetProcessHeap () returned 0x630000 [0074.496] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0074.496] GetProcessHeap () returned 0x630000 [0074.496] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.496] GetProcessHeap () returned 0x630000 [0074.496] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e190 [0074.496] GetProcessHeap () returned 0x630000 [0074.496] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.496] GetProcessHeap () returned 0x630000 [0074.496] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0074.496] GetProcessHeap () returned 0x630000 [0074.496] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656a68 [0074.496] GetProcessHeap () returned 0x630000 [0074.496] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2f8 [0074.496] GetProcessHeap () returned 0x630000 [0074.496] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0074.496] GetProcessHeap () returned 0x630000 [0074.496] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.496] GetProcessHeap () returned 0x630000 [0074.496] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0074.496] GetProcessHeap () returned 0x630000 [0074.496] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.496] GetProcessHeap () returned 0x630000 [0074.497] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657788 [0074.497] GetProcessHeap () returned 0x630000 [0074.497] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.497] GetProcessHeap () returned 0x630000 [0074.497] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0074.497] GetProcessHeap () returned 0x630000 [0074.497] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e580 [0074.497] GetProcessHeap () returned 0x630000 [0074.497] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.497] GetProcessHeap () returned 0x630000 [0074.497] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0074.497] GetProcessHeap () returned 0x630000 [0074.497] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0074.497] GetProcessHeap () returned 0x630000 [0074.497] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.497] GetProcessHeap () returned 0x630000 [0074.497] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cec8 [0074.497] GetProcessHeap () returned 0x630000 [0074.497] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.497] GetProcessHeap () returned 0x630000 [0074.497] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.497] GetProcessHeap () returned 0x630000 [0074.497] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.497] GetProcessHeap () returned 0x630000 [0074.497] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.497] GetProcessHeap () returned 0x630000 [0074.497] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e610 [0074.497] GetProcessHeap () returned 0x630000 [0074.497] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cec8 | out: hHeap=0x630000) returned 1 [0074.497] GetProcessHeap () returned 0x630000 [0074.497] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0074.497] GetProcessHeap () returned 0x630000 [0074.497] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0074.497] GetProcessHeap () returned 0x630000 [0074.497] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.497] GetProcessHeap () returned 0x630000 [0074.497] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.497] GetProcessHeap () returned 0x630000 [0074.497] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.497] GetProcessHeap () returned 0x630000 [0074.497] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.497] GetProcessHeap () returned 0x630000 [0074.498] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.498] GetProcessHeap () returned 0x630000 [0074.498] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.498] GetProcessHeap () returned 0x630000 [0074.498] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.498] GetProcessHeap () returned 0x630000 [0074.498] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.498] GetProcessHeap () returned 0x630000 [0074.498] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.498] GetProcessHeap () returned 0x630000 [0074.498] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.498] GetProcessHeap () returned 0x630000 [0074.498] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.498] GetProcessHeap () returned 0x630000 [0074.498] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.498] GetProcessHeap () returned 0x630000 [0074.498] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.498] GetProcessHeap () returned 0x630000 [0074.498] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.498] GetProcessHeap () returned 0x630000 [0074.498] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.498] GetProcessHeap () returned 0x630000 [0074.498] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.498] GetProcessHeap () returned 0x630000 [0074.498] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.498] GetProcessHeap () returned 0x630000 [0074.498] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.498] GetProcessHeap () returned 0x630000 [0074.498] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.498] GetProcessHeap () returned 0x630000 [0074.499] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.499] GetProcessHeap () returned 0x630000 [0074.499] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.499] GetProcessHeap () returned 0x630000 [0074.499] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.499] GetProcessHeap () returned 0x630000 [0074.499] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.499] GetProcessHeap () returned 0x630000 [0074.499] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.499] GetProcessHeap () returned 0x630000 [0074.499] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.499] GetProcessHeap () returned 0x630000 [0074.499] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.499] GetProcessHeap () returned 0x630000 [0074.499] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.499] GetProcessHeap () returned 0x630000 [0074.499] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.499] GetProcessHeap () returned 0x630000 [0074.499] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.499] GetProcessHeap () returned 0x630000 [0074.499] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.499] GetProcessHeap () returned 0x630000 [0074.499] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.499] GetProcessHeap () returned 0x630000 [0074.499] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.499] GetProcessHeap () returned 0x630000 [0074.499] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.499] GetProcessHeap () returned 0x630000 [0074.499] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.499] GetProcessHeap () returned 0x630000 [0074.499] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.499] GetProcessHeap () returned 0x630000 [0074.499] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.499] GetProcessHeap () returned 0x630000 [0074.499] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.499] GetProcessHeap () returned 0x630000 [0074.499] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.499] GetProcessHeap () returned 0x630000 [0074.499] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.499] GetProcessHeap () returned 0x630000 [0074.500] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.500] GetProcessHeap () returned 0x630000 [0074.500] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.500] GetProcessHeap () returned 0x630000 [0074.500] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.500] GetProcessHeap () returned 0x630000 [0074.500] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.500] GetProcessHeap () returned 0x630000 [0074.500] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.500] GetProcessHeap () returned 0x630000 [0074.500] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.500] GetProcessHeap () returned 0x630000 [0074.500] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.500] GetProcessHeap () returned 0x630000 [0074.500] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.500] GetProcessHeap () returned 0x630000 [0074.500] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.500] GetProcessHeap () returned 0x630000 [0074.500] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.500] GetProcessHeap () returned 0x630000 [0074.500] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.500] GetProcessHeap () returned 0x630000 [0074.500] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.500] GetProcessHeap () returned 0x630000 [0074.500] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.500] GetProcessHeap () returned 0x630000 [0074.500] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.500] GetProcessHeap () returned 0x630000 [0074.500] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.500] GetProcessHeap () returned 0x630000 [0074.500] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.500] GetProcessHeap () returned 0x630000 [0074.500] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.500] GetProcessHeap () returned 0x630000 [0074.500] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.500] GetProcessHeap () returned 0x630000 [0074.500] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.500] GetProcessHeap () returned 0x630000 [0074.500] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.500] GetProcessHeap () returned 0x630000 [0074.500] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.501] GetProcessHeap () returned 0x630000 [0074.501] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0074.501] GetProcessHeap () returned 0x630000 [0074.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0074.501] GetProcessHeap () returned 0x630000 [0074.501] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.501] GetProcessHeap () returned 0x630000 [0074.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.501] GetProcessHeap () returned 0x630000 [0074.501] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.501] GetProcessHeap () returned 0x630000 [0074.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.501] GetProcessHeap () returned 0x630000 [0074.501] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.501] GetProcessHeap () returned 0x630000 [0074.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.501] GetProcessHeap () returned 0x630000 [0074.501] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0074.501] GetProcessHeap () returned 0x630000 [0074.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0074.501] GetProcessHeap () returned 0x630000 [0074.501] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.501] GetProcessHeap () returned 0x630000 [0074.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.501] GetProcessHeap () returned 0x630000 [0074.501] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.501] GetProcessHeap () returned 0x630000 [0074.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.501] GetProcessHeap () returned 0x630000 [0074.501] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.501] GetProcessHeap () returned 0x630000 [0074.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.501] GetProcessHeap () returned 0x630000 [0074.501] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.501] GetProcessHeap () returned 0x630000 [0074.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.501] GetProcessHeap () returned 0x630000 [0074.501] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.501] GetProcessHeap () returned 0x630000 [0074.501] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.502] GetProcessHeap () returned 0x630000 [0074.502] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.502] GetProcessHeap () returned 0x630000 [0074.502] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.502] GetProcessHeap () returned 0x630000 [0074.502] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0074.502] GetProcessHeap () returned 0x630000 [0074.502] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0074.502] GetProcessHeap () returned 0x630000 [0074.502] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0074.502] GetProcessHeap () returned 0x630000 [0074.502] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0074.502] GetProcessHeap () returned 0x630000 [0074.502] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0074.502] GetProcessHeap () returned 0x630000 [0074.502] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0074.502] GetProcessHeap () returned 0x630000 [0074.502] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0074.502] GetProcessHeap () returned 0x630000 [0074.502] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0074.502] GetProcessHeap () returned 0x630000 [0074.502] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0074.502] GetProcessHeap () returned 0x630000 [0074.502] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.502] GetProcessHeap () returned 0x630000 [0074.502] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0074.502] WriteFile (in: hFile=0x230, lpBuffer=0x6721d8*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6721d8*, lpNumberOfBytesWritten=0x243d864*=0x388, lpOverlapped=0x0) returned 1 [0074.505] GetProcessHeap () returned 0x630000 [0074.505] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6721d8, Size=0x30) returned 0x6721d8 [0074.505] GetProcessHeap () returned 0x630000 [0074.505] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0074.505] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.505] GetProcessHeap () returned 0x630000 [0074.505] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9de0) returned 0x672210 [0074.505] ReadFile (in: hFile=0x230, lpBuffer=0x672210, nNumberOfBytesToRead=0x9de0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x672210*, lpNumberOfBytesRead=0x243d7e8*=0x9de0, lpOverlapped=0x0) returned 1 [0074.505] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.506] WriteFile (in: hFile=0x230, lpBuffer=0x672210*, nNumberOfBytesToWrite=0x9de0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x672210*, lpNumberOfBytesWritten=0x243d7e4*=0x9de0, lpOverlapped=0x0) returned 1 [0074.507] GetProcessHeap () returned 0x630000 [0074.507] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672210 | out: hHeap=0x630000) returned 1 [0074.508] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.508] WriteFile (in: hFile=0x230, lpBuffer=0x6721d8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6721d8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0074.509] CloseHandle (hObject=0x230) returned 1 [0074.510] GetProcessHeap () returned 0x630000 [0074.510] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0074.510] GetProcessHeap () returned 0x630000 [0074.510] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6557d8 | out: hHeap=0x630000) returned 1 [0074.510] GetProcessHeap () returned 0x630000 [0074.510] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0074.510] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\brtE.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\brtE.mkv") returned="C:\\Users\\FD1HVy\\Desktop\\brtE.mkv" [0074.510] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\brtE.mkv", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\brtE.mkv.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\brtE.mkv.happythreechoose" [0074.510] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\brtE.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\brte.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\brtE.mkv.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\brte.mkv.happythreechoose"), dwFlags=0x1) returned 1 [0074.510] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\brtE.mkv" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0074.510] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned="" [0074.510] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" [0074.510] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\decryption info.html")) returned 0x20 [0074.510] GetProcessHeap () returned 0x630000 [0074.510] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0074.510] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0074.511] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0074.511] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0074.511] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\desktop.ini") returned="C:\\Users\\FD1HVy\\Desktop\\desktop.ini" [0074.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0074.511] GetProcessHeap () returned 0x630000 [0074.511] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0074.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0074.511] lstrlenA (lpString="desktop.ini") returned 11 [0074.511] lstrlenA (lpString=".happythreechoose") returned 17 [0074.511] lstrcmpiW (lpString1="desktop.ini", lpString2="Decryption INFO.html") returned 1 [0074.511] lstrcmpiW (lpString1="desktop.ini", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0074.511] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0074.511] lstrcmpiW (lpString1="desktop.ini", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0074.511] GetProcessHeap () returned 0x630000 [0074.511] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0074.511] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0074.511] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=282) returned 1 [0074.511] GetProcessHeap () returned 0x630000 [0074.511] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6556e8 [0074.511] GetProcessHeap () returned 0x630000 [0074.511] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.511] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\desktop.ini") returned 35 [0074.511] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.511] GetProcessHeap () returned 0x630000 [0074.511] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0074.511] GetProcessHeap () returned 0x630000 [0074.511] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x386) returned 0x672210 [0074.513] lstrlenA (lpString="rsa_encrypt") returned 11 [0074.513] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0074.513] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0074.513] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0074.513] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0074.513] GetProcessHeap () returned 0x630000 [0074.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0074.513] lstrlenA (lpString="010001") returned 6 [0074.513] GetProcessHeap () returned 0x630000 [0074.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0074.514] GetProcessHeap () returned 0x630000 [0074.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.514] GetProcessHeap () returned 0x630000 [0074.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e6a0 [0074.514] GetProcessHeap () returned 0x630000 [0074.514] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.514] GetProcessHeap () returned 0x630000 [0074.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e340 [0074.514] GetProcessHeap () returned 0x630000 [0074.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657328 [0074.514] GetProcessHeap () returned 0x630000 [0074.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0074.514] GetProcessHeap () returned 0x630000 [0074.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0074.514] GetProcessHeap () returned 0x630000 [0074.514] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.514] GetProcessHeap () returned 0x630000 [0074.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0074.514] GetProcessHeap () returned 0x630000 [0074.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.514] GetProcessHeap () returned 0x630000 [0074.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657440 [0074.514] GetProcessHeap () returned 0x630000 [0074.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.514] GetProcessHeap () returned 0x630000 [0074.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0074.514] GetProcessHeap () returned 0x630000 [0074.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e8e0 [0074.514] GetProcessHeap () returned 0x630000 [0074.514] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.514] GetProcessHeap () returned 0x630000 [0074.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0074.514] GetProcessHeap () returned 0x630000 [0074.514] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0074.514] GetProcessHeap () returned 0x630000 [0074.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.514] GetProcessHeap () returned 0x630000 [0074.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65d060 [0074.514] GetProcessHeap () returned 0x630000 [0074.514] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.514] GetProcessHeap () returned 0x630000 [0074.514] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.515] GetProcessHeap () returned 0x630000 [0074.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.515] GetProcessHeap () returned 0x630000 [0074.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.515] GetProcessHeap () returned 0x630000 [0074.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e220 [0074.515] GetProcessHeap () returned 0x630000 [0074.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65d060 | out: hHeap=0x630000) returned 1 [0074.515] GetProcessHeap () returned 0x630000 [0074.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0074.515] GetProcessHeap () returned 0x630000 [0074.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0074.515] GetProcessHeap () returned 0x630000 [0074.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.515] GetProcessHeap () returned 0x630000 [0074.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.515] GetProcessHeap () returned 0x630000 [0074.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.515] GetProcessHeap () returned 0x630000 [0074.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.515] GetProcessHeap () returned 0x630000 [0074.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.515] GetProcessHeap () returned 0x630000 [0074.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.515] GetProcessHeap () returned 0x630000 [0074.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.515] GetProcessHeap () returned 0x630000 [0074.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.515] GetProcessHeap () returned 0x630000 [0074.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.515] GetProcessHeap () returned 0x630000 [0074.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.515] GetProcessHeap () returned 0x630000 [0074.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.515] GetProcessHeap () returned 0x630000 [0074.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.515] GetProcessHeap () returned 0x630000 [0074.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.515] GetProcessHeap () returned 0x630000 [0074.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.516] GetProcessHeap () returned 0x630000 [0074.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.516] GetProcessHeap () returned 0x630000 [0074.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.516] GetProcessHeap () returned 0x630000 [0074.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.516] GetProcessHeap () returned 0x630000 [0074.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.516] GetProcessHeap () returned 0x630000 [0074.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.516] GetProcessHeap () returned 0x630000 [0074.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.516] GetProcessHeap () returned 0x630000 [0074.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.516] GetProcessHeap () returned 0x630000 [0074.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.516] GetProcessHeap () returned 0x630000 [0074.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.516] GetProcessHeap () returned 0x630000 [0074.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.516] GetProcessHeap () returned 0x630000 [0074.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.516] GetProcessHeap () returned 0x630000 [0074.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.516] GetProcessHeap () returned 0x630000 [0074.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.516] GetProcessHeap () returned 0x630000 [0074.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.516] GetProcessHeap () returned 0x630000 [0074.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.516] GetProcessHeap () returned 0x630000 [0074.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.516] GetProcessHeap () returned 0x630000 [0074.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.516] GetProcessHeap () returned 0x630000 [0074.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.516] GetProcessHeap () returned 0x630000 [0074.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.516] GetProcessHeap () returned 0x630000 [0074.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.517] GetProcessHeap () returned 0x630000 [0074.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.517] GetProcessHeap () returned 0x630000 [0074.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.517] GetProcessHeap () returned 0x630000 [0074.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.517] GetProcessHeap () returned 0x630000 [0074.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.517] GetProcessHeap () returned 0x630000 [0074.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.517] GetProcessHeap () returned 0x630000 [0074.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.517] GetProcessHeap () returned 0x630000 [0074.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.517] GetProcessHeap () returned 0x630000 [0074.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.517] GetProcessHeap () returned 0x630000 [0074.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.517] GetProcessHeap () returned 0x630000 [0074.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.517] GetProcessHeap () returned 0x630000 [0074.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.517] GetProcessHeap () returned 0x630000 [0074.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.517] GetProcessHeap () returned 0x630000 [0074.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.517] GetProcessHeap () returned 0x630000 [0074.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.517] GetProcessHeap () returned 0x630000 [0074.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.517] GetProcessHeap () returned 0x630000 [0074.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.517] GetProcessHeap () returned 0x630000 [0074.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.517] GetProcessHeap () returned 0x630000 [0074.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.517] GetProcessHeap () returned 0x630000 [0074.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.518] GetProcessHeap () returned 0x630000 [0074.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.518] GetProcessHeap () returned 0x630000 [0074.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.518] GetProcessHeap () returned 0x630000 [0074.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.518] GetProcessHeap () returned 0x630000 [0074.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.518] GetProcessHeap () returned 0x630000 [0074.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.518] GetProcessHeap () returned 0x630000 [0074.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.518] GetProcessHeap () returned 0x630000 [0074.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.518] GetProcessHeap () returned 0x630000 [0074.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.518] GetProcessHeap () returned 0x630000 [0074.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.518] GetProcessHeap () returned 0x630000 [0074.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.518] GetProcessHeap () returned 0x630000 [0074.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.518] GetProcessHeap () returned 0x630000 [0074.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.518] GetProcessHeap () returned 0x630000 [0074.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.518] GetProcessHeap () returned 0x630000 [0074.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.518] GetProcessHeap () returned 0x630000 [0074.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.519] GetProcessHeap () returned 0x630000 [0074.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.519] GetProcessHeap () returned 0x630000 [0074.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.519] GetProcessHeap () returned 0x630000 [0074.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.519] GetProcessHeap () returned 0x630000 [0074.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.519] GetProcessHeap () returned 0x630000 [0074.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.519] GetProcessHeap () returned 0x630000 [0074.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.519] GetProcessHeap () returned 0x630000 [0074.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.519] GetProcessHeap () returned 0x630000 [0074.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.519] GetProcessHeap () returned 0x630000 [0074.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.519] GetProcessHeap () returned 0x630000 [0074.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.519] GetProcessHeap () returned 0x630000 [0074.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.519] GetProcessHeap () returned 0x630000 [0074.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.519] GetProcessHeap () returned 0x630000 [0074.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.519] GetProcessHeap () returned 0x630000 [0074.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.519] GetProcessHeap () returned 0x630000 [0074.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0074.519] GetProcessHeap () returned 0x630000 [0074.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0074.520] GetProcessHeap () returned 0x630000 [0074.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0074.520] GetProcessHeap () returned 0x630000 [0074.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0074.520] GetProcessHeap () returned 0x630000 [0074.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0074.520] GetProcessHeap () returned 0x630000 [0074.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0074.520] GetProcessHeap () returned 0x630000 [0074.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0074.520] GetProcessHeap () returned 0x630000 [0074.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e6a0 | out: hHeap=0x630000) returned 1 [0074.520] GetProcessHeap () returned 0x630000 [0074.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0074.520] GetProcessHeap () returned 0x630000 [0074.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.520] GetProcessHeap () returned 0x630000 [0074.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0074.520] WriteFile (in: hFile=0x230, lpBuffer=0x672210*, nNumberOfBytesToWrite=0x386, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672210*, lpNumberOfBytesWritten=0x243d864*=0x386, lpOverlapped=0x0) returned 1 [0074.523] GetProcessHeap () returned 0x630000 [0074.523] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x672210, Size=0x30) returned 0x672210 [0074.523] GetProcessHeap () returned 0x630000 [0074.523] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0074.523] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.523] GetProcessHeap () returned 0x630000 [0074.523] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x120) returned 0x63f408 [0074.523] ReadFile (in: hFile=0x230, lpBuffer=0x63f408, nNumberOfBytesToRead=0x120, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x63f408*, lpNumberOfBytesRead=0x243d7e8*=0x120, lpOverlapped=0x0) returned 1 [0074.523] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.523] WriteFile (in: hFile=0x230, lpBuffer=0x63f408*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x63f408*, lpNumberOfBytesWritten=0x243d7e4*=0x120, lpOverlapped=0x0) returned 1 [0074.524] GetProcessHeap () returned 0x630000 [0074.524] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63f408 | out: hHeap=0x630000) returned 1 [0074.524] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.524] WriteFile (in: hFile=0x230, lpBuffer=0x672210*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672210*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0074.525] CloseHandle (hObject=0x230) returned 1 [0074.525] GetProcessHeap () returned 0x630000 [0074.526] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0074.526] GetProcessHeap () returned 0x630000 [0074.526] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6556e8 | out: hHeap=0x630000) returned 1 [0074.526] GetProcessHeap () returned 0x630000 [0074.526] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0074.526] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\desktop.ini") returned="C:\\Users\\FD1HVy\\Desktop\\desktop.ini" [0074.526] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\desktop.ini", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\desktop.ini.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\desktop.ini.happythreechoose" [0074.526] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\desktop.ini.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\desktop.ini.happythreechoose"), dwFlags=0x1) returned 1 [0074.526] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0074.526] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned="" [0074.526] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" [0074.526] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\decryption info.html")) returned 0x20 [0074.526] GetProcessHeap () returned 0x630000 [0074.526] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0074.526] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab06bdf0, ftCreationTime.dwHighDateTime=0x1d5ce7c, ftLastAccessTime.dwLowDateTime=0x4bd77b50, ftLastAccessTime.dwHighDateTime=0x1d5d66d, ftLastWriteTime.dwLowDateTime=0x4bd77b50, ftLastWriteTime.dwHighDateTime=0x1d5d66d, nFileSizeHigh=0x0, nFileSizeLow=0x37e9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Dl3riytf.png", cAlternateFileName="")) returned 1 [0074.527] lstrcmpiW (lpString1="Dl3riytf.png", lpString2=".") returned 1 [0074.527] lstrcmpiW (lpString1="Dl3riytf.png", lpString2="..") returned 1 [0074.527] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="Dl3riytf.png" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Dl3riytf.png") returned="C:\\Users\\FD1HVy\\Desktop\\Dl3riytf.png" [0074.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Dl3riytf.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0074.527] GetProcessHeap () returned 0x630000 [0074.527] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd) returned 0x64c9f0 [0074.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Dl3riytf.png", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dl3riytf.png", lpUsedDefaultChar=0x0) returned 13 [0074.527] lstrlenA (lpString="Dl3riytf.png") returned 12 [0074.527] lstrlenA (lpString=".happythreechoose") returned 17 [0074.527] lstrcmpiW (lpString1="Dl3riytf.png", lpString2="Decryption INFO.html") returned 1 [0074.527] lstrcmpiW (lpString1="Dl3riytf.png", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0074.527] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0074.527] lstrcmpiW (lpString1="Dl3riytf.png", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0074.527] GetProcessHeap () returned 0x630000 [0074.527] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0074.527] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Dl3riytf.png" (normalized: "c:\\users\\fd1hvy\\desktop\\dl3riytf.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0074.527] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=14313) returned 1 [0074.527] GetProcessHeap () returned 0x630000 [0074.527] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655a30 [0074.527] GetProcessHeap () returned 0x630000 [0074.527] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.527] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\Dl3riytf.png") returned 36 [0074.527] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.528] GetProcessHeap () returned 0x630000 [0074.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0074.528] GetProcessHeap () returned 0x630000 [0074.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x672248 [0074.528] lstrlenA (lpString="rsa_encrypt") returned 11 [0074.528] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0074.528] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0074.528] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0074.528] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0074.529] GetProcessHeap () returned 0x630000 [0074.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0074.529] lstrlenA (lpString="010001") returned 6 [0074.529] GetProcessHeap () returned 0x630000 [0074.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2a8 [0074.529] GetProcessHeap () returned 0x630000 [0074.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.529] GetProcessHeap () returned 0x630000 [0074.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65df50 [0074.529] GetProcessHeap () returned 0x630000 [0074.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.529] GetProcessHeap () returned 0x630000 [0074.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0074.529] GetProcessHeap () returned 0x630000 [0074.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657440 [0074.529] GetProcessHeap () returned 0x630000 [0074.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2f8 [0074.529] GetProcessHeap () returned 0x630000 [0074.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0074.529] GetProcessHeap () returned 0x630000 [0074.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.530] GetProcessHeap () returned 0x630000 [0074.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0074.530] GetProcessHeap () returned 0x630000 [0074.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.530] GetProcessHeap () returned 0x630000 [0074.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656a68 [0074.530] GetProcessHeap () returned 0x630000 [0074.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.530] GetProcessHeap () returned 0x630000 [0074.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0074.530] GetProcessHeap () returned 0x630000 [0074.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e970 [0074.530] GetProcessHeap () returned 0x630000 [0074.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.530] GetProcessHeap () returned 0x630000 [0074.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0074.530] GetProcessHeap () returned 0x630000 [0074.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0074.530] GetProcessHeap () returned 0x630000 [0074.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.530] GetProcessHeap () returned 0x630000 [0074.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65ce80 [0074.530] GetProcessHeap () returned 0x630000 [0074.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.530] GetProcessHeap () returned 0x630000 [0074.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.530] GetProcessHeap () returned 0x630000 [0074.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.530] GetProcessHeap () returned 0x630000 [0074.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.530] GetProcessHeap () returned 0x630000 [0074.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65dda0 [0074.530] GetProcessHeap () returned 0x630000 [0074.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ce80 | out: hHeap=0x630000) returned 1 [0074.531] GetProcessHeap () returned 0x630000 [0074.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0074.531] GetProcessHeap () returned 0x630000 [0074.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0074.531] GetProcessHeap () returned 0x630000 [0074.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.531] GetProcessHeap () returned 0x630000 [0074.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.531] GetProcessHeap () returned 0x630000 [0074.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.531] GetProcessHeap () returned 0x630000 [0074.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.531] GetProcessHeap () returned 0x630000 [0074.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.531] GetProcessHeap () returned 0x630000 [0074.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.531] GetProcessHeap () returned 0x630000 [0074.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.531] GetProcessHeap () returned 0x630000 [0074.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.531] GetProcessHeap () returned 0x630000 [0074.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.531] GetProcessHeap () returned 0x630000 [0074.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.531] GetProcessHeap () returned 0x630000 [0074.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.531] GetProcessHeap () returned 0x630000 [0074.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.531] GetProcessHeap () returned 0x630000 [0074.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.531] GetProcessHeap () returned 0x630000 [0074.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.532] GetProcessHeap () returned 0x630000 [0074.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.532] GetProcessHeap () returned 0x630000 [0074.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.532] GetProcessHeap () returned 0x630000 [0074.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.532] GetProcessHeap () returned 0x630000 [0074.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.532] GetProcessHeap () returned 0x630000 [0074.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.532] GetProcessHeap () returned 0x630000 [0074.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.532] GetProcessHeap () returned 0x630000 [0074.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.532] GetProcessHeap () returned 0x630000 [0074.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.532] GetProcessHeap () returned 0x630000 [0074.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.532] GetProcessHeap () returned 0x630000 [0074.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.532] GetProcessHeap () returned 0x630000 [0074.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.532] GetProcessHeap () returned 0x630000 [0074.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.532] GetProcessHeap () returned 0x630000 [0074.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0074.532] GetProcessHeap () returned 0x630000 [0074.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0074.532] GetProcessHeap () returned 0x630000 [0074.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.533] GetProcessHeap () returned 0x630000 [0074.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.533] GetProcessHeap () returned 0x630000 [0074.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.533] GetProcessHeap () returned 0x630000 [0074.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.533] GetProcessHeap () returned 0x630000 [0074.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.533] GetProcessHeap () returned 0x630000 [0074.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.533] GetProcessHeap () returned 0x630000 [0074.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.533] GetProcessHeap () returned 0x630000 [0074.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.533] GetProcessHeap () returned 0x630000 [0074.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.533] GetProcessHeap () returned 0x630000 [0074.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.533] GetProcessHeap () returned 0x630000 [0074.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.533] GetProcessHeap () returned 0x630000 [0074.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.533] GetProcessHeap () returned 0x630000 [0074.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.533] GetProcessHeap () returned 0x630000 [0074.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.533] GetProcessHeap () returned 0x630000 [0074.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.533] GetProcessHeap () returned 0x630000 [0074.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.533] GetProcessHeap () returned 0x630000 [0074.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.533] GetProcessHeap () returned 0x630000 [0074.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.533] GetProcessHeap () returned 0x630000 [0074.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.534] GetProcessHeap () returned 0x630000 [0074.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.534] GetProcessHeap () returned 0x630000 [0074.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.534] GetProcessHeap () returned 0x630000 [0074.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.534] GetProcessHeap () returned 0x630000 [0074.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.534] GetProcessHeap () returned 0x630000 [0074.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.534] GetProcessHeap () returned 0x630000 [0074.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.534] GetProcessHeap () returned 0x630000 [0074.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.534] GetProcessHeap () returned 0x630000 [0074.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.534] GetProcessHeap () returned 0x630000 [0074.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.534] GetProcessHeap () returned 0x630000 [0074.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.534] GetProcessHeap () returned 0x630000 [0074.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.534] GetProcessHeap () returned 0x630000 [0074.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.534] GetProcessHeap () returned 0x630000 [0074.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.534] GetProcessHeap () returned 0x630000 [0074.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.534] GetProcessHeap () returned 0x630000 [0074.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.534] GetProcessHeap () returned 0x630000 [0074.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.534] GetProcessHeap () returned 0x630000 [0074.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.534] GetProcessHeap () returned 0x630000 [0074.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.534] GetProcessHeap () returned 0x630000 [0074.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.534] GetProcessHeap () returned 0x630000 [0074.535] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.535] GetProcessHeap () returned 0x630000 [0074.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.535] GetProcessHeap () returned 0x630000 [0074.535] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.535] GetProcessHeap () returned 0x630000 [0074.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.535] GetProcessHeap () returned 0x630000 [0074.535] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.535] GetProcessHeap () returned 0x630000 [0074.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.535] GetProcessHeap () returned 0x630000 [0074.535] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.535] GetProcessHeap () returned 0x630000 [0074.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.535] GetProcessHeap () returned 0x630000 [0074.535] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.535] GetProcessHeap () returned 0x630000 [0074.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.535] GetProcessHeap () returned 0x630000 [0074.535] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.535] GetProcessHeap () returned 0x630000 [0074.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.535] GetProcessHeap () returned 0x630000 [0074.535] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.535] GetProcessHeap () returned 0x630000 [0074.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.535] GetProcessHeap () returned 0x630000 [0074.535] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.535] GetProcessHeap () returned 0x630000 [0074.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.535] GetProcessHeap () returned 0x630000 [0074.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0074.535] GetProcessHeap () returned 0x630000 [0074.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0074.535] GetProcessHeap () returned 0x630000 [0074.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0074.535] GetProcessHeap () returned 0x630000 [0074.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0074.536] GetProcessHeap () returned 0x630000 [0074.536] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0074.536] GetProcessHeap () returned 0x630000 [0074.536] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0074.536] GetProcessHeap () returned 0x630000 [0074.536] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0074.536] GetProcessHeap () returned 0x630000 [0074.536] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0074.536] GetProcessHeap () returned 0x630000 [0074.536] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0074.536] GetProcessHeap () returned 0x630000 [0074.536] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.536] GetProcessHeap () returned 0x630000 [0074.536] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0074.536] WriteFile (in: hFile=0x230, lpBuffer=0x672248*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672248*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0074.537] GetProcessHeap () returned 0x630000 [0074.537] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x672248, Size=0x30) returned 0x672248 [0074.538] GetProcessHeap () returned 0x630000 [0074.538] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0074.538] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.538] GetProcessHeap () returned 0x630000 [0074.538] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x37e9) returned 0x672280 [0074.538] ReadFile (in: hFile=0x230, lpBuffer=0x672280, nNumberOfBytesToRead=0x37e9, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x672280*, lpNumberOfBytesRead=0x243d7e8*=0x37e9, lpOverlapped=0x0) returned 1 [0074.538] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.538] WriteFile (in: hFile=0x230, lpBuffer=0x672280*, nNumberOfBytesToWrite=0x37e9, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x672280*, lpNumberOfBytesWritten=0x243d7e4*=0x37e9, lpOverlapped=0x0) returned 1 [0074.539] GetProcessHeap () returned 0x630000 [0074.539] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672280 | out: hHeap=0x630000) returned 1 [0074.539] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.539] WriteFile (in: hFile=0x230, lpBuffer=0x672248*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672248*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0074.540] CloseHandle (hObject=0x230) returned 1 [0074.540] GetProcessHeap () returned 0x630000 [0074.540] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0074.540] GetProcessHeap () returned 0x630000 [0074.541] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655a30 | out: hHeap=0x630000) returned 1 [0074.541] GetProcessHeap () returned 0x630000 [0074.541] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0074.541] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\Dl3riytf.png" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Dl3riytf.png") returned="C:\\Users\\FD1HVy\\Desktop\\Dl3riytf.png" [0074.541] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\Dl3riytf.png", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Dl3riytf.png.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\Dl3riytf.png.happythreechoose" [0074.541] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\Dl3riytf.png" (normalized: "c:\\users\\fd1hvy\\desktop\\dl3riytf.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\Dl3riytf.png.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\dl3riytf.png.happythreechoose"), dwFlags=0x1) returned 1 [0074.541] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\Dl3riytf.png" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0074.541] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned="" [0074.541] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" [0074.541] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\decryption info.html")) returned 0x20 [0074.541] GetProcessHeap () returned 0x630000 [0074.541] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0074.541] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b6e3680, ftCreationTime.dwHighDateTime=0x1d5dbe3, ftLastAccessTime.dwLowDateTime=0x2c06cd00, ftLastAccessTime.dwHighDateTime=0x1d5dbe3, ftLastWriteTime.dwLowDateTime=0x29a47300, ftLastWriteTime.dwHighDateTime=0x1d5dbe3, nFileSizeHigh=0x0, nFileSizeLow=0xd600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HAPPYTHREE.EXE.exe", cAlternateFileName="HAPPYT~1.EXE")) returned 1 [0074.541] lstrcmpiW (lpString1="HAPPYTHREE.EXE.exe", lpString2=".") returned 1 [0074.541] lstrcmpiW (lpString1="HAPPYTHREE.EXE.exe", lpString2="..") returned 1 [0074.541] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="HAPPYTHREE.EXE.exe" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe" [0074.542] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HAPPYTHREE.EXE.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0074.542] GetProcessHeap () returned 0x630000 [0074.542] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x13) returned 0x645c58 [0074.542] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HAPPYTHREE.EXE.exe", cchWideChar=-1, lpMultiByteStr=0x645c58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HAPPYTHREE.EXE.exe", lpUsedDefaultChar=0x0) returned 19 [0074.542] lstrlenA (lpString="HAPPYTHREE.EXE.exe") returned 18 [0074.542] lstrlenA (lpString=".happythreechoose") returned 17 [0074.542] lstrlenA (lpString=".happythreechoose") returned 17 [0074.542] lstrlenA (lpString="HAPPYTHREE.EXE.exe") returned 18 [0074.542] lstrcmpiA (lpString1="APPYTHREE.EXE.exe", lpString2=".happythreechoose") returned 1 [0074.542] lstrcmpiW (lpString1="HAPPYTHREE.EXE.exe", lpString2="Decryption INFO.html") returned 1 [0074.542] lstrcmpiW (lpString1="HAPPYTHREE.EXE.exe", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0074.542] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0074.542] lstrcmpiW (lpString1="HAPPYTHREE.EXE.exe", lpString2="HAPPYTHREE.EXE.exe") returned 0 [0074.542] GetProcessHeap () returned 0x630000 [0074.542] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645c58 | out: hHeap=0x630000) returned 1 [0074.542] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c1cbef0, ftCreationTime.dwHighDateTime=0x1d5ce75, ftLastAccessTime.dwLowDateTime=0x145f7420, ftLastAccessTime.dwHighDateTime=0x1d5ce16, ftLastWriteTime.dwLowDateTime=0x145f7420, ftLastWriteTime.dwHighDateTime=0x1d5ce16, nFileSizeHigh=0x0, nFileSizeLow=0xd03e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Kg2Vl3-TxW0c7U.pdf", cAlternateFileName="KG2VL3~1.PDF")) returned 1 [0074.542] lstrcmpiW (lpString1="Kg2Vl3-TxW0c7U.pdf", lpString2=".") returned 1 [0074.542] lstrcmpiW (lpString1="Kg2Vl3-TxW0c7U.pdf", lpString2="..") returned 1 [0074.542] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="Kg2Vl3-TxW0c7U.pdf" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Kg2Vl3-TxW0c7U.pdf") returned="C:\\Users\\FD1HVy\\Desktop\\Kg2Vl3-TxW0c7U.pdf" [0074.542] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Kg2Vl3-TxW0c7U.pdf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0074.542] GetProcessHeap () returned 0x630000 [0074.542] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x13) returned 0x645ef8 [0074.542] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Kg2Vl3-TxW0c7U.pdf", cchWideChar=-1, lpMultiByteStr=0x645ef8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Kg2Vl3-TxW0c7U.pdf", lpUsedDefaultChar=0x0) returned 19 [0074.542] lstrlenA (lpString="Kg2Vl3-TxW0c7U.pdf") returned 18 [0074.542] lstrlenA (lpString=".happythreechoose") returned 17 [0074.542] lstrlenA (lpString=".happythreechoose") returned 17 [0074.542] lstrlenA (lpString="Kg2Vl3-TxW0c7U.pdf") returned 18 [0074.542] lstrcmpiA (lpString1="g2Vl3-TxW0c7U.pdf", lpString2=".happythreechoose") returned 1 [0074.542] lstrcmpiW (lpString1="Kg2Vl3-TxW0c7U.pdf", lpString2="Decryption INFO.html") returned 1 [0074.542] lstrcmpiW (lpString1="Kg2Vl3-TxW0c7U.pdf", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0074.542] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0074.542] lstrcmpiW (lpString1="Kg2Vl3-TxW0c7U.pdf", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0074.542] GetProcessHeap () returned 0x630000 [0074.542] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0074.542] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Kg2Vl3-TxW0c7U.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\kg2vl3-txw0c7u.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0074.543] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=53310) returned 1 [0074.543] GetProcessHeap () returned 0x630000 [0074.543] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655418 [0074.543] GetProcessHeap () returned 0x630000 [0074.543] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.543] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\Kg2Vl3-TxW0c7U.pdf") returned 42 [0074.543] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.543] GetProcessHeap () returned 0x630000 [0074.543] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0074.543] GetProcessHeap () returned 0x630000 [0074.543] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x382) returned 0x672280 [0074.543] lstrlenA (lpString="rsa_encrypt") returned 11 [0074.543] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0074.543] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0074.543] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0074.543] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0074.544] GetProcessHeap () returned 0x630000 [0074.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0074.544] lstrlenA (lpString="010001") returned 6 [0074.544] GetProcessHeap () returned 0x630000 [0074.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0074.544] GetProcessHeap () returned 0x630000 [0074.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.544] GetProcessHeap () returned 0x630000 [0074.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e2b0 [0074.544] GetProcessHeap () returned 0x630000 [0074.544] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.544] GetProcessHeap () returned 0x630000 [0074.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dec0 [0074.544] GetProcessHeap () returned 0x630000 [0074.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656db0 [0074.544] GetProcessHeap () returned 0x630000 [0074.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a348 [0074.544] GetProcessHeap () returned 0x630000 [0074.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0074.544] GetProcessHeap () returned 0x630000 [0074.544] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0074.544] GetProcessHeap () returned 0x630000 [0074.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0074.544] GetProcessHeap () returned 0x630000 [0074.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.544] GetProcessHeap () returned 0x630000 [0074.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656b80 [0074.544] GetProcessHeap () returned 0x630000 [0074.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.544] GetProcessHeap () returned 0x630000 [0074.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0074.544] GetProcessHeap () returned 0x630000 [0074.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e7c0 [0074.544] GetProcessHeap () returned 0x630000 [0074.544] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.544] GetProcessHeap () returned 0x630000 [0074.545] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0074.545] GetProcessHeap () returned 0x630000 [0074.545] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e7c0 | out: hHeap=0x630000) returned 1 [0074.545] GetProcessHeap () returned 0x630000 [0074.545] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.545] GetProcessHeap () returned 0x630000 [0074.545] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0074.545] GetProcessHeap () returned 0x630000 [0074.545] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.545] GetProcessHeap () returned 0x630000 [0074.545] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.545] GetProcessHeap () returned 0x630000 [0074.545] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.545] GetProcessHeap () returned 0x630000 [0074.545] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.545] GetProcessHeap () returned 0x630000 [0074.545] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e4f0 [0074.545] GetProcessHeap () returned 0x630000 [0074.545] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0074.545] GetProcessHeap () returned 0x630000 [0074.545] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0074.545] GetProcessHeap () returned 0x630000 [0074.545] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0074.545] GetProcessHeap () returned 0x630000 [0074.545] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.545] GetProcessHeap () returned 0x630000 [0074.545] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.545] GetProcessHeap () returned 0x630000 [0074.545] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.545] GetProcessHeap () returned 0x630000 [0074.545] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.545] GetProcessHeap () returned 0x630000 [0074.545] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.545] GetProcessHeap () returned 0x630000 [0074.545] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.545] GetProcessHeap () returned 0x630000 [0074.545] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.545] GetProcessHeap () returned 0x630000 [0074.545] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.545] GetProcessHeap () returned 0x630000 [0074.545] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.545] GetProcessHeap () returned 0x630000 [0074.546] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.546] GetProcessHeap () returned 0x630000 [0074.546] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.546] GetProcessHeap () returned 0x630000 [0074.546] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.546] GetProcessHeap () returned 0x630000 [0074.546] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.546] GetProcessHeap () returned 0x630000 [0074.546] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.546] GetProcessHeap () returned 0x630000 [0074.546] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.546] GetProcessHeap () returned 0x630000 [0074.546] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.546] GetProcessHeap () returned 0x630000 [0074.546] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.546] GetProcessHeap () returned 0x630000 [0074.546] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.546] GetProcessHeap () returned 0x630000 [0074.546] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.546] GetProcessHeap () returned 0x630000 [0074.546] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.546] GetProcessHeap () returned 0x630000 [0074.546] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.546] GetProcessHeap () returned 0x630000 [0074.546] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.546] GetProcessHeap () returned 0x630000 [0074.546] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.546] GetProcessHeap () returned 0x630000 [0074.546] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.546] GetProcessHeap () returned 0x630000 [0074.546] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.546] GetProcessHeap () returned 0x630000 [0074.546] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.546] GetProcessHeap () returned 0x630000 [0074.546] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.546] GetProcessHeap () returned 0x630000 [0074.546] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.546] GetProcessHeap () returned 0x630000 [0074.546] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.546] GetProcessHeap () returned 0x630000 [0074.547] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.547] GetProcessHeap () returned 0x630000 [0074.547] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.547] GetProcessHeap () returned 0x630000 [0074.547] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.547] GetProcessHeap () returned 0x630000 [0074.547] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.547] GetProcessHeap () returned 0x630000 [0074.547] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.547] GetProcessHeap () returned 0x630000 [0074.547] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.547] GetProcessHeap () returned 0x630000 [0074.547] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.547] GetProcessHeap () returned 0x630000 [0074.547] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.547] GetProcessHeap () returned 0x630000 [0074.547] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.547] GetProcessHeap () returned 0x630000 [0074.547] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.547] GetProcessHeap () returned 0x630000 [0074.547] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.547] GetProcessHeap () returned 0x630000 [0074.547] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.547] GetProcessHeap () returned 0x630000 [0074.547] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.547] GetProcessHeap () returned 0x630000 [0074.547] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.547] GetProcessHeap () returned 0x630000 [0074.547] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.547] GetProcessHeap () returned 0x630000 [0074.547] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.547] GetProcessHeap () returned 0x630000 [0074.547] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.547] GetProcessHeap () returned 0x630000 [0074.547] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.547] GetProcessHeap () returned 0x630000 [0074.547] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.547] GetProcessHeap () returned 0x630000 [0074.547] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.547] GetProcessHeap () returned 0x630000 [0074.547] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.548] GetProcessHeap () returned 0x630000 [0074.548] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.548] GetProcessHeap () returned 0x630000 [0074.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.548] GetProcessHeap () returned 0x630000 [0074.548] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.548] GetProcessHeap () returned 0x630000 [0074.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.548] GetProcessHeap () returned 0x630000 [0074.548] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.548] GetProcessHeap () returned 0x630000 [0074.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.548] GetProcessHeap () returned 0x630000 [0074.548] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.548] GetProcessHeap () returned 0x630000 [0074.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.548] GetProcessHeap () returned 0x630000 [0074.548] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.548] GetProcessHeap () returned 0x630000 [0074.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.548] GetProcessHeap () returned 0x630000 [0074.548] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.548] GetProcessHeap () returned 0x630000 [0074.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.548] GetProcessHeap () returned 0x630000 [0074.548] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.548] GetProcessHeap () returned 0x630000 [0074.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.548] GetProcessHeap () returned 0x630000 [0074.548] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.548] GetProcessHeap () returned 0x630000 [0074.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.548] GetProcessHeap () returned 0x630000 [0074.548] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.548] GetProcessHeap () returned 0x630000 [0074.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.548] GetProcessHeap () returned 0x630000 [0074.548] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.548] GetProcessHeap () returned 0x630000 [0074.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.548] GetProcessHeap () returned 0x630000 [0074.549] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.549] GetProcessHeap () returned 0x630000 [0074.549] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.549] GetProcessHeap () returned 0x630000 [0074.549] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.549] GetProcessHeap () returned 0x630000 [0074.549] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.549] GetProcessHeap () returned 0x630000 [0074.549] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.549] GetProcessHeap () returned 0x630000 [0074.549] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.549] GetProcessHeap () returned 0x630000 [0074.549] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.549] GetProcessHeap () returned 0x630000 [0074.549] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.549] GetProcessHeap () returned 0x630000 [0074.549] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.549] GetProcessHeap () returned 0x630000 [0074.549] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.549] GetProcessHeap () returned 0x630000 [0074.549] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.549] GetProcessHeap () returned 0x630000 [0074.549] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.549] GetProcessHeap () returned 0x630000 [0074.549] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0074.549] GetProcessHeap () returned 0x630000 [0074.549] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0074.549] GetProcessHeap () returned 0x630000 [0074.549] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0074.549] GetProcessHeap () returned 0x630000 [0074.549] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0074.549] GetProcessHeap () returned 0x630000 [0074.549] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0074.549] GetProcessHeap () returned 0x630000 [0074.549] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0074.549] GetProcessHeap () returned 0x630000 [0074.549] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0074.549] GetProcessHeap () returned 0x630000 [0074.549] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e2b0 | out: hHeap=0x630000) returned 1 [0074.550] GetProcessHeap () returned 0x630000 [0074.550] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0074.550] GetProcessHeap () returned 0x630000 [0074.550] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.550] GetProcessHeap () returned 0x630000 [0074.550] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0074.550] WriteFile (in: hFile=0x230, lpBuffer=0x672280*, nNumberOfBytesToWrite=0x382, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672280*, lpNumberOfBytesWritten=0x243d864*=0x382, lpOverlapped=0x0) returned 1 [0074.551] GetProcessHeap () returned 0x630000 [0074.551] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x672280, Size=0x30) returned 0x672280 [0074.552] GetProcessHeap () returned 0x630000 [0074.552] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0074.552] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.552] GetProcessHeap () returned 0x630000 [0074.552] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd040) returned 0x6722b8 [0074.552] ReadFile (in: hFile=0x230, lpBuffer=0x6722b8, nNumberOfBytesToRead=0xd040, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x6722b8*, lpNumberOfBytesRead=0x243d7e8*=0xd040, lpOverlapped=0x0) returned 1 [0074.553] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.553] WriteFile (in: hFile=0x230, lpBuffer=0x6722b8*, nNumberOfBytesToWrite=0xd040, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x6722b8*, lpNumberOfBytesWritten=0x243d7e4*=0xd040, lpOverlapped=0x0) returned 1 [0074.555] GetProcessHeap () returned 0x630000 [0074.555] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6722b8 | out: hHeap=0x630000) returned 1 [0074.555] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.555] WriteFile (in: hFile=0x230, lpBuffer=0x672280*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672280*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0074.556] CloseHandle (hObject=0x230) returned 1 [0074.556] GetProcessHeap () returned 0x630000 [0074.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0074.556] GetProcessHeap () returned 0x630000 [0074.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655418 | out: hHeap=0x630000) returned 1 [0074.556] GetProcessHeap () returned 0x630000 [0074.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0074.556] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\Kg2Vl3-TxW0c7U.pdf" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Kg2Vl3-TxW0c7U.pdf") returned="C:\\Users\\FD1HVy\\Desktop\\Kg2Vl3-TxW0c7U.pdf" [0074.556] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\Kg2Vl3-TxW0c7U.pdf", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Kg2Vl3-TxW0c7U.pdf.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\Kg2Vl3-TxW0c7U.pdf.happythreechoose" [0074.556] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\Kg2Vl3-TxW0c7U.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\kg2vl3-txw0c7u.pdf"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\Kg2Vl3-TxW0c7U.pdf.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\kg2vl3-txw0c7u.pdf.happythreechoose"), dwFlags=0x1) returned 1 [0074.557] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\Kg2Vl3-TxW0c7U.pdf" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0074.557] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned="" [0074.557] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" [0074.557] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\decryption info.html")) returned 0x20 [0074.557] GetProcessHeap () returned 0x630000 [0074.557] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645ef8 | out: hHeap=0x630000) returned 1 [0074.557] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0219140, ftCreationTime.dwHighDateTime=0x1d5cae5, ftLastAccessTime.dwLowDateTime=0x25a8d4d0, ftLastAccessTime.dwHighDateTime=0x1d5cf81, ftLastWriteTime.dwLowDateTime=0x25a8d4d0, ftLastWriteTime.dwHighDateTime=0x1d5cf81, nFileSizeHigh=0x0, nFileSizeLow=0x1854d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="kzAx5kq5 2V7_iY.wav", cAlternateFileName="KZAX5K~1.WAV")) returned 1 [0074.557] lstrcmpiW (lpString1="kzAx5kq5 2V7_iY.wav", lpString2=".") returned 1 [0074.557] lstrcmpiW (lpString1="kzAx5kq5 2V7_iY.wav", lpString2="..") returned 1 [0074.557] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="kzAx5kq5 2V7_iY.wav" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\kzAx5kq5 2V7_iY.wav") returned="C:\\Users\\FD1HVy\\Desktop\\kzAx5kq5 2V7_iY.wav" [0074.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kzAx5kq5 2V7_iY.wav", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0074.557] GetProcessHeap () returned 0x630000 [0074.557] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x645fd8 [0074.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kzAx5kq5 2V7_iY.wav", cchWideChar=-1, lpMultiByteStr=0x645fd8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kzAx5kq5 2V7_iY.wav", lpUsedDefaultChar=0x0) returned 20 [0074.557] lstrlenA (lpString="kzAx5kq5 2V7_iY.wav") returned 19 [0074.557] lstrlenA (lpString=".happythreechoose") returned 17 [0074.557] lstrlenA (lpString=".happythreechoose") returned 17 [0074.558] lstrlenA (lpString="kzAx5kq5 2V7_iY.wav") returned 19 [0074.558] lstrcmpiA (lpString1="Ax5kq5 2V7_iY.wav", lpString2=".happythreechoose") returned 1 [0074.558] lstrcmpiW (lpString1="kzAx5kq5 2V7_iY.wav", lpString2="Decryption INFO.html") returned 1 [0074.558] lstrcmpiW (lpString1="kzAx5kq5 2V7_iY.wav", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0074.558] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0074.558] lstrcmpiW (lpString1="kzAx5kq5 2V7_iY.wav", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0074.558] GetProcessHeap () returned 0x630000 [0074.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0074.558] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\kzAx5kq5 2V7_iY.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\kzax5kq5 2v7_iy.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0074.558] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=99661) returned 1 [0074.558] GetProcessHeap () returned 0x630000 [0074.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655940 [0074.558] GetProcessHeap () returned 0x630000 [0074.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.558] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\kzAx5kq5 2V7_iY.wav") returned 43 [0074.558] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.558] GetProcessHeap () returned 0x630000 [0074.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0074.558] GetProcessHeap () returned 0x630000 [0074.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x383) returned 0x6722b8 [0074.558] lstrlenA (lpString="rsa_encrypt") returned 11 [0074.558] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0074.559] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0074.559] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0074.559] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0074.559] GetProcessHeap () returned 0x630000 [0074.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0074.559] lstrlenA (lpString="010001") returned 6 [0074.559] GetProcessHeap () returned 0x630000 [0074.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2f8 [0074.559] GetProcessHeap () returned 0x630000 [0074.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.559] GetProcessHeap () returned 0x630000 [0074.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e3d0 [0074.559] GetProcessHeap () returned 0x630000 [0074.559] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.559] GetProcessHeap () returned 0x630000 [0074.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e6a0 [0074.559] GetProcessHeap () returned 0x630000 [0074.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656950 [0074.559] GetProcessHeap () returned 0x630000 [0074.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0074.559] GetProcessHeap () returned 0x630000 [0074.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0074.559] GetProcessHeap () returned 0x630000 [0074.559] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.559] GetProcessHeap () returned 0x630000 [0074.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0074.559] GetProcessHeap () returned 0x630000 [0074.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.559] GetProcessHeap () returned 0x630000 [0074.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656ec8 [0074.560] GetProcessHeap () returned 0x630000 [0074.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.560] GetProcessHeap () returned 0x630000 [0074.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0074.560] GetProcessHeap () returned 0x630000 [0074.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0074.560] GetProcessHeap () returned 0x630000 [0074.560] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.612] GetProcessHeap () returned 0x630000 [0074.613] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0074.613] GetProcessHeap () returned 0x630000 [0074.613] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0074.613] GetProcessHeap () returned 0x630000 [0074.613] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.613] GetProcessHeap () returned 0x630000 [0074.613] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0074.613] GetProcessHeap () returned 0x630000 [0074.613] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.613] GetProcessHeap () returned 0x630000 [0074.613] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.613] GetProcessHeap () returned 0x630000 [0074.613] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.613] GetProcessHeap () returned 0x630000 [0074.613] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.613] GetProcessHeap () returned 0x630000 [0074.613] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e190 [0074.613] GetProcessHeap () returned 0x630000 [0074.613] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0074.613] GetProcessHeap () returned 0x630000 [0074.613] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0074.613] GetProcessHeap () returned 0x630000 [0074.613] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0074.613] GetProcessHeap () returned 0x630000 [0074.613] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.613] GetProcessHeap () returned 0x630000 [0074.613] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.613] GetProcessHeap () returned 0x630000 [0074.613] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.613] GetProcessHeap () returned 0x630000 [0074.613] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.613] GetProcessHeap () returned 0x630000 [0074.613] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.613] GetProcessHeap () returned 0x630000 [0074.613] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.613] GetProcessHeap () returned 0x630000 [0074.613] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.613] GetProcessHeap () returned 0x630000 [0074.613] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.613] GetProcessHeap () returned 0x630000 [0074.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.614] GetProcessHeap () returned 0x630000 [0074.614] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.614] GetProcessHeap () returned 0x630000 [0074.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.614] GetProcessHeap () returned 0x630000 [0074.614] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.614] GetProcessHeap () returned 0x630000 [0074.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.614] GetProcessHeap () returned 0x630000 [0074.614] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.614] GetProcessHeap () returned 0x630000 [0074.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.614] GetProcessHeap () returned 0x630000 [0074.614] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.614] GetProcessHeap () returned 0x630000 [0074.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.614] GetProcessHeap () returned 0x630000 [0074.614] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.614] GetProcessHeap () returned 0x630000 [0074.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.614] GetProcessHeap () returned 0x630000 [0074.614] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.614] GetProcessHeap () returned 0x630000 [0074.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.614] GetProcessHeap () returned 0x630000 [0074.614] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.614] GetProcessHeap () returned 0x630000 [0074.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.614] GetProcessHeap () returned 0x630000 [0074.614] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.614] GetProcessHeap () returned 0x630000 [0074.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.614] GetProcessHeap () returned 0x630000 [0074.614] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.614] GetProcessHeap () returned 0x630000 [0074.614] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.614] GetProcessHeap () returned 0x630000 [0074.614] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.614] GetProcessHeap () returned 0x630000 [0074.615] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.615] GetProcessHeap () returned 0x630000 [0074.615] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.615] GetProcessHeap () returned 0x630000 [0074.615] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.615] GetProcessHeap () returned 0x630000 [0074.615] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.615] GetProcessHeap () returned 0x630000 [0074.615] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.615] GetProcessHeap () returned 0x630000 [0074.615] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.615] GetProcessHeap () returned 0x630000 [0074.615] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.615] GetProcessHeap () returned 0x630000 [0074.615] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.615] GetProcessHeap () returned 0x630000 [0074.615] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.615] GetProcessHeap () returned 0x630000 [0074.615] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.615] GetProcessHeap () returned 0x630000 [0074.615] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.615] GetProcessHeap () returned 0x630000 [0074.615] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.615] GetProcessHeap () returned 0x630000 [0074.615] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.615] GetProcessHeap () returned 0x630000 [0074.615] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.615] GetProcessHeap () returned 0x630000 [0074.615] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.615] GetProcessHeap () returned 0x630000 [0074.615] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.615] GetProcessHeap () returned 0x630000 [0074.615] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.615] GetProcessHeap () returned 0x630000 [0074.615] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.615] GetProcessHeap () returned 0x630000 [0074.615] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.615] GetProcessHeap () returned 0x630000 [0074.615] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.615] GetProcessHeap () returned 0x630000 [0074.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.616] GetProcessHeap () returned 0x630000 [0074.616] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.616] GetProcessHeap () returned 0x630000 [0074.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.616] GetProcessHeap () returned 0x630000 [0074.616] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.616] GetProcessHeap () returned 0x630000 [0074.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.616] GetProcessHeap () returned 0x630000 [0074.616] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.616] GetProcessHeap () returned 0x630000 [0074.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.616] GetProcessHeap () returned 0x630000 [0074.616] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.616] GetProcessHeap () returned 0x630000 [0074.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.616] GetProcessHeap () returned 0x630000 [0074.616] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.616] GetProcessHeap () returned 0x630000 [0074.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.616] GetProcessHeap () returned 0x630000 [0074.616] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.616] GetProcessHeap () returned 0x630000 [0074.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.616] GetProcessHeap () returned 0x630000 [0074.616] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.616] GetProcessHeap () returned 0x630000 [0074.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.616] GetProcessHeap () returned 0x630000 [0074.616] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.616] GetProcessHeap () returned 0x630000 [0074.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.616] GetProcessHeap () returned 0x630000 [0074.616] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.616] GetProcessHeap () returned 0x630000 [0074.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.616] GetProcessHeap () returned 0x630000 [0074.616] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.616] GetProcessHeap () returned 0x630000 [0074.616] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.617] GetProcessHeap () returned 0x630000 [0074.617] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.617] GetProcessHeap () returned 0x630000 [0074.617] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.617] GetProcessHeap () returned 0x630000 [0074.617] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.617] GetProcessHeap () returned 0x630000 [0074.617] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.617] GetProcessHeap () returned 0x630000 [0074.617] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.617] GetProcessHeap () returned 0x630000 [0074.617] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.617] GetProcessHeap () returned 0x630000 [0074.617] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.617] GetProcessHeap () returned 0x630000 [0074.617] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.617] GetProcessHeap () returned 0x630000 [0074.617] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.617] GetProcessHeap () returned 0x630000 [0074.617] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.617] GetProcessHeap () returned 0x630000 [0074.617] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.617] GetProcessHeap () returned 0x630000 [0074.617] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.617] GetProcessHeap () returned 0x630000 [0074.617] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.617] GetProcessHeap () returned 0x630000 [0074.617] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0074.617] GetProcessHeap () returned 0x630000 [0074.617] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0074.617] GetProcessHeap () returned 0x630000 [0074.617] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0074.617] GetProcessHeap () returned 0x630000 [0074.617] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0074.617] GetProcessHeap () returned 0x630000 [0074.617] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0074.617] GetProcessHeap () returned 0x630000 [0074.617] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e6a0 | out: hHeap=0x630000) returned 1 [0074.617] GetProcessHeap () returned 0x630000 [0074.618] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0074.618] GetProcessHeap () returned 0x630000 [0074.618] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0074.618] GetProcessHeap () returned 0x630000 [0074.618] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0074.618] GetProcessHeap () returned 0x630000 [0074.618] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.618] GetProcessHeap () returned 0x630000 [0074.618] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0074.618] WriteFile (in: hFile=0x230, lpBuffer=0x6722b8*, nNumberOfBytesToWrite=0x383, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6722b8*, lpNumberOfBytesWritten=0x243d864*=0x383, lpOverlapped=0x0) returned 1 [0074.620] GetProcessHeap () returned 0x630000 [0074.620] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6722b8, Size=0x30) returned 0x6722b8 [0074.620] GetProcessHeap () returned 0x630000 [0074.620] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0074.620] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.620] GetProcessHeap () returned 0x630000 [0074.620] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18550) returned 0x6722f0 [0074.621] ReadFile (in: hFile=0x230, lpBuffer=0x6722f0, nNumberOfBytesToRead=0x18550, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x6722f0*, lpNumberOfBytesRead=0x243d7e8*=0x18550, lpOverlapped=0x0) returned 1 [0074.622] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.622] WriteFile (in: hFile=0x230, lpBuffer=0x6722f0*, nNumberOfBytesToWrite=0x18550, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x6722f0*, lpNumberOfBytesWritten=0x243d7e4*=0x18550, lpOverlapped=0x0) returned 1 [0074.624] GetProcessHeap () returned 0x630000 [0074.624] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6722f0 | out: hHeap=0x630000) returned 1 [0074.624] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.624] WriteFile (in: hFile=0x230, lpBuffer=0x6722b8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6722b8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0074.625] CloseHandle (hObject=0x230) returned 1 [0074.628] GetProcessHeap () returned 0x630000 [0074.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0074.628] GetProcessHeap () returned 0x630000 [0074.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655940 | out: hHeap=0x630000) returned 1 [0074.628] GetProcessHeap () returned 0x630000 [0074.628] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0074.628] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\kzAx5kq5 2V7_iY.wav" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\kzAx5kq5 2V7_iY.wav") returned="C:\\Users\\FD1HVy\\Desktop\\kzAx5kq5 2V7_iY.wav" [0074.628] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\kzAx5kq5 2V7_iY.wav", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\kzAx5kq5 2V7_iY.wav.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\kzAx5kq5 2V7_iY.wav.happythreechoose" [0074.628] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\kzAx5kq5 2V7_iY.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\kzax5kq5 2v7_iy.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\kzAx5kq5 2V7_iY.wav.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\kzax5kq5 2v7_iy.wav.happythreechoose"), dwFlags=0x1) returned 1 [0074.629] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\kzAx5kq5 2V7_iY.wav" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0074.629] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned="" [0074.629] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" [0074.629] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\decryption info.html")) returned 0x20 [0074.629] GetProcessHeap () returned 0x630000 [0074.629] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645fd8 | out: hHeap=0x630000) returned 1 [0074.629] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18092800, ftCreationTime.dwHighDateTime=0x1d5cd62, ftLastAccessTime.dwLowDateTime=0xe1518170, ftLastAccessTime.dwHighDateTime=0x1d5cf0c, ftLastWriteTime.dwLowDateTime=0xe1518170, ftLastWriteTime.dwHighDateTime=0x1d5cf0c, nFileSizeHigh=0x0, nFileSizeLow=0x15ad7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LEptSgwFTE2dAPD.swf", cAlternateFileName="LEPTSG~1.SWF")) returned 1 [0074.629] lstrcmpiW (lpString1="LEptSgwFTE2dAPD.swf", lpString2=".") returned 1 [0074.629] lstrcmpiW (lpString1="LEptSgwFTE2dAPD.swf", lpString2="..") returned 1 [0074.629] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="LEptSgwFTE2dAPD.swf" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\LEptSgwFTE2dAPD.swf") returned="C:\\Users\\FD1HVy\\Desktop\\LEptSgwFTE2dAPD.swf" [0074.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LEptSgwFTE2dAPD.swf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0074.629] GetProcessHeap () returned 0x630000 [0074.629] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x645f78 [0074.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LEptSgwFTE2dAPD.swf", cchWideChar=-1, lpMultiByteStr=0x645f78, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LEptSgwFTE2dAPD.swf", lpUsedDefaultChar=0x0) returned 20 [0074.629] lstrlenA (lpString="LEptSgwFTE2dAPD.swf") returned 19 [0074.629] lstrlenA (lpString=".happythreechoose") returned 17 [0074.629] lstrlenA (lpString=".happythreechoose") returned 17 [0074.629] lstrlenA (lpString="LEptSgwFTE2dAPD.swf") returned 19 [0074.629] lstrcmpiA (lpString1="ptSgwFTE2dAPD.swf", lpString2=".happythreechoose") returned 1 [0074.629] lstrcmpiW (lpString1="LEptSgwFTE2dAPD.swf", lpString2="Decryption INFO.html") returned 1 [0074.629] lstrcmpiW (lpString1="LEptSgwFTE2dAPD.swf", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0074.629] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0074.629] lstrcmpiW (lpString1="LEptSgwFTE2dAPD.swf", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0074.629] GetProcessHeap () returned 0x630000 [0074.629] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0074.630] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\LEptSgwFTE2dAPD.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\leptsgwfte2dapd.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0074.630] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=88791) returned 1 [0074.630] GetProcessHeap () returned 0x630000 [0074.630] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6557d8 [0074.630] GetProcessHeap () returned 0x630000 [0074.630] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.630] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\LEptSgwFTE2dAPD.swf") returned 43 [0074.630] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.630] GetProcessHeap () returned 0x630000 [0074.630] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0074.630] GetProcessHeap () returned 0x630000 [0074.630] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x389) returned 0x6722f0 [0074.630] lstrlenA (lpString="rsa_encrypt") returned 11 [0074.630] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0074.631] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0074.631] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0074.631] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0074.631] GetProcessHeap () returned 0x630000 [0074.631] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0074.631] lstrlenA (lpString="010001") returned 6 [0074.631] GetProcessHeap () returned 0x630000 [0074.631] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2f8 [0074.631] GetProcessHeap () returned 0x630000 [0074.631] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.631] GetProcessHeap () returned 0x630000 [0074.631] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e190 [0074.631] GetProcessHeap () returned 0x630000 [0074.631] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.631] GetProcessHeap () returned 0x630000 [0074.631] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e850 [0074.631] GetProcessHeap () returned 0x630000 [0074.631] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656fe0 [0074.631] GetProcessHeap () returned 0x630000 [0074.631] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0074.631] GetProcessHeap () returned 0x630000 [0074.631] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0074.631] GetProcessHeap () returned 0x630000 [0074.631] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.632] GetProcessHeap () returned 0x630000 [0074.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0074.632] GetProcessHeap () returned 0x630000 [0074.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.632] GetProcessHeap () returned 0x630000 [0074.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656c98 [0074.632] GetProcessHeap () returned 0x630000 [0074.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.632] GetProcessHeap () returned 0x630000 [0074.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0074.632] GetProcessHeap () returned 0x630000 [0074.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e8e0 [0074.632] GetProcessHeap () returned 0x630000 [0074.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.632] GetProcessHeap () returned 0x630000 [0074.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0074.632] GetProcessHeap () returned 0x630000 [0074.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0074.632] GetProcessHeap () returned 0x630000 [0074.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.632] GetProcessHeap () returned 0x630000 [0074.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0074.632] GetProcessHeap () returned 0x630000 [0074.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.632] GetProcessHeap () returned 0x630000 [0074.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.632] GetProcessHeap () returned 0x630000 [0074.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.632] GetProcessHeap () returned 0x630000 [0074.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.632] GetProcessHeap () returned 0x630000 [0074.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e220 [0074.632] GetProcessHeap () returned 0x630000 [0074.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0074.632] GetProcessHeap () returned 0x630000 [0074.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0074.632] GetProcessHeap () returned 0x630000 [0074.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0074.632] GetProcessHeap () returned 0x630000 [0074.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.632] GetProcessHeap () returned 0x630000 [0074.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.633] GetProcessHeap () returned 0x630000 [0074.633] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.633] GetProcessHeap () returned 0x630000 [0074.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.633] GetProcessHeap () returned 0x630000 [0074.633] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.633] GetProcessHeap () returned 0x630000 [0074.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.633] GetProcessHeap () returned 0x630000 [0074.633] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.633] GetProcessHeap () returned 0x630000 [0074.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.633] GetProcessHeap () returned 0x630000 [0074.633] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.633] GetProcessHeap () returned 0x630000 [0074.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.633] GetProcessHeap () returned 0x630000 [0074.633] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.633] GetProcessHeap () returned 0x630000 [0074.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.633] GetProcessHeap () returned 0x630000 [0074.633] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.633] GetProcessHeap () returned 0x630000 [0074.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.633] GetProcessHeap () returned 0x630000 [0074.633] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.633] GetProcessHeap () returned 0x630000 [0074.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.633] GetProcessHeap () returned 0x630000 [0074.633] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.633] GetProcessHeap () returned 0x630000 [0074.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.633] GetProcessHeap () returned 0x630000 [0074.633] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.633] GetProcessHeap () returned 0x630000 [0074.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.633] GetProcessHeap () returned 0x630000 [0074.633] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.633] GetProcessHeap () returned 0x630000 [0074.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.634] GetProcessHeap () returned 0x630000 [0074.634] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.634] GetProcessHeap () returned 0x630000 [0074.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.634] GetProcessHeap () returned 0x630000 [0074.634] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0074.634] GetProcessHeap () returned 0x630000 [0074.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0074.634] GetProcessHeap () returned 0x630000 [0074.634] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.634] GetProcessHeap () returned 0x630000 [0074.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.634] GetProcessHeap () returned 0x630000 [0074.634] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.634] GetProcessHeap () returned 0x630000 [0074.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.634] GetProcessHeap () returned 0x630000 [0074.634] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.634] GetProcessHeap () returned 0x630000 [0074.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.634] GetProcessHeap () returned 0x630000 [0074.634] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.634] GetProcessHeap () returned 0x630000 [0074.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.634] GetProcessHeap () returned 0x630000 [0074.634] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.634] GetProcessHeap () returned 0x630000 [0074.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.634] GetProcessHeap () returned 0x630000 [0074.634] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.634] GetProcessHeap () returned 0x630000 [0074.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.634] GetProcessHeap () returned 0x630000 [0074.634] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.634] GetProcessHeap () returned 0x630000 [0074.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.635] GetProcessHeap () returned 0x630000 [0074.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.635] GetProcessHeap () returned 0x630000 [0074.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.635] GetProcessHeap () returned 0x630000 [0074.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.635] GetProcessHeap () returned 0x630000 [0074.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.635] GetProcessHeap () returned 0x630000 [0074.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.635] GetProcessHeap () returned 0x630000 [0074.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.635] GetProcessHeap () returned 0x630000 [0074.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.635] GetProcessHeap () returned 0x630000 [0074.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.635] GetProcessHeap () returned 0x630000 [0074.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.635] GetProcessHeap () returned 0x630000 [0074.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.635] GetProcessHeap () returned 0x630000 [0074.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.635] GetProcessHeap () returned 0x630000 [0074.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.635] GetProcessHeap () returned 0x630000 [0074.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.635] GetProcessHeap () returned 0x630000 [0074.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.635] GetProcessHeap () returned 0x630000 [0074.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.635] GetProcessHeap () returned 0x630000 [0074.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.635] GetProcessHeap () returned 0x630000 [0074.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.635] GetProcessHeap () returned 0x630000 [0074.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.635] GetProcessHeap () returned 0x630000 [0074.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.636] GetProcessHeap () returned 0x630000 [0074.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.636] GetProcessHeap () returned 0x630000 [0074.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.636] GetProcessHeap () returned 0x630000 [0074.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.636] GetProcessHeap () returned 0x630000 [0074.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.636] GetProcessHeap () returned 0x630000 [0074.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.636] GetProcessHeap () returned 0x630000 [0074.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.636] GetProcessHeap () returned 0x630000 [0074.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.636] GetProcessHeap () returned 0x630000 [0074.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.636] GetProcessHeap () returned 0x630000 [0074.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.636] GetProcessHeap () returned 0x630000 [0074.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.636] GetProcessHeap () returned 0x630000 [0074.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.636] GetProcessHeap () returned 0x630000 [0074.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.636] GetProcessHeap () returned 0x630000 [0074.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.636] GetProcessHeap () returned 0x630000 [0074.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.636] GetProcessHeap () returned 0x630000 [0074.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.636] GetProcessHeap () returned 0x630000 [0074.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.636] GetProcessHeap () returned 0x630000 [0074.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.636] GetProcessHeap () returned 0x630000 [0074.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.636] GetProcessHeap () returned 0x630000 [0074.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.637] GetProcessHeap () returned 0x630000 [0074.637] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.637] GetProcessHeap () returned 0x630000 [0074.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.637] GetProcessHeap () returned 0x630000 [0074.637] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.637] GetProcessHeap () returned 0x630000 [0074.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.637] GetProcessHeap () returned 0x630000 [0074.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0074.637] GetProcessHeap () returned 0x630000 [0074.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0074.637] GetProcessHeap () returned 0x630000 [0074.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0074.637] GetProcessHeap () returned 0x630000 [0074.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0074.637] GetProcessHeap () returned 0x630000 [0074.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0074.637] GetProcessHeap () returned 0x630000 [0074.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0074.637] GetProcessHeap () returned 0x630000 [0074.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0074.637] GetProcessHeap () returned 0x630000 [0074.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0074.637] GetProcessHeap () returned 0x630000 [0074.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0074.637] GetProcessHeap () returned 0x630000 [0074.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.637] GetProcessHeap () returned 0x630000 [0074.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0074.637] WriteFile (in: hFile=0x230, lpBuffer=0x6722f0*, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6722f0*, lpNumberOfBytesWritten=0x243d864*=0x389, lpOverlapped=0x0) returned 1 [0074.649] GetProcessHeap () returned 0x630000 [0074.649] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6722f0, Size=0x30) returned 0x6722f0 [0074.649] GetProcessHeap () returned 0x630000 [0074.649] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0074.649] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.649] GetProcessHeap () returned 0x630000 [0074.649] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x15ae0) returned 0x672328 [0074.649] ReadFile (in: hFile=0x230, lpBuffer=0x672328, nNumberOfBytesToRead=0x15ae0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x672328*, lpNumberOfBytesRead=0x243d7e8*=0x15ae0, lpOverlapped=0x0) returned 1 [0074.650] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.650] WriteFile (in: hFile=0x230, lpBuffer=0x672328*, nNumberOfBytesToWrite=0x15ae0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x672328*, lpNumberOfBytesWritten=0x243d7e4*=0x15ae0, lpOverlapped=0x0) returned 1 [0074.652] GetProcessHeap () returned 0x630000 [0074.652] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672328 | out: hHeap=0x630000) returned 1 [0074.653] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.654] WriteFile (in: hFile=0x230, lpBuffer=0x6722f0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6722f0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0074.655] CloseHandle (hObject=0x230) returned 1 [0074.655] GetProcessHeap () returned 0x630000 [0074.655] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0074.655] GetProcessHeap () returned 0x630000 [0074.655] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6557d8 | out: hHeap=0x630000) returned 1 [0074.655] GetProcessHeap () returned 0x630000 [0074.655] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0074.655] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\LEptSgwFTE2dAPD.swf" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\LEptSgwFTE2dAPD.swf") returned="C:\\Users\\FD1HVy\\Desktop\\LEptSgwFTE2dAPD.swf" [0074.655] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\LEptSgwFTE2dAPD.swf", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\LEptSgwFTE2dAPD.swf.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\LEptSgwFTE2dAPD.swf.happythreechoose" [0074.655] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\LEptSgwFTE2dAPD.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\leptsgwfte2dapd.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\LEptSgwFTE2dAPD.swf.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\leptsgwfte2dapd.swf.happythreechoose"), dwFlags=0x1) returned 1 [0074.656] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\LEptSgwFTE2dAPD.swf" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0074.656] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned="" [0074.656] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" [0074.656] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\decryption info.html")) returned 0x20 [0074.656] GetProcessHeap () returned 0x630000 [0074.656] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645f78 | out: hHeap=0x630000) returned 1 [0074.656] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5645abf0, ftCreationTime.dwHighDateTime=0x1d5cf44, ftLastAccessTime.dwLowDateTime=0xfda6f220, ftLastAccessTime.dwHighDateTime=0x1d5cdbc, ftLastWriteTime.dwLowDateTime=0xfda6f220, ftLastWriteTime.dwHighDateTime=0x1d5cdbc, nFileSizeHigh=0x0, nFileSizeLow=0x4f2d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="M0U5JwRmVl52mhTh.avi", cAlternateFileName="M0U5JW~1.AVI")) returned 1 [0074.656] lstrcmpiW (lpString1="M0U5JwRmVl52mhTh.avi", lpString2=".") returned 1 [0074.656] lstrcmpiW (lpString1="M0U5JwRmVl52mhTh.avi", lpString2="..") returned 1 [0074.656] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="M0U5JwRmVl52mhTh.avi" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\M0U5JwRmVl52mhTh.avi") returned="C:\\Users\\FD1HVy\\Desktop\\M0U5JwRmVl52mhTh.avi" [0074.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="M0U5JwRmVl52mhTh.avi", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0074.656] GetProcessHeap () returned 0x630000 [0074.656] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x15) returned 0x645c78 [0074.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="M0U5JwRmVl52mhTh.avi", cchWideChar=-1, lpMultiByteStr=0x645c78, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M0U5JwRmVl52mhTh.avi", lpUsedDefaultChar=0x0) returned 21 [0074.656] lstrlenA (lpString="M0U5JwRmVl52mhTh.avi") returned 20 [0074.656] lstrlenA (lpString=".happythreechoose") returned 17 [0074.656] lstrlenA (lpString=".happythreechoose") returned 17 [0074.656] lstrlenA (lpString="M0U5JwRmVl52mhTh.avi") returned 20 [0074.656] lstrcmpiA (lpString1="5JwRmVl52mhTh.avi", lpString2=".happythreechoose") returned 1 [0074.656] lstrcmpiW (lpString1="M0U5JwRmVl52mhTh.avi", lpString2="Decryption INFO.html") returned 1 [0074.656] lstrcmpiW (lpString1="M0U5JwRmVl52mhTh.avi", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0074.656] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0074.656] lstrcmpiW (lpString1="M0U5JwRmVl52mhTh.avi", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0074.656] GetProcessHeap () returned 0x630000 [0074.656] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f10 [0074.657] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\M0U5JwRmVl52mhTh.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\m0u5jwrmvl52mhth.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0074.657] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=20269) returned 1 [0074.657] GetProcessHeap () returned 0x630000 [0074.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655418 [0074.657] GetProcessHeap () returned 0x630000 [0074.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.657] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\M0U5JwRmVl52mhTh.avi") returned 44 [0074.657] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.657] GetProcessHeap () returned 0x630000 [0074.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0074.657] GetProcessHeap () returned 0x630000 [0074.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x383) returned 0x672328 [0074.658] lstrlenA (lpString="rsa_encrypt") returned 11 [0074.658] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0074.658] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0074.658] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0074.658] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0074.659] GetProcessHeap () returned 0x630000 [0074.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0074.659] lstrlenA (lpString="010001") returned 6 [0074.659] GetProcessHeap () returned 0x630000 [0074.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0074.659] GetProcessHeap () returned 0x630000 [0074.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.659] GetProcessHeap () returned 0x630000 [0074.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea00 [0074.659] GetProcessHeap () returned 0x630000 [0074.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.659] GetProcessHeap () returned 0x630000 [0074.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e610 [0074.659] GetProcessHeap () returned 0x630000 [0074.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656b80 [0074.659] GetProcessHeap () returned 0x630000 [0074.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a318 [0074.659] GetProcessHeap () returned 0x630000 [0074.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0074.659] GetProcessHeap () returned 0x630000 [0074.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.659] GetProcessHeap () returned 0x630000 [0074.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0074.659] GetProcessHeap () returned 0x630000 [0074.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.659] GetProcessHeap () returned 0x630000 [0074.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656950 [0074.659] GetProcessHeap () returned 0x630000 [0074.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.659] GetProcessHeap () returned 0x630000 [0074.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0074.659] GetProcessHeap () returned 0x630000 [0074.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e970 [0074.659] GetProcessHeap () returned 0x630000 [0074.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.659] GetProcessHeap () returned 0x630000 [0074.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0074.659] GetProcessHeap () returned 0x630000 [0074.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0074.660] GetProcessHeap () returned 0x630000 [0074.660] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.660] GetProcessHeap () returned 0x630000 [0074.660] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0074.660] GetProcessHeap () returned 0x630000 [0074.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.660] GetProcessHeap () returned 0x630000 [0074.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.660] GetProcessHeap () returned 0x630000 [0074.660] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.660] GetProcessHeap () returned 0x630000 [0074.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.660] GetProcessHeap () returned 0x630000 [0074.660] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e100 [0074.660] GetProcessHeap () returned 0x630000 [0074.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0074.660] GetProcessHeap () returned 0x630000 [0074.660] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0074.660] GetProcessHeap () returned 0x630000 [0074.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0074.660] GetProcessHeap () returned 0x630000 [0074.660] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.660] GetProcessHeap () returned 0x630000 [0074.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.660] GetProcessHeap () returned 0x630000 [0074.660] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.660] GetProcessHeap () returned 0x630000 [0074.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.660] GetProcessHeap () returned 0x630000 [0074.660] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.660] GetProcessHeap () returned 0x630000 [0074.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.660] GetProcessHeap () returned 0x630000 [0074.660] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.660] GetProcessHeap () returned 0x630000 [0074.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.660] GetProcessHeap () returned 0x630000 [0074.660] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.660] GetProcessHeap () returned 0x630000 [0074.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.661] GetProcessHeap () returned 0x630000 [0074.661] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.661] GetProcessHeap () returned 0x630000 [0074.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.661] GetProcessHeap () returned 0x630000 [0074.661] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.661] GetProcessHeap () returned 0x630000 [0074.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.661] GetProcessHeap () returned 0x630000 [0074.661] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.661] GetProcessHeap () returned 0x630000 [0074.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.661] GetProcessHeap () returned 0x630000 [0074.661] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.661] GetProcessHeap () returned 0x630000 [0074.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.661] GetProcessHeap () returned 0x630000 [0074.661] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.661] GetProcessHeap () returned 0x630000 [0074.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.661] GetProcessHeap () returned 0x630000 [0074.661] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.661] GetProcessHeap () returned 0x630000 [0074.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.661] GetProcessHeap () returned 0x630000 [0074.661] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.661] GetProcessHeap () returned 0x630000 [0074.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.661] GetProcessHeap () returned 0x630000 [0074.661] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.661] GetProcessHeap () returned 0x630000 [0074.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.661] GetProcessHeap () returned 0x630000 [0074.661] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.661] GetProcessHeap () returned 0x630000 [0074.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.661] GetProcessHeap () returned 0x630000 [0074.661] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.661] GetProcessHeap () returned 0x630000 [0074.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.662] GetProcessHeap () returned 0x630000 [0074.662] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.662] GetProcessHeap () returned 0x630000 [0074.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.662] GetProcessHeap () returned 0x630000 [0074.662] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.662] GetProcessHeap () returned 0x630000 [0074.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.662] GetProcessHeap () returned 0x630000 [0074.662] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.662] GetProcessHeap () returned 0x630000 [0074.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.662] GetProcessHeap () returned 0x630000 [0074.662] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.662] GetProcessHeap () returned 0x630000 [0074.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.662] GetProcessHeap () returned 0x630000 [0074.662] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.662] GetProcessHeap () returned 0x630000 [0074.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.662] GetProcessHeap () returned 0x630000 [0074.662] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.662] GetProcessHeap () returned 0x630000 [0074.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.662] GetProcessHeap () returned 0x630000 [0074.662] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.662] GetProcessHeap () returned 0x630000 [0074.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.662] GetProcessHeap () returned 0x630000 [0074.662] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.662] GetProcessHeap () returned 0x630000 [0074.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.662] GetProcessHeap () returned 0x630000 [0074.662] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.662] GetProcessHeap () returned 0x630000 [0074.662] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.662] GetProcessHeap () returned 0x630000 [0074.662] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.662] GetProcessHeap () returned 0x630000 [0074.663] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.663] GetProcessHeap () returned 0x630000 [0074.663] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.663] GetProcessHeap () returned 0x630000 [0074.663] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.663] GetProcessHeap () returned 0x630000 [0074.663] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.663] GetProcessHeap () returned 0x630000 [0074.663] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.663] GetProcessHeap () returned 0x630000 [0074.663] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.663] GetProcessHeap () returned 0x630000 [0074.663] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.663] GetProcessHeap () returned 0x630000 [0074.663] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.663] GetProcessHeap () returned 0x630000 [0074.663] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.663] GetProcessHeap () returned 0x630000 [0074.663] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.663] GetProcessHeap () returned 0x630000 [0074.663] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.663] GetProcessHeap () returned 0x630000 [0074.663] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.663] GetProcessHeap () returned 0x630000 [0074.663] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.663] GetProcessHeap () returned 0x630000 [0074.663] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.663] GetProcessHeap () returned 0x630000 [0074.663] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.663] GetProcessHeap () returned 0x630000 [0074.663] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.663] GetProcessHeap () returned 0x630000 [0074.663] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.663] GetProcessHeap () returned 0x630000 [0074.663] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.663] GetProcessHeap () returned 0x630000 [0074.663] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.663] GetProcessHeap () returned 0x630000 [0074.663] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.664] GetProcessHeap () returned 0x630000 [0074.664] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.664] GetProcessHeap () returned 0x630000 [0074.664] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.664] GetProcessHeap () returned 0x630000 [0074.664] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.664] GetProcessHeap () returned 0x630000 [0074.664] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.664] GetProcessHeap () returned 0x630000 [0074.664] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.664] GetProcessHeap () returned 0x630000 [0074.664] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.664] GetProcessHeap () returned 0x630000 [0074.664] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.664] GetProcessHeap () returned 0x630000 [0074.664] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.664] GetProcessHeap () returned 0x630000 [0074.664] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.664] GetProcessHeap () returned 0x630000 [0074.664] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.664] GetProcessHeap () returned 0x630000 [0074.664] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.664] GetProcessHeap () returned 0x630000 [0074.664] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.664] GetProcessHeap () returned 0x630000 [0074.664] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.664] GetProcessHeap () returned 0x630000 [0074.664] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0074.664] GetProcessHeap () returned 0x630000 [0074.664] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0074.664] GetProcessHeap () returned 0x630000 [0074.664] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0074.664] GetProcessHeap () returned 0x630000 [0074.664] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0074.664] GetProcessHeap () returned 0x630000 [0074.664] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0074.664] GetProcessHeap () returned 0x630000 [0074.664] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0074.664] GetProcessHeap () returned 0x630000 [0074.665] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0074.665] GetProcessHeap () returned 0x630000 [0074.665] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0074.665] GetProcessHeap () returned 0x630000 [0074.665] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0074.665] GetProcessHeap () returned 0x630000 [0074.665] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.665] GetProcessHeap () returned 0x630000 [0074.665] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0074.665] WriteFile (in: hFile=0x230, lpBuffer=0x672328*, nNumberOfBytesToWrite=0x383, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672328*, lpNumberOfBytesWritten=0x243d864*=0x383, lpOverlapped=0x0) returned 1 [0074.667] GetProcessHeap () returned 0x630000 [0074.667] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x672328, Size=0x30) returned 0x672328 [0074.667] GetProcessHeap () returned 0x630000 [0074.667] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0074.667] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.668] GetProcessHeap () returned 0x630000 [0074.668] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4f30) returned 0x672360 [0074.668] ReadFile (in: hFile=0x230, lpBuffer=0x672360, nNumberOfBytesToRead=0x4f30, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x672360*, lpNumberOfBytesRead=0x243d7e8*=0x4f30, lpOverlapped=0x0) returned 1 [0074.668] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.668] WriteFile (in: hFile=0x230, lpBuffer=0x672360*, nNumberOfBytesToWrite=0x4f30, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x672360*, lpNumberOfBytesWritten=0x243d7e4*=0x4f30, lpOverlapped=0x0) returned 1 [0074.669] GetProcessHeap () returned 0x630000 [0074.669] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672360 | out: hHeap=0x630000) returned 1 [0074.670] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.670] WriteFile (in: hFile=0x230, lpBuffer=0x672328*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672328*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0074.671] CloseHandle (hObject=0x230) returned 1 [0074.672] GetProcessHeap () returned 0x630000 [0074.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f10 | out: hHeap=0x630000) returned 1 [0074.672] GetProcessHeap () returned 0x630000 [0074.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655418 | out: hHeap=0x630000) returned 1 [0074.672] GetProcessHeap () returned 0x630000 [0074.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0074.672] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\M0U5JwRmVl52mhTh.avi" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\M0U5JwRmVl52mhTh.avi") returned="C:\\Users\\FD1HVy\\Desktop\\M0U5JwRmVl52mhTh.avi" [0074.672] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\M0U5JwRmVl52mhTh.avi", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\M0U5JwRmVl52mhTh.avi.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\M0U5JwRmVl52mhTh.avi.happythreechoose" [0074.672] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\M0U5JwRmVl52mhTh.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\m0u5jwrmvl52mhth.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\M0U5JwRmVl52mhTh.avi.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\m0u5jwrmvl52mhth.avi.happythreechoose"), dwFlags=0x1) returned 1 [0074.673] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\M0U5JwRmVl52mhTh.avi" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0074.673] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned="" [0074.673] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" [0074.673] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\decryption info.html")) returned 0x20 [0074.673] GetProcessHeap () returned 0x630000 [0074.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645c78 | out: hHeap=0x630000) returned 1 [0074.673] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31d3dc0, ftCreationTime.dwHighDateTime=0x1d5ca4b, ftLastAccessTime.dwLowDateTime=0x3ac2b570, ftLastAccessTime.dwHighDateTime=0x1d5c89c, ftLastWriteTime.dwLowDateTime=0x3ac2b570, ftLastWriteTime.dwHighDateTime=0x1d5c89c, nFileSizeHigh=0x0, nFileSizeLow=0x7e0c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mc5ldNQWNxPv87 v-coo.m4a", cAlternateFileName="MC5LDN~1.M4A")) returned 1 [0074.673] lstrcmpiW (lpString1="mc5ldNQWNxPv87 v-coo.m4a", lpString2=".") returned 1 [0074.673] lstrcmpiW (lpString1="mc5ldNQWNxPv87 v-coo.m4a", lpString2="..") returned 1 [0074.673] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="mc5ldNQWNxPv87 v-coo.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\mc5ldNQWNxPv87 v-coo.m4a") returned="C:\\Users\\FD1HVy\\Desktop\\mc5ldNQWNxPv87 v-coo.m4a" [0074.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mc5ldNQWNxPv87 v-coo.m4a", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0074.673] GetProcessHeap () returned 0x630000 [0074.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x19) returned 0x651fd8 [0074.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mc5ldNQWNxPv87 v-coo.m4a", cchWideChar=-1, lpMultiByteStr=0x651fd8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mc5ldNQWNxPv87 v-coo.m4a", lpUsedDefaultChar=0x0) returned 25 [0074.673] lstrlenA (lpString="mc5ldNQWNxPv87 v-coo.m4a") returned 24 [0074.673] lstrlenA (lpString=".happythreechoose") returned 17 [0074.673] lstrlenA (lpString=".happythreechoose") returned 17 [0074.673] lstrlenA (lpString="mc5ldNQWNxPv87 v-coo.m4a") returned 24 [0074.673] lstrcmpiA (lpString1="WNxPv87 v-coo.m4a", lpString2=".happythreechoose") returned 1 [0074.673] lstrcmpiW (lpString1="mc5ldNQWNxPv87 v-coo.m4a", lpString2="Decryption INFO.html") returned 1 [0074.673] lstrcmpiW (lpString1="mc5ldNQWNxPv87 v-coo.m4a", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0074.673] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0074.673] lstrcmpiW (lpString1="mc5ldNQWNxPv87 v-coo.m4a", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0074.673] GetProcessHeap () returned 0x630000 [0074.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0074.673] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\mc5ldNQWNxPv87 v-coo.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\mc5ldnqwnxpv87 v-coo.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0074.674] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=32268) returned 1 [0074.674] GetProcessHeap () returned 0x630000 [0074.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655b20 [0074.674] GetProcessHeap () returned 0x630000 [0074.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.674] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\mc5ldNQWNxPv87 v-coo.m4a") returned 48 [0074.674] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.674] GetProcessHeap () returned 0x630000 [0074.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0074.674] GetProcessHeap () returned 0x630000 [0074.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x672360 [0074.675] lstrlenA (lpString="rsa_encrypt") returned 11 [0074.675] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0074.675] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0074.675] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0074.675] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0074.675] GetProcessHeap () returned 0x630000 [0074.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0074.676] lstrlenA (lpString="010001") returned 6 [0074.676] GetProcessHeap () returned 0x630000 [0074.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0074.676] GetProcessHeap () returned 0x630000 [0074.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.676] GetProcessHeap () returned 0x630000 [0074.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ecd0 [0074.676] GetProcessHeap () returned 0x630000 [0074.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.676] GetProcessHeap () returned 0x630000 [0074.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea00 [0074.676] GetProcessHeap () returned 0x630000 [0074.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656c98 [0074.676] GetProcessHeap () returned 0x630000 [0074.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a318 [0074.676] GetProcessHeap () returned 0x630000 [0074.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0074.676] GetProcessHeap () returned 0x630000 [0074.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.676] GetProcessHeap () returned 0x630000 [0074.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0074.676] GetProcessHeap () returned 0x630000 [0074.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.676] GetProcessHeap () returned 0x630000 [0074.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656db0 [0074.676] GetProcessHeap () returned 0x630000 [0074.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.676] GetProcessHeap () returned 0x630000 [0074.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0074.676] GetProcessHeap () returned 0x630000 [0074.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e340 [0074.676] GetProcessHeap () returned 0x630000 [0074.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.676] GetProcessHeap () returned 0x630000 [0074.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0074.676] GetProcessHeap () returned 0x630000 [0074.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0074.676] GetProcessHeap () returned 0x630000 [0074.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.676] GetProcessHeap () returned 0x630000 [0074.677] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0074.677] GetProcessHeap () returned 0x630000 [0074.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.677] GetProcessHeap () returned 0x630000 [0074.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.677] GetProcessHeap () returned 0x630000 [0074.677] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.677] GetProcessHeap () returned 0x630000 [0074.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.677] GetProcessHeap () returned 0x630000 [0074.677] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ec40 [0074.677] GetProcessHeap () returned 0x630000 [0074.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0074.677] GetProcessHeap () returned 0x630000 [0074.677] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0074.677] GetProcessHeap () returned 0x630000 [0074.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ec40 | out: hHeap=0x630000) returned 1 [0074.677] GetProcessHeap () returned 0x630000 [0074.677] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.677] GetProcessHeap () returned 0x630000 [0074.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.677] GetProcessHeap () returned 0x630000 [0074.677] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.677] GetProcessHeap () returned 0x630000 [0074.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.677] GetProcessHeap () returned 0x630000 [0074.677] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.677] GetProcessHeap () returned 0x630000 [0074.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.677] GetProcessHeap () returned 0x630000 [0074.677] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.677] GetProcessHeap () returned 0x630000 [0074.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.677] GetProcessHeap () returned 0x630000 [0074.677] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.677] GetProcessHeap () returned 0x630000 [0074.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.677] GetProcessHeap () returned 0x630000 [0074.677] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.677] GetProcessHeap () returned 0x630000 [0074.678] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.678] GetProcessHeap () returned 0x630000 [0074.678] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.678] GetProcessHeap () returned 0x630000 [0074.678] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.678] GetProcessHeap () returned 0x630000 [0074.678] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.678] GetProcessHeap () returned 0x630000 [0074.678] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.678] GetProcessHeap () returned 0x630000 [0074.678] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.678] GetProcessHeap () returned 0x630000 [0074.678] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.678] GetProcessHeap () returned 0x630000 [0074.678] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0074.678] GetProcessHeap () returned 0x630000 [0074.678] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0074.678] GetProcessHeap () returned 0x630000 [0074.678] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.678] GetProcessHeap () returned 0x630000 [0074.678] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.678] GetProcessHeap () returned 0x630000 [0074.678] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.678] GetProcessHeap () returned 0x630000 [0074.678] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.678] GetProcessHeap () returned 0x630000 [0074.678] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.678] GetProcessHeap () returned 0x630000 [0074.678] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.678] GetProcessHeap () returned 0x630000 [0074.678] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.678] GetProcessHeap () returned 0x630000 [0074.678] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.678] GetProcessHeap () returned 0x630000 [0074.678] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.678] GetProcessHeap () returned 0x630000 [0074.678] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.679] GetProcessHeap () returned 0x630000 [0074.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.679] GetProcessHeap () returned 0x630000 [0074.679] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.679] GetProcessHeap () returned 0x630000 [0074.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.679] GetProcessHeap () returned 0x630000 [0074.679] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.679] GetProcessHeap () returned 0x630000 [0074.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.679] GetProcessHeap () returned 0x630000 [0074.679] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.679] GetProcessHeap () returned 0x630000 [0074.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.679] GetProcessHeap () returned 0x630000 [0074.679] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.679] GetProcessHeap () returned 0x630000 [0074.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.679] GetProcessHeap () returned 0x630000 [0074.679] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.679] GetProcessHeap () returned 0x630000 [0074.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.679] GetProcessHeap () returned 0x630000 [0074.679] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.679] GetProcessHeap () returned 0x630000 [0074.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.679] GetProcessHeap () returned 0x630000 [0074.679] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.679] GetProcessHeap () returned 0x630000 [0074.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.679] GetProcessHeap () returned 0x630000 [0074.679] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.679] GetProcessHeap () returned 0x630000 [0074.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.679] GetProcessHeap () returned 0x630000 [0074.679] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.679] GetProcessHeap () returned 0x630000 [0074.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.679] GetProcessHeap () returned 0x630000 [0074.680] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.680] GetProcessHeap () returned 0x630000 [0074.680] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.680] GetProcessHeap () returned 0x630000 [0074.680] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.680] GetProcessHeap () returned 0x630000 [0074.680] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.680] GetProcessHeap () returned 0x630000 [0074.680] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.680] GetProcessHeap () returned 0x630000 [0074.680] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.680] GetProcessHeap () returned 0x630000 [0074.680] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.680] GetProcessHeap () returned 0x630000 [0074.680] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.680] GetProcessHeap () returned 0x630000 [0074.680] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.680] GetProcessHeap () returned 0x630000 [0074.680] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.680] GetProcessHeap () returned 0x630000 [0074.680] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.680] GetProcessHeap () returned 0x630000 [0074.680] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.680] GetProcessHeap () returned 0x630000 [0074.680] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.680] GetProcessHeap () returned 0x630000 [0074.680] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.680] GetProcessHeap () returned 0x630000 [0074.680] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.680] GetProcessHeap () returned 0x630000 [0074.680] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0074.680] GetProcessHeap () returned 0x630000 [0074.680] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0074.680] GetProcessHeap () returned 0x630000 [0074.680] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.680] GetProcessHeap () returned 0x630000 [0074.680] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.680] GetProcessHeap () returned 0x630000 [0074.680] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.680] GetProcessHeap () returned 0x630000 [0074.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.681] GetProcessHeap () returned 0x630000 [0074.681] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.681] GetProcessHeap () returned 0x630000 [0074.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.681] GetProcessHeap () returned 0x630000 [0074.681] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.681] GetProcessHeap () returned 0x630000 [0074.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.681] GetProcessHeap () returned 0x630000 [0074.681] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.681] GetProcessHeap () returned 0x630000 [0074.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.681] GetProcessHeap () returned 0x630000 [0074.681] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.681] GetProcessHeap () returned 0x630000 [0074.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.681] GetProcessHeap () returned 0x630000 [0074.681] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.681] GetProcessHeap () returned 0x630000 [0074.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.681] GetProcessHeap () returned 0x630000 [0074.681] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.681] GetProcessHeap () returned 0x630000 [0074.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.681] GetProcessHeap () returned 0x630000 [0074.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0074.681] GetProcessHeap () returned 0x630000 [0074.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0074.681] GetProcessHeap () returned 0x630000 [0074.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0074.681] GetProcessHeap () returned 0x630000 [0074.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0074.681] GetProcessHeap () returned 0x630000 [0074.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0074.681] GetProcessHeap () returned 0x630000 [0074.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0074.681] GetProcessHeap () returned 0x630000 [0074.681] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0074.682] GetProcessHeap () returned 0x630000 [0074.682] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ecd0 | out: hHeap=0x630000) returned 1 [0074.682] GetProcessHeap () returned 0x630000 [0074.682] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0074.682] GetProcessHeap () returned 0x630000 [0074.682] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.682] GetProcessHeap () returned 0x630000 [0074.682] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0074.682] WriteFile (in: hFile=0x230, lpBuffer=0x672360*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672360*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0074.733] GetProcessHeap () returned 0x630000 [0074.733] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x672360, Size=0x30) returned 0x672360 [0074.733] GetProcessHeap () returned 0x630000 [0074.733] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0074.733] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.733] GetProcessHeap () returned 0x630000 [0074.733] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7e0c) returned 0x672398 [0074.733] ReadFile (in: hFile=0x230, lpBuffer=0x672398, nNumberOfBytesToRead=0x7e0c, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x672398*, lpNumberOfBytesRead=0x243d7e8*=0x7e0c, lpOverlapped=0x0) returned 1 [0074.734] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.734] WriteFile (in: hFile=0x230, lpBuffer=0x672398*, nNumberOfBytesToWrite=0x7e0c, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x672398*, lpNumberOfBytesWritten=0x243d7e4*=0x7e0c, lpOverlapped=0x0) returned 1 [0074.735] GetProcessHeap () returned 0x630000 [0074.735] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672398 | out: hHeap=0x630000) returned 1 [0074.735] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.736] WriteFile (in: hFile=0x230, lpBuffer=0x672360*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672360*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0074.736] CloseHandle (hObject=0x230) returned 1 [0074.737] GetProcessHeap () returned 0x630000 [0074.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0074.737] GetProcessHeap () returned 0x630000 [0074.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655b20 | out: hHeap=0x630000) returned 1 [0074.737] GetProcessHeap () returned 0x630000 [0074.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0074.737] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\mc5ldNQWNxPv87 v-coo.m4a" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\mc5ldNQWNxPv87 v-coo.m4a") returned="C:\\Users\\FD1HVy\\Desktop\\mc5ldNQWNxPv87 v-coo.m4a" [0074.737] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\mc5ldNQWNxPv87 v-coo.m4a", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\mc5ldNQWNxPv87 v-coo.m4a.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\mc5ldNQWNxPv87 v-coo.m4a.happythreechoose" [0074.737] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\mc5ldNQWNxPv87 v-coo.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\mc5ldnqwnxpv87 v-coo.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\mc5ldNQWNxPv87 v-coo.m4a.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\mc5ldnqwnxpv87 v-coo.m4a.happythreechoose"), dwFlags=0x1) returned 1 [0074.738] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\mc5ldNQWNxPv87 v-coo.m4a" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0074.738] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned="" [0074.738] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" [0074.738] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\decryption info.html")) returned 0x20 [0074.738] GetProcessHeap () returned 0x630000 [0074.738] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0074.738] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe477fc0, ftCreationTime.dwHighDateTime=0x1d5d814, ftLastAccessTime.dwLowDateTime=0x6d23b6e0, ftLastAccessTime.dwHighDateTime=0x1d5d76a, ftLastWriteTime.dwLowDateTime=0x6d23b6e0, ftLastWriteTime.dwHighDateTime=0x1d5d76a, nFileSizeHigh=0x0, nFileSizeLow=0x3c31, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="moI9QUZ0kWfF_.mp3", cAlternateFileName="MOI9QU~1.MP3")) returned 1 [0074.738] lstrcmpiW (lpString1="moI9QUZ0kWfF_.mp3", lpString2=".") returned 1 [0074.738] lstrcmpiW (lpString1="moI9QUZ0kWfF_.mp3", lpString2="..") returned 1 [0074.738] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="moI9QUZ0kWfF_.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\moI9QUZ0kWfF_.mp3") returned="C:\\Users\\FD1HVy\\Desktop\\moI9QUZ0kWfF_.mp3" [0074.738] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="moI9QUZ0kWfF_.mp3", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0074.738] GetProcessHeap () returned 0x630000 [0074.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x645d38 [0074.738] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="moI9QUZ0kWfF_.mp3", cchWideChar=-1, lpMultiByteStr=0x645d38, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="moI9QUZ0kWfF_.mp3", lpUsedDefaultChar=0x0) returned 18 [0074.738] lstrlenA (lpString="moI9QUZ0kWfF_.mp3") returned 17 [0074.738] lstrlenA (lpString=".happythreechoose") returned 17 [0074.738] lstrlenA (lpString=".happythreechoose") returned 17 [0074.738] lstrlenA (lpString="moI9QUZ0kWfF_.mp3") returned 17 [0074.738] lstrcmpiA (lpString1="moI9QUZ0kWfF_.mp3", lpString2=".happythreechoose") returned 1 [0074.738] lstrcmpiW (lpString1="moI9QUZ0kWfF_.mp3", lpString2="Decryption INFO.html") returned 1 [0074.738] lstrcmpiW (lpString1="moI9QUZ0kWfF_.mp3", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0074.738] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0074.738] lstrcmpiW (lpString1="moI9QUZ0kWfF_.mp3", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0074.738] GetProcessHeap () returned 0x630000 [0074.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0074.739] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\moI9QUZ0kWfF_.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\moi9quz0kwff_.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0074.739] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=15409) returned 1 [0074.739] GetProcessHeap () returned 0x630000 [0074.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655760 [0074.739] GetProcessHeap () returned 0x630000 [0074.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.739] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\moI9QUZ0kWfF_.mp3") returned 41 [0074.739] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.739] GetProcessHeap () returned 0x630000 [0074.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0074.739] GetProcessHeap () returned 0x630000 [0074.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x672398 [0074.739] lstrlenA (lpString="rsa_encrypt") returned 11 [0074.739] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0074.740] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0074.740] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0074.740] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0074.740] GetProcessHeap () returned 0x630000 [0074.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0074.740] lstrlenA (lpString="010001") returned 6 [0074.740] GetProcessHeap () returned 0x630000 [0074.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0074.740] GetProcessHeap () returned 0x630000 [0074.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.740] GetProcessHeap () returned 0x630000 [0074.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65eb20 [0074.740] GetProcessHeap () returned 0x630000 [0074.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.740] GetProcessHeap () returned 0x630000 [0074.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ebb0 [0074.740] GetProcessHeap () returned 0x630000 [0074.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656ec8 [0074.740] GetProcessHeap () returned 0x630000 [0074.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2a8 [0074.740] GetProcessHeap () returned 0x630000 [0074.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0074.741] GetProcessHeap () returned 0x630000 [0074.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.741] GetProcessHeap () returned 0x630000 [0074.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0074.741] GetProcessHeap () returned 0x630000 [0074.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.741] GetProcessHeap () returned 0x630000 [0074.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657210 [0074.741] GetProcessHeap () returned 0x630000 [0074.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.741] GetProcessHeap () returned 0x630000 [0074.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0074.741] GetProcessHeap () returned 0x630000 [0074.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0074.741] GetProcessHeap () returned 0x630000 [0074.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.741] GetProcessHeap () returned 0x630000 [0074.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0074.741] GetProcessHeap () returned 0x630000 [0074.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0074.741] GetProcessHeap () returned 0x630000 [0074.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.741] GetProcessHeap () returned 0x630000 [0074.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0074.741] GetProcessHeap () returned 0x630000 [0074.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.741] GetProcessHeap () returned 0x630000 [0074.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.741] GetProcessHeap () returned 0x630000 [0074.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.741] GetProcessHeap () returned 0x630000 [0074.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.741] GetProcessHeap () returned 0x630000 [0074.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e070 [0074.741] GetProcessHeap () returned 0x630000 [0074.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0074.741] GetProcessHeap () returned 0x630000 [0074.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0074.741] GetProcessHeap () returned 0x630000 [0074.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0074.741] GetProcessHeap () returned 0x630000 [0074.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.742] GetProcessHeap () returned 0x630000 [0074.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.742] GetProcessHeap () returned 0x630000 [0074.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.742] GetProcessHeap () returned 0x630000 [0074.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.742] GetProcessHeap () returned 0x630000 [0074.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.742] GetProcessHeap () returned 0x630000 [0074.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.742] GetProcessHeap () returned 0x630000 [0074.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.742] GetProcessHeap () returned 0x630000 [0074.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.742] GetProcessHeap () returned 0x630000 [0074.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.742] GetProcessHeap () returned 0x630000 [0074.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.742] GetProcessHeap () returned 0x630000 [0074.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.742] GetProcessHeap () returned 0x630000 [0074.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.742] GetProcessHeap () returned 0x630000 [0074.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.742] GetProcessHeap () returned 0x630000 [0074.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.742] GetProcessHeap () returned 0x630000 [0074.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.742] GetProcessHeap () returned 0x630000 [0074.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.742] GetProcessHeap () returned 0x630000 [0074.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.742] GetProcessHeap () returned 0x630000 [0074.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.742] GetProcessHeap () returned 0x630000 [0074.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0074.742] GetProcessHeap () returned 0x630000 [0074.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0074.742] GetProcessHeap () returned 0x630000 [0074.742] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.743] GetProcessHeap () returned 0x630000 [0074.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.743] GetProcessHeap () returned 0x630000 [0074.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.743] GetProcessHeap () returned 0x630000 [0074.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.743] GetProcessHeap () returned 0x630000 [0074.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.743] GetProcessHeap () returned 0x630000 [0074.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.743] GetProcessHeap () returned 0x630000 [0074.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.743] GetProcessHeap () returned 0x630000 [0074.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.743] GetProcessHeap () returned 0x630000 [0074.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.743] GetProcessHeap () returned 0x630000 [0074.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.743] GetProcessHeap () returned 0x630000 [0074.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.743] GetProcessHeap () returned 0x630000 [0074.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.743] GetProcessHeap () returned 0x630000 [0074.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.743] GetProcessHeap () returned 0x630000 [0074.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.743] GetProcessHeap () returned 0x630000 [0074.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.743] GetProcessHeap () returned 0x630000 [0074.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.743] GetProcessHeap () returned 0x630000 [0074.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.743] GetProcessHeap () returned 0x630000 [0074.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.743] GetProcessHeap () returned 0x630000 [0074.743] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.743] GetProcessHeap () returned 0x630000 [0074.743] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.743] GetProcessHeap () returned 0x630000 [0074.744] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.744] GetProcessHeap () returned 0x630000 [0074.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.744] GetProcessHeap () returned 0x630000 [0074.744] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.744] GetProcessHeap () returned 0x630000 [0074.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.744] GetProcessHeap () returned 0x630000 [0074.744] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.744] GetProcessHeap () returned 0x630000 [0074.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.744] GetProcessHeap () returned 0x630000 [0074.744] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.744] GetProcessHeap () returned 0x630000 [0074.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.744] GetProcessHeap () returned 0x630000 [0074.744] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.744] GetProcessHeap () returned 0x630000 [0074.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.744] GetProcessHeap () returned 0x630000 [0074.744] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.744] GetProcessHeap () returned 0x630000 [0074.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.744] GetProcessHeap () returned 0x630000 [0074.744] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.744] GetProcessHeap () returned 0x630000 [0074.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.744] GetProcessHeap () returned 0x630000 [0074.744] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.744] GetProcessHeap () returned 0x630000 [0074.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.744] GetProcessHeap () returned 0x630000 [0074.744] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.744] GetProcessHeap () returned 0x630000 [0074.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.744] GetProcessHeap () returned 0x630000 [0074.744] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.744] GetProcessHeap () returned 0x630000 [0074.744] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.744] GetProcessHeap () returned 0x630000 [0074.745] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.745] GetProcessHeap () returned 0x630000 [0074.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.745] GetProcessHeap () returned 0x630000 [0074.745] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.745] GetProcessHeap () returned 0x630000 [0074.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.745] GetProcessHeap () returned 0x630000 [0074.745] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.745] GetProcessHeap () returned 0x630000 [0074.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.745] GetProcessHeap () returned 0x630000 [0074.745] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.745] GetProcessHeap () returned 0x630000 [0074.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.745] GetProcessHeap () returned 0x630000 [0074.745] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.745] GetProcessHeap () returned 0x630000 [0074.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.745] GetProcessHeap () returned 0x630000 [0074.745] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.745] GetProcessHeap () returned 0x630000 [0074.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.745] GetProcessHeap () returned 0x630000 [0074.745] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.745] GetProcessHeap () returned 0x630000 [0074.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.745] GetProcessHeap () returned 0x630000 [0074.745] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.745] GetProcessHeap () returned 0x630000 [0074.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.745] GetProcessHeap () returned 0x630000 [0074.745] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.745] GetProcessHeap () returned 0x630000 [0074.745] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.745] GetProcessHeap () returned 0x630000 [0074.745] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.746] GetProcessHeap () returned 0x630000 [0074.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.746] GetProcessHeap () returned 0x630000 [0074.746] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.746] GetProcessHeap () returned 0x630000 [0074.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.746] GetProcessHeap () returned 0x630000 [0074.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0074.746] GetProcessHeap () returned 0x630000 [0074.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0074.746] GetProcessHeap () returned 0x630000 [0074.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0074.746] GetProcessHeap () returned 0x630000 [0074.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0074.746] GetProcessHeap () returned 0x630000 [0074.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0074.746] GetProcessHeap () returned 0x630000 [0074.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0074.746] GetProcessHeap () returned 0x630000 [0074.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0074.746] GetProcessHeap () returned 0x630000 [0074.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0074.746] GetProcessHeap () returned 0x630000 [0074.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0074.746] GetProcessHeap () returned 0x630000 [0074.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.746] GetProcessHeap () returned 0x630000 [0074.746] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0074.746] WriteFile (in: hFile=0x230, lpBuffer=0x672398*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672398*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0074.748] GetProcessHeap () returned 0x630000 [0074.748] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x672398, Size=0x30) returned 0x672398 [0074.748] GetProcessHeap () returned 0x630000 [0074.748] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0074.748] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.748] GetProcessHeap () returned 0x630000 [0074.748] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3c31) returned 0x6723d0 [0074.748] ReadFile (in: hFile=0x230, lpBuffer=0x6723d0, nNumberOfBytesToRead=0x3c31, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x6723d0*, lpNumberOfBytesRead=0x243d7e8*=0x3c31, lpOverlapped=0x0) returned 1 [0074.748] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.749] WriteFile (in: hFile=0x230, lpBuffer=0x6723d0*, nNumberOfBytesToWrite=0x3c31, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x6723d0*, lpNumberOfBytesWritten=0x243d7e4*=0x3c31, lpOverlapped=0x0) returned 1 [0074.749] GetProcessHeap () returned 0x630000 [0074.749] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6723d0 | out: hHeap=0x630000) returned 1 [0074.749] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.750] WriteFile (in: hFile=0x230, lpBuffer=0x672398*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672398*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0074.750] CloseHandle (hObject=0x230) returned 1 [0074.751] GetProcessHeap () returned 0x630000 [0074.751] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0074.751] GetProcessHeap () returned 0x630000 [0074.751] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655760 | out: hHeap=0x630000) returned 1 [0074.751] GetProcessHeap () returned 0x630000 [0074.751] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0074.751] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\moI9QUZ0kWfF_.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\moI9QUZ0kWfF_.mp3") returned="C:\\Users\\FD1HVy\\Desktop\\moI9QUZ0kWfF_.mp3" [0074.751] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\moI9QUZ0kWfF_.mp3", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\moI9QUZ0kWfF_.mp3.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\moI9QUZ0kWfF_.mp3.happythreechoose" [0074.751] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\moI9QUZ0kWfF_.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\moi9quz0kwff_.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\moI9QUZ0kWfF_.mp3.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\moi9quz0kwff_.mp3.happythreechoose"), dwFlags=0x1) returned 1 [0074.752] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\moI9QUZ0kWfF_.mp3" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0074.752] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned="" [0074.752] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" [0074.752] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\decryption info.html")) returned 0x20 [0074.752] GetProcessHeap () returned 0x630000 [0074.752] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645d38 | out: hHeap=0x630000) returned 1 [0074.752] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b8b7c60, ftCreationTime.dwHighDateTime=0x1d5d744, ftLastAccessTime.dwLowDateTime=0xe19ed950, ftLastAccessTime.dwHighDateTime=0x1d5c815, ftLastWriteTime.dwLowDateTime=0xe19ed950, ftLastWriteTime.dwHighDateTime=0x1d5c815, nFileSizeHigh=0x0, nFileSizeLow=0x51c1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nltCL-U0u.mkv", cAlternateFileName="NLTCL-~1.MKV")) returned 1 [0074.752] lstrcmpiW (lpString1="nltCL-U0u.mkv", lpString2=".") returned 1 [0074.752] lstrcmpiW (lpString1="nltCL-U0u.mkv", lpString2="..") returned 1 [0074.752] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="nltCL-U0u.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\nltCL-U0u.mkv") returned="C:\\Users\\FD1HVy\\Desktop\\nltCL-U0u.mkv" [0074.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nltCL-U0u.mkv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0074.752] GetProcessHeap () returned 0x630000 [0074.752] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x64c9f0 [0074.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nltCL-U0u.mkv", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nltCL-U0u.mkv", lpUsedDefaultChar=0x0) returned 14 [0074.752] lstrlenA (lpString="nltCL-U0u.mkv") returned 13 [0074.752] lstrlenA (lpString=".happythreechoose") returned 17 [0074.752] lstrcmpiW (lpString1="nltCL-U0u.mkv", lpString2="Decryption INFO.html") returned 1 [0074.752] lstrcmpiW (lpString1="nltCL-U0u.mkv", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0074.752] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0074.752] lstrcmpiW (lpString1="nltCL-U0u.mkv", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0074.752] GetProcessHeap () returned 0x630000 [0074.752] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0074.753] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\nltCL-U0u.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\nltcl-u0u.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0074.753] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=20929) returned 1 [0074.753] GetProcessHeap () returned 0x630000 [0074.753] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6557d8 [0074.753] GetProcessHeap () returned 0x630000 [0074.753] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.753] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\nltCL-U0u.mkv") returned 37 [0074.753] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.753] GetProcessHeap () returned 0x630000 [0074.753] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0074.753] GetProcessHeap () returned 0x630000 [0074.753] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38f) returned 0x6723d0 [0074.753] lstrlenA (lpString="rsa_encrypt") returned 11 [0074.753] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0074.753] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0074.753] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0074.754] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0074.754] GetProcessHeap () returned 0x630000 [0074.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0074.754] lstrlenA (lpString="010001") returned 6 [0074.754] GetProcessHeap () returned 0x630000 [0074.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0074.754] GetProcessHeap () returned 0x630000 [0074.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.754] GetProcessHeap () returned 0x630000 [0074.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ecd0 [0074.754] GetProcessHeap () returned 0x630000 [0074.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.754] GetProcessHeap () returned 0x630000 [0074.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e4f0 [0074.754] GetProcessHeap () returned 0x630000 [0074.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657558 [0074.754] GetProcessHeap () returned 0x630000 [0074.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0074.754] GetProcessHeap () returned 0x630000 [0074.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0074.754] GetProcessHeap () returned 0x630000 [0074.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.754] GetProcessHeap () returned 0x630000 [0074.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0074.754] GetProcessHeap () returned 0x630000 [0074.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.754] GetProcessHeap () returned 0x630000 [0074.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656b80 [0074.754] GetProcessHeap () returned 0x630000 [0074.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.754] GetProcessHeap () returned 0x630000 [0074.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0074.754] GetProcessHeap () returned 0x630000 [0074.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea90 [0074.754] GetProcessHeap () returned 0x630000 [0074.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.754] GetProcessHeap () returned 0x630000 [0074.754] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0074.754] GetProcessHeap () returned 0x630000 [0074.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea90 | out: hHeap=0x630000) returned 1 [0074.755] GetProcessHeap () returned 0x630000 [0074.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.755] GetProcessHeap () returned 0x630000 [0074.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cec8 [0074.755] GetProcessHeap () returned 0x630000 [0074.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.755] GetProcessHeap () returned 0x630000 [0074.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.755] GetProcessHeap () returned 0x630000 [0074.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.755] GetProcessHeap () returned 0x630000 [0074.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.755] GetProcessHeap () returned 0x630000 [0074.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e7c0 [0074.755] GetProcessHeap () returned 0x630000 [0074.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cec8 | out: hHeap=0x630000) returned 1 [0074.755] GetProcessHeap () returned 0x630000 [0074.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0074.755] GetProcessHeap () returned 0x630000 [0074.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e7c0 | out: hHeap=0x630000) returned 1 [0074.755] GetProcessHeap () returned 0x630000 [0074.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.755] GetProcessHeap () returned 0x630000 [0074.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.755] GetProcessHeap () returned 0x630000 [0074.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.755] GetProcessHeap () returned 0x630000 [0074.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.755] GetProcessHeap () returned 0x630000 [0074.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.755] GetProcessHeap () returned 0x630000 [0074.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.755] GetProcessHeap () returned 0x630000 [0074.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.755] GetProcessHeap () returned 0x630000 [0074.755] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.755] GetProcessHeap () returned 0x630000 [0074.755] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.755] GetProcessHeap () returned 0x630000 [0074.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.756] GetProcessHeap () returned 0x630000 [0074.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.756] GetProcessHeap () returned 0x630000 [0074.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.756] GetProcessHeap () returned 0x630000 [0074.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.756] GetProcessHeap () returned 0x630000 [0074.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.756] GetProcessHeap () returned 0x630000 [0074.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.756] GetProcessHeap () returned 0x630000 [0074.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.756] GetProcessHeap () returned 0x630000 [0074.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.756] GetProcessHeap () returned 0x630000 [0074.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.756] GetProcessHeap () returned 0x630000 [0074.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.756] GetProcessHeap () returned 0x630000 [0074.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.756] GetProcessHeap () returned 0x630000 [0074.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.756] GetProcessHeap () returned 0x630000 [0074.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.756] GetProcessHeap () returned 0x630000 [0074.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.756] GetProcessHeap () returned 0x630000 [0074.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.756] GetProcessHeap () returned 0x630000 [0074.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.756] GetProcessHeap () returned 0x630000 [0074.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.756] GetProcessHeap () returned 0x630000 [0074.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.756] GetProcessHeap () returned 0x630000 [0074.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.756] GetProcessHeap () returned 0x630000 [0074.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.757] GetProcessHeap () returned 0x630000 [0074.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.757] GetProcessHeap () returned 0x630000 [0074.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.757] GetProcessHeap () returned 0x630000 [0074.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.757] GetProcessHeap () returned 0x630000 [0074.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.757] GetProcessHeap () returned 0x630000 [0074.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.757] GetProcessHeap () returned 0x630000 [0074.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.757] GetProcessHeap () returned 0x630000 [0074.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.757] GetProcessHeap () returned 0x630000 [0074.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.757] GetProcessHeap () returned 0x630000 [0074.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.757] GetProcessHeap () returned 0x630000 [0074.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.757] GetProcessHeap () returned 0x630000 [0074.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.757] GetProcessHeap () returned 0x630000 [0074.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.757] GetProcessHeap () returned 0x630000 [0074.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.757] GetProcessHeap () returned 0x630000 [0074.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.757] GetProcessHeap () returned 0x630000 [0074.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.757] GetProcessHeap () returned 0x630000 [0074.757] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.757] GetProcessHeap () returned 0x630000 [0074.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.758] GetProcessHeap () returned 0x630000 [0074.758] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.758] GetProcessHeap () returned 0x630000 [0074.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.758] GetProcessHeap () returned 0x630000 [0074.758] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.758] GetProcessHeap () returned 0x630000 [0074.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.758] GetProcessHeap () returned 0x630000 [0074.758] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.758] GetProcessHeap () returned 0x630000 [0074.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.758] GetProcessHeap () returned 0x630000 [0074.758] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.758] GetProcessHeap () returned 0x630000 [0074.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.758] GetProcessHeap () returned 0x630000 [0074.758] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.758] GetProcessHeap () returned 0x630000 [0074.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.758] GetProcessHeap () returned 0x630000 [0074.758] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.758] GetProcessHeap () returned 0x630000 [0074.758] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.759] GetProcessHeap () returned 0x630000 [0074.759] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.759] GetProcessHeap () returned 0x630000 [0074.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.759] GetProcessHeap () returned 0x630000 [0074.759] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.759] GetProcessHeap () returned 0x630000 [0074.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.759] GetProcessHeap () returned 0x630000 [0074.759] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.759] GetProcessHeap () returned 0x630000 [0074.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.759] GetProcessHeap () returned 0x630000 [0074.759] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.759] GetProcessHeap () returned 0x630000 [0074.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.759] GetProcessHeap () returned 0x630000 [0074.759] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.759] GetProcessHeap () returned 0x630000 [0074.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.759] GetProcessHeap () returned 0x630000 [0074.759] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.759] GetProcessHeap () returned 0x630000 [0074.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.759] GetProcessHeap () returned 0x630000 [0074.759] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.759] GetProcessHeap () returned 0x630000 [0074.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.759] GetProcessHeap () returned 0x630000 [0074.759] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.759] GetProcessHeap () returned 0x630000 [0074.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.759] GetProcessHeap () returned 0x630000 [0074.759] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.759] GetProcessHeap () returned 0x630000 [0074.759] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.759] GetProcessHeap () returned 0x630000 [0074.759] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.759] GetProcessHeap () returned 0x630000 [0074.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.760] GetProcessHeap () returned 0x630000 [0074.760] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.760] GetProcessHeap () returned 0x630000 [0074.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.760] GetProcessHeap () returned 0x630000 [0074.760] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.760] GetProcessHeap () returned 0x630000 [0074.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.760] GetProcessHeap () returned 0x630000 [0074.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0074.760] GetProcessHeap () returned 0x630000 [0074.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0074.760] GetProcessHeap () returned 0x630000 [0074.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0074.760] GetProcessHeap () returned 0x630000 [0074.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0074.760] GetProcessHeap () returned 0x630000 [0074.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0074.760] GetProcessHeap () returned 0x630000 [0074.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0074.760] GetProcessHeap () returned 0x630000 [0074.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0074.760] GetProcessHeap () returned 0x630000 [0074.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ecd0 | out: hHeap=0x630000) returned 1 [0074.760] GetProcessHeap () returned 0x630000 [0074.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0074.760] GetProcessHeap () returned 0x630000 [0074.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.760] GetProcessHeap () returned 0x630000 [0074.760] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0074.760] WriteFile (in: hFile=0x230, lpBuffer=0x6723d0*, nNumberOfBytesToWrite=0x38f, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6723d0*, lpNumberOfBytesWritten=0x243d864*=0x38f, lpOverlapped=0x0) returned 1 [0074.762] GetProcessHeap () returned 0x630000 [0074.762] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6723d0, Size=0x30) returned 0x6723d0 [0074.762] GetProcessHeap () returned 0x630000 [0074.762] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0074.762] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.762] GetProcessHeap () returned 0x630000 [0074.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x51d0) returned 0x672408 [0074.762] ReadFile (in: hFile=0x230, lpBuffer=0x672408, nNumberOfBytesToRead=0x51d0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x672408*, lpNumberOfBytesRead=0x243d7e8*=0x51d0, lpOverlapped=0x0) returned 1 [0074.762] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.762] WriteFile (in: hFile=0x230, lpBuffer=0x672408*, nNumberOfBytesToWrite=0x51d0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x672408*, lpNumberOfBytesWritten=0x243d7e4*=0x51d0, lpOverlapped=0x0) returned 1 [0074.763] GetProcessHeap () returned 0x630000 [0074.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672408 | out: hHeap=0x630000) returned 1 [0074.763] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.763] WriteFile (in: hFile=0x230, lpBuffer=0x6723d0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6723d0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0074.764] CloseHandle (hObject=0x230) returned 1 [0074.765] GetProcessHeap () returned 0x630000 [0074.765] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0074.765] GetProcessHeap () returned 0x630000 [0074.765] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6557d8 | out: hHeap=0x630000) returned 1 [0074.765] GetProcessHeap () returned 0x630000 [0074.765] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0074.765] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\nltCL-U0u.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\nltCL-U0u.mkv") returned="C:\\Users\\FD1HVy\\Desktop\\nltCL-U0u.mkv" [0074.765] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\nltCL-U0u.mkv", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\nltCL-U0u.mkv.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\nltCL-U0u.mkv.happythreechoose" [0074.765] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\nltCL-U0u.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\nltcl-u0u.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\nltCL-U0u.mkv.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\nltcl-u0u.mkv.happythreechoose"), dwFlags=0x1) returned 1 [0074.765] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\nltCL-U0u.mkv" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0074.765] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned="" [0074.765] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" [0074.765] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\decryption info.html")) returned 0x20 [0074.765] GetProcessHeap () returned 0x630000 [0074.766] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0074.766] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda9a3b50, ftCreationTime.dwHighDateTime=0x1d5cf03, ftLastAccessTime.dwLowDateTime=0x94d8fb00, ftLastAccessTime.dwHighDateTime=0x1d5ca9a, ftLastWriteTime.dwLowDateTime=0x94d8fb00, ftLastWriteTime.dwHighDateTime=0x1d5ca9a, nFileSizeHigh=0x0, nFileSizeLow=0x11fa9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RqdStU2_B6kOD13.ots", cAlternateFileName="RQDSTU~1.OTS")) returned 1 [0074.766] lstrcmpiW (lpString1="RqdStU2_B6kOD13.ots", lpString2=".") returned 1 [0074.766] lstrcmpiW (lpString1="RqdStU2_B6kOD13.ots", lpString2="..") returned 1 [0074.766] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="RqdStU2_B6kOD13.ots" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\RqdStU2_B6kOD13.ots") returned="C:\\Users\\FD1HVy\\Desktop\\RqdStU2_B6kOD13.ots" [0074.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RqdStU2_B6kOD13.ots", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0074.766] GetProcessHeap () returned 0x630000 [0074.766] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x645c58 [0074.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RqdStU2_B6kOD13.ots", cchWideChar=-1, lpMultiByteStr=0x645c58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RqdStU2_B6kOD13.ots", lpUsedDefaultChar=0x0) returned 20 [0074.766] lstrlenA (lpString="RqdStU2_B6kOD13.ots") returned 19 [0074.766] lstrlenA (lpString=".happythreechoose") returned 17 [0074.766] lstrlenA (lpString=".happythreechoose") returned 17 [0074.766] lstrlenA (lpString="RqdStU2_B6kOD13.ots") returned 19 [0074.766] lstrcmpiA (lpString1="dStU2_B6kOD13.ots", lpString2=".happythreechoose") returned 1 [0074.766] lstrcmpiW (lpString1="RqdStU2_B6kOD13.ots", lpString2="Decryption INFO.html") returned 1 [0074.766] lstrcmpiW (lpString1="RqdStU2_B6kOD13.ots", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0074.766] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0074.766] lstrcmpiW (lpString1="RqdStU2_B6kOD13.ots", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0074.766] GetProcessHeap () returned 0x630000 [0074.766] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0074.766] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\RqdStU2_B6kOD13.ots" (normalized: "c:\\users\\fd1hvy\\desktop\\rqdstu2_b6kod13.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0074.766] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=73641) returned 1 [0074.766] GetProcessHeap () returned 0x630000 [0074.766] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6555f8 [0074.766] GetProcessHeap () returned 0x630000 [0074.766] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.766] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\RqdStU2_B6kOD13.ots") returned 43 [0074.766] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.766] GetProcessHeap () returned 0x630000 [0074.766] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0074.766] GetProcessHeap () returned 0x630000 [0074.767] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x387) returned 0x672408 [0074.767] lstrlenA (lpString="rsa_encrypt") returned 11 [0074.767] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0074.767] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0074.767] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0074.767] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0074.767] GetProcessHeap () returned 0x630000 [0074.767] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0074.767] lstrlenA (lpString="010001") returned 6 [0074.767] GetProcessHeap () returned 0x630000 [0074.767] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0074.767] GetProcessHeap () returned 0x630000 [0074.767] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.767] GetProcessHeap () returned 0x630000 [0074.767] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e3d0 [0074.767] GetProcessHeap () returned 0x630000 [0074.767] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.767] GetProcessHeap () returned 0x630000 [0074.767] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e610 [0074.767] GetProcessHeap () returned 0x630000 [0074.768] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x6570f8 [0074.768] GetProcessHeap () returned 0x630000 [0074.768] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0074.768] GetProcessHeap () returned 0x630000 [0074.768] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0074.768] GetProcessHeap () returned 0x630000 [0074.768] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.768] GetProcessHeap () returned 0x630000 [0074.768] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0074.768] GetProcessHeap () returned 0x630000 [0074.768] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.768] GetProcessHeap () returned 0x630000 [0074.768] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656ec8 [0074.768] GetProcessHeap () returned 0x630000 [0074.768] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.768] GetProcessHeap () returned 0x630000 [0074.768] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0074.768] GetProcessHeap () returned 0x630000 [0074.768] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e4f0 [0074.768] GetProcessHeap () returned 0x630000 [0074.768] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.768] GetProcessHeap () returned 0x630000 [0074.768] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0074.768] GetProcessHeap () returned 0x630000 [0074.768] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0074.768] GetProcessHeap () returned 0x630000 [0074.768] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0074.768] GetProcessHeap () returned 0x630000 [0074.768] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0074.768] GetProcessHeap () returned 0x630000 [0074.768] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.768] GetProcessHeap () returned 0x630000 [0074.768] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0074.768] GetProcessHeap () returned 0x630000 [0074.768] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.768] GetProcessHeap () returned 0x630000 [0074.768] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.768] GetProcessHeap () returned 0x630000 [0074.768] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65dda0 [0074.768] GetProcessHeap () returned 0x630000 [0074.768] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0074.768] GetProcessHeap () returned 0x630000 [0074.769] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0074.769] GetProcessHeap () returned 0x630000 [0074.769] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0074.769] GetProcessHeap () returned 0x630000 [0074.769] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.769] GetProcessHeap () returned 0x630000 [0074.769] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.769] GetProcessHeap () returned 0x630000 [0074.769] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.769] GetProcessHeap () returned 0x630000 [0074.769] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.769] GetProcessHeap () returned 0x630000 [0074.769] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.769] GetProcessHeap () returned 0x630000 [0074.769] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.769] GetProcessHeap () returned 0x630000 [0074.769] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.769] GetProcessHeap () returned 0x630000 [0074.769] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.769] GetProcessHeap () returned 0x630000 [0074.769] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.769] GetProcessHeap () returned 0x630000 [0074.769] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.769] GetProcessHeap () returned 0x630000 [0074.769] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.769] GetProcessHeap () returned 0x630000 [0074.769] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.769] GetProcessHeap () returned 0x630000 [0074.769] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.769] GetProcessHeap () returned 0x630000 [0074.769] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.769] GetProcessHeap () returned 0x630000 [0074.769] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.769] GetProcessHeap () returned 0x630000 [0074.769] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.769] GetProcessHeap () returned 0x630000 [0074.769] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.769] GetProcessHeap () returned 0x630000 [0074.769] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.769] GetProcessHeap () returned 0x630000 [0074.770] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.770] GetProcessHeap () returned 0x630000 [0074.770] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.770] GetProcessHeap () returned 0x630000 [0074.770] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.770] GetProcessHeap () returned 0x630000 [0074.770] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.770] GetProcessHeap () returned 0x630000 [0074.770] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.770] GetProcessHeap () returned 0x630000 [0074.770] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.770] GetProcessHeap () returned 0x630000 [0074.770] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.770] GetProcessHeap () returned 0x630000 [0074.770] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.770] GetProcessHeap () returned 0x630000 [0074.770] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.770] GetProcessHeap () returned 0x630000 [0074.770] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.770] GetProcessHeap () returned 0x630000 [0074.770] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.770] GetProcessHeap () returned 0x630000 [0074.770] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.770] GetProcessHeap () returned 0x630000 [0074.770] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.770] GetProcessHeap () returned 0x630000 [0074.770] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.770] GetProcessHeap () returned 0x630000 [0074.770] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.770] GetProcessHeap () returned 0x630000 [0074.770] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.770] GetProcessHeap () returned 0x630000 [0074.770] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.770] GetProcessHeap () returned 0x630000 [0074.770] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.770] GetProcessHeap () returned 0x630000 [0074.770] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.770] GetProcessHeap () returned 0x630000 [0074.770] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.771] GetProcessHeap () returned 0x630000 [0074.771] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.771] GetProcessHeap () returned 0x630000 [0074.771] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.771] GetProcessHeap () returned 0x630000 [0074.771] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.771] GetProcessHeap () returned 0x630000 [0074.771] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.771] GetProcessHeap () returned 0x630000 [0074.771] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.771] GetProcessHeap () returned 0x630000 [0074.771] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.771] GetProcessHeap () returned 0x630000 [0074.771] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.771] GetProcessHeap () returned 0x630000 [0074.771] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.771] GetProcessHeap () returned 0x630000 [0074.771] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.771] GetProcessHeap () returned 0x630000 [0074.771] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.771] GetProcessHeap () returned 0x630000 [0074.771] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.771] GetProcessHeap () returned 0x630000 [0074.771] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.771] GetProcessHeap () returned 0x630000 [0074.771] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.771] GetProcessHeap () returned 0x630000 [0074.771] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.771] GetProcessHeap () returned 0x630000 [0074.771] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.771] GetProcessHeap () returned 0x630000 [0074.771] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.771] GetProcessHeap () returned 0x630000 [0074.771] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.771] GetProcessHeap () returned 0x630000 [0074.771] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.771] GetProcessHeap () returned 0x630000 [0074.771] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.771] GetProcessHeap () returned 0x630000 [0074.771] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.772] GetProcessHeap () returned 0x630000 [0074.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.772] GetProcessHeap () returned 0x630000 [0074.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.772] GetProcessHeap () returned 0x630000 [0074.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.772] GetProcessHeap () returned 0x630000 [0074.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.772] GetProcessHeap () returned 0x630000 [0074.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.772] GetProcessHeap () returned 0x630000 [0074.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.772] GetProcessHeap () returned 0x630000 [0074.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.772] GetProcessHeap () returned 0x630000 [0074.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.772] GetProcessHeap () returned 0x630000 [0074.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.772] GetProcessHeap () returned 0x630000 [0074.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.772] GetProcessHeap () returned 0x630000 [0074.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.772] GetProcessHeap () returned 0x630000 [0074.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.772] GetProcessHeap () returned 0x630000 [0074.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0074.772] GetProcessHeap () returned 0x630000 [0074.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0074.772] GetProcessHeap () returned 0x630000 [0074.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.772] GetProcessHeap () returned 0x630000 [0074.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.772] GetProcessHeap () returned 0x630000 [0074.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.772] GetProcessHeap () returned 0x630000 [0074.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.772] GetProcessHeap () returned 0x630000 [0074.772] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.772] GetProcessHeap () returned 0x630000 [0074.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.773] GetProcessHeap () returned 0x630000 [0074.773] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.773] GetProcessHeap () returned 0x630000 [0074.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.773] GetProcessHeap () returned 0x630000 [0074.773] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.773] GetProcessHeap () returned 0x630000 [0074.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.773] GetProcessHeap () returned 0x630000 [0074.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0074.773] GetProcessHeap () returned 0x630000 [0074.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0074.773] GetProcessHeap () returned 0x630000 [0074.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0074.773] GetProcessHeap () returned 0x630000 [0074.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0074.773] GetProcessHeap () returned 0x630000 [0074.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0074.773] GetProcessHeap () returned 0x630000 [0074.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0074.773] GetProcessHeap () returned 0x630000 [0074.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0074.773] GetProcessHeap () returned 0x630000 [0074.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0074.773] GetProcessHeap () returned 0x630000 [0074.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0074.773] GetProcessHeap () returned 0x630000 [0074.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.773] GetProcessHeap () returned 0x630000 [0074.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0074.773] WriteFile (in: hFile=0x230, lpBuffer=0x672408*, nNumberOfBytesToWrite=0x387, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672408*, lpNumberOfBytesWritten=0x243d864*=0x387, lpOverlapped=0x0) returned 1 [0074.777] GetProcessHeap () returned 0x630000 [0074.777] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x672408, Size=0x30) returned 0x672408 [0074.777] GetProcessHeap () returned 0x630000 [0074.777] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0074.778] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.778] GetProcessHeap () returned 0x630000 [0074.778] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11fb0) returned 0x672440 [0074.778] ReadFile (in: hFile=0x230, lpBuffer=0x672440, nNumberOfBytesToRead=0x11fb0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x672440*, lpNumberOfBytesRead=0x243d7e8*=0x11fb0, lpOverlapped=0x0) returned 1 [0074.779] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.779] WriteFile (in: hFile=0x230, lpBuffer=0x672440*, nNumberOfBytesToWrite=0x11fb0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x672440*, lpNumberOfBytesWritten=0x243d7e4*=0x11fb0, lpOverlapped=0x0) returned 1 [0074.781] GetProcessHeap () returned 0x630000 [0074.781] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672440 | out: hHeap=0x630000) returned 1 [0074.782] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.782] WriteFile (in: hFile=0x230, lpBuffer=0x672408*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672408*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0074.783] CloseHandle (hObject=0x230) returned 1 [0074.783] GetProcessHeap () returned 0x630000 [0074.783] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0074.783] GetProcessHeap () returned 0x630000 [0074.783] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6555f8 | out: hHeap=0x630000) returned 1 [0074.783] GetProcessHeap () returned 0x630000 [0074.784] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0074.784] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\RqdStU2_B6kOD13.ots" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\RqdStU2_B6kOD13.ots") returned="C:\\Users\\FD1HVy\\Desktop\\RqdStU2_B6kOD13.ots" [0074.784] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\RqdStU2_B6kOD13.ots", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\RqdStU2_B6kOD13.ots.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\RqdStU2_B6kOD13.ots.happythreechoose" [0074.784] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\RqdStU2_B6kOD13.ots" (normalized: "c:\\users\\fd1hvy\\desktop\\rqdstu2_b6kod13.ots"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\RqdStU2_B6kOD13.ots.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\rqdstu2_b6kod13.ots.happythreechoose"), dwFlags=0x1) returned 1 [0074.784] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\RqdStU2_B6kOD13.ots" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0074.784] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned="" [0074.784] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" [0074.784] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\decryption info.html")) returned 0x20 [0074.784] GetProcessHeap () returned 0x630000 [0074.784] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645c58 | out: hHeap=0x630000) returned 1 [0074.784] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc624a050, ftCreationTime.dwHighDateTime=0x1d5cded, ftLastAccessTime.dwLowDateTime=0x668e6cc0, ftLastAccessTime.dwHighDateTime=0x1d5d234, ftLastWriteTime.dwLowDateTime=0x668e6cc0, ftLastWriteTime.dwHighDateTime=0x1d5d234, nFileSizeHigh=0x0, nFileSizeLow=0x13d17, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sE2vpMDSF.mkv", cAlternateFileName="SE2VPM~1.MKV")) returned 1 [0074.784] lstrcmpiW (lpString1="sE2vpMDSF.mkv", lpString2=".") returned 1 [0074.784] lstrcmpiW (lpString1="sE2vpMDSF.mkv", lpString2="..") returned 1 [0074.784] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="sE2vpMDSF.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\sE2vpMDSF.mkv") returned="C:\\Users\\FD1HVy\\Desktop\\sE2vpMDSF.mkv" [0074.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sE2vpMDSF.mkv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0074.784] GetProcessHeap () returned 0x630000 [0074.784] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x64c9f0 [0074.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="sE2vpMDSF.mkv", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sE2vpMDSF.mkv", lpUsedDefaultChar=0x0) returned 14 [0074.785] lstrlenA (lpString="sE2vpMDSF.mkv") returned 13 [0074.785] lstrlenA (lpString=".happythreechoose") returned 17 [0074.785] lstrcmpiW (lpString1="sE2vpMDSF.mkv", lpString2="Decryption INFO.html") returned 1 [0074.785] lstrcmpiW (lpString1="sE2vpMDSF.mkv", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0074.785] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0074.785] lstrcmpiW (lpString1="sE2vpMDSF.mkv", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0074.785] GetProcessHeap () returned 0x630000 [0074.785] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0074.785] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\sE2vpMDSF.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\se2vpmdsf.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0074.785] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=81175) returned 1 [0074.785] GetProcessHeap () returned 0x630000 [0074.785] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655580 [0074.785] GetProcessHeap () returned 0x630000 [0074.785] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.785] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\sE2vpMDSF.mkv") returned 37 [0074.785] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.785] GetProcessHeap () returned 0x630000 [0074.785] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0074.785] GetProcessHeap () returned 0x630000 [0074.785] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x672440 [0074.786] lstrlenA (lpString="rsa_encrypt") returned 11 [0074.786] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0074.787] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0074.787] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0074.787] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0074.787] GetProcessHeap () returned 0x630000 [0074.787] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0074.787] lstrlenA (lpString="010001") returned 6 [0074.787] GetProcessHeap () returned 0x630000 [0074.787] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0074.787] GetProcessHeap () returned 0x630000 [0074.787] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.787] GetProcessHeap () returned 0x630000 [0074.787] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e610 [0074.787] GetProcessHeap () returned 0x630000 [0074.787] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.787] GetProcessHeap () returned 0x630000 [0074.787] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e970 [0074.787] GetProcessHeap () returned 0x630000 [0074.787] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656ec8 [0074.787] GetProcessHeap () returned 0x630000 [0074.787] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a328 [0074.787] GetProcessHeap () returned 0x630000 [0074.787] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0074.787] GetProcessHeap () returned 0x630000 [0074.787] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.787] GetProcessHeap () returned 0x630000 [0074.787] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0074.787] GetProcessHeap () returned 0x630000 [0074.787] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.787] GetProcessHeap () returned 0x630000 [0074.787] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657788 [0074.787] GetProcessHeap () returned 0x630000 [0074.787] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.787] GetProcessHeap () returned 0x630000 [0074.787] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0074.787] GetProcessHeap () returned 0x630000 [0074.787] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e190 [0074.787] GetProcessHeap () returned 0x630000 [0074.787] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.788] GetProcessHeap () returned 0x630000 [0074.788] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0074.788] GetProcessHeap () returned 0x630000 [0074.788] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0074.788] GetProcessHeap () returned 0x630000 [0074.788] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.788] GetProcessHeap () returned 0x630000 [0074.788] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cd48 [0074.788] GetProcessHeap () returned 0x630000 [0074.788] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.788] GetProcessHeap () returned 0x630000 [0074.788] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.788] GetProcessHeap () returned 0x630000 [0074.788] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.788] GetProcessHeap () returned 0x630000 [0074.788] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.788] GetProcessHeap () returned 0x630000 [0074.788] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e340 [0074.788] GetProcessHeap () returned 0x630000 [0074.788] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cd48 | out: hHeap=0x630000) returned 1 [0074.788] GetProcessHeap () returned 0x630000 [0074.788] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0074.788] GetProcessHeap () returned 0x630000 [0074.788] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0074.788] GetProcessHeap () returned 0x630000 [0074.788] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.788] GetProcessHeap () returned 0x630000 [0074.788] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.788] GetProcessHeap () returned 0x630000 [0074.788] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.788] GetProcessHeap () returned 0x630000 [0074.788] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.788] GetProcessHeap () returned 0x630000 [0074.788] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0074.788] GetProcessHeap () returned 0x630000 [0074.788] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0074.788] GetProcessHeap () returned 0x630000 [0074.788] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.788] GetProcessHeap () returned 0x630000 [0074.788] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.788] GetProcessHeap () returned 0x630000 [0074.788] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.789] GetProcessHeap () returned 0x630000 [0074.789] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.789] GetProcessHeap () returned 0x630000 [0074.789] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.789] GetProcessHeap () returned 0x630000 [0074.789] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.789] GetProcessHeap () returned 0x630000 [0074.789] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.789] GetProcessHeap () returned 0x630000 [0074.789] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.789] GetProcessHeap () returned 0x630000 [0074.789] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.789] GetProcessHeap () returned 0x630000 [0074.789] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.789] GetProcessHeap () returned 0x630000 [0074.789] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.789] GetProcessHeap () returned 0x630000 [0074.789] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.789] GetProcessHeap () returned 0x630000 [0074.789] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.789] GetProcessHeap () returned 0x630000 [0074.789] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.789] GetProcessHeap () returned 0x630000 [0074.789] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.789] GetProcessHeap () returned 0x630000 [0074.789] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.789] GetProcessHeap () returned 0x630000 [0074.789] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.789] GetProcessHeap () returned 0x630000 [0074.789] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.789] GetProcessHeap () returned 0x630000 [0074.789] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.789] GetProcessHeap () returned 0x630000 [0074.789] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.789] GetProcessHeap () returned 0x630000 [0074.789] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.789] GetProcessHeap () returned 0x630000 [0074.789] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.789] GetProcessHeap () returned 0x630000 [0074.789] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.790] GetProcessHeap () returned 0x630000 [0074.790] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.790] GetProcessHeap () returned 0x630000 [0074.790] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.790] GetProcessHeap () returned 0x630000 [0074.790] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.790] GetProcessHeap () returned 0x630000 [0074.790] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.790] GetProcessHeap () returned 0x630000 [0074.790] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.790] GetProcessHeap () returned 0x630000 [0074.790] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.790] GetProcessHeap () returned 0x630000 [0074.790] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.790] GetProcessHeap () returned 0x630000 [0074.790] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.790] GetProcessHeap () returned 0x630000 [0074.790] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.790] GetProcessHeap () returned 0x630000 [0074.790] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.790] GetProcessHeap () returned 0x630000 [0074.790] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.790] GetProcessHeap () returned 0x630000 [0074.790] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.790] GetProcessHeap () returned 0x630000 [0074.790] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.790] GetProcessHeap () returned 0x630000 [0074.790] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.790] GetProcessHeap () returned 0x630000 [0074.790] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.790] GetProcessHeap () returned 0x630000 [0074.790] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.790] GetProcessHeap () returned 0x630000 [0074.790] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.790] GetProcessHeap () returned 0x630000 [0074.790] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.790] GetProcessHeap () returned 0x630000 [0074.790] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.790] GetProcessHeap () returned 0x630000 [0074.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.791] GetProcessHeap () returned 0x630000 [0074.791] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.791] GetProcessHeap () returned 0x630000 [0074.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.791] GetProcessHeap () returned 0x630000 [0074.791] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.791] GetProcessHeap () returned 0x630000 [0074.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.791] GetProcessHeap () returned 0x630000 [0074.791] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.791] GetProcessHeap () returned 0x630000 [0074.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.791] GetProcessHeap () returned 0x630000 [0074.791] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.791] GetProcessHeap () returned 0x630000 [0074.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.791] GetProcessHeap () returned 0x630000 [0074.791] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.791] GetProcessHeap () returned 0x630000 [0074.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.791] GetProcessHeap () returned 0x630000 [0074.791] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.791] GetProcessHeap () returned 0x630000 [0074.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.791] GetProcessHeap () returned 0x630000 [0074.791] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.791] GetProcessHeap () returned 0x630000 [0074.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.791] GetProcessHeap () returned 0x630000 [0074.791] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.791] GetProcessHeap () returned 0x630000 [0074.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.791] GetProcessHeap () returned 0x630000 [0074.791] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.791] GetProcessHeap () returned 0x630000 [0074.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.791] GetProcessHeap () returned 0x630000 [0074.791] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.792] GetProcessHeap () returned 0x630000 [0074.792] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.792] GetProcessHeap () returned 0x630000 [0074.792] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.792] GetProcessHeap () returned 0x630000 [0074.792] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.792] GetProcessHeap () returned 0x630000 [0074.792] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.792] GetProcessHeap () returned 0x630000 [0074.792] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.792] GetProcessHeap () returned 0x630000 [0074.792] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.792] GetProcessHeap () returned 0x630000 [0074.792] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.792] GetProcessHeap () returned 0x630000 [0074.792] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.792] GetProcessHeap () returned 0x630000 [0074.792] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.792] GetProcessHeap () returned 0x630000 [0074.792] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.792] GetProcessHeap () returned 0x630000 [0074.792] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.792] GetProcessHeap () returned 0x630000 [0074.792] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.792] GetProcessHeap () returned 0x630000 [0074.792] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.792] GetProcessHeap () returned 0x630000 [0074.792] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.792] GetProcessHeap () returned 0x630000 [0074.792] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0074.792] GetProcessHeap () returned 0x630000 [0074.792] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0074.792] GetProcessHeap () returned 0x630000 [0074.792] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0074.792] GetProcessHeap () returned 0x630000 [0074.792] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0074.792] GetProcessHeap () returned 0x630000 [0074.792] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0074.793] GetProcessHeap () returned 0x630000 [0074.793] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0074.793] GetProcessHeap () returned 0x630000 [0074.793] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0074.793] GetProcessHeap () returned 0x630000 [0074.793] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0074.793] GetProcessHeap () returned 0x630000 [0074.793] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0074.793] GetProcessHeap () returned 0x630000 [0074.793] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.793] GetProcessHeap () returned 0x630000 [0074.793] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0074.793] WriteFile (in: hFile=0x230, lpBuffer=0x672440*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672440*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0074.806] GetProcessHeap () returned 0x630000 [0074.806] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x672440, Size=0x30) returned 0x672440 [0074.806] GetProcessHeap () returned 0x630000 [0074.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0074.806] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.806] GetProcessHeap () returned 0x630000 [0074.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x13d17) returned 0x672478 [0074.807] ReadFile (in: hFile=0x230, lpBuffer=0x672478, nNumberOfBytesToRead=0x13d17, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x672478*, lpNumberOfBytesRead=0x243d7e8*=0x13d17, lpOverlapped=0x0) returned 1 [0074.808] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.808] WriteFile (in: hFile=0x230, lpBuffer=0x672478*, nNumberOfBytesToWrite=0x13d17, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x672478*, lpNumberOfBytesWritten=0x243d7e4*=0x13d17, lpOverlapped=0x0) returned 1 [0074.809] GetProcessHeap () returned 0x630000 [0074.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672478 | out: hHeap=0x630000) returned 1 [0074.810] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.810] WriteFile (in: hFile=0x230, lpBuffer=0x672440*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672440*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0074.811] CloseHandle (hObject=0x230) returned 1 [0074.811] GetProcessHeap () returned 0x630000 [0074.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0074.811] GetProcessHeap () returned 0x630000 [0074.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655580 | out: hHeap=0x630000) returned 1 [0074.811] GetProcessHeap () returned 0x630000 [0074.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0074.811] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\sE2vpMDSF.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\sE2vpMDSF.mkv") returned="C:\\Users\\FD1HVy\\Desktop\\sE2vpMDSF.mkv" [0074.811] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\sE2vpMDSF.mkv", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\sE2vpMDSF.mkv.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\sE2vpMDSF.mkv.happythreechoose" [0074.811] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\sE2vpMDSF.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\se2vpmdsf.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\sE2vpMDSF.mkv.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\se2vpmdsf.mkv.happythreechoose"), dwFlags=0x1) returned 1 [0074.812] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\sE2vpMDSF.mkv" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0074.812] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned="" [0074.812] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" [0074.812] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\decryption info.html")) returned 0x20 [0074.812] GetProcessHeap () returned 0x630000 [0074.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0074.812] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0bfb80, ftCreationTime.dwHighDateTime=0x1d5d141, ftLastAccessTime.dwLowDateTime=0x16e25f60, ftLastAccessTime.dwHighDateTime=0x1d5d7e3, ftLastWriteTime.dwLowDateTime=0x16e25f60, ftLastWriteTime.dwHighDateTime=0x1d5d7e3, nFileSizeHigh=0x0, nFileSizeLow=0x742f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="U2qXqtqMCAL_.flv", cAlternateFileName="U2QXQT~1.FLV")) returned 1 [0074.812] lstrcmpiW (lpString1="U2qXqtqMCAL_.flv", lpString2=".") returned 1 [0074.812] lstrcmpiW (lpString1="U2qXqtqMCAL_.flv", lpString2="..") returned 1 [0074.812] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="U2qXqtqMCAL_.flv" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\U2qXqtqMCAL_.flv") returned="C:\\Users\\FD1HVy\\Desktop\\U2qXqtqMCAL_.flv" [0074.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="U2qXqtqMCAL_.flv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0074.812] GetProcessHeap () returned 0x630000 [0074.812] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11) returned 0x645ff8 [0074.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="U2qXqtqMCAL_.flv", cchWideChar=-1, lpMultiByteStr=0x645ff8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="U2qXqtqMCAL_.flv", lpUsedDefaultChar=0x0) returned 17 [0074.812] lstrlenA (lpString="U2qXqtqMCAL_.flv") returned 16 [0074.812] lstrlenA (lpString=".happythreechoose") returned 17 [0074.813] lstrcmpiW (lpString1="U2qXqtqMCAL_.flv", lpString2="Decryption INFO.html") returned 1 [0074.813] lstrcmpiW (lpString1="U2qXqtqMCAL_.flv", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0074.813] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0074.813] lstrcmpiW (lpString1="U2qXqtqMCAL_.flv", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0074.813] GetProcessHeap () returned 0x630000 [0074.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651ec0 [0074.813] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\U2qXqtqMCAL_.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\u2qxqtqmcal_.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0074.813] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=29743) returned 1 [0074.813] GetProcessHeap () returned 0x630000 [0074.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655490 [0074.813] GetProcessHeap () returned 0x630000 [0074.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.813] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\U2qXqtqMCAL_.flv") returned 40 [0074.813] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.813] GetProcessHeap () returned 0x630000 [0074.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0074.813] GetProcessHeap () returned 0x630000 [0074.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x672478 [0074.813] lstrlenA (lpString="rsa_encrypt") returned 11 [0074.813] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0074.814] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0074.814] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0074.814] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0074.814] GetProcessHeap () returned 0x630000 [0074.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0074.814] lstrlenA (lpString="010001") returned 6 [0074.814] GetProcessHeap () returned 0x630000 [0074.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2f8 [0074.814] GetProcessHeap () returned 0x630000 [0074.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.814] GetProcessHeap () returned 0x630000 [0074.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0074.814] GetProcessHeap () returned 0x630000 [0074.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.814] GetProcessHeap () returned 0x630000 [0074.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65eb20 [0074.814] GetProcessHeap () returned 0x630000 [0074.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657788 [0074.814] GetProcessHeap () returned 0x630000 [0074.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a328 [0074.814] GetProcessHeap () returned 0x630000 [0074.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0074.814] GetProcessHeap () returned 0x630000 [0074.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.814] GetProcessHeap () returned 0x630000 [0074.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0074.814] GetProcessHeap () returned 0x630000 [0074.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.814] GetProcessHeap () returned 0x630000 [0074.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657440 [0074.814] GetProcessHeap () returned 0x630000 [0074.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.814] GetProcessHeap () returned 0x630000 [0074.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0074.814] GetProcessHeap () returned 0x630000 [0074.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e610 [0074.815] GetProcessHeap () returned 0x630000 [0074.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.815] GetProcessHeap () returned 0x630000 [0074.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0074.815] GetProcessHeap () returned 0x630000 [0074.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0074.815] GetProcessHeap () returned 0x630000 [0074.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.815] GetProcessHeap () returned 0x630000 [0074.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0074.815] GetProcessHeap () returned 0x630000 [0074.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.815] GetProcessHeap () returned 0x630000 [0074.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.815] GetProcessHeap () returned 0x630000 [0074.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.815] GetProcessHeap () returned 0x630000 [0074.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.815] GetProcessHeap () returned 0x630000 [0074.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e3d0 [0074.815] GetProcessHeap () returned 0x630000 [0074.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0074.815] GetProcessHeap () returned 0x630000 [0074.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0074.815] GetProcessHeap () returned 0x630000 [0074.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0074.815] GetProcessHeap () returned 0x630000 [0074.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.815] GetProcessHeap () returned 0x630000 [0074.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.815] GetProcessHeap () returned 0x630000 [0074.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.815] GetProcessHeap () returned 0x630000 [0074.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.815] GetProcessHeap () returned 0x630000 [0074.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.815] GetProcessHeap () returned 0x630000 [0074.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.815] GetProcessHeap () returned 0x630000 [0074.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.815] GetProcessHeap () returned 0x630000 [0074.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.816] GetProcessHeap () returned 0x630000 [0074.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.816] GetProcessHeap () returned 0x630000 [0074.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.816] GetProcessHeap () returned 0x630000 [0074.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.816] GetProcessHeap () returned 0x630000 [0074.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.816] GetProcessHeap () returned 0x630000 [0074.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.816] GetProcessHeap () returned 0x630000 [0074.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.816] GetProcessHeap () returned 0x630000 [0074.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.816] GetProcessHeap () returned 0x630000 [0074.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.816] GetProcessHeap () returned 0x630000 [0074.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.816] GetProcessHeap () returned 0x630000 [0074.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.816] GetProcessHeap () returned 0x630000 [0074.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.816] GetProcessHeap () returned 0x630000 [0074.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.816] GetProcessHeap () returned 0x630000 [0074.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.816] GetProcessHeap () returned 0x630000 [0074.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.816] GetProcessHeap () returned 0x630000 [0074.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.816] GetProcessHeap () returned 0x630000 [0074.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.816] GetProcessHeap () returned 0x630000 [0074.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.816] GetProcessHeap () returned 0x630000 [0074.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.816] GetProcessHeap () returned 0x630000 [0074.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.816] GetProcessHeap () returned 0x630000 [0074.817] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.817] GetProcessHeap () returned 0x630000 [0074.817] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.817] GetProcessHeap () returned 0x630000 [0074.817] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.817] GetProcessHeap () returned 0x630000 [0074.817] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.817] GetProcessHeap () returned 0x630000 [0074.817] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.817] GetProcessHeap () returned 0x630000 [0074.817] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.817] GetProcessHeap () returned 0x630000 [0074.817] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.817] GetProcessHeap () returned 0x630000 [0074.817] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.817] GetProcessHeap () returned 0x630000 [0074.817] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.817] GetProcessHeap () returned 0x630000 [0074.817] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.817] GetProcessHeap () returned 0x630000 [0074.817] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.817] GetProcessHeap () returned 0x630000 [0074.817] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.817] GetProcessHeap () returned 0x630000 [0074.817] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.817] GetProcessHeap () returned 0x630000 [0074.817] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.817] GetProcessHeap () returned 0x630000 [0074.817] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.817] GetProcessHeap () returned 0x630000 [0074.817] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.817] GetProcessHeap () returned 0x630000 [0074.817] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.817] GetProcessHeap () returned 0x630000 [0074.817] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.817] GetProcessHeap () returned 0x630000 [0074.817] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.817] GetProcessHeap () returned 0x630000 [0074.817] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.817] GetProcessHeap () returned 0x630000 [0074.818] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.818] GetProcessHeap () returned 0x630000 [0074.818] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.818] GetProcessHeap () returned 0x630000 [0074.818] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.818] GetProcessHeap () returned 0x630000 [0074.818] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.818] GetProcessHeap () returned 0x630000 [0074.818] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.818] GetProcessHeap () returned 0x630000 [0074.818] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.818] GetProcessHeap () returned 0x630000 [0074.818] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.818] GetProcessHeap () returned 0x630000 [0074.818] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.818] GetProcessHeap () returned 0x630000 [0074.818] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.818] GetProcessHeap () returned 0x630000 [0074.818] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.818] GetProcessHeap () returned 0x630000 [0074.818] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.818] GetProcessHeap () returned 0x630000 [0074.818] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.818] GetProcessHeap () returned 0x630000 [0074.818] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.818] GetProcessHeap () returned 0x630000 [0074.818] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.818] GetProcessHeap () returned 0x630000 [0074.818] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.818] GetProcessHeap () returned 0x630000 [0074.818] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0074.818] GetProcessHeap () returned 0x630000 [0074.818] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0074.818] GetProcessHeap () returned 0x630000 [0074.818] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.818] GetProcessHeap () returned 0x630000 [0074.818] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.818] GetProcessHeap () returned 0x630000 [0074.818] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.818] GetProcessHeap () returned 0x630000 [0074.818] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.819] GetProcessHeap () returned 0x630000 [0074.819] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.819] GetProcessHeap () returned 0x630000 [0074.819] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.819] GetProcessHeap () returned 0x630000 [0074.819] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.819] GetProcessHeap () returned 0x630000 [0074.819] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.819] GetProcessHeap () returned 0x630000 [0074.819] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.819] GetProcessHeap () returned 0x630000 [0074.819] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.819] GetProcessHeap () returned 0x630000 [0074.819] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.819] GetProcessHeap () returned 0x630000 [0074.819] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.819] GetProcessHeap () returned 0x630000 [0074.819] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.819] GetProcessHeap () returned 0x630000 [0074.819] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.819] GetProcessHeap () returned 0x630000 [0074.819] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.819] GetProcessHeap () returned 0x630000 [0074.819] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.819] GetProcessHeap () returned 0x630000 [0074.819] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.819] GetProcessHeap () returned 0x630000 [0074.819] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.819] GetProcessHeap () returned 0x630000 [0074.819] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0074.819] GetProcessHeap () returned 0x630000 [0074.819] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0074.819] GetProcessHeap () returned 0x630000 [0074.819] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0074.819] GetProcessHeap () returned 0x630000 [0074.819] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0074.819] GetProcessHeap () returned 0x630000 [0074.819] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0074.820] GetProcessHeap () returned 0x630000 [0074.820] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0074.820] GetProcessHeap () returned 0x630000 [0074.820] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0074.820] GetProcessHeap () returned 0x630000 [0074.820] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0074.820] GetProcessHeap () returned 0x630000 [0074.820] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0074.820] GetProcessHeap () returned 0x630000 [0074.820] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.820] GetProcessHeap () returned 0x630000 [0074.820] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0074.820] WriteFile (in: hFile=0x230, lpBuffer=0x672478*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672478*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0074.821] GetProcessHeap () returned 0x630000 [0074.821] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x672478, Size=0x30) returned 0x672478 [0074.821] GetProcessHeap () returned 0x630000 [0074.822] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0074.822] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.822] GetProcessHeap () returned 0x630000 [0074.822] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x742f) returned 0x6724b0 [0074.822] ReadFile (in: hFile=0x230, lpBuffer=0x6724b0, nNumberOfBytesToRead=0x742f, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x6724b0*, lpNumberOfBytesRead=0x243d7e8*=0x742f, lpOverlapped=0x0) returned 1 [0074.822] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.822] WriteFile (in: hFile=0x230, lpBuffer=0x6724b0*, nNumberOfBytesToWrite=0x742f, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x6724b0*, lpNumberOfBytesWritten=0x243d7e4*=0x742f, lpOverlapped=0x0) returned 1 [0074.826] GetProcessHeap () returned 0x630000 [0074.826] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6724b0 | out: hHeap=0x630000) returned 1 [0074.827] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.827] WriteFile (in: hFile=0x230, lpBuffer=0x672478*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672478*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0074.828] CloseHandle (hObject=0x230) returned 1 [0074.828] GetProcessHeap () returned 0x630000 [0074.828] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651ec0 | out: hHeap=0x630000) returned 1 [0074.828] GetProcessHeap () returned 0x630000 [0074.828] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655490 | out: hHeap=0x630000) returned 1 [0074.828] GetProcessHeap () returned 0x630000 [0074.828] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0074.828] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\U2qXqtqMCAL_.flv" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\U2qXqtqMCAL_.flv") returned="C:\\Users\\FD1HVy\\Desktop\\U2qXqtqMCAL_.flv" [0074.829] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\U2qXqtqMCAL_.flv", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\U2qXqtqMCAL_.flv.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\U2qXqtqMCAL_.flv.happythreechoose" [0074.829] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\U2qXqtqMCAL_.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\u2qxqtqmcal_.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\U2qXqtqMCAL_.flv.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\u2qxqtqmcal_.flv.happythreechoose"), dwFlags=0x1) returned 1 [0074.829] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\U2qXqtqMCAL_.flv" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0074.829] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned="" [0074.829] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" [0074.829] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\decryption info.html")) returned 0x20 [0074.829] GetProcessHeap () returned 0x630000 [0074.829] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645ff8 | out: hHeap=0x630000) returned 1 [0074.829] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83b6d660, ftCreationTime.dwHighDateTime=0x1d5cdda, ftLastAccessTime.dwLowDateTime=0xc55c88b0, ftLastAccessTime.dwHighDateTime=0x1d5cf8a, ftLastWriteTime.dwLowDateTime=0xc55c88b0, ftLastWriteTime.dwHighDateTime=0x1d5cf8a, nFileSizeHigh=0x0, nFileSizeLow=0x8f86, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ugosVgZJsJnzR6HAu.jpg", cAlternateFileName="UGOSVG~1.JPG")) returned 1 [0074.829] lstrcmpiW (lpString1="ugosVgZJsJnzR6HAu.jpg", lpString2=".") returned 1 [0074.829] lstrcmpiW (lpString1="ugosVgZJsJnzR6HAu.jpg", lpString2="..") returned 1 [0074.829] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="ugosVgZJsJnzR6HAu.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\ugosVgZJsJnzR6HAu.jpg") returned="C:\\Users\\FD1HVy\\Desktop\\ugosVgZJsJnzR6HAu.jpg" [0074.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ugosVgZJsJnzR6HAu.jpg", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0074.829] GetProcessHeap () returned 0x630000 [0074.829] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x645e58 [0074.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ugosVgZJsJnzR6HAu.jpg", cchWideChar=-1, lpMultiByteStr=0x645e58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ugosVgZJsJnzR6HAu.jpg", lpUsedDefaultChar=0x0) returned 22 [0074.829] lstrlenA (lpString="ugosVgZJsJnzR6HAu.jpg") returned 21 [0074.830] lstrlenA (lpString=".happythreechoose") returned 17 [0074.830] lstrlenA (lpString=".happythreechoose") returned 17 [0074.830] lstrlenA (lpString="ugosVgZJsJnzR6HAu.jpg") returned 21 [0074.830] lstrcmpiA (lpString1="VgZJsJnzR6HAu.jpg", lpString2=".happythreechoose") returned 1 [0074.830] lstrcmpiW (lpString1="ugosVgZJsJnzR6HAu.jpg", lpString2="Decryption INFO.html") returned 1 [0074.830] lstrcmpiW (lpString1="ugosVgZJsJnzR6HAu.jpg", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0074.830] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0074.830] lstrcmpiW (lpString1="ugosVgZJsJnzR6HAu.jpg", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0074.830] GetProcessHeap () returned 0x630000 [0074.830] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0074.830] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ugosVgZJsJnzR6HAu.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\ugosvgzjsjnzr6hau.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0074.830] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=36742) returned 1 [0074.830] GetProcessHeap () returned 0x630000 [0074.830] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655418 [0074.830] GetProcessHeap () returned 0x630000 [0074.830] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.830] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\ugosVgZJsJnzR6HAu.jpg") returned 45 [0074.830] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.830] GetProcessHeap () returned 0x630000 [0074.830] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0074.830] GetProcessHeap () returned 0x630000 [0074.830] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38a) returned 0x6724b0 [0074.831] lstrlenA (lpString="rsa_encrypt") returned 11 [0074.831] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0074.832] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0074.832] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0074.832] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0074.832] GetProcessHeap () returned 0x630000 [0074.832] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0074.832] lstrlenA (lpString="010001") returned 6 [0074.832] GetProcessHeap () returned 0x630000 [0074.832] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2f8 [0074.832] GetProcessHeap () returned 0x630000 [0074.832] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.832] GetProcessHeap () returned 0x630000 [0074.832] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0074.832] GetProcessHeap () returned 0x630000 [0074.832] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.832] GetProcessHeap () returned 0x630000 [0074.832] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e100 [0074.832] GetProcessHeap () returned 0x630000 [0074.832] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656ec8 [0074.832] GetProcessHeap () returned 0x630000 [0074.832] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a318 [0074.832] GetProcessHeap () returned 0x630000 [0074.832] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0074.832] GetProcessHeap () returned 0x630000 [0074.832] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.832] GetProcessHeap () returned 0x630000 [0074.832] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0074.832] GetProcessHeap () returned 0x630000 [0074.832] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.832] GetProcessHeap () returned 0x630000 [0074.832] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656950 [0074.832] GetProcessHeap () returned 0x630000 [0074.832] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.833] GetProcessHeap () returned 0x630000 [0074.833] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0074.833] GetProcessHeap () returned 0x630000 [0074.833] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0074.833] GetProcessHeap () returned 0x630000 [0074.833] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.833] GetProcessHeap () returned 0x630000 [0074.833] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0074.833] GetProcessHeap () returned 0x630000 [0074.833] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0074.833] GetProcessHeap () returned 0x630000 [0074.833] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.833] GetProcessHeap () returned 0x630000 [0074.833] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0074.833] GetProcessHeap () returned 0x630000 [0074.833] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.833] GetProcessHeap () returned 0x630000 [0074.833] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.833] GetProcessHeap () returned 0x630000 [0074.833] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0074.833] GetProcessHeap () returned 0x630000 [0074.833] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0074.833] GetProcessHeap () returned 0x630000 [0074.833] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65dda0 [0074.833] GetProcessHeap () returned 0x630000 [0074.833] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0074.833] GetProcessHeap () returned 0x630000 [0074.833] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0074.833] GetProcessHeap () returned 0x630000 [0074.833] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0074.833] GetProcessHeap () returned 0x630000 [0074.833] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.833] GetProcessHeap () returned 0x630000 [0074.833] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.833] GetProcessHeap () returned 0x630000 [0074.833] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.833] GetProcessHeap () returned 0x630000 [0074.833] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.833] GetProcessHeap () returned 0x630000 [0074.834] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.834] GetProcessHeap () returned 0x630000 [0074.834] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.834] GetProcessHeap () returned 0x630000 [0074.834] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.834] GetProcessHeap () returned 0x630000 [0074.834] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.834] GetProcessHeap () returned 0x630000 [0074.834] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.834] GetProcessHeap () returned 0x630000 [0074.834] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.834] GetProcessHeap () returned 0x630000 [0074.834] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.834] GetProcessHeap () returned 0x630000 [0074.834] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.834] GetProcessHeap () returned 0x630000 [0074.834] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.834] GetProcessHeap () returned 0x630000 [0074.834] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.834] GetProcessHeap () returned 0x630000 [0074.834] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.834] GetProcessHeap () returned 0x630000 [0074.834] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.834] GetProcessHeap () returned 0x630000 [0074.834] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.834] GetProcessHeap () returned 0x630000 [0074.834] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.834] GetProcessHeap () returned 0x630000 [0074.834] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.834] GetProcessHeap () returned 0x630000 [0074.834] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.834] GetProcessHeap () returned 0x630000 [0074.834] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.834] GetProcessHeap () returned 0x630000 [0074.834] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.834] GetProcessHeap () returned 0x630000 [0074.834] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.834] GetProcessHeap () returned 0x630000 [0074.834] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.835] GetProcessHeap () returned 0x630000 [0074.835] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.835] GetProcessHeap () returned 0x630000 [0074.835] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.835] GetProcessHeap () returned 0x630000 [0074.835] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.835] GetProcessHeap () returned 0x630000 [0074.835] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.835] GetProcessHeap () returned 0x630000 [0074.835] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.835] GetProcessHeap () returned 0x630000 [0074.835] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.835] GetProcessHeap () returned 0x630000 [0074.835] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.835] GetProcessHeap () returned 0x630000 [0074.835] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.835] GetProcessHeap () returned 0x630000 [0074.835] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.835] GetProcessHeap () returned 0x630000 [0074.835] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.835] GetProcessHeap () returned 0x630000 [0074.835] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.835] GetProcessHeap () returned 0x630000 [0074.835] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.835] GetProcessHeap () returned 0x630000 [0074.835] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.835] GetProcessHeap () returned 0x630000 [0074.835] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.835] GetProcessHeap () returned 0x630000 [0074.835] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.835] GetProcessHeap () returned 0x630000 [0074.835] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.835] GetProcessHeap () returned 0x630000 [0074.835] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.835] GetProcessHeap () returned 0x630000 [0074.835] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.835] GetProcessHeap () returned 0x630000 [0074.835] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.836] GetProcessHeap () returned 0x630000 [0074.836] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.836] GetProcessHeap () returned 0x630000 [0074.836] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.836] GetProcessHeap () returned 0x630000 [0074.836] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.836] GetProcessHeap () returned 0x630000 [0074.836] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.836] GetProcessHeap () returned 0x630000 [0074.836] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.836] GetProcessHeap () returned 0x630000 [0074.836] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.836] GetProcessHeap () returned 0x630000 [0074.836] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.836] GetProcessHeap () returned 0x630000 [0074.836] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.836] GetProcessHeap () returned 0x630000 [0074.836] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.836] GetProcessHeap () returned 0x630000 [0074.836] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.836] GetProcessHeap () returned 0x630000 [0074.836] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.836] GetProcessHeap () returned 0x630000 [0074.836] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.836] GetProcessHeap () returned 0x630000 [0074.836] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.836] GetProcessHeap () returned 0x630000 [0074.836] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.836] GetProcessHeap () returned 0x630000 [0074.836] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.836] GetProcessHeap () returned 0x630000 [0074.836] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.836] GetProcessHeap () returned 0x630000 [0074.836] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.836] GetProcessHeap () returned 0x630000 [0074.836] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.836] GetProcessHeap () returned 0x630000 [0074.836] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.836] GetProcessHeap () returned 0x630000 [0074.836] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0074.836] GetProcessHeap () returned 0x630000 [0074.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0074.837] GetProcessHeap () returned 0x630000 [0074.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.837] GetProcessHeap () returned 0x630000 [0074.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.837] GetProcessHeap () returned 0x630000 [0074.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.837] GetProcessHeap () returned 0x630000 [0074.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.837] GetProcessHeap () returned 0x630000 [0074.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.837] GetProcessHeap () returned 0x630000 [0074.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.837] GetProcessHeap () returned 0x630000 [0074.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.837] GetProcessHeap () returned 0x630000 [0074.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.837] GetProcessHeap () returned 0x630000 [0074.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.837] GetProcessHeap () returned 0x630000 [0074.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.837] GetProcessHeap () returned 0x630000 [0074.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.837] GetProcessHeap () returned 0x630000 [0074.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.837] GetProcessHeap () returned 0x630000 [0074.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.837] GetProcessHeap () returned 0x630000 [0074.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.837] GetProcessHeap () returned 0x630000 [0074.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.837] GetProcessHeap () returned 0x630000 [0074.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.837] GetProcessHeap () returned 0x630000 [0074.837] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.837] GetProcessHeap () returned 0x630000 [0074.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.837] GetProcessHeap () returned 0x630000 [0074.837] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0074.837] GetProcessHeap () returned 0x630000 [0074.838] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0074.838] GetProcessHeap () returned 0x630000 [0074.838] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0074.838] GetProcessHeap () returned 0x630000 [0074.838] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0074.838] GetProcessHeap () returned 0x630000 [0074.838] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0074.838] GetProcessHeap () returned 0x630000 [0074.838] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0074.838] GetProcessHeap () returned 0x630000 [0074.838] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0074.838] GetProcessHeap () returned 0x630000 [0074.838] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0074.838] GetProcessHeap () returned 0x630000 [0074.838] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0074.838] GetProcessHeap () returned 0x630000 [0074.838] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.838] GetProcessHeap () returned 0x630000 [0074.838] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0074.838] WriteFile (in: hFile=0x230, lpBuffer=0x6724b0*, nNumberOfBytesToWrite=0x38a, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6724b0*, lpNumberOfBytesWritten=0x243d864*=0x38a, lpOverlapped=0x0) returned 1 [0074.840] GetProcessHeap () returned 0x630000 [0074.840] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6724b0, Size=0x30) returned 0x6724b0 [0074.840] GetProcessHeap () returned 0x630000 [0074.840] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0074.840] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.840] GetProcessHeap () returned 0x630000 [0074.840] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8f90) returned 0x6724e8 [0074.841] ReadFile (in: hFile=0x230, lpBuffer=0x6724e8, nNumberOfBytesToRead=0x8f90, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x6724e8*, lpNumberOfBytesRead=0x243d7e8*=0x8f90, lpOverlapped=0x0) returned 1 [0074.842] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.842] WriteFile (in: hFile=0x230, lpBuffer=0x6724e8*, nNumberOfBytesToWrite=0x8f90, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x6724e8*, lpNumberOfBytesWritten=0x243d7e4*=0x8f90, lpOverlapped=0x0) returned 1 [0074.843] GetProcessHeap () returned 0x630000 [0074.843] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6724e8 | out: hHeap=0x630000) returned 1 [0074.843] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.843] WriteFile (in: hFile=0x230, lpBuffer=0x6724b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6724b0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0074.844] CloseHandle (hObject=0x230) returned 1 [0074.845] GetProcessHeap () returned 0x630000 [0074.845] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0074.845] GetProcessHeap () returned 0x630000 [0074.845] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655418 | out: hHeap=0x630000) returned 1 [0074.845] GetProcessHeap () returned 0x630000 [0074.845] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0074.845] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\ugosVgZJsJnzR6HAu.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\ugosVgZJsJnzR6HAu.jpg") returned="C:\\Users\\FD1HVy\\Desktop\\ugosVgZJsJnzR6HAu.jpg" [0074.845] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\ugosVgZJsJnzR6HAu.jpg", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\ugosVgZJsJnzR6HAu.jpg.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\ugosVgZJsJnzR6HAu.jpg.happythreechoose" [0074.845] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ugosVgZJsJnzR6HAu.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\ugosvgzjsjnzr6hau.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\ugosVgZJsJnzR6HAu.jpg.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\ugosvgzjsjnzr6hau.jpg.happythreechoose"), dwFlags=0x1) returned 1 [0074.845] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\ugosVgZJsJnzR6HAu.jpg" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0074.845] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned="" [0074.845] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" [0074.845] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\decryption info.html")) returned 0x20 [0074.846] GetProcessHeap () returned 0x630000 [0074.846] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645e58 | out: hHeap=0x630000) returned 1 [0074.846] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11df8db0, ftCreationTime.dwHighDateTime=0x1d5d632, ftLastAccessTime.dwLowDateTime=0xaa354470, ftLastAccessTime.dwHighDateTime=0x1d5ca5b, ftLastWriteTime.dwLowDateTime=0xaa354470, ftLastWriteTime.dwHighDateTime=0x1d5ca5b, nFileSizeHigh=0x0, nFileSizeLow=0x13bde, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="U_q3crBpXL2iRXxEea.gif", cAlternateFileName="U_Q3CR~1.GIF")) returned 1 [0074.846] lstrcmpiW (lpString1="U_q3crBpXL2iRXxEea.gif", lpString2=".") returned 1 [0074.846] lstrcmpiW (lpString1="U_q3crBpXL2iRXxEea.gif", lpString2="..") returned 1 [0074.846] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="U_q3crBpXL2iRXxEea.gif" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\U_q3crBpXL2iRXxEea.gif") returned="C:\\Users\\FD1HVy\\Desktop\\U_q3crBpXL2iRXxEea.gif" [0074.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="U_q3crBpXL2iRXxEea.gif", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0074.846] GetProcessHeap () returned 0x630000 [0074.846] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x17) returned 0x645e78 [0074.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="U_q3crBpXL2iRXxEea.gif", cchWideChar=-1, lpMultiByteStr=0x645e78, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="U_q3crBpXL2iRXxEea.gif", lpUsedDefaultChar=0x0) returned 23 [0074.846] lstrlenA (lpString="U_q3crBpXL2iRXxEea.gif") returned 22 [0074.846] lstrlenA (lpString=".happythreechoose") returned 17 [0074.846] lstrlenA (lpString=".happythreechoose") returned 17 [0074.846] lstrlenA (lpString="U_q3crBpXL2iRXxEea.gif") returned 22 [0074.846] lstrcmpiA (lpString1="rBpXL2iRXxEea.gif", lpString2=".happythreechoose") returned 1 [0074.846] lstrcmpiW (lpString1="U_q3crBpXL2iRXxEea.gif", lpString2="Decryption INFO.html") returned 1 [0074.846] lstrcmpiW (lpString1="U_q3crBpXL2iRXxEea.gif", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0074.846] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0074.846] lstrcmpiW (lpString1="U_q3crBpXL2iRXxEea.gif", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0074.846] GetProcessHeap () returned 0x630000 [0074.846] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0074.846] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\U_q3crBpXL2iRXxEea.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\u_q3crbpxl2irxxeea.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0074.846] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=80862) returned 1 [0074.846] GetProcessHeap () returned 0x630000 [0074.846] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655760 [0074.846] GetProcessHeap () returned 0x630000 [0074.846] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.846] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\U_q3crBpXL2iRXxEea.gif") returned 46 [0074.846] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.847] GetProcessHeap () returned 0x630000 [0074.847] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0074.847] GetProcessHeap () returned 0x630000 [0074.847] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x6724e8 [0074.847] lstrlenA (lpString="rsa_encrypt") returned 11 [0074.847] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0074.847] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0074.847] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0074.847] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0074.847] GetProcessHeap () returned 0x630000 [0074.847] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0074.847] lstrlenA (lpString="010001") returned 6 [0074.847] GetProcessHeap () returned 0x630000 [0074.847] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2f8 [0074.847] GetProcessHeap () returned 0x630000 [0074.847] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.847] GetProcessHeap () returned 0x630000 [0074.847] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e8e0 [0074.848] GetProcessHeap () returned 0x630000 [0074.848] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.848] GetProcessHeap () returned 0x630000 [0074.848] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e6a0 [0074.848] GetProcessHeap () returned 0x630000 [0074.848] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656ec8 [0074.848] GetProcessHeap () returned 0x630000 [0074.848] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0074.848] GetProcessHeap () returned 0x630000 [0074.848] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0074.848] GetProcessHeap () returned 0x630000 [0074.848] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.848] GetProcessHeap () returned 0x630000 [0074.848] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0074.848] GetProcessHeap () returned 0x630000 [0074.848] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.848] GetProcessHeap () returned 0x630000 [0074.848] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656950 [0074.848] GetProcessHeap () returned 0x630000 [0074.848] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.848] GetProcessHeap () returned 0x630000 [0074.848] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0074.848] GetProcessHeap () returned 0x630000 [0074.848] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0074.848] GetProcessHeap () returned 0x630000 [0074.848] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.848] GetProcessHeap () returned 0x630000 [0074.848] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0074.848] GetProcessHeap () returned 0x630000 [0074.848] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0074.848] GetProcessHeap () returned 0x630000 [0074.848] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.848] GetProcessHeap () returned 0x630000 [0074.848] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0074.848] GetProcessHeap () returned 0x630000 [0074.848] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.848] GetProcessHeap () returned 0x630000 [0074.848] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.848] GetProcessHeap () returned 0x630000 [0074.848] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.849] GetProcessHeap () returned 0x630000 [0074.849] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.849] GetProcessHeap () returned 0x630000 [0074.849] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e2b0 [0074.849] GetProcessHeap () returned 0x630000 [0074.849] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0074.849] GetProcessHeap () returned 0x630000 [0074.849] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0074.849] GetProcessHeap () returned 0x630000 [0074.849] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e2b0 | out: hHeap=0x630000) returned 1 [0074.849] GetProcessHeap () returned 0x630000 [0074.849] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.849] GetProcessHeap () returned 0x630000 [0074.849] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.849] GetProcessHeap () returned 0x630000 [0074.849] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.849] GetProcessHeap () returned 0x630000 [0074.849] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.849] GetProcessHeap () returned 0x630000 [0074.849] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.849] GetProcessHeap () returned 0x630000 [0074.849] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.849] GetProcessHeap () returned 0x630000 [0074.849] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.849] GetProcessHeap () returned 0x630000 [0074.849] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.849] GetProcessHeap () returned 0x630000 [0074.849] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.849] GetProcessHeap () returned 0x630000 [0074.849] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.849] GetProcessHeap () returned 0x630000 [0074.849] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.849] GetProcessHeap () returned 0x630000 [0074.849] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.849] GetProcessHeap () returned 0x630000 [0074.849] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.849] GetProcessHeap () returned 0x630000 [0074.849] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.849] GetProcessHeap () returned 0x630000 [0074.849] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.850] GetProcessHeap () returned 0x630000 [0074.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.850] GetProcessHeap () returned 0x630000 [0074.850] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.850] GetProcessHeap () returned 0x630000 [0074.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.850] GetProcessHeap () returned 0x630000 [0074.850] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.850] GetProcessHeap () returned 0x630000 [0074.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.850] GetProcessHeap () returned 0x630000 [0074.850] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.850] GetProcessHeap () returned 0x630000 [0074.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.850] GetProcessHeap () returned 0x630000 [0074.850] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.850] GetProcessHeap () returned 0x630000 [0074.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.850] GetProcessHeap () returned 0x630000 [0074.850] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.850] GetProcessHeap () returned 0x630000 [0074.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.850] GetProcessHeap () returned 0x630000 [0074.850] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.850] GetProcessHeap () returned 0x630000 [0074.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.850] GetProcessHeap () returned 0x630000 [0074.850] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.850] GetProcessHeap () returned 0x630000 [0074.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.850] GetProcessHeap () returned 0x630000 [0074.850] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.850] GetProcessHeap () returned 0x630000 [0074.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.850] GetProcessHeap () returned 0x630000 [0074.850] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.850] GetProcessHeap () returned 0x630000 [0074.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.851] GetProcessHeap () returned 0x630000 [0074.851] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.851] GetProcessHeap () returned 0x630000 [0074.851] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.851] GetProcessHeap () returned 0x630000 [0074.851] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.851] GetProcessHeap () returned 0x630000 [0074.851] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.851] GetProcessHeap () returned 0x630000 [0074.851] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0074.851] GetProcessHeap () returned 0x630000 [0074.851] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0074.851] GetProcessHeap () returned 0x630000 [0074.851] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.851] GetProcessHeap () returned 0x630000 [0074.851] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.851] GetProcessHeap () returned 0x630000 [0074.851] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.851] GetProcessHeap () returned 0x630000 [0074.851] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.851] GetProcessHeap () returned 0x630000 [0074.851] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.851] GetProcessHeap () returned 0x630000 [0074.851] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.851] GetProcessHeap () returned 0x630000 [0074.851] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.851] GetProcessHeap () returned 0x630000 [0074.851] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.851] GetProcessHeap () returned 0x630000 [0074.851] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.851] GetProcessHeap () returned 0x630000 [0074.851] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.851] GetProcessHeap () returned 0x630000 [0074.851] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.851] GetProcessHeap () returned 0x630000 [0074.851] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.851] GetProcessHeap () returned 0x630000 [0074.851] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.852] GetProcessHeap () returned 0x630000 [0074.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.852] GetProcessHeap () returned 0x630000 [0074.852] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.852] GetProcessHeap () returned 0x630000 [0074.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.852] GetProcessHeap () returned 0x630000 [0074.852] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.852] GetProcessHeap () returned 0x630000 [0074.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.852] GetProcessHeap () returned 0x630000 [0074.852] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.852] GetProcessHeap () returned 0x630000 [0074.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.852] GetProcessHeap () returned 0x630000 [0074.852] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.852] GetProcessHeap () returned 0x630000 [0074.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.852] GetProcessHeap () returned 0x630000 [0074.852] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.852] GetProcessHeap () returned 0x630000 [0074.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.852] GetProcessHeap () returned 0x630000 [0074.852] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.852] GetProcessHeap () returned 0x630000 [0074.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.852] GetProcessHeap () returned 0x630000 [0074.852] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.852] GetProcessHeap () returned 0x630000 [0074.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.852] GetProcessHeap () returned 0x630000 [0074.852] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.852] GetProcessHeap () returned 0x630000 [0074.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.852] GetProcessHeap () returned 0x630000 [0074.852] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.852] GetProcessHeap () returned 0x630000 [0074.852] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.852] GetProcessHeap () returned 0x630000 [0074.852] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.853] GetProcessHeap () returned 0x630000 [0074.853] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.853] GetProcessHeap () returned 0x630000 [0074.853] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.853] GetProcessHeap () returned 0x630000 [0074.853] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.853] GetProcessHeap () returned 0x630000 [0074.853] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.853] GetProcessHeap () returned 0x630000 [0074.853] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.853] GetProcessHeap () returned 0x630000 [0074.853] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.853] GetProcessHeap () returned 0x630000 [0074.853] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.853] GetProcessHeap () returned 0x630000 [0074.853] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.853] GetProcessHeap () returned 0x630000 [0074.853] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.853] GetProcessHeap () returned 0x630000 [0074.853] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0074.853] GetProcessHeap () returned 0x630000 [0074.853] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0074.853] GetProcessHeap () returned 0x630000 [0074.853] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0074.853] GetProcessHeap () returned 0x630000 [0074.853] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0074.853] GetProcessHeap () returned 0x630000 [0074.853] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0074.853] GetProcessHeap () returned 0x630000 [0074.853] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e6a0 | out: hHeap=0x630000) returned 1 [0074.853] GetProcessHeap () returned 0x630000 [0074.853] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0074.853] GetProcessHeap () returned 0x630000 [0074.853] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0074.853] GetProcessHeap () returned 0x630000 [0074.853] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0074.853] GetProcessHeap () returned 0x630000 [0074.853] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.854] GetProcessHeap () returned 0x630000 [0074.854] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0074.854] WriteFile (in: hFile=0x230, lpBuffer=0x6724e8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6724e8*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0074.855] GetProcessHeap () returned 0x630000 [0074.855] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6724e8, Size=0x30) returned 0x6724e8 [0074.855] GetProcessHeap () returned 0x630000 [0074.856] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0074.856] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.856] GetProcessHeap () returned 0x630000 [0074.856] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x13bde) returned 0x672520 [0074.856] ReadFile (in: hFile=0x230, lpBuffer=0x672520, nNumberOfBytesToRead=0x13bde, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x672520*, lpNumberOfBytesRead=0x243d7e8*=0x13bde, lpOverlapped=0x0) returned 1 [0074.857] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.857] WriteFile (in: hFile=0x230, lpBuffer=0x672520*, nNumberOfBytesToWrite=0x13bde, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x672520*, lpNumberOfBytesWritten=0x243d7e4*=0x13bde, lpOverlapped=0x0) returned 1 [0074.859] GetProcessHeap () returned 0x630000 [0074.859] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672520 | out: hHeap=0x630000) returned 1 [0074.860] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.860] WriteFile (in: hFile=0x230, lpBuffer=0x6724e8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6724e8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0074.861] CloseHandle (hObject=0x230) returned 1 [0074.861] GetProcessHeap () returned 0x630000 [0074.861] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0074.861] GetProcessHeap () returned 0x630000 [0074.861] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655760 | out: hHeap=0x630000) returned 1 [0074.861] GetProcessHeap () returned 0x630000 [0074.861] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0074.861] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\U_q3crBpXL2iRXxEea.gif" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\U_q3crBpXL2iRXxEea.gif") returned="C:\\Users\\FD1HVy\\Desktop\\U_q3crBpXL2iRXxEea.gif" [0074.861] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\U_q3crBpXL2iRXxEea.gif", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\U_q3crBpXL2iRXxEea.gif.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\U_q3crBpXL2iRXxEea.gif.happythreechoose" [0074.861] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\U_q3crBpXL2iRXxEea.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\u_q3crbpxl2irxxeea.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\U_q3crBpXL2iRXxEea.gif.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\u_q3crbpxl2irxxeea.gif.happythreechoose"), dwFlags=0x1) returned 1 [0074.862] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\U_q3crBpXL2iRXxEea.gif" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0074.862] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned="" [0074.862] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" [0074.862] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\decryption info.html")) returned 0x20 [0074.862] GetProcessHeap () returned 0x630000 [0074.862] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645e78 | out: hHeap=0x630000) returned 1 [0074.862] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3dc0df0, ftCreationTime.dwHighDateTime=0x1d5c8ab, ftLastAccessTime.dwLowDateTime=0xdd79d940, ftLastAccessTime.dwHighDateTime=0x1d5c9ed, ftLastWriteTime.dwLowDateTime=0xdd79d940, ftLastWriteTime.dwHighDateTime=0x1d5c9ed, nFileSizeHigh=0x0, nFileSizeLow=0x9063, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VuB3Slo6mrmvViWmZxu.mp3", cAlternateFileName="VUB3SL~1.MP3")) returned 1 [0074.862] lstrcmpiW (lpString1="VuB3Slo6mrmvViWmZxu.mp3", lpString2=".") returned 1 [0074.862] lstrcmpiW (lpString1="VuB3Slo6mrmvViWmZxu.mp3", lpString2="..") returned 1 [0074.862] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="VuB3Slo6mrmvViWmZxu.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\VuB3Slo6mrmvViWmZxu.mp3") returned="C:\\Users\\FD1HVy\\Desktop\\VuB3Slo6mrmvViWmZxu.mp3" [0074.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VuB3Slo6mrmvViWmZxu.mp3", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0074.862] GetProcessHeap () returned 0x630000 [0074.862] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18) returned 0x645d58 [0074.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VuB3Slo6mrmvViWmZxu.mp3", cchWideChar=-1, lpMultiByteStr=0x645d58, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VuB3Slo6mrmvViWmZxu.mp3", lpUsedDefaultChar=0x0) returned 24 [0074.862] lstrlenA (lpString="VuB3Slo6mrmvViWmZxu.mp3") returned 23 [0074.862] lstrlenA (lpString=".happythreechoose") returned 17 [0074.862] lstrlenA (lpString=".happythreechoose") returned 17 [0074.862] lstrlenA (lpString="VuB3Slo6mrmvViWmZxu.mp3") returned 23 [0074.862] lstrcmpiA (lpString1="o6mrmvViWmZxu.mp3", lpString2=".happythreechoose") returned 1 [0074.863] lstrcmpiW (lpString1="VuB3Slo6mrmvViWmZxu.mp3", lpString2="Decryption INFO.html") returned 1 [0074.863] lstrcmpiW (lpString1="VuB3Slo6mrmvViWmZxu.mp3", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0074.863] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0074.863] lstrcmpiW (lpString1="VuB3Slo6mrmvViWmZxu.mp3", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0074.863] GetProcessHeap () returned 0x630000 [0074.863] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f10 [0074.863] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\VuB3Slo6mrmvViWmZxu.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\vub3slo6mrmvviwmzxu.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0074.863] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=36963) returned 1 [0074.863] GetProcessHeap () returned 0x630000 [0074.863] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655b20 [0074.863] GetProcessHeap () returned 0x630000 [0074.863] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.863] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\VuB3Slo6mrmvViWmZxu.mp3") returned 47 [0074.863] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.863] GetProcessHeap () returned 0x630000 [0074.863] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0074.863] GetProcessHeap () returned 0x630000 [0074.863] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38d) returned 0x672520 [0074.864] lstrlenA (lpString="rsa_encrypt") returned 11 [0074.864] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0074.865] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0074.865] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0074.865] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0074.865] GetProcessHeap () returned 0x630000 [0074.865] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0074.865] lstrlenA (lpString="010001") returned 6 [0074.865] GetProcessHeap () returned 0x630000 [0074.865] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0074.865] GetProcessHeap () returned 0x630000 [0074.865] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.865] GetProcessHeap () returned 0x630000 [0074.865] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65df50 [0074.865] GetProcessHeap () returned 0x630000 [0074.865] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.865] GetProcessHeap () returned 0x630000 [0074.865] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0074.865] GetProcessHeap () returned 0x630000 [0074.865] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656a68 [0074.865] GetProcessHeap () returned 0x630000 [0074.865] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2a8 [0074.865] GetProcessHeap () returned 0x630000 [0074.865] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0074.865] GetProcessHeap () returned 0x630000 [0074.865] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.865] GetProcessHeap () returned 0x630000 [0074.865] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0074.865] GetProcessHeap () returned 0x630000 [0074.865] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.865] GetProcessHeap () returned 0x630000 [0074.865] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657328 [0074.865] GetProcessHeap () returned 0x630000 [0074.865] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.865] GetProcessHeap () returned 0x630000 [0074.865] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0074.865] GetProcessHeap () returned 0x630000 [0074.865] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65eb20 [0074.865] GetProcessHeap () returned 0x630000 [0074.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.866] GetProcessHeap () returned 0x630000 [0074.866] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0074.866] GetProcessHeap () returned 0x630000 [0074.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0074.866] GetProcessHeap () returned 0x630000 [0074.866] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.866] GetProcessHeap () returned 0x630000 [0074.866] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0074.866] GetProcessHeap () returned 0x630000 [0074.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.866] GetProcessHeap () returned 0x630000 [0074.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.866] GetProcessHeap () returned 0x630000 [0074.866] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.866] GetProcessHeap () returned 0x630000 [0074.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.866] GetProcessHeap () returned 0x630000 [0074.866] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65dda0 [0074.866] GetProcessHeap () returned 0x630000 [0074.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0074.866] GetProcessHeap () returned 0x630000 [0074.866] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0074.866] GetProcessHeap () returned 0x630000 [0074.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0074.866] GetProcessHeap () returned 0x630000 [0074.866] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.866] GetProcessHeap () returned 0x630000 [0074.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.866] GetProcessHeap () returned 0x630000 [0074.866] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.866] GetProcessHeap () returned 0x630000 [0074.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.866] GetProcessHeap () returned 0x630000 [0074.866] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.866] GetProcessHeap () returned 0x630000 [0074.866] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.866] GetProcessHeap () returned 0x630000 [0074.866] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.866] GetProcessHeap () returned 0x630000 [0074.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.867] GetProcessHeap () returned 0x630000 [0074.867] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.867] GetProcessHeap () returned 0x630000 [0074.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.867] GetProcessHeap () returned 0x630000 [0074.867] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.867] GetProcessHeap () returned 0x630000 [0074.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.867] GetProcessHeap () returned 0x630000 [0074.867] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.867] GetProcessHeap () returned 0x630000 [0074.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.867] GetProcessHeap () returned 0x630000 [0074.867] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.867] GetProcessHeap () returned 0x630000 [0074.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.867] GetProcessHeap () returned 0x630000 [0074.867] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.867] GetProcessHeap () returned 0x630000 [0074.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.867] GetProcessHeap () returned 0x630000 [0074.867] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.867] GetProcessHeap () returned 0x630000 [0074.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.867] GetProcessHeap () returned 0x630000 [0074.867] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.867] GetProcessHeap () returned 0x630000 [0074.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.867] GetProcessHeap () returned 0x630000 [0074.867] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.867] GetProcessHeap () returned 0x630000 [0074.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.867] GetProcessHeap () returned 0x630000 [0074.867] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.867] GetProcessHeap () returned 0x630000 [0074.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.867] GetProcessHeap () returned 0x630000 [0074.867] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.867] GetProcessHeap () returned 0x630000 [0074.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.868] GetProcessHeap () returned 0x630000 [0074.868] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.868] GetProcessHeap () returned 0x630000 [0074.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.868] GetProcessHeap () returned 0x630000 [0074.868] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.868] GetProcessHeap () returned 0x630000 [0074.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.868] GetProcessHeap () returned 0x630000 [0074.868] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.868] GetProcessHeap () returned 0x630000 [0074.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.868] GetProcessHeap () returned 0x630000 [0074.868] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0074.868] GetProcessHeap () returned 0x630000 [0074.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0074.868] GetProcessHeap () returned 0x630000 [0074.868] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.868] GetProcessHeap () returned 0x630000 [0074.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.868] GetProcessHeap () returned 0x630000 [0074.868] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.868] GetProcessHeap () returned 0x630000 [0074.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.868] GetProcessHeap () returned 0x630000 [0074.868] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.868] GetProcessHeap () returned 0x630000 [0074.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.868] GetProcessHeap () returned 0x630000 [0074.868] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.868] GetProcessHeap () returned 0x630000 [0074.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.868] GetProcessHeap () returned 0x630000 [0074.868] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.868] GetProcessHeap () returned 0x630000 [0074.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.868] GetProcessHeap () returned 0x630000 [0074.869] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.869] GetProcessHeap () returned 0x630000 [0074.869] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.869] GetProcessHeap () returned 0x630000 [0074.869] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.869] GetProcessHeap () returned 0x630000 [0074.869] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.869] GetProcessHeap () returned 0x630000 [0074.869] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.869] GetProcessHeap () returned 0x630000 [0074.869] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.869] GetProcessHeap () returned 0x630000 [0074.869] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.869] GetProcessHeap () returned 0x630000 [0074.869] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.869] GetProcessHeap () returned 0x630000 [0074.869] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.869] GetProcessHeap () returned 0x630000 [0074.869] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.869] GetProcessHeap () returned 0x630000 [0074.869] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.869] GetProcessHeap () returned 0x630000 [0074.869] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.869] GetProcessHeap () returned 0x630000 [0074.869] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.869] GetProcessHeap () returned 0x630000 [0074.869] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.869] GetProcessHeap () returned 0x630000 [0074.869] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.869] GetProcessHeap () returned 0x630000 [0074.869] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.869] GetProcessHeap () returned 0x630000 [0074.869] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.869] GetProcessHeap () returned 0x630000 [0074.869] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.869] GetProcessHeap () returned 0x630000 [0074.869] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.869] GetProcessHeap () returned 0x630000 [0074.870] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.870] GetProcessHeap () returned 0x630000 [0074.870] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.870] GetProcessHeap () returned 0x630000 [0074.870] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.870] GetProcessHeap () returned 0x630000 [0074.870] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.870] GetProcessHeap () returned 0x630000 [0074.870] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.870] GetProcessHeap () returned 0x630000 [0074.870] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.870] GetProcessHeap () returned 0x630000 [0074.870] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.870] GetProcessHeap () returned 0x630000 [0074.870] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.870] GetProcessHeap () returned 0x630000 [0074.870] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.870] GetProcessHeap () returned 0x630000 [0074.870] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.870] GetProcessHeap () returned 0x630000 [0074.870] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.870] GetProcessHeap () returned 0x630000 [0074.870] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.870] GetProcessHeap () returned 0x630000 [0074.870] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.870] GetProcessHeap () returned 0x630000 [0074.870] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.870] GetProcessHeap () returned 0x630000 [0074.870] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.870] GetProcessHeap () returned 0x630000 [0074.870] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.870] GetProcessHeap () returned 0x630000 [0074.870] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.870] GetProcessHeap () returned 0x630000 [0074.870] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0074.870] GetProcessHeap () returned 0x630000 [0074.871] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0074.871] GetProcessHeap () returned 0x630000 [0074.871] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0074.871] GetProcessHeap () returned 0x630000 [0074.871] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0074.871] GetProcessHeap () returned 0x630000 [0074.871] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0074.871] GetProcessHeap () returned 0x630000 [0074.871] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0074.871] GetProcessHeap () returned 0x630000 [0074.871] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0074.871] GetProcessHeap () returned 0x630000 [0074.871] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0074.871] GetProcessHeap () returned 0x630000 [0074.871] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0074.871] GetProcessHeap () returned 0x630000 [0074.871] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.871] GetProcessHeap () returned 0x630000 [0074.871] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0074.871] WriteFile (in: hFile=0x230, lpBuffer=0x672520*, nNumberOfBytesToWrite=0x38d, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672520*, lpNumberOfBytesWritten=0x243d864*=0x38d, lpOverlapped=0x0) returned 1 [0074.873] GetProcessHeap () returned 0x630000 [0074.873] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x672520, Size=0x30) returned 0x672520 [0074.873] GetProcessHeap () returned 0x630000 [0074.873] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0074.873] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.873] GetProcessHeap () returned 0x630000 [0074.873] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9070) returned 0x672558 [0074.873] ReadFile (in: hFile=0x230, lpBuffer=0x672558, nNumberOfBytesToRead=0x9070, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x672558*, lpNumberOfBytesRead=0x243d7e8*=0x9070, lpOverlapped=0x0) returned 1 [0074.874] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.874] WriteFile (in: hFile=0x230, lpBuffer=0x672558*, nNumberOfBytesToWrite=0x9070, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x672558*, lpNumberOfBytesWritten=0x243d7e4*=0x9070, lpOverlapped=0x0) returned 1 [0074.875] GetProcessHeap () returned 0x630000 [0074.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672558 | out: hHeap=0x630000) returned 1 [0074.875] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.875] WriteFile (in: hFile=0x230, lpBuffer=0x672520*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672520*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0074.876] CloseHandle (hObject=0x230) returned 1 [0074.876] GetProcessHeap () returned 0x630000 [0074.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f10 | out: hHeap=0x630000) returned 1 [0074.876] GetProcessHeap () returned 0x630000 [0074.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655b20 | out: hHeap=0x630000) returned 1 [0074.876] GetProcessHeap () returned 0x630000 [0074.876] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0074.877] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\VuB3Slo6mrmvViWmZxu.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\VuB3Slo6mrmvViWmZxu.mp3") returned="C:\\Users\\FD1HVy\\Desktop\\VuB3Slo6mrmvViWmZxu.mp3" [0074.877] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\VuB3Slo6mrmvViWmZxu.mp3", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\VuB3Slo6mrmvViWmZxu.mp3.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\VuB3Slo6mrmvViWmZxu.mp3.happythreechoose" [0074.877] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\VuB3Slo6mrmvViWmZxu.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\vub3slo6mrmvviwmzxu.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\VuB3Slo6mrmvViWmZxu.mp3.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\vub3slo6mrmvviwmzxu.mp3.happythreechoose"), dwFlags=0x1) returned 1 [0074.877] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\VuB3Slo6mrmvViWmZxu.mp3" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0074.877] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned="" [0074.877] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" [0074.877] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\decryption info.html")) returned 0x20 [0074.877] GetProcessHeap () returned 0x630000 [0074.877] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645d58 | out: hHeap=0x630000) returned 1 [0074.877] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f718730, ftCreationTime.dwHighDateTime=0x1d5cdbc, ftLastAccessTime.dwLowDateTime=0x8a004550, ftLastAccessTime.dwHighDateTime=0x1d5c89a, ftLastWriteTime.dwLowDateTime=0x8a004550, ftLastWriteTime.dwHighDateTime=0x1d5c89a, nFileSizeHigh=0x0, nFileSizeLow=0x5080, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vUxJQeQ5u3zLL4VelZ.jpg", cAlternateFileName="VUXJQE~1.JPG")) returned 1 [0074.877] lstrcmpiW (lpString1="vUxJQeQ5u3zLL4VelZ.jpg", lpString2=".") returned 1 [0074.877] lstrcmpiW (lpString1="vUxJQeQ5u3zLL4VelZ.jpg", lpString2="..") returned 1 [0074.877] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="vUxJQeQ5u3zLL4VelZ.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\vUxJQeQ5u3zLL4VelZ.jpg") returned="C:\\Users\\FD1HVy\\Desktop\\vUxJQeQ5u3zLL4VelZ.jpg" [0074.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vUxJQeQ5u3zLL4VelZ.jpg", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0074.877] GetProcessHeap () returned 0x630000 [0074.877] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x17) returned 0x645d98 [0074.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="vUxJQeQ5u3zLL4VelZ.jpg", cchWideChar=-1, lpMultiByteStr=0x645d98, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vUxJQeQ5u3zLL4VelZ.jpg", lpUsedDefaultChar=0x0) returned 23 [0074.878] lstrlenA (lpString="vUxJQeQ5u3zLL4VelZ.jpg") returned 22 [0074.878] lstrlenA (lpString=".happythreechoose") returned 17 [0074.878] lstrlenA (lpString=".happythreechoose") returned 17 [0074.878] lstrlenA (lpString="vUxJQeQ5u3zLL4VelZ.jpg") returned 22 [0074.878] lstrcmpiA (lpString1="eQ5u3zLL4VelZ.jpg", lpString2=".happythreechoose") returned 1 [0074.878] lstrcmpiW (lpString1="vUxJQeQ5u3zLL4VelZ.jpg", lpString2="Decryption INFO.html") returned 1 [0074.878] lstrcmpiW (lpString1="vUxJQeQ5u3zLL4VelZ.jpg", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0074.878] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0074.878] lstrcmpiW (lpString1="vUxJQeQ5u3zLL4VelZ.jpg", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0074.878] GetProcessHeap () returned 0x630000 [0074.878] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f10 [0074.878] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\vUxJQeQ5u3zLL4VelZ.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\vuxjqeq5u3zll4velz.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0074.878] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=20608) returned 1 [0074.878] GetProcessHeap () returned 0x630000 [0074.878] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655580 [0074.878] GetProcessHeap () returned 0x630000 [0074.878] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.878] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\vUxJQeQ5u3zLL4VelZ.jpg") returned 46 [0074.878] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.878] GetProcessHeap () returned 0x630000 [0074.878] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0074.878] GetProcessHeap () returned 0x630000 [0074.878] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x672558 [0074.878] lstrlenA (lpString="rsa_encrypt") returned 11 [0074.878] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0074.879] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0074.879] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0074.879] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0074.879] GetProcessHeap () returned 0x630000 [0074.879] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0074.879] lstrlenA (lpString="010001") returned 6 [0074.879] GetProcessHeap () returned 0x630000 [0074.879] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0074.879] GetProcessHeap () returned 0x630000 [0074.879] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.879] GetProcessHeap () returned 0x630000 [0074.879] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0074.879] GetProcessHeap () returned 0x630000 [0074.879] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.879] GetProcessHeap () returned 0x630000 [0074.879] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e610 [0074.879] GetProcessHeap () returned 0x630000 [0074.879] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656a68 [0074.879] GetProcessHeap () returned 0x630000 [0074.879] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2f8 [0074.879] GetProcessHeap () returned 0x630000 [0074.879] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0074.879] GetProcessHeap () returned 0x630000 [0074.879] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.879] GetProcessHeap () returned 0x630000 [0074.879] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0074.880] GetProcessHeap () returned 0x630000 [0074.880] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.880] GetProcessHeap () returned 0x630000 [0074.880] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656db0 [0074.880] GetProcessHeap () returned 0x630000 [0074.880] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.880] GetProcessHeap () returned 0x630000 [0074.880] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0074.880] GetProcessHeap () returned 0x630000 [0074.880] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e580 [0074.880] GetProcessHeap () returned 0x630000 [0074.880] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.880] GetProcessHeap () returned 0x630000 [0074.880] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0074.880] GetProcessHeap () returned 0x630000 [0074.880] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0074.880] GetProcessHeap () returned 0x630000 [0074.880] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.880] GetProcessHeap () returned 0x630000 [0074.880] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0074.880] GetProcessHeap () returned 0x630000 [0074.880] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.880] GetProcessHeap () returned 0x630000 [0074.880] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.880] GetProcessHeap () returned 0x630000 [0074.880] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.880] GetProcessHeap () returned 0x630000 [0074.880] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.880] GetProcessHeap () returned 0x630000 [0074.880] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e220 [0074.880] GetProcessHeap () returned 0x630000 [0074.880] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0074.880] GetProcessHeap () returned 0x630000 [0074.880] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0074.880] GetProcessHeap () returned 0x630000 [0074.880] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0074.880] GetProcessHeap () returned 0x630000 [0074.880] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.880] GetProcessHeap () returned 0x630000 [0074.880] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.881] GetProcessHeap () returned 0x630000 [0074.881] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.881] GetProcessHeap () returned 0x630000 [0074.881] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.881] GetProcessHeap () returned 0x630000 [0074.881] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.881] GetProcessHeap () returned 0x630000 [0074.881] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.881] GetProcessHeap () returned 0x630000 [0074.881] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.881] GetProcessHeap () returned 0x630000 [0074.881] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.881] GetProcessHeap () returned 0x630000 [0074.881] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.881] GetProcessHeap () returned 0x630000 [0074.881] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.881] GetProcessHeap () returned 0x630000 [0074.881] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.881] GetProcessHeap () returned 0x630000 [0074.881] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.881] GetProcessHeap () returned 0x630000 [0074.881] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.881] GetProcessHeap () returned 0x630000 [0074.881] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.881] GetProcessHeap () returned 0x630000 [0074.881] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.881] GetProcessHeap () returned 0x630000 [0074.881] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.881] GetProcessHeap () returned 0x630000 [0074.881] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.881] GetProcessHeap () returned 0x630000 [0074.881] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.881] GetProcessHeap () returned 0x630000 [0074.881] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.881] GetProcessHeap () returned 0x630000 [0074.881] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.881] GetProcessHeap () returned 0x630000 [0074.881] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.881] GetProcessHeap () returned 0x630000 [0074.881] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.882] GetProcessHeap () returned 0x630000 [0074.882] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.882] GetProcessHeap () returned 0x630000 [0074.882] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.882] GetProcessHeap () returned 0x630000 [0074.882] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.882] GetProcessHeap () returned 0x630000 [0074.882] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.882] GetProcessHeap () returned 0x630000 [0074.882] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.882] GetProcessHeap () returned 0x630000 [0074.882] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.882] GetProcessHeap () returned 0x630000 [0074.882] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.882] GetProcessHeap () returned 0x630000 [0074.882] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.882] GetProcessHeap () returned 0x630000 [0074.882] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.882] GetProcessHeap () returned 0x630000 [0074.882] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.882] GetProcessHeap () returned 0x630000 [0074.882] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.882] GetProcessHeap () returned 0x630000 [0074.882] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.882] GetProcessHeap () returned 0x630000 [0074.882] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.882] GetProcessHeap () returned 0x630000 [0074.882] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.882] GetProcessHeap () returned 0x630000 [0074.882] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.882] GetProcessHeap () returned 0x630000 [0074.882] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.882] GetProcessHeap () returned 0x630000 [0074.882] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.882] GetProcessHeap () returned 0x630000 [0074.882] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.882] GetProcessHeap () returned 0x630000 [0074.882] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.882] GetProcessHeap () returned 0x630000 [0074.883] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.883] GetProcessHeap () returned 0x630000 [0074.883] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.883] GetProcessHeap () returned 0x630000 [0074.883] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.883] GetProcessHeap () returned 0x630000 [0074.883] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.883] GetProcessHeap () returned 0x630000 [0074.883] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.883] GetProcessHeap () returned 0x630000 [0074.883] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.883] GetProcessHeap () returned 0x630000 [0074.883] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.883] GetProcessHeap () returned 0x630000 [0074.883] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.883] GetProcessHeap () returned 0x630000 [0074.883] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.883] GetProcessHeap () returned 0x630000 [0074.883] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.883] GetProcessHeap () returned 0x630000 [0074.883] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.883] GetProcessHeap () returned 0x630000 [0074.883] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0074.883] GetProcessHeap () returned 0x630000 [0074.883] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0074.883] GetProcessHeap () returned 0x630000 [0074.883] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.883] GetProcessHeap () returned 0x630000 [0074.883] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.883] GetProcessHeap () returned 0x630000 [0074.883] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.883] GetProcessHeap () returned 0x630000 [0074.883] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.883] GetProcessHeap () returned 0x630000 [0074.883] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.883] GetProcessHeap () returned 0x630000 [0074.883] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.883] GetProcessHeap () returned 0x630000 [0074.883] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.884] GetProcessHeap () returned 0x630000 [0074.884] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.884] GetProcessHeap () returned 0x630000 [0074.884] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.884] GetProcessHeap () returned 0x630000 [0074.884] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.884] GetProcessHeap () returned 0x630000 [0074.884] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.884] GetProcessHeap () returned 0x630000 [0074.884] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.884] GetProcessHeap () returned 0x630000 [0074.884] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.884] GetProcessHeap () returned 0x630000 [0074.884] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.884] GetProcessHeap () returned 0x630000 [0074.884] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.884] GetProcessHeap () returned 0x630000 [0074.884] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.884] GetProcessHeap () returned 0x630000 [0074.884] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.884] GetProcessHeap () returned 0x630000 [0074.884] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.884] GetProcessHeap () returned 0x630000 [0074.884] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.884] GetProcessHeap () returned 0x630000 [0074.884] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.884] GetProcessHeap () returned 0x630000 [0074.884] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.884] GetProcessHeap () returned 0x630000 [0074.884] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.884] GetProcessHeap () returned 0x630000 [0074.884] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.884] GetProcessHeap () returned 0x630000 [0074.884] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.884] GetProcessHeap () returned 0x630000 [0074.884] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.884] GetProcessHeap () returned 0x630000 [0074.884] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.884] GetProcessHeap () returned 0x630000 [0074.885] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.885] GetProcessHeap () returned 0x630000 [0074.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.885] GetProcessHeap () returned 0x630000 [0074.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0074.885] GetProcessHeap () returned 0x630000 [0074.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0074.885] GetProcessHeap () returned 0x630000 [0074.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0074.885] GetProcessHeap () returned 0x630000 [0074.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0074.885] GetProcessHeap () returned 0x630000 [0074.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0074.885] GetProcessHeap () returned 0x630000 [0074.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0074.885] GetProcessHeap () returned 0x630000 [0074.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0074.885] GetProcessHeap () returned 0x630000 [0074.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0074.885] GetProcessHeap () returned 0x630000 [0074.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0074.885] GetProcessHeap () returned 0x630000 [0074.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.885] GetProcessHeap () returned 0x630000 [0074.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0074.885] WriteFile (in: hFile=0x230, lpBuffer=0x672558*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672558*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0074.887] GetProcessHeap () returned 0x630000 [0074.887] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x672558, Size=0x30) returned 0x672558 [0074.887] GetProcessHeap () returned 0x630000 [0074.887] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0074.887] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.887] GetProcessHeap () returned 0x630000 [0074.887] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5080) returned 0x672590 [0074.887] ReadFile (in: hFile=0x230, lpBuffer=0x672590, nNumberOfBytesToRead=0x5080, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x672590*, lpNumberOfBytesRead=0x243d7e8*=0x5080, lpOverlapped=0x0) returned 1 [0074.887] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.887] WriteFile (in: hFile=0x230, lpBuffer=0x672590*, nNumberOfBytesToWrite=0x5080, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x672590*, lpNumberOfBytesWritten=0x243d7e4*=0x5080, lpOverlapped=0x0) returned 1 [0074.892] GetProcessHeap () returned 0x630000 [0074.892] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672590 | out: hHeap=0x630000) returned 1 [0074.893] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.893] WriteFile (in: hFile=0x230, lpBuffer=0x672558*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672558*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0074.894] CloseHandle (hObject=0x230) returned 1 [0074.894] GetProcessHeap () returned 0x630000 [0074.894] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f10 | out: hHeap=0x630000) returned 1 [0074.894] GetProcessHeap () returned 0x630000 [0074.894] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655580 | out: hHeap=0x630000) returned 1 [0074.894] GetProcessHeap () returned 0x630000 [0074.895] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0074.895] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\vUxJQeQ5u3zLL4VelZ.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\vUxJQeQ5u3zLL4VelZ.jpg") returned="C:\\Users\\FD1HVy\\Desktop\\vUxJQeQ5u3zLL4VelZ.jpg" [0074.895] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\vUxJQeQ5u3zLL4VelZ.jpg", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\vUxJQeQ5u3zLL4VelZ.jpg.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\vUxJQeQ5u3zLL4VelZ.jpg.happythreechoose" [0074.895] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\vUxJQeQ5u3zLL4VelZ.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\vuxjqeq5u3zll4velz.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\vUxJQeQ5u3zLL4VelZ.jpg.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\vuxjqeq5u3zll4velz.jpg.happythreechoose"), dwFlags=0x1) returned 1 [0074.895] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\vUxJQeQ5u3zLL4VelZ.jpg" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0074.895] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned="" [0074.895] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" [0074.895] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\decryption info.html")) returned 0x20 [0074.895] GetProcessHeap () returned 0x630000 [0074.895] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645d98 | out: hHeap=0x630000) returned 1 [0074.895] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x451a8cf0, ftCreationTime.dwHighDateTime=0x1d5ce6e, ftLastAccessTime.dwLowDateTime=0x555e6570, ftLastAccessTime.dwHighDateTime=0x1d5c93f, ftLastWriteTime.dwLowDateTime=0x555e6570, ftLastWriteTime.dwHighDateTime=0x1d5c93f, nFileSizeHigh=0x0, nFileSizeLow=0x14fae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VZ5pRpL6c678.swf", cAlternateFileName="VZ5PRP~1.SWF")) returned 1 [0074.895] lstrcmpiW (lpString1="VZ5pRpL6c678.swf", lpString2=".") returned 1 [0074.895] lstrcmpiW (lpString1="VZ5pRpL6c678.swf", lpString2="..") returned 1 [0074.895] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="VZ5pRpL6c678.swf" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\VZ5pRpL6c678.swf") returned="C:\\Users\\FD1HVy\\Desktop\\VZ5pRpL6c678.swf" [0074.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VZ5pRpL6c678.swf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0074.895] GetProcessHeap () returned 0x630000 [0074.895] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11) returned 0x645f58 [0074.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VZ5pRpL6c678.swf", cchWideChar=-1, lpMultiByteStr=0x645f58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VZ5pRpL6c678.swf", lpUsedDefaultChar=0x0) returned 17 [0074.896] lstrlenA (lpString="VZ5pRpL6c678.swf") returned 16 [0074.896] lstrlenA (lpString=".happythreechoose") returned 17 [0074.896] lstrcmpiW (lpString1="VZ5pRpL6c678.swf", lpString2="Decryption INFO.html") returned 1 [0074.896] lstrcmpiW (lpString1="VZ5pRpL6c678.swf", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0074.896] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0074.896] lstrcmpiW (lpString1="VZ5pRpL6c678.swf", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0074.896] GetProcessHeap () returned 0x630000 [0074.896] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0074.896] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\VZ5pRpL6c678.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\vz5prpl6c678.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0074.896] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=85934) returned 1 [0074.896] GetProcessHeap () returned 0x630000 [0074.896] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655670 [0074.896] GetProcessHeap () returned 0x630000 [0074.896] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.896] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\VZ5pRpL6c678.swf") returned 40 [0074.896] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.896] GetProcessHeap () returned 0x630000 [0074.896] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0074.896] GetProcessHeap () returned 0x630000 [0074.896] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x382) returned 0x672590 [0074.897] lstrlenA (lpString="rsa_encrypt") returned 11 [0074.897] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0074.898] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0074.898] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0074.898] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0074.898] GetProcessHeap () returned 0x630000 [0074.898] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0074.898] lstrlenA (lpString="010001") returned 6 [0074.898] GetProcessHeap () returned 0x630000 [0074.898] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0074.898] GetProcessHeap () returned 0x630000 [0074.898] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.898] GetProcessHeap () returned 0x630000 [0074.898] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e7c0 [0074.898] GetProcessHeap () returned 0x630000 [0074.898] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.898] GetProcessHeap () returned 0x630000 [0074.898] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65eb20 [0074.898] GetProcessHeap () returned 0x630000 [0074.898] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657558 [0074.898] GetProcessHeap () returned 0x630000 [0074.898] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0074.898] GetProcessHeap () returned 0x630000 [0074.898] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0074.898] GetProcessHeap () returned 0x630000 [0074.898] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.898] GetProcessHeap () returned 0x630000 [0074.898] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0074.898] GetProcessHeap () returned 0x630000 [0074.898] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.898] GetProcessHeap () returned 0x630000 [0074.898] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656db0 [0074.898] GetProcessHeap () returned 0x630000 [0074.898] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.899] GetProcessHeap () returned 0x630000 [0074.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0074.899] GetProcessHeap () returned 0x630000 [0074.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0074.899] GetProcessHeap () returned 0x630000 [0074.899] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.899] GetProcessHeap () returned 0x630000 [0074.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0074.899] GetProcessHeap () returned 0x630000 [0074.899] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0074.899] GetProcessHeap () returned 0x630000 [0074.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.899] GetProcessHeap () returned 0x630000 [0074.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0074.899] GetProcessHeap () returned 0x630000 [0074.899] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.899] GetProcessHeap () returned 0x630000 [0074.899] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.899] GetProcessHeap () returned 0x630000 [0074.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.899] GetProcessHeap () returned 0x630000 [0074.899] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.899] GetProcessHeap () returned 0x630000 [0074.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65dec0 [0074.899] GetProcessHeap () returned 0x630000 [0074.899] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0074.899] GetProcessHeap () returned 0x630000 [0074.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0074.899] GetProcessHeap () returned 0x630000 [0074.899] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0074.899] GetProcessHeap () returned 0x630000 [0074.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.899] GetProcessHeap () returned 0x630000 [0074.899] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.899] GetProcessHeap () returned 0x630000 [0074.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.899] GetProcessHeap () returned 0x630000 [0074.899] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.899] GetProcessHeap () returned 0x630000 [0074.899] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.900] GetProcessHeap () returned 0x630000 [0074.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.900] GetProcessHeap () returned 0x630000 [0074.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.900] GetProcessHeap () returned 0x630000 [0074.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.900] GetProcessHeap () returned 0x630000 [0074.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.900] GetProcessHeap () returned 0x630000 [0074.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.900] GetProcessHeap () returned 0x630000 [0074.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.900] GetProcessHeap () returned 0x630000 [0074.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.900] GetProcessHeap () returned 0x630000 [0074.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.900] GetProcessHeap () returned 0x630000 [0074.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.900] GetProcessHeap () returned 0x630000 [0074.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.900] GetProcessHeap () returned 0x630000 [0074.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.900] GetProcessHeap () returned 0x630000 [0074.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.900] GetProcessHeap () returned 0x630000 [0074.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.900] GetProcessHeap () returned 0x630000 [0074.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.900] GetProcessHeap () returned 0x630000 [0074.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.900] GetProcessHeap () returned 0x630000 [0074.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.900] GetProcessHeap () returned 0x630000 [0074.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.900] GetProcessHeap () returned 0x630000 [0074.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.900] GetProcessHeap () returned 0x630000 [0074.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.901] GetProcessHeap () returned 0x630000 [0074.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.901] GetProcessHeap () returned 0x630000 [0074.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.901] GetProcessHeap () returned 0x630000 [0074.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.901] GetProcessHeap () returned 0x630000 [0074.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.901] GetProcessHeap () returned 0x630000 [0074.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.901] GetProcessHeap () returned 0x630000 [0074.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.901] GetProcessHeap () returned 0x630000 [0074.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.901] GetProcessHeap () returned 0x630000 [0074.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.901] GetProcessHeap () returned 0x630000 [0074.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.901] GetProcessHeap () returned 0x630000 [0074.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.901] GetProcessHeap () returned 0x630000 [0074.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.901] GetProcessHeap () returned 0x630000 [0074.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.901] GetProcessHeap () returned 0x630000 [0074.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.901] GetProcessHeap () returned 0x630000 [0074.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.901] GetProcessHeap () returned 0x630000 [0074.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.901] GetProcessHeap () returned 0x630000 [0074.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.901] GetProcessHeap () returned 0x630000 [0074.901] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.901] GetProcessHeap () returned 0x630000 [0074.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.901] GetProcessHeap () returned 0x630000 [0074.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.902] GetProcessHeap () returned 0x630000 [0074.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.902] GetProcessHeap () returned 0x630000 [0074.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.902] GetProcessHeap () returned 0x630000 [0074.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.902] GetProcessHeap () returned 0x630000 [0074.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.902] GetProcessHeap () returned 0x630000 [0074.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.902] GetProcessHeap () returned 0x630000 [0074.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.902] GetProcessHeap () returned 0x630000 [0074.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.902] GetProcessHeap () returned 0x630000 [0074.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.902] GetProcessHeap () returned 0x630000 [0074.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.902] GetProcessHeap () returned 0x630000 [0074.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.902] GetProcessHeap () returned 0x630000 [0074.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.902] GetProcessHeap () returned 0x630000 [0074.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.902] GetProcessHeap () returned 0x630000 [0074.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.902] GetProcessHeap () returned 0x630000 [0074.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.902] GetProcessHeap () returned 0x630000 [0074.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.902] GetProcessHeap () returned 0x630000 [0074.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.902] GetProcessHeap () returned 0x630000 [0074.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.902] GetProcessHeap () returned 0x630000 [0074.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.902] GetProcessHeap () returned 0x630000 [0074.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.903] GetProcessHeap () returned 0x630000 [0074.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0074.903] GetProcessHeap () returned 0x630000 [0074.903] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0074.903] GetProcessHeap () returned 0x630000 [0074.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.903] GetProcessHeap () returned 0x630000 [0074.903] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.903] GetProcessHeap () returned 0x630000 [0074.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.903] GetProcessHeap () returned 0x630000 [0074.903] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.903] GetProcessHeap () returned 0x630000 [0074.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.903] GetProcessHeap () returned 0x630000 [0074.903] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.903] GetProcessHeap () returned 0x630000 [0074.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.903] GetProcessHeap () returned 0x630000 [0074.903] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.903] GetProcessHeap () returned 0x630000 [0074.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.903] GetProcessHeap () returned 0x630000 [0074.903] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.903] GetProcessHeap () returned 0x630000 [0074.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.903] GetProcessHeap () returned 0x630000 [0074.903] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.903] GetProcessHeap () returned 0x630000 [0074.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.903] GetProcessHeap () returned 0x630000 [0074.903] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.903] GetProcessHeap () returned 0x630000 [0074.903] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.903] GetProcessHeap () returned 0x630000 [0074.903] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.904] GetProcessHeap () returned 0x630000 [0074.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.904] GetProcessHeap () returned 0x630000 [0074.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.904] GetProcessHeap () returned 0x630000 [0074.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0074.904] GetProcessHeap () returned 0x630000 [0074.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0074.904] GetProcessHeap () returned 0x630000 [0074.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0074.904] GetProcessHeap () returned 0x630000 [0074.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0074.904] GetProcessHeap () returned 0x630000 [0074.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0074.904] GetProcessHeap () returned 0x630000 [0074.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0074.904] GetProcessHeap () returned 0x630000 [0074.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0074.904] GetProcessHeap () returned 0x630000 [0074.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e7c0 | out: hHeap=0x630000) returned 1 [0074.904] GetProcessHeap () returned 0x630000 [0074.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0074.904] GetProcessHeap () returned 0x630000 [0074.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.904] GetProcessHeap () returned 0x630000 [0074.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0074.904] WriteFile (in: hFile=0x230, lpBuffer=0x672590*, nNumberOfBytesToWrite=0x382, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672590*, lpNumberOfBytesWritten=0x243d864*=0x382, lpOverlapped=0x0) returned 1 [0074.906] GetProcessHeap () returned 0x630000 [0074.906] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x672590, Size=0x30) returned 0x672590 [0074.906] GetProcessHeap () returned 0x630000 [0074.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0074.906] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.907] GetProcessHeap () returned 0x630000 [0074.907] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14fb0) returned 0x6725c8 [0074.908] ReadFile (in: hFile=0x230, lpBuffer=0x6725c8, nNumberOfBytesToRead=0x14fb0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x6725c8*, lpNumberOfBytesRead=0x243d7e8*=0x14fb0, lpOverlapped=0x0) returned 1 [0074.909] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.909] WriteFile (in: hFile=0x230, lpBuffer=0x6725c8*, nNumberOfBytesToWrite=0x14fb0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x6725c8*, lpNumberOfBytesWritten=0x243d7e4*=0x14fb0, lpOverlapped=0x0) returned 1 [0074.910] GetProcessHeap () returned 0x630000 [0074.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6725c8 | out: hHeap=0x630000) returned 1 [0074.910] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.910] WriteFile (in: hFile=0x230, lpBuffer=0x672590*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672590*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0074.911] CloseHandle (hObject=0x230) returned 1 [0074.911] GetProcessHeap () returned 0x630000 [0074.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0074.911] GetProcessHeap () returned 0x630000 [0074.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655670 | out: hHeap=0x630000) returned 1 [0074.912] GetProcessHeap () returned 0x630000 [0074.912] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0074.912] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\VZ5pRpL6c678.swf" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\VZ5pRpL6c678.swf") returned="C:\\Users\\FD1HVy\\Desktop\\VZ5pRpL6c678.swf" [0074.912] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\VZ5pRpL6c678.swf", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\VZ5pRpL6c678.swf.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\VZ5pRpL6c678.swf.happythreechoose" [0074.912] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\VZ5pRpL6c678.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\vz5prpl6c678.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\VZ5pRpL6c678.swf.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\vz5prpl6c678.swf.happythreechoose"), dwFlags=0x1) returned 1 [0074.913] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\VZ5pRpL6c678.swf" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0074.913] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned="" [0074.913] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" [0074.913] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\decryption info.html")) returned 0x20 [0074.913] GetProcessHeap () returned 0x630000 [0074.913] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645f58 | out: hHeap=0x630000) returned 1 [0074.913] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea65df40, ftCreationTime.dwHighDateTime=0x1d5d709, ftLastAccessTime.dwLowDateTime=0xa8af5340, ftLastAccessTime.dwHighDateTime=0x1d5d3c8, ftLastWriteTime.dwLowDateTime=0xa8af5340, ftLastWriteTime.dwHighDateTime=0x1d5d3c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="YB4HOwQiFgMJ-CuKY", cAlternateFileName="YB4HOW~1")) returned 1 [0074.913] lstrcmpiW (lpString1="YB4HOwQiFgMJ-CuKY", lpString2=".") returned 1 [0074.914] lstrcmpiW (lpString1="YB4HOwQiFgMJ-CuKY", lpString2="..") returned 1 [0074.914] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="YB4HOwQiFgMJ-CuKY" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY") returned="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY" [0074.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="YB4HOwQiFgMJ-CuKY", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0074.914] GetProcessHeap () returned 0x630000 [0074.914] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x645f58 [0074.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="YB4HOwQiFgMJ-CuKY", cchWideChar=-1, lpMultiByteStr=0x645f58, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="YB4HOwQiFgMJ-CuKY", lpUsedDefaultChar=0x0) returned 18 [0074.914] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YB4HOwQiFgMJ-CuKY", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 3 [0074.914] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YB4HOwQiFgMJ-CuKY", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0074.914] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YB4HOwQiFgMJ-CuKY", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0074.914] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YB4HOwQiFgMJ-CuKY", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 3 [0074.914] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YB4HOwQiFgMJ-CuKY", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 3 [0074.914] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YB4HOwQiFgMJ-CuKY", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0074.914] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YB4HOwQiFgMJ-CuKY", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0074.914] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YB4HOwQiFgMJ-CuKY", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 3 [0074.914] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YB4HOwQiFgMJ-CuKY", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 3 [0074.914] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YB4HOwQiFgMJ-CuKY", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 3 [0074.914] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YB4HOwQiFgMJ-CuKY", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 3 [0074.914] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YB4HOwQiFgMJ-CuKY", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 3 [0074.914] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YB4HOwQiFgMJ-CuKY", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 3 [0074.914] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YB4HOwQiFgMJ-CuKY", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 3 [0074.914] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YB4HOwQiFgMJ-CuKY", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 3 [0074.914] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YB4HOwQiFgMJ-CuKY", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 3 [0074.914] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YB4HOwQiFgMJ-CuKY", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 3 [0074.914] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YB4HOwQiFgMJ-CuKY", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 3 [0074.914] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YB4HOwQiFgMJ-CuKY", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0074.914] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YB4HOwQiFgMJ-CuKY", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0074.914] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YB4HOwQiFgMJ-CuKY", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0074.914] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YB4HOwQiFgMJ-CuKY", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0074.914] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YB4HOwQiFgMJ-CuKY", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0074.914] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YB4HOwQiFgMJ-CuKY", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0074.914] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YB4HOwQiFgMJ-CuKY", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 3 [0074.914] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YB4HOwQiFgMJ-CuKY", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 3 [0074.914] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YB4HOwQiFgMJ-CuKY", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0074.915] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YB4HOwQiFgMJ-CuKY", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0074.915] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YB4HOwQiFgMJ-CuKY", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 3 [0074.915] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YB4HOwQiFgMJ-CuKY", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 3 [0074.915] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YB4HOwQiFgMJ-CuKY", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 3 [0074.915] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YB4HOwQiFgMJ-CuKY", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0074.915] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YB4HOwQiFgMJ-CuKY", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0074.915] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YB4HOwQiFgMJ-CuKY", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0074.915] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YB4HOwQiFgMJ-CuKY", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0074.915] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YB4HOwQiFgMJ-CuKY", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0074.915] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YB4HOwQiFgMJ-CuKY", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0074.915] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YB4HOwQiFgMJ-CuKY", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0074.915] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YB4HOwQiFgMJ-CuKY", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0074.915] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YB4HOwQiFgMJ-CuKY", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 3 [0074.915] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YB4HOwQiFgMJ-CuKY", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0074.915] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YB4HOwQiFgMJ-CuKY", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 3 [0074.915] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="YB4HOwQiFgMJ-CuKY", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0074.915] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\") returned="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\" [0074.915] GetProcessHeap () returned 0x630000 [0074.915] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a408 [0074.915] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\") returned 42 [0074.915] GetProcessHeap () returned 0x630000 [0074.915] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x56) returned 0x6539f0 [0074.915] lstrcpyW (in: lpString1=0x6539f0, lpString2="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\") returned="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\" [0074.915] GetProcessHeap () returned 0x630000 [0074.915] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645f58 | out: hHeap=0x630000) returned 1 [0074.915] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38770330, ftCreationTime.dwHighDateTime=0x1d5cdeb, ftLastAccessTime.dwLowDateTime=0xdbc79a20, ftLastAccessTime.dwHighDateTime=0x1d5cf37, ftLastWriteTime.dwLowDateTime=0xdbc79a20, ftLastWriteTime.dwHighDateTime=0x1d5cf37, nFileSizeHigh=0x0, nFileSizeLow=0x6602, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="YifcGNYkRpgr.wav", cAlternateFileName="YIFCGN~1.WAV")) returned 1 [0074.915] lstrcmpiW (lpString1="YifcGNYkRpgr.wav", lpString2=".") returned 1 [0074.915] lstrcmpiW (lpString1="YifcGNYkRpgr.wav", lpString2="..") returned 1 [0074.915] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="YifcGNYkRpgr.wav" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\YifcGNYkRpgr.wav") returned="C:\\Users\\FD1HVy\\Desktop\\YifcGNYkRpgr.wav" [0074.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="YifcGNYkRpgr.wav", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0074.915] GetProcessHeap () returned 0x630000 [0074.915] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11) returned 0x645d18 [0074.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="YifcGNYkRpgr.wav", cchWideChar=-1, lpMultiByteStr=0x645d18, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="YifcGNYkRpgr.wav", lpUsedDefaultChar=0x0) returned 17 [0074.915] lstrlenA (lpString="YifcGNYkRpgr.wav") returned 16 [0074.915] lstrlenA (lpString=".happythreechoose") returned 17 [0074.916] lstrcmpiW (lpString1="YifcGNYkRpgr.wav", lpString2="Decryption INFO.html") returned 1 [0074.916] lstrcmpiW (lpString1="YifcGNYkRpgr.wav", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0074.916] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0074.916] lstrcmpiW (lpString1="YifcGNYkRpgr.wav", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0074.916] GetProcessHeap () returned 0x630000 [0074.916] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0074.916] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\YifcGNYkRpgr.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\yifcgnykrpgr.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0074.916] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=26114) returned 1 [0074.916] GetProcessHeap () returned 0x630000 [0074.916] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655580 [0074.916] GetProcessHeap () returned 0x630000 [0074.916] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.916] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\YifcGNYkRpgr.wav") returned 40 [0074.916] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.916] GetProcessHeap () returned 0x630000 [0074.916] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0074.916] GetProcessHeap () returned 0x630000 [0074.916] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x6725c8 [0074.916] lstrlenA (lpString="rsa_encrypt") returned 11 [0074.916] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0074.917] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0074.917] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0074.917] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0074.917] GetProcessHeap () returned 0x630000 [0074.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0074.917] lstrlenA (lpString="010001") returned 6 [0074.917] GetProcessHeap () returned 0x630000 [0074.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0074.917] GetProcessHeap () returned 0x630000 [0074.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.917] GetProcessHeap () returned 0x630000 [0074.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e730 [0074.917] GetProcessHeap () returned 0x630000 [0074.917] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.917] GetProcessHeap () returned 0x630000 [0074.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e850 [0074.917] GetProcessHeap () returned 0x630000 [0074.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x6570f8 [0074.917] GetProcessHeap () returned 0x630000 [0074.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a298 [0074.917] GetProcessHeap () returned 0x630000 [0074.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0074.917] GetProcessHeap () returned 0x630000 [0074.917] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.917] GetProcessHeap () returned 0x630000 [0074.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0074.917] GetProcessHeap () returned 0x630000 [0074.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.917] GetProcessHeap () returned 0x630000 [0074.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656ec8 [0074.917] GetProcessHeap () returned 0x630000 [0074.917] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.918] GetProcessHeap () returned 0x630000 [0074.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0074.918] GetProcessHeap () returned 0x630000 [0074.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e4f0 [0074.918] GetProcessHeap () returned 0x630000 [0074.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.918] GetProcessHeap () returned 0x630000 [0074.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0074.918] GetProcessHeap () returned 0x630000 [0074.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0074.918] GetProcessHeap () returned 0x630000 [0074.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.918] GetProcessHeap () returned 0x630000 [0074.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0074.918] GetProcessHeap () returned 0x630000 [0074.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.918] GetProcessHeap () returned 0x630000 [0074.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.918] GetProcessHeap () returned 0x630000 [0074.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.918] GetProcessHeap () returned 0x630000 [0074.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.918] GetProcessHeap () returned 0x630000 [0074.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ea90 [0074.918] GetProcessHeap () returned 0x630000 [0074.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0074.918] GetProcessHeap () returned 0x630000 [0074.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0074.918] GetProcessHeap () returned 0x630000 [0074.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea90 | out: hHeap=0x630000) returned 1 [0074.918] GetProcessHeap () returned 0x630000 [0074.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.918] GetProcessHeap () returned 0x630000 [0074.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.918] GetProcessHeap () returned 0x630000 [0074.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.918] GetProcessHeap () returned 0x630000 [0074.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.918] GetProcessHeap () returned 0x630000 [0074.918] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.918] GetProcessHeap () returned 0x630000 [0074.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.919] GetProcessHeap () returned 0x630000 [0074.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.919] GetProcessHeap () returned 0x630000 [0074.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.919] GetProcessHeap () returned 0x630000 [0074.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0074.919] GetProcessHeap () returned 0x630000 [0074.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0074.919] GetProcessHeap () returned 0x630000 [0074.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.919] GetProcessHeap () returned 0x630000 [0074.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.919] GetProcessHeap () returned 0x630000 [0074.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.919] GetProcessHeap () returned 0x630000 [0074.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.919] GetProcessHeap () returned 0x630000 [0074.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.919] GetProcessHeap () returned 0x630000 [0074.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.919] GetProcessHeap () returned 0x630000 [0074.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.919] GetProcessHeap () returned 0x630000 [0074.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.919] GetProcessHeap () returned 0x630000 [0074.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.919] GetProcessHeap () returned 0x630000 [0074.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.919] GetProcessHeap () returned 0x630000 [0074.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0074.920] GetProcessHeap () returned 0x630000 [0074.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0074.920] GetProcessHeap () returned 0x630000 [0074.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.920] GetProcessHeap () returned 0x630000 [0074.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.920] GetProcessHeap () returned 0x630000 [0074.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.920] GetProcessHeap () returned 0x630000 [0074.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.920] GetProcessHeap () returned 0x630000 [0074.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.920] GetProcessHeap () returned 0x630000 [0074.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.920] GetProcessHeap () returned 0x630000 [0074.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.920] GetProcessHeap () returned 0x630000 [0074.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.920] GetProcessHeap () returned 0x630000 [0074.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.920] GetProcessHeap () returned 0x630000 [0074.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.920] GetProcessHeap () returned 0x630000 [0074.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.920] GetProcessHeap () returned 0x630000 [0074.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.920] GetProcessHeap () returned 0x630000 [0074.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.920] GetProcessHeap () returned 0x630000 [0074.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.920] GetProcessHeap () returned 0x630000 [0074.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0074.920] GetProcessHeap () returned 0x630000 [0074.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0074.920] GetProcessHeap () returned 0x630000 [0074.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.920] GetProcessHeap () returned 0x630000 [0074.920] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.920] GetProcessHeap () returned 0x630000 [0074.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.921] GetProcessHeap () returned 0x630000 [0074.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.921] GetProcessHeap () returned 0x630000 [0074.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.921] GetProcessHeap () returned 0x630000 [0074.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.921] GetProcessHeap () returned 0x630000 [0074.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.921] GetProcessHeap () returned 0x630000 [0074.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.921] GetProcessHeap () returned 0x630000 [0074.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.921] GetProcessHeap () returned 0x630000 [0074.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.921] GetProcessHeap () returned 0x630000 [0074.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.921] GetProcessHeap () returned 0x630000 [0074.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.921] GetProcessHeap () returned 0x630000 [0074.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.921] GetProcessHeap () returned 0x630000 [0074.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.921] GetProcessHeap () returned 0x630000 [0074.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.921] GetProcessHeap () returned 0x630000 [0074.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.921] GetProcessHeap () returned 0x630000 [0074.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.921] GetProcessHeap () returned 0x630000 [0074.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.921] GetProcessHeap () returned 0x630000 [0074.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.921] GetProcessHeap () returned 0x630000 [0074.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.921] GetProcessHeap () returned 0x630000 [0074.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.921] GetProcessHeap () returned 0x630000 [0074.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.921] GetProcessHeap () returned 0x630000 [0074.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.921] GetProcessHeap () returned 0x630000 [0074.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.922] GetProcessHeap () returned 0x630000 [0074.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.922] GetProcessHeap () returned 0x630000 [0074.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.922] GetProcessHeap () returned 0x630000 [0074.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.922] GetProcessHeap () returned 0x630000 [0074.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.922] GetProcessHeap () returned 0x630000 [0074.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.922] GetProcessHeap () returned 0x630000 [0074.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.922] GetProcessHeap () returned 0x630000 [0074.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.922] GetProcessHeap () returned 0x630000 [0074.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.922] GetProcessHeap () returned 0x630000 [0074.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.922] GetProcessHeap () returned 0x630000 [0074.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.922] GetProcessHeap () returned 0x630000 [0074.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.922] GetProcessHeap () returned 0x630000 [0074.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.922] GetProcessHeap () returned 0x630000 [0074.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.922] GetProcessHeap () returned 0x630000 [0074.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.922] GetProcessHeap () returned 0x630000 [0074.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.922] GetProcessHeap () returned 0x630000 [0074.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.922] GetProcessHeap () returned 0x630000 [0074.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.922] GetProcessHeap () returned 0x630000 [0074.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.922] GetProcessHeap () returned 0x630000 [0074.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.923] GetProcessHeap () returned 0x630000 [0074.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.923] GetProcessHeap () returned 0x630000 [0074.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0074.923] GetProcessHeap () returned 0x630000 [0074.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0074.923] GetProcessHeap () returned 0x630000 [0074.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0074.923] GetProcessHeap () returned 0x630000 [0074.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0074.923] GetProcessHeap () returned 0x630000 [0074.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0074.923] GetProcessHeap () returned 0x630000 [0074.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0074.923] GetProcessHeap () returned 0x630000 [0074.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0074.923] GetProcessHeap () returned 0x630000 [0074.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0074.923] GetProcessHeap () returned 0x630000 [0074.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0074.923] GetProcessHeap () returned 0x630000 [0074.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.923] GetProcessHeap () returned 0x630000 [0074.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0074.923] WriteFile (in: hFile=0x230, lpBuffer=0x6725c8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6725c8*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0074.926] GetProcessHeap () returned 0x630000 [0074.926] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6725c8, Size=0x30) returned 0x6725c8 [0074.926] GetProcessHeap () returned 0x630000 [0074.926] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0074.926] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.926] GetProcessHeap () returned 0x630000 [0074.926] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6602) returned 0x672600 [0074.926] ReadFile (in: hFile=0x230, lpBuffer=0x672600, nNumberOfBytesToRead=0x6602, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x672600*, lpNumberOfBytesRead=0x243d7e8*=0x6602, lpOverlapped=0x0) returned 1 [0074.926] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.927] WriteFile (in: hFile=0x230, lpBuffer=0x672600*, nNumberOfBytesToWrite=0x6602, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x672600*, lpNumberOfBytesWritten=0x243d7e4*=0x6602, lpOverlapped=0x0) returned 1 [0074.928] GetProcessHeap () returned 0x630000 [0074.928] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672600 | out: hHeap=0x630000) returned 1 [0074.929] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.929] WriteFile (in: hFile=0x230, lpBuffer=0x6725c8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6725c8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0074.930] CloseHandle (hObject=0x230) returned 1 [0074.930] GetProcessHeap () returned 0x630000 [0074.930] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0074.930] GetProcessHeap () returned 0x630000 [0074.930] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655580 | out: hHeap=0x630000) returned 1 [0074.930] GetProcessHeap () returned 0x630000 [0074.930] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0074.930] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\YifcGNYkRpgr.wav" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\YifcGNYkRpgr.wav") returned="C:\\Users\\FD1HVy\\Desktop\\YifcGNYkRpgr.wav" [0074.930] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\YifcGNYkRpgr.wav", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\YifcGNYkRpgr.wav.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\YifcGNYkRpgr.wav.happythreechoose" [0074.931] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\YifcGNYkRpgr.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\yifcgnykrpgr.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\YifcGNYkRpgr.wav.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\yifcgnykrpgr.wav.happythreechoose"), dwFlags=0x1) returned 1 [0074.931] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\YifcGNYkRpgr.wav" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0074.931] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned="" [0074.931] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" [0074.931] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\decryption info.html")) returned 0x20 [0074.931] GetProcessHeap () returned 0x630000 [0074.931] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645d18 | out: hHeap=0x630000) returned 1 [0074.931] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17bb370, ftCreationTime.dwHighDateTime=0x1d5ca31, ftLastAccessTime.dwLowDateTime=0xe120570, ftLastAccessTime.dwHighDateTime=0x1d5d7a7, ftLastWriteTime.dwLowDateTime=0xe120570, ftLastWriteTime.dwHighDateTime=0x1d5d7a7, nFileSizeHigh=0x0, nFileSizeLow=0x7ce, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="YIrJCRfSyW.swf", cAlternateFileName="YIRJCR~1.SWF")) returned 1 [0074.931] lstrcmpiW (lpString1="YIrJCRfSyW.swf", lpString2=".") returned 1 [0074.931] lstrcmpiW (lpString1="YIrJCRfSyW.swf", lpString2="..") returned 1 [0074.931] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="YIrJCRfSyW.swf" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\YIrJCRfSyW.swf") returned="C:\\Users\\FD1HVy\\Desktop\\YIrJCRfSyW.swf" [0074.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="YIrJCRfSyW.swf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0074.931] GetProcessHeap () returned 0x630000 [0074.931] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0074.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="YIrJCRfSyW.swf", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="YIrJCRfSyW.swf", lpUsedDefaultChar=0x0) returned 15 [0074.931] lstrlenA (lpString="YIrJCRfSyW.swf") returned 14 [0074.931] lstrlenA (lpString=".happythreechoose") returned 17 [0074.931] lstrcmpiW (lpString1="YIrJCRfSyW.swf", lpString2="Decryption INFO.html") returned 1 [0074.932] lstrcmpiW (lpString1="YIrJCRfSyW.swf", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0074.932] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0074.932] lstrcmpiW (lpString1="YIrJCRfSyW.swf", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0074.932] GetProcessHeap () returned 0x630000 [0074.932] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0074.932] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\YIrJCRfSyW.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\yirjcrfsyw.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0074.932] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=1998) returned 1 [0074.932] GetProcessHeap () returned 0x630000 [0074.932] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655490 [0074.932] GetProcessHeap () returned 0x630000 [0074.932] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.932] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\YIrJCRfSyW.swf") returned 38 [0074.932] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.932] GetProcessHeap () returned 0x630000 [0074.932] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0074.932] GetProcessHeap () returned 0x630000 [0074.932] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x382) returned 0x672600 [0074.933] lstrlenA (lpString="rsa_encrypt") returned 11 [0074.933] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0074.934] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0074.934] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0074.934] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0074.934] GetProcessHeap () returned 0x630000 [0074.934] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0074.934] lstrlenA (lpString="010001") returned 6 [0074.934] GetProcessHeap () returned 0x630000 [0074.934] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0074.934] GetProcessHeap () returned 0x630000 [0074.934] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.934] GetProcessHeap () returned 0x630000 [0074.934] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65eb20 [0074.934] GetProcessHeap () returned 0x630000 [0074.934] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.934] GetProcessHeap () returned 0x630000 [0074.934] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e340 [0074.934] GetProcessHeap () returned 0x630000 [0074.934] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656db0 [0074.934] GetProcessHeap () returned 0x630000 [0074.934] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0074.934] GetProcessHeap () returned 0x630000 [0074.934] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0074.934] GetProcessHeap () returned 0x630000 [0074.934] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.934] GetProcessHeap () returned 0x630000 [0074.934] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0074.934] GetProcessHeap () returned 0x630000 [0074.934] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.934] GetProcessHeap () returned 0x630000 [0074.934] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657328 [0074.934] GetProcessHeap () returned 0x630000 [0074.934] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.934] GetProcessHeap () returned 0x630000 [0074.934] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0074.934] GetProcessHeap () returned 0x630000 [0074.934] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e610 [0074.934] GetProcessHeap () returned 0x630000 [0074.935] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.935] GetProcessHeap () returned 0x630000 [0074.935] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0074.935] GetProcessHeap () returned 0x630000 [0074.935] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0074.935] GetProcessHeap () returned 0x630000 [0074.935] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.935] GetProcessHeap () returned 0x630000 [0074.935] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65ce80 [0074.935] GetProcessHeap () returned 0x630000 [0074.935] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.935] GetProcessHeap () returned 0x630000 [0074.935] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.935] GetProcessHeap () returned 0x630000 [0074.935] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.935] GetProcessHeap () returned 0x630000 [0074.935] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.935] GetProcessHeap () returned 0x630000 [0074.935] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ebb0 [0074.935] GetProcessHeap () returned 0x630000 [0074.935] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ce80 | out: hHeap=0x630000) returned 1 [0074.935] GetProcessHeap () returned 0x630000 [0074.935] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0074.935] GetProcessHeap () returned 0x630000 [0074.935] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0074.935] GetProcessHeap () returned 0x630000 [0074.935] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.935] GetProcessHeap () returned 0x630000 [0074.935] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.935] GetProcessHeap () returned 0x630000 [0074.935] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.935] GetProcessHeap () returned 0x630000 [0074.935] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.935] GetProcessHeap () returned 0x630000 [0074.935] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.936] GetProcessHeap () returned 0x630000 [0074.936] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.936] GetProcessHeap () returned 0x630000 [0074.936] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.936] GetProcessHeap () returned 0x630000 [0074.936] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.936] GetProcessHeap () returned 0x630000 [0074.936] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.936] GetProcessHeap () returned 0x630000 [0074.936] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.936] GetProcessHeap () returned 0x630000 [0074.936] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.936] GetProcessHeap () returned 0x630000 [0074.936] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.936] GetProcessHeap () returned 0x630000 [0074.936] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.936] GetProcessHeap () returned 0x630000 [0074.936] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.936] GetProcessHeap () returned 0x630000 [0074.936] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.936] GetProcessHeap () returned 0x630000 [0074.936] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.936] GetProcessHeap () returned 0x630000 [0074.936] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.936] GetProcessHeap () returned 0x630000 [0074.936] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.936] GetProcessHeap () returned 0x630000 [0074.936] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.936] GetProcessHeap () returned 0x630000 [0074.936] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.936] GetProcessHeap () returned 0x630000 [0074.936] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.936] GetProcessHeap () returned 0x630000 [0074.936] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.936] GetProcessHeap () returned 0x630000 [0074.936] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.936] GetProcessHeap () returned 0x630000 [0074.936] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.936] GetProcessHeap () returned 0x630000 [0074.937] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.937] GetProcessHeap () returned 0x630000 [0074.937] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.937] GetProcessHeap () returned 0x630000 [0074.937] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.937] GetProcessHeap () returned 0x630000 [0074.937] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.937] GetProcessHeap () returned 0x630000 [0074.937] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.937] GetProcessHeap () returned 0x630000 [0074.937] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.937] GetProcessHeap () returned 0x630000 [0074.937] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.937] GetProcessHeap () returned 0x630000 [0074.937] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.937] GetProcessHeap () returned 0x630000 [0074.937] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.937] GetProcessHeap () returned 0x630000 [0074.937] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.937] GetProcessHeap () returned 0x630000 [0074.937] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.937] GetProcessHeap () returned 0x630000 [0074.937] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.937] GetProcessHeap () returned 0x630000 [0074.937] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.937] GetProcessHeap () returned 0x630000 [0074.937] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.937] GetProcessHeap () returned 0x630000 [0074.937] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.937] GetProcessHeap () returned 0x630000 [0074.937] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.937] GetProcessHeap () returned 0x630000 [0074.937] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.937] GetProcessHeap () returned 0x630000 [0074.937] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.938] GetProcessHeap () returned 0x630000 [0074.938] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.938] GetProcessHeap () returned 0x630000 [0074.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.938] GetProcessHeap () returned 0x630000 [0074.938] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.938] GetProcessHeap () returned 0x630000 [0074.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.938] GetProcessHeap () returned 0x630000 [0074.938] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.938] GetProcessHeap () returned 0x630000 [0074.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.938] GetProcessHeap () returned 0x630000 [0074.938] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.938] GetProcessHeap () returned 0x630000 [0074.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.938] GetProcessHeap () returned 0x630000 [0074.938] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.938] GetProcessHeap () returned 0x630000 [0074.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.938] GetProcessHeap () returned 0x630000 [0074.938] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.938] GetProcessHeap () returned 0x630000 [0074.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.938] GetProcessHeap () returned 0x630000 [0074.938] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.938] GetProcessHeap () returned 0x630000 [0074.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.938] GetProcessHeap () returned 0x630000 [0074.938] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.938] GetProcessHeap () returned 0x630000 [0074.938] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.938] GetProcessHeap () returned 0x630000 [0074.939] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.939] GetProcessHeap () returned 0x630000 [0074.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.939] GetProcessHeap () returned 0x630000 [0074.939] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.939] GetProcessHeap () returned 0x630000 [0074.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.939] GetProcessHeap () returned 0x630000 [0074.939] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.939] GetProcessHeap () returned 0x630000 [0074.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.939] GetProcessHeap () returned 0x630000 [0074.939] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.939] GetProcessHeap () returned 0x630000 [0074.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.939] GetProcessHeap () returned 0x630000 [0074.939] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.939] GetProcessHeap () returned 0x630000 [0074.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.939] GetProcessHeap () returned 0x630000 [0074.939] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.939] GetProcessHeap () returned 0x630000 [0074.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.939] GetProcessHeap () returned 0x630000 [0074.939] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.939] GetProcessHeap () returned 0x630000 [0074.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.939] GetProcessHeap () returned 0x630000 [0074.939] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.939] GetProcessHeap () returned 0x630000 [0074.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.939] GetProcessHeap () returned 0x630000 [0074.939] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.939] GetProcessHeap () returned 0x630000 [0074.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.939] GetProcessHeap () returned 0x630000 [0074.939] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.939] GetProcessHeap () returned 0x630000 [0074.939] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.939] GetProcessHeap () returned 0x630000 [0074.940] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.940] GetProcessHeap () returned 0x630000 [0074.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.940] GetProcessHeap () returned 0x630000 [0074.940] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0074.940] GetProcessHeap () returned 0x630000 [0074.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0074.940] GetProcessHeap () returned 0x630000 [0074.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0074.940] GetProcessHeap () returned 0x630000 [0074.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0074.940] GetProcessHeap () returned 0x630000 [0074.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0074.940] GetProcessHeap () returned 0x630000 [0074.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0074.940] GetProcessHeap () returned 0x630000 [0074.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0074.940] GetProcessHeap () returned 0x630000 [0074.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0074.940] GetProcessHeap () returned 0x630000 [0074.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0074.940] GetProcessHeap () returned 0x630000 [0074.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0074.940] GetProcessHeap () returned 0x630000 [0074.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0074.940] GetProcessHeap () returned 0x630000 [0074.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.940] GetProcessHeap () returned 0x630000 [0074.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0074.940] WriteFile (in: hFile=0x230, lpBuffer=0x672600*, nNumberOfBytesToWrite=0x382, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672600*, lpNumberOfBytesWritten=0x243d864*=0x382, lpOverlapped=0x0) returned 1 [0074.942] GetProcessHeap () returned 0x630000 [0074.942] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x672600, Size=0x30) returned 0x672600 [0074.942] GetProcessHeap () returned 0x630000 [0074.942] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0074.942] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.942] GetProcessHeap () returned 0x630000 [0074.942] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7d0) returned 0x672638 [0074.942] ReadFile (in: hFile=0x230, lpBuffer=0x672638, nNumberOfBytesToRead=0x7d0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x672638*, lpNumberOfBytesRead=0x243d7e8*=0x7d0, lpOverlapped=0x0) returned 1 [0074.942] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.943] WriteFile (in: hFile=0x230, lpBuffer=0x672638*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x672638*, lpNumberOfBytesWritten=0x243d7e4*=0x7d0, lpOverlapped=0x0) returned 1 [0074.943] GetProcessHeap () returned 0x630000 [0074.943] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672638 | out: hHeap=0x630000) returned 1 [0074.943] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.943] WriteFile (in: hFile=0x230, lpBuffer=0x672600*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672600*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0074.944] CloseHandle (hObject=0x230) returned 1 [0074.945] GetProcessHeap () returned 0x630000 [0074.945] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0074.945] GetProcessHeap () returned 0x630000 [0074.945] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655490 | out: hHeap=0x630000) returned 1 [0074.945] GetProcessHeap () returned 0x630000 [0074.945] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0074.945] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\YIrJCRfSyW.swf" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\YIrJCRfSyW.swf") returned="C:\\Users\\FD1HVy\\Desktop\\YIrJCRfSyW.swf" [0074.945] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\YIrJCRfSyW.swf", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\YIrJCRfSyW.swf.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\YIrJCRfSyW.swf.happythreechoose" [0074.945] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\YIrJCRfSyW.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\yirjcrfsyw.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\YIrJCRfSyW.swf.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\yirjcrfsyw.swf.happythreechoose"), dwFlags=0x1) returned 1 [0074.945] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\YIrJCRfSyW.swf" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0074.945] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned="" [0074.945] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" [0074.945] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\decryption info.html")) returned 0x20 [0074.946] GetProcessHeap () returned 0x630000 [0074.946] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0074.946] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x305f1370, ftCreationTime.dwHighDateTime=0x1d5cba4, ftLastAccessTime.dwLowDateTime=0x2ea7e0d0, ftLastAccessTime.dwHighDateTime=0x1d5d7c9, ftLastWriteTime.dwLowDateTime=0x2ea7e0d0, ftLastWriteTime.dwHighDateTime=0x1d5d7c9, nFileSizeHigh=0x0, nFileSizeLow=0x1680, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="YqrYLs-9EMMXvUhoGER.png", cAlternateFileName="YQRYLS~1.PNG")) returned 1 [0074.946] lstrcmpiW (lpString1="YqrYLs-9EMMXvUhoGER.png", lpString2=".") returned 1 [0074.946] lstrcmpiW (lpString1="YqrYLs-9EMMXvUhoGER.png", lpString2="..") returned 1 [0074.946] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="YqrYLs-9EMMXvUhoGER.png" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\YqrYLs-9EMMXvUhoGER.png") returned="C:\\Users\\FD1HVy\\Desktop\\YqrYLs-9EMMXvUhoGER.png" [0074.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="YqrYLs-9EMMXvUhoGER.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0074.946] GetProcessHeap () returned 0x630000 [0074.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18) returned 0x645f78 [0074.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="YqrYLs-9EMMXvUhoGER.png", cchWideChar=-1, lpMultiByteStr=0x645f78, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="YqrYLs-9EMMXvUhoGER.png", lpUsedDefaultChar=0x0) returned 24 [0074.946] lstrlenA (lpString="YqrYLs-9EMMXvUhoGER.png") returned 23 [0074.946] lstrlenA (lpString=".happythreechoose") returned 17 [0074.946] lstrlenA (lpString=".happythreechoose") returned 17 [0074.946] lstrlenA (lpString="YqrYLs-9EMMXvUhoGER.png") returned 23 [0074.946] lstrcmpiA (lpString1="-9EMMXvUhoGER.png", lpString2=".happythreechoose") returned 1 [0074.946] lstrcmpiW (lpString1="YqrYLs-9EMMXvUhoGER.png", lpString2="Decryption INFO.html") returned 1 [0074.946] lstrcmpiW (lpString1="YqrYLs-9EMMXvUhoGER.png", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0074.946] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0074.946] lstrcmpiW (lpString1="YqrYLs-9EMMXvUhoGER.png", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0074.946] GetProcessHeap () returned 0x630000 [0074.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0074.946] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\YqrYLs-9EMMXvUhoGER.png" (normalized: "c:\\users\\fd1hvy\\desktop\\yqryls-9emmxvuhoger.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0074.946] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=5760) returned 1 [0074.946] GetProcessHeap () returned 0x630000 [0074.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655850 [0074.946] GetProcessHeap () returned 0x630000 [0074.946] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.946] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\YqrYLs-9EMMXvUhoGER.png") returned 47 [0074.947] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.947] GetProcessHeap () returned 0x630000 [0074.947] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0074.947] GetProcessHeap () returned 0x630000 [0074.947] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x672638 [0074.947] lstrlenA (lpString="rsa_encrypt") returned 11 [0074.947] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0074.947] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0074.947] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0074.947] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0074.947] GetProcessHeap () returned 0x630000 [0074.947] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0074.947] lstrlenA (lpString="010001") returned 6 [0074.947] GetProcessHeap () returned 0x630000 [0074.947] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0074.947] GetProcessHeap () returned 0x630000 [0074.947] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.948] GetProcessHeap () returned 0x630000 [0074.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65eb20 [0074.948] GetProcessHeap () returned 0x630000 [0074.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.948] GetProcessHeap () returned 0x630000 [0074.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e190 [0074.948] GetProcessHeap () returned 0x630000 [0074.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656ec8 [0074.948] GetProcessHeap () returned 0x630000 [0074.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a298 [0074.948] GetProcessHeap () returned 0x630000 [0074.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0074.948] GetProcessHeap () returned 0x630000 [0074.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.948] GetProcessHeap () returned 0x630000 [0074.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0074.948] GetProcessHeap () returned 0x630000 [0074.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.948] GetProcessHeap () returned 0x630000 [0074.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657788 [0074.948] GetProcessHeap () returned 0x630000 [0074.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.948] GetProcessHeap () returned 0x630000 [0074.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0074.948] GetProcessHeap () returned 0x630000 [0074.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e460 [0074.948] GetProcessHeap () returned 0x630000 [0074.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.948] GetProcessHeap () returned 0x630000 [0074.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0074.948] GetProcessHeap () returned 0x630000 [0074.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e460 | out: hHeap=0x630000) returned 1 [0074.948] GetProcessHeap () returned 0x630000 [0074.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.948] GetProcessHeap () returned 0x630000 [0074.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0074.948] GetProcessHeap () returned 0x630000 [0074.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.948] GetProcessHeap () returned 0x630000 [0074.948] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.948] GetProcessHeap () returned 0x630000 [0074.948] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.949] GetProcessHeap () returned 0x630000 [0074.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.949] GetProcessHeap () returned 0x630000 [0074.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e6a0 [0074.949] GetProcessHeap () returned 0x630000 [0074.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0074.949] GetProcessHeap () returned 0x630000 [0074.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0074.949] GetProcessHeap () returned 0x630000 [0074.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e6a0 | out: hHeap=0x630000) returned 1 [0074.949] GetProcessHeap () returned 0x630000 [0074.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.949] GetProcessHeap () returned 0x630000 [0074.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.949] GetProcessHeap () returned 0x630000 [0074.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.949] GetProcessHeap () returned 0x630000 [0074.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.949] GetProcessHeap () returned 0x630000 [0074.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.949] GetProcessHeap () returned 0x630000 [0074.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.949] GetProcessHeap () returned 0x630000 [0074.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.949] GetProcessHeap () returned 0x630000 [0074.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.949] GetProcessHeap () returned 0x630000 [0074.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.949] GetProcessHeap () returned 0x630000 [0074.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.949] GetProcessHeap () returned 0x630000 [0074.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.949] GetProcessHeap () returned 0x630000 [0074.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.949] GetProcessHeap () returned 0x630000 [0074.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.949] GetProcessHeap () returned 0x630000 [0074.949] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.949] GetProcessHeap () returned 0x630000 [0074.949] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.950] GetProcessHeap () returned 0x630000 [0074.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.950] GetProcessHeap () returned 0x630000 [0074.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.950] GetProcessHeap () returned 0x630000 [0074.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.950] GetProcessHeap () returned 0x630000 [0074.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.950] GetProcessHeap () returned 0x630000 [0074.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.950] GetProcessHeap () returned 0x630000 [0074.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.950] GetProcessHeap () returned 0x630000 [0074.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.950] GetProcessHeap () returned 0x630000 [0074.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.950] GetProcessHeap () returned 0x630000 [0074.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.950] GetProcessHeap () returned 0x630000 [0074.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.950] GetProcessHeap () returned 0x630000 [0074.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.950] GetProcessHeap () returned 0x630000 [0074.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.950] GetProcessHeap () returned 0x630000 [0074.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.950] GetProcessHeap () returned 0x630000 [0074.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.950] GetProcessHeap () returned 0x630000 [0074.950] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.950] GetProcessHeap () returned 0x630000 [0074.950] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.951] GetProcessHeap () returned 0x630000 [0074.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.951] GetProcessHeap () returned 0x630000 [0074.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.951] GetProcessHeap () returned 0x630000 [0074.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.951] GetProcessHeap () returned 0x630000 [0074.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.951] GetProcessHeap () returned 0x630000 [0074.951] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.951] GetProcessHeap () returned 0x630000 [0074.951] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.952] GetProcessHeap () returned 0x630000 [0074.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.952] GetProcessHeap () returned 0x630000 [0074.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.952] GetProcessHeap () returned 0x630000 [0074.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.952] GetProcessHeap () returned 0x630000 [0074.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.952] GetProcessHeap () returned 0x630000 [0074.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.952] GetProcessHeap () returned 0x630000 [0074.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.952] GetProcessHeap () returned 0x630000 [0074.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.952] GetProcessHeap () returned 0x630000 [0074.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.952] GetProcessHeap () returned 0x630000 [0074.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.952] GetProcessHeap () returned 0x630000 [0074.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.952] GetProcessHeap () returned 0x630000 [0074.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.952] GetProcessHeap () returned 0x630000 [0074.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.952] GetProcessHeap () returned 0x630000 [0074.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.952] GetProcessHeap () returned 0x630000 [0074.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.952] GetProcessHeap () returned 0x630000 [0074.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.952] GetProcessHeap () returned 0x630000 [0074.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.952] GetProcessHeap () returned 0x630000 [0074.952] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.952] GetProcessHeap () returned 0x630000 [0074.952] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.952] GetProcessHeap () returned 0x630000 [0074.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.953] GetProcessHeap () returned 0x630000 [0074.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.953] GetProcessHeap () returned 0x630000 [0074.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.953] GetProcessHeap () returned 0x630000 [0074.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.953] GetProcessHeap () returned 0x630000 [0074.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.953] GetProcessHeap () returned 0x630000 [0074.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.953] GetProcessHeap () returned 0x630000 [0074.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.953] GetProcessHeap () returned 0x630000 [0074.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.953] GetProcessHeap () returned 0x630000 [0074.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.953] GetProcessHeap () returned 0x630000 [0074.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.953] GetProcessHeap () returned 0x630000 [0074.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.953] GetProcessHeap () returned 0x630000 [0074.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.953] GetProcessHeap () returned 0x630000 [0074.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.953] GetProcessHeap () returned 0x630000 [0074.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.953] GetProcessHeap () returned 0x630000 [0074.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.953] GetProcessHeap () returned 0x630000 [0074.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.953] GetProcessHeap () returned 0x630000 [0074.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.953] GetProcessHeap () returned 0x630000 [0074.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0074.953] GetProcessHeap () returned 0x630000 [0074.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0074.953] GetProcessHeap () returned 0x630000 [0074.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.953] GetProcessHeap () returned 0x630000 [0074.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.954] GetProcessHeap () returned 0x630000 [0074.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.954] GetProcessHeap () returned 0x630000 [0074.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.954] GetProcessHeap () returned 0x630000 [0074.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.954] GetProcessHeap () returned 0x630000 [0074.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.954] GetProcessHeap () returned 0x630000 [0074.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.954] GetProcessHeap () returned 0x630000 [0074.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.954] GetProcessHeap () returned 0x630000 [0074.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0074.954] GetProcessHeap () returned 0x630000 [0074.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0074.954] GetProcessHeap () returned 0x630000 [0074.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0074.954] GetProcessHeap () returned 0x630000 [0074.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0074.954] GetProcessHeap () returned 0x630000 [0074.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0074.954] GetProcessHeap () returned 0x630000 [0074.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0074.954] GetProcessHeap () returned 0x630000 [0074.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0074.954] GetProcessHeap () returned 0x630000 [0074.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0074.954] GetProcessHeap () returned 0x630000 [0074.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0074.954] GetProcessHeap () returned 0x630000 [0074.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.954] GetProcessHeap () returned 0x630000 [0074.954] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0074.954] WriteFile (in: hFile=0x230, lpBuffer=0x672638*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672638*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0074.956] GetProcessHeap () returned 0x630000 [0074.957] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x672638, Size=0x30) returned 0x672638 [0074.957] GetProcessHeap () returned 0x630000 [0074.957] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0074.957] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.957] GetProcessHeap () returned 0x630000 [0074.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1680) returned 0x672670 [0074.957] ReadFile (in: hFile=0x230, lpBuffer=0x672670, nNumberOfBytesToRead=0x1680, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x672670*, lpNumberOfBytesRead=0x243d7e8*=0x1680, lpOverlapped=0x0) returned 1 [0074.957] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.957] WriteFile (in: hFile=0x230, lpBuffer=0x672670*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x672670*, lpNumberOfBytesWritten=0x243d7e4*=0x1680, lpOverlapped=0x0) returned 1 [0074.958] GetProcessHeap () returned 0x630000 [0074.958] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672670 | out: hHeap=0x630000) returned 1 [0074.958] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.958] WriteFile (in: hFile=0x230, lpBuffer=0x672638*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672638*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0074.959] CloseHandle (hObject=0x230) returned 1 [0074.960] GetProcessHeap () returned 0x630000 [0074.960] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0074.960] GetProcessHeap () returned 0x630000 [0074.960] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655850 | out: hHeap=0x630000) returned 1 [0074.960] GetProcessHeap () returned 0x630000 [0074.960] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0074.960] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\YqrYLs-9EMMXvUhoGER.png" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\YqrYLs-9EMMXvUhoGER.png") returned="C:\\Users\\FD1HVy\\Desktop\\YqrYLs-9EMMXvUhoGER.png" [0074.960] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\YqrYLs-9EMMXvUhoGER.png", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\YqrYLs-9EMMXvUhoGER.png.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\YqrYLs-9EMMXvUhoGER.png.happythreechoose" [0074.960] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\YqrYLs-9EMMXvUhoGER.png" (normalized: "c:\\users\\fd1hvy\\desktop\\yqryls-9emmxvuhoger.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\YqrYLs-9EMMXvUhoGER.png.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\yqryls-9emmxvuhoger.png.happythreechoose"), dwFlags=0x1) returned 1 [0074.961] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\YqrYLs-9EMMXvUhoGER.png" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0074.961] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned="" [0074.961] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" [0074.961] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\decryption info.html")) returned 0x20 [0074.961] GetProcessHeap () returned 0x630000 [0074.961] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645f78 | out: hHeap=0x630000) returned 1 [0074.961] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfad15640, ftCreationTime.dwHighDateTime=0x1d5d6b7, ftLastAccessTime.dwLowDateTime=0xa228c4a0, ftLastAccessTime.dwHighDateTime=0x1d5cc6d, ftLastWriteTime.dwLowDateTime=0xa228c4a0, ftLastWriteTime.dwHighDateTime=0x1d5cc6d, nFileSizeHigh=0x0, nFileSizeLow=0x16cc6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="z3P8_DQ4jdIUA3T0hE.pptx", cAlternateFileName="Z3P8_D~1.PPT")) returned 1 [0074.961] lstrcmpiW (lpString1="z3P8_DQ4jdIUA3T0hE.pptx", lpString2=".") returned 1 [0074.961] lstrcmpiW (lpString1="z3P8_DQ4jdIUA3T0hE.pptx", lpString2="..") returned 1 [0074.961] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="z3P8_DQ4jdIUA3T0hE.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\z3P8_DQ4jdIUA3T0hE.pptx") returned="C:\\Users\\FD1HVy\\Desktop\\z3P8_DQ4jdIUA3T0hE.pptx" [0074.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="z3P8_DQ4jdIUA3T0hE.pptx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0074.961] GetProcessHeap () returned 0x630000 [0074.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18) returned 0x645ef8 [0074.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="z3P8_DQ4jdIUA3T0hE.pptx", cchWideChar=-1, lpMultiByteStr=0x645ef8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="z3P8_DQ4jdIUA3T0hE.pptx", lpUsedDefaultChar=0x0) returned 24 [0074.961] lstrlenA (lpString="z3P8_DQ4jdIUA3T0hE.pptx") returned 23 [0074.961] lstrlenA (lpString=".happythreechoose") returned 17 [0074.961] lstrlenA (lpString=".happythreechoose") returned 17 [0074.961] lstrlenA (lpString="z3P8_DQ4jdIUA3T0hE.pptx") returned 23 [0074.961] lstrcmpiA (lpString1="Q4jdIUA3T0hE.pptx", lpString2=".happythreechoose") returned 1 [0074.961] lstrcmpiW (lpString1="z3P8_DQ4jdIUA3T0hE.pptx", lpString2="Decryption INFO.html") returned 1 [0074.961] lstrcmpiW (lpString1="z3P8_DQ4jdIUA3T0hE.pptx", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0074.961] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0074.961] lstrcmpiW (lpString1="z3P8_DQ4jdIUA3T0hE.pptx", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0074.961] GetProcessHeap () returned 0x630000 [0074.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0074.961] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\z3P8_DQ4jdIUA3T0hE.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\z3p8_dq4jdiua3t0he.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0074.962] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=93382) returned 1 [0074.962] GetProcessHeap () returned 0x630000 [0074.962] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6556e8 [0074.962] GetProcessHeap () returned 0x630000 [0074.962] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.962] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\z3P8_DQ4jdIUA3T0hE.pptx") returned 47 [0074.962] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.962] GetProcessHeap () returned 0x630000 [0074.962] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0074.962] GetProcessHeap () returned 0x630000 [0074.962] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x672670 [0074.962] lstrlenA (lpString="rsa_encrypt") returned 11 [0074.962] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0074.963] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0074.963] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0074.963] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0074.963] GetProcessHeap () returned 0x630000 [0074.963] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0074.963] lstrlenA (lpString="010001") returned 6 [0074.963] GetProcessHeap () returned 0x630000 [0074.963] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0074.963] GetProcessHeap () returned 0x630000 [0074.963] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.963] GetProcessHeap () returned 0x630000 [0074.963] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0074.963] GetProcessHeap () returned 0x630000 [0074.963] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.963] GetProcessHeap () returned 0x630000 [0074.963] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e4f0 [0074.963] GetProcessHeap () returned 0x630000 [0074.963] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657210 [0074.963] GetProcessHeap () returned 0x630000 [0074.963] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2f8 [0074.964] GetProcessHeap () returned 0x630000 [0074.964] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0074.964] GetProcessHeap () returned 0x630000 [0074.964] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.964] GetProcessHeap () returned 0x630000 [0074.964] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0074.964] GetProcessHeap () returned 0x630000 [0074.964] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.964] GetProcessHeap () returned 0x630000 [0074.964] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657788 [0074.964] GetProcessHeap () returned 0x630000 [0074.964] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.964] GetProcessHeap () returned 0x630000 [0074.964] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0074.964] GetProcessHeap () returned 0x630000 [0074.964] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ecd0 [0074.964] GetProcessHeap () returned 0x630000 [0074.964] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.964] GetProcessHeap () returned 0x630000 [0074.964] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0074.964] GetProcessHeap () returned 0x630000 [0074.964] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ecd0 | out: hHeap=0x630000) returned 1 [0074.964] GetProcessHeap () returned 0x630000 [0074.964] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.964] GetProcessHeap () returned 0x630000 [0074.964] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0074.964] GetProcessHeap () returned 0x630000 [0074.964] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.964] GetProcessHeap () returned 0x630000 [0074.964] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.964] GetProcessHeap () returned 0x630000 [0074.964] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.964] GetProcessHeap () returned 0x630000 [0074.964] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.964] GetProcessHeap () returned 0x630000 [0074.964] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e220 [0074.965] GetProcessHeap () returned 0x630000 [0074.965] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0074.965] GetProcessHeap () returned 0x630000 [0074.965] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0074.965] GetProcessHeap () returned 0x630000 [0074.965] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0074.965] GetProcessHeap () returned 0x630000 [0074.965] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.965] GetProcessHeap () returned 0x630000 [0074.965] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.965] GetProcessHeap () returned 0x630000 [0074.965] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.965] GetProcessHeap () returned 0x630000 [0074.965] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.965] GetProcessHeap () returned 0x630000 [0074.965] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.965] GetProcessHeap () returned 0x630000 [0074.965] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.965] GetProcessHeap () returned 0x630000 [0074.965] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.965] GetProcessHeap () returned 0x630000 [0074.965] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.965] GetProcessHeap () returned 0x630000 [0074.965] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.965] GetProcessHeap () returned 0x630000 [0074.965] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.965] GetProcessHeap () returned 0x630000 [0074.965] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.966] GetProcessHeap () returned 0x630000 [0074.966] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.966] GetProcessHeap () returned 0x630000 [0074.966] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.966] GetProcessHeap () returned 0x630000 [0074.966] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.966] GetProcessHeap () returned 0x630000 [0074.966] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.966] GetProcessHeap () returned 0x630000 [0074.966] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.966] GetProcessHeap () returned 0x630000 [0074.966] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.966] GetProcessHeap () returned 0x630000 [0074.966] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.966] GetProcessHeap () returned 0x630000 [0074.966] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.966] GetProcessHeap () returned 0x630000 [0074.966] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.966] GetProcessHeap () returned 0x630000 [0074.966] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.966] GetProcessHeap () returned 0x630000 [0074.966] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.966] GetProcessHeap () returned 0x630000 [0074.966] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.966] GetProcessHeap () returned 0x630000 [0074.966] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.966] GetProcessHeap () returned 0x630000 [0074.966] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.966] GetProcessHeap () returned 0x630000 [0074.966] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.966] GetProcessHeap () returned 0x630000 [0074.966] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.966] GetProcessHeap () returned 0x630000 [0074.966] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.966] GetProcessHeap () returned 0x630000 [0074.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0074.967] GetProcessHeap () returned 0x630000 [0074.967] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0074.967] GetProcessHeap () returned 0x630000 [0074.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.967] GetProcessHeap () returned 0x630000 [0074.967] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.967] GetProcessHeap () returned 0x630000 [0074.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.967] GetProcessHeap () returned 0x630000 [0074.967] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.967] GetProcessHeap () returned 0x630000 [0074.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.967] GetProcessHeap () returned 0x630000 [0074.967] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.967] GetProcessHeap () returned 0x630000 [0074.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.967] GetProcessHeap () returned 0x630000 [0074.967] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.967] GetProcessHeap () returned 0x630000 [0074.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.967] GetProcessHeap () returned 0x630000 [0074.967] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.967] GetProcessHeap () returned 0x630000 [0074.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.967] GetProcessHeap () returned 0x630000 [0074.967] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.968] GetProcessHeap () returned 0x630000 [0074.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.968] GetProcessHeap () returned 0x630000 [0074.968] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.968] GetProcessHeap () returned 0x630000 [0074.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.968] GetProcessHeap () returned 0x630000 [0074.968] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.968] GetProcessHeap () returned 0x630000 [0074.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.968] GetProcessHeap () returned 0x630000 [0074.968] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.968] GetProcessHeap () returned 0x630000 [0074.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.968] GetProcessHeap () returned 0x630000 [0074.968] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.968] GetProcessHeap () returned 0x630000 [0074.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.968] GetProcessHeap () returned 0x630000 [0074.968] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.968] GetProcessHeap () returned 0x630000 [0074.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.968] GetProcessHeap () returned 0x630000 [0074.968] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.968] GetProcessHeap () returned 0x630000 [0074.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.968] GetProcessHeap () returned 0x630000 [0074.968] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.968] GetProcessHeap () returned 0x630000 [0074.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.968] GetProcessHeap () returned 0x630000 [0074.968] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.968] GetProcessHeap () returned 0x630000 [0074.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.968] GetProcessHeap () returned 0x630000 [0074.969] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.969] GetProcessHeap () returned 0x630000 [0074.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.969] GetProcessHeap () returned 0x630000 [0074.969] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.969] GetProcessHeap () returned 0x630000 [0074.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.969] GetProcessHeap () returned 0x630000 [0074.969] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.969] GetProcessHeap () returned 0x630000 [0074.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.969] GetProcessHeap () returned 0x630000 [0074.969] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.969] GetProcessHeap () returned 0x630000 [0074.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.969] GetProcessHeap () returned 0x630000 [0074.969] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.969] GetProcessHeap () returned 0x630000 [0074.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.969] GetProcessHeap () returned 0x630000 [0074.969] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.969] GetProcessHeap () returned 0x630000 [0074.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.969] GetProcessHeap () returned 0x630000 [0074.969] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.969] GetProcessHeap () returned 0x630000 [0074.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.969] GetProcessHeap () returned 0x630000 [0074.969] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.969] GetProcessHeap () returned 0x630000 [0074.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.969] GetProcessHeap () returned 0x630000 [0074.969] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.969] GetProcessHeap () returned 0x630000 [0074.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.969] GetProcessHeap () returned 0x630000 [0074.969] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.970] GetProcessHeap () returned 0x630000 [0074.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.970] GetProcessHeap () returned 0x630000 [0074.970] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.970] GetProcessHeap () returned 0x630000 [0074.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.970] GetProcessHeap () returned 0x630000 [0074.970] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.970] GetProcessHeap () returned 0x630000 [0074.970] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0074.970] GetProcessHeap () returned 0x630000 [0074.970] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0074.970] GetProcessHeap () returned 0x630000 [0074.971] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0074.971] GetProcessHeap () returned 0x630000 [0074.971] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0074.971] GetProcessHeap () returned 0x630000 [0074.971] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0074.971] GetProcessHeap () returned 0x630000 [0074.971] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0074.971] GetProcessHeap () returned 0x630000 [0074.971] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0074.971] GetProcessHeap () returned 0x630000 [0074.971] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0074.971] GetProcessHeap () returned 0x630000 [0074.971] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0074.971] GetProcessHeap () returned 0x630000 [0074.971] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.971] GetProcessHeap () returned 0x630000 [0074.971] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0074.971] WriteFile (in: hFile=0x230, lpBuffer=0x672670*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672670*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0074.974] GetProcessHeap () returned 0x630000 [0074.974] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x672670, Size=0x30) returned 0x672670 [0074.974] GetProcessHeap () returned 0x630000 [0074.974] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0074.974] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.974] GetProcessHeap () returned 0x630000 [0074.974] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16cc6) returned 0x6726a8 [0074.976] ReadFile (in: hFile=0x230, lpBuffer=0x6726a8, nNumberOfBytesToRead=0x16cc6, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x6726a8*, lpNumberOfBytesRead=0x243d7e8*=0x16cc6, lpOverlapped=0x0) returned 1 [0074.976] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.976] WriteFile (in: hFile=0x230, lpBuffer=0x6726a8*, nNumberOfBytesToWrite=0x16cc6, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x6726a8*, lpNumberOfBytesWritten=0x243d7e4*=0x16cc6, lpOverlapped=0x0) returned 1 [0074.978] GetProcessHeap () returned 0x630000 [0074.978] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6726a8 | out: hHeap=0x630000) returned 1 [0074.978] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.978] WriteFile (in: hFile=0x230, lpBuffer=0x672670*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672670*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0074.979] CloseHandle (hObject=0x230) returned 1 [0074.980] GetProcessHeap () returned 0x630000 [0074.980] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0074.980] GetProcessHeap () returned 0x630000 [0074.980] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6556e8 | out: hHeap=0x630000) returned 1 [0074.980] GetProcessHeap () returned 0x630000 [0074.980] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0074.980] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\z3P8_DQ4jdIUA3T0hE.pptx" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\z3P8_DQ4jdIUA3T0hE.pptx") returned="C:\\Users\\FD1HVy\\Desktop\\z3P8_DQ4jdIUA3T0hE.pptx" [0074.980] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\z3P8_DQ4jdIUA3T0hE.pptx", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\z3P8_DQ4jdIUA3T0hE.pptx.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\z3P8_DQ4jdIUA3T0hE.pptx.happythreechoose" [0074.980] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\z3P8_DQ4jdIUA3T0hE.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\z3p8_dq4jdiua3t0he.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\z3P8_DQ4jdIUA3T0hE.pptx.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\z3p8_dq4jdiua3t0he.pptx.happythreechoose"), dwFlags=0x1) returned 1 [0074.980] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\z3P8_DQ4jdIUA3T0hE.pptx" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0074.980] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned="" [0074.981] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" [0074.981] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\decryption info.html")) returned 0x20 [0074.981] GetProcessHeap () returned 0x630000 [0074.981] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645ef8 | out: hHeap=0x630000) returned 1 [0074.981] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d81fa00, ftCreationTime.dwHighDateTime=0x1d5d6e8, ftLastAccessTime.dwLowDateTime=0xf7981890, ftLastAccessTime.dwHighDateTime=0x1d5d367, ftLastWriteTime.dwLowDateTime=0xf7981890, ftLastWriteTime.dwHighDateTime=0x1d5d367, nFileSizeHigh=0x0, nFileSizeLow=0x173c1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ZRmISXr.ppt", cAlternateFileName="")) returned 1 [0074.981] lstrcmpiW (lpString1="ZRmISXr.ppt", lpString2=".") returned 1 [0074.981] lstrcmpiW (lpString1="ZRmISXr.ppt", lpString2="..") returned 1 [0074.981] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="ZRmISXr.ppt" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\ZRmISXr.ppt") returned="C:\\Users\\FD1HVy\\Desktop\\ZRmISXr.ppt" [0074.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ZRmISXr.ppt", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0074.981] GetProcessHeap () returned 0x630000 [0074.981] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0074.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ZRmISXr.ppt", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ZRmISXr.ppt", lpUsedDefaultChar=0x0) returned 12 [0074.981] lstrlenA (lpString="ZRmISXr.ppt") returned 11 [0074.981] lstrlenA (lpString=".happythreechoose") returned 17 [0074.981] lstrcmpiW (lpString1="ZRmISXr.ppt", lpString2="Decryption INFO.html") returned 1 [0074.981] lstrcmpiW (lpString1="ZRmISXr.ppt", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0074.981] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0074.981] lstrcmpiW (lpString1="ZRmISXr.ppt", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0074.981] GetProcessHeap () returned 0x630000 [0074.981] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x652000 [0074.981] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\ZRmISXr.ppt" (normalized: "c:\\users\\fd1hvy\\desktop\\zrmisxr.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0074.982] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=95169) returned 1 [0074.982] GetProcessHeap () returned 0x630000 [0074.982] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655418 [0074.982] GetProcessHeap () returned 0x630000 [0074.982] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.982] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\ZRmISXr.ppt") returned 35 [0074.982] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.982] GetProcessHeap () returned 0x630000 [0074.982] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0074.982] GetProcessHeap () returned 0x630000 [0074.982] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x6726a8 [0074.982] lstrlenA (lpString="rsa_encrypt") returned 11 [0074.982] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0074.983] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0074.984] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0074.984] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0074.984] GetProcessHeap () returned 0x630000 [0074.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0074.984] lstrlenA (lpString="010001") returned 6 [0074.984] GetProcessHeap () returned 0x630000 [0074.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0074.984] GetProcessHeap () returned 0x630000 [0074.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.984] GetProcessHeap () returned 0x630000 [0074.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e340 [0074.984] GetProcessHeap () returned 0x630000 [0074.984] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.984] GetProcessHeap () returned 0x630000 [0074.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea90 [0074.984] GetProcessHeap () returned 0x630000 [0074.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657788 [0074.984] GetProcessHeap () returned 0x630000 [0074.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a328 [0074.984] GetProcessHeap () returned 0x630000 [0074.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0074.984] GetProcessHeap () returned 0x630000 [0074.984] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.984] GetProcessHeap () returned 0x630000 [0074.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0074.984] GetProcessHeap () returned 0x630000 [0074.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.984] GetProcessHeap () returned 0x630000 [0074.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656db0 [0074.984] GetProcessHeap () returned 0x630000 [0074.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.984] GetProcessHeap () returned 0x630000 [0074.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0074.984] GetProcessHeap () returned 0x630000 [0074.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65eb20 [0074.984] GetProcessHeap () returned 0x630000 [0074.984] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.984] GetProcessHeap () returned 0x630000 [0074.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0074.985] GetProcessHeap () returned 0x630000 [0074.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0074.985] GetProcessHeap () returned 0x630000 [0074.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.985] GetProcessHeap () returned 0x630000 [0074.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65d060 [0074.985] GetProcessHeap () returned 0x630000 [0074.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.985] GetProcessHeap () returned 0x630000 [0074.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.985] GetProcessHeap () returned 0x630000 [0074.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.985] GetProcessHeap () returned 0x630000 [0074.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.985] GetProcessHeap () returned 0x630000 [0074.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e190 [0074.985] GetProcessHeap () returned 0x630000 [0074.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65d060 | out: hHeap=0x630000) returned 1 [0074.985] GetProcessHeap () returned 0x630000 [0074.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0074.985] GetProcessHeap () returned 0x630000 [0074.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0074.985] GetProcessHeap () returned 0x630000 [0074.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.985] GetProcessHeap () returned 0x630000 [0074.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.985] GetProcessHeap () returned 0x630000 [0074.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.985] GetProcessHeap () returned 0x630000 [0074.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.985] GetProcessHeap () returned 0x630000 [0074.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.985] GetProcessHeap () returned 0x630000 [0074.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.985] GetProcessHeap () returned 0x630000 [0074.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.985] GetProcessHeap () returned 0x630000 [0074.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.985] GetProcessHeap () returned 0x630000 [0074.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.985] GetProcessHeap () returned 0x630000 [0074.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.986] GetProcessHeap () returned 0x630000 [0074.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.986] GetProcessHeap () returned 0x630000 [0074.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.986] GetProcessHeap () returned 0x630000 [0074.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.986] GetProcessHeap () returned 0x630000 [0074.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.986] GetProcessHeap () returned 0x630000 [0074.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.986] GetProcessHeap () returned 0x630000 [0074.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.986] GetProcessHeap () returned 0x630000 [0074.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.986] GetProcessHeap () returned 0x630000 [0074.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.986] GetProcessHeap () returned 0x630000 [0074.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.986] GetProcessHeap () returned 0x630000 [0074.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.986] GetProcessHeap () returned 0x630000 [0074.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.986] GetProcessHeap () returned 0x630000 [0074.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.986] GetProcessHeap () returned 0x630000 [0074.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.986] GetProcessHeap () returned 0x630000 [0074.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.986] GetProcessHeap () returned 0x630000 [0074.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0074.986] GetProcessHeap () returned 0x630000 [0074.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0074.986] GetProcessHeap () returned 0x630000 [0074.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.986] GetProcessHeap () returned 0x630000 [0074.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.986] GetProcessHeap () returned 0x630000 [0074.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0074.986] GetProcessHeap () returned 0x630000 [0074.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0074.987] GetProcessHeap () returned 0x630000 [0074.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.987] GetProcessHeap () returned 0x630000 [0074.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.987] GetProcessHeap () returned 0x630000 [0074.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.987] GetProcessHeap () returned 0x630000 [0074.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.987] GetProcessHeap () returned 0x630000 [0074.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0074.987] GetProcessHeap () returned 0x630000 [0074.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0074.987] GetProcessHeap () returned 0x630000 [0074.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.987] GetProcessHeap () returned 0x630000 [0074.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.987] GetProcessHeap () returned 0x630000 [0074.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.987] GetProcessHeap () returned 0x630000 [0074.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.987] GetProcessHeap () returned 0x630000 [0074.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.987] GetProcessHeap () returned 0x630000 [0074.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.987] GetProcessHeap () returned 0x630000 [0074.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.987] GetProcessHeap () returned 0x630000 [0074.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.987] GetProcessHeap () returned 0x630000 [0074.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0074.987] GetProcessHeap () returned 0x630000 [0074.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0074.987] GetProcessHeap () returned 0x630000 [0074.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.987] GetProcessHeap () returned 0x630000 [0074.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.987] GetProcessHeap () returned 0x630000 [0074.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0074.987] GetProcessHeap () returned 0x630000 [0074.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0074.988] GetProcessHeap () returned 0x630000 [0074.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.988] GetProcessHeap () returned 0x630000 [0074.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.988] GetProcessHeap () returned 0x630000 [0074.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.988] GetProcessHeap () returned 0x630000 [0074.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.988] GetProcessHeap () returned 0x630000 [0074.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0074.988] GetProcessHeap () returned 0x630000 [0074.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0074.988] GetProcessHeap () returned 0x630000 [0074.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.988] GetProcessHeap () returned 0x630000 [0074.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.988] GetProcessHeap () returned 0x630000 [0074.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.988] GetProcessHeap () returned 0x630000 [0074.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.988] GetProcessHeap () returned 0x630000 [0074.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.988] GetProcessHeap () returned 0x630000 [0074.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.988] GetProcessHeap () returned 0x630000 [0074.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.988] GetProcessHeap () returned 0x630000 [0074.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.988] GetProcessHeap () returned 0x630000 [0074.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.988] GetProcessHeap () returned 0x630000 [0074.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.988] GetProcessHeap () returned 0x630000 [0074.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.988] GetProcessHeap () returned 0x630000 [0074.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.988] GetProcessHeap () returned 0x630000 [0074.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.988] GetProcessHeap () returned 0x630000 [0074.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.989] GetProcessHeap () returned 0x630000 [0074.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.989] GetProcessHeap () returned 0x630000 [0074.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.989] GetProcessHeap () returned 0x630000 [0074.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.989] GetProcessHeap () returned 0x630000 [0074.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.989] GetProcessHeap () returned 0x630000 [0074.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.989] GetProcessHeap () returned 0x630000 [0074.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.989] GetProcessHeap () returned 0x630000 [0074.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0074.989] GetProcessHeap () returned 0x630000 [0074.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0074.989] GetProcessHeap () returned 0x630000 [0074.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.989] GetProcessHeap () returned 0x630000 [0074.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.989] GetProcessHeap () returned 0x630000 [0074.989] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0074.989] GetProcessHeap () returned 0x630000 [0074.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0074.989] GetProcessHeap () returned 0x630000 [0074.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0074.989] GetProcessHeap () returned 0x630000 [0074.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0074.989] GetProcessHeap () returned 0x630000 [0074.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0074.989] GetProcessHeap () returned 0x630000 [0074.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0074.989] GetProcessHeap () returned 0x630000 [0074.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0074.989] GetProcessHeap () returned 0x630000 [0074.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea90 | out: hHeap=0x630000) returned 1 [0074.989] GetProcessHeap () returned 0x630000 [0074.989] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0074.989] GetProcessHeap () returned 0x630000 [0074.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0074.990] GetProcessHeap () returned 0x630000 [0074.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0074.990] GetProcessHeap () returned 0x630000 [0074.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.990] GetProcessHeap () returned 0x630000 [0074.990] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0074.990] WriteFile (in: hFile=0x230, lpBuffer=0x6726a8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6726a8*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0074.991] GetProcessHeap () returned 0x630000 [0074.991] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6726a8, Size=0x30) returned 0x6726a8 [0074.991] GetProcessHeap () returned 0x630000 [0074.991] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0074.991] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.992] GetProcessHeap () returned 0x630000 [0074.992] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x173c1) returned 0x6726e0 [0074.992] ReadFile (in: hFile=0x230, lpBuffer=0x6726e0, nNumberOfBytesToRead=0x173c1, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x6726e0*, lpNumberOfBytesRead=0x243d7e8*=0x173c1, lpOverlapped=0x0) returned 1 [0074.993] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0074.993] WriteFile (in: hFile=0x230, lpBuffer=0x6726e0*, nNumberOfBytesToWrite=0x173c1, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x6726e0*, lpNumberOfBytesWritten=0x243d7e4*=0x173c1, lpOverlapped=0x0) returned 1 [0074.994] GetProcessHeap () returned 0x630000 [0074.994] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6726e0 | out: hHeap=0x630000) returned 1 [0074.994] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.994] WriteFile (in: hFile=0x230, lpBuffer=0x6726a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6726a8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0074.995] CloseHandle (hObject=0x230) returned 1 [0074.996] GetProcessHeap () returned 0x630000 [0074.996] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x652000 | out: hHeap=0x630000) returned 1 [0074.996] GetProcessHeap () returned 0x630000 [0074.996] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655418 | out: hHeap=0x630000) returned 1 [0074.996] GetProcessHeap () returned 0x630000 [0074.996] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0074.996] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\ZRmISXr.ppt" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\ZRmISXr.ppt") returned="C:\\Users\\FD1HVy\\Desktop\\ZRmISXr.ppt" [0074.996] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\ZRmISXr.ppt", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\ZRmISXr.ppt.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\ZRmISXr.ppt.happythreechoose" [0074.996] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ZRmISXr.ppt" (normalized: "c:\\users\\fd1hvy\\desktop\\zrmisxr.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\ZRmISXr.ppt.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\zrmisxr.ppt.happythreechoose"), dwFlags=0x1) returned 1 [0074.996] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\ZRmISXr.ppt" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0074.996] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned="" [0074.996] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" [0074.996] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\decryption info.html")) returned 0x20 [0074.996] GetProcessHeap () returned 0x630000 [0074.997] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0074.997] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x391c18f0, ftCreationTime.dwHighDateTime=0x1d5d653, ftLastAccessTime.dwLowDateTime=0x43778b60, ftLastAccessTime.dwHighDateTime=0x1d5c8c8, ftLastWriteTime.dwLowDateTime=0x43778b60, ftLastWriteTime.dwHighDateTime=0x1d5c8c8, nFileSizeHigh=0x0, nFileSizeLow=0xba25, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_CsHR_-UguLHOpdJY.avi", cAlternateFileName="_CSHR_~1.AVI")) returned 1 [0074.997] lstrcmpiW (lpString1="_CsHR_-UguLHOpdJY.avi", lpString2=".") returned 1 [0074.997] lstrcmpiW (lpString1="_CsHR_-UguLHOpdJY.avi", lpString2="..") returned 1 [0074.997] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="_CsHR_-UguLHOpdJY.avi" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\_CsHR_-UguLHOpdJY.avi") returned="C:\\Users\\FD1HVy\\Desktop\\_CsHR_-UguLHOpdJY.avi" [0074.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="_CsHR_-UguLHOpdJY.avi", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0074.997] GetProcessHeap () returned 0x630000 [0074.997] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x645cd8 [0074.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="_CsHR_-UguLHOpdJY.avi", cchWideChar=-1, lpMultiByteStr=0x645cd8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_CsHR_-UguLHOpdJY.avi", lpUsedDefaultChar=0x0) returned 22 [0074.997] lstrlenA (lpString="_CsHR_-UguLHOpdJY.avi") returned 21 [0074.997] lstrlenA (lpString=".happythreechoose") returned 17 [0074.997] lstrlenA (lpString=".happythreechoose") returned 17 [0074.997] lstrlenA (lpString="_CsHR_-UguLHOpdJY.avi") returned 21 [0074.997] lstrcmpiA (lpString1="R_-UguLHOpdJY.avi", lpString2=".happythreechoose") returned 1 [0074.997] lstrcmpiW (lpString1="_CsHR_-UguLHOpdJY.avi", lpString2="Decryption INFO.html") returned -1 [0074.997] lstrcmpiW (lpString1="_CsHR_-UguLHOpdJY.avi", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned -1 [0074.997] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0074.997] lstrcmpiW (lpString1="_CsHR_-UguLHOpdJY.avi", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0074.997] GetProcessHeap () returned 0x630000 [0074.997] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f10 [0074.997] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\_CsHR_-UguLHOpdJY.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\_cshr_-ugulhopdjy.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0074.997] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=47653) returned 1 [0074.997] GetProcessHeap () returned 0x630000 [0074.997] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655b20 [0074.997] GetProcessHeap () returned 0x630000 [0074.997] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0074.997] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\_CsHR_-UguLHOpdJY.avi") returned 45 [0074.997] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0074.997] GetProcessHeap () returned 0x630000 [0074.997] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0074.997] GetProcessHeap () returned 0x630000 [0074.998] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x6726e0 [0074.998] lstrlenA (lpString="rsa_encrypt") returned 11 [0074.998] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0074.998] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0074.998] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0074.998] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0074.998] GetProcessHeap () returned 0x630000 [0074.998] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0074.998] lstrlenA (lpString="010001") returned 6 [0074.998] GetProcessHeap () returned 0x630000 [0074.998] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0074.998] GetProcessHeap () returned 0x630000 [0074.998] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.998] GetProcessHeap () returned 0x630000 [0074.998] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e340 [0074.998] GetProcessHeap () returned 0x630000 [0074.998] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.998] GetProcessHeap () returned 0x630000 [0074.998] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e970 [0074.998] GetProcessHeap () returned 0x630000 [0074.999] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656ec8 [0074.999] GetProcessHeap () returned 0x630000 [0074.999] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0074.999] GetProcessHeap () returned 0x630000 [0074.999] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0074.999] GetProcessHeap () returned 0x630000 [0074.999] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.999] GetProcessHeap () returned 0x630000 [0074.999] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0074.999] GetProcessHeap () returned 0x630000 [0074.999] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0074.999] GetProcessHeap () returned 0x630000 [0074.999] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656fe0 [0074.999] GetProcessHeap () returned 0x630000 [0074.999] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0074.999] GetProcessHeap () returned 0x630000 [0074.999] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0074.999] GetProcessHeap () returned 0x630000 [0074.999] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dfe0 [0074.999] GetProcessHeap () returned 0x630000 [0074.999] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0074.999] GetProcessHeap () returned 0x630000 [0074.999] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0074.999] GetProcessHeap () returned 0x630000 [0074.999] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0074.999] GetProcessHeap () returned 0x630000 [0074.999] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.999] GetProcessHeap () returned 0x630000 [0074.999] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0074.999] GetProcessHeap () returned 0x630000 [0074.999] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0074.999] GetProcessHeap () returned 0x630000 [0074.999] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.999] GetProcessHeap () returned 0x630000 [0074.999] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0074.999] GetProcessHeap () returned 0x630000 [0074.999] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0074.999] GetProcessHeap () returned 0x630000 [0074.999] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65dda0 [0075.000] GetProcessHeap () returned 0x630000 [0075.000] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0075.000] GetProcessHeap () returned 0x630000 [0075.000] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0075.000] GetProcessHeap () returned 0x630000 [0075.000] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0075.000] GetProcessHeap () returned 0x630000 [0075.000] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0075.000] GetProcessHeap () returned 0x630000 [0075.000] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0075.000] GetProcessHeap () returned 0x630000 [0075.000] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0075.000] GetProcessHeap () returned 0x630000 [0075.000] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0075.000] GetProcessHeap () returned 0x630000 [0075.000] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.000] GetProcessHeap () returned 0x630000 [0075.000] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.000] GetProcessHeap () returned 0x630000 [0075.000] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.000] GetProcessHeap () returned 0x630000 [0075.000] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.000] GetProcessHeap () returned 0x630000 [0075.000] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0075.000] GetProcessHeap () returned 0x630000 [0075.000] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0075.000] GetProcessHeap () returned 0x630000 [0075.000] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.000] GetProcessHeap () returned 0x630000 [0075.000] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.000] GetProcessHeap () returned 0x630000 [0075.000] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0075.000] GetProcessHeap () returned 0x630000 [0075.000] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0075.000] GetProcessHeap () returned 0x630000 [0075.000] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.000] GetProcessHeap () returned 0x630000 [0075.000] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.000] GetProcessHeap () returned 0x630000 [0075.000] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.001] GetProcessHeap () returned 0x630000 [0075.001] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.001] GetProcessHeap () returned 0x630000 [0075.001] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.001] GetProcessHeap () returned 0x630000 [0075.001] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.001] GetProcessHeap () returned 0x630000 [0075.001] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.001] GetProcessHeap () returned 0x630000 [0075.001] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.001] GetProcessHeap () returned 0x630000 [0075.001] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0075.001] GetProcessHeap () returned 0x630000 [0075.001] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0075.001] GetProcessHeap () returned 0x630000 [0075.001] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0075.001] GetProcessHeap () returned 0x630000 [0075.001] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0075.001] GetProcessHeap () returned 0x630000 [0075.001] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.001] GetProcessHeap () returned 0x630000 [0075.001] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.001] GetProcessHeap () returned 0x630000 [0075.001] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.001] GetProcessHeap () returned 0x630000 [0075.001] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.001] GetProcessHeap () returned 0x630000 [0075.001] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.001] GetProcessHeap () returned 0x630000 [0075.001] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.001] GetProcessHeap () returned 0x630000 [0075.001] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0075.001] GetProcessHeap () returned 0x630000 [0075.001] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0075.002] GetProcessHeap () returned 0x630000 [0075.002] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0075.002] GetProcessHeap () returned 0x630000 [0075.002] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0075.002] GetProcessHeap () returned 0x630000 [0075.002] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.002] GetProcessHeap () returned 0x630000 [0075.002] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.002] GetProcessHeap () returned 0x630000 [0075.002] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0075.002] GetProcessHeap () returned 0x630000 [0075.002] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0075.002] GetProcessHeap () returned 0x630000 [0075.002] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0075.002] GetProcessHeap () returned 0x630000 [0075.002] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0075.002] GetProcessHeap () returned 0x630000 [0075.002] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0075.002] GetProcessHeap () returned 0x630000 [0075.002] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0075.002] GetProcessHeap () returned 0x630000 [0075.002] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0075.002] GetProcessHeap () returned 0x630000 [0075.002] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0075.002] GetProcessHeap () returned 0x630000 [0075.002] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.002] GetProcessHeap () returned 0x630000 [0075.002] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.002] GetProcessHeap () returned 0x630000 [0075.002] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.003] GetProcessHeap () returned 0x630000 [0075.003] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.003] GetProcessHeap () returned 0x630000 [0075.003] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.003] GetProcessHeap () returned 0x630000 [0075.003] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.003] GetProcessHeap () returned 0x630000 [0075.003] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0075.003] GetProcessHeap () returned 0x630000 [0075.003] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0075.003] GetProcessHeap () returned 0x630000 [0075.003] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.003] GetProcessHeap () returned 0x630000 [0075.003] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.003] GetProcessHeap () returned 0x630000 [0075.003] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0075.003] GetProcessHeap () returned 0x630000 [0075.003] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0075.003] GetProcessHeap () returned 0x630000 [0075.003] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.003] GetProcessHeap () returned 0x630000 [0075.003] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.003] GetProcessHeap () returned 0x630000 [0075.003] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0075.003] GetProcessHeap () returned 0x630000 [0075.003] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0075.003] GetProcessHeap () returned 0x630000 [0075.003] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.003] GetProcessHeap () returned 0x630000 [0075.003] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.003] GetProcessHeap () returned 0x630000 [0075.004] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0075.004] GetProcessHeap () returned 0x630000 [0075.004] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0075.004] GetProcessHeap () returned 0x630000 [0075.004] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0075.004] GetProcessHeap () returned 0x630000 [0075.004] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0075.004] GetProcessHeap () returned 0x630000 [0075.004] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.004] GetProcessHeap () returned 0x630000 [0075.004] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.004] GetProcessHeap () returned 0x630000 [0075.004] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.004] GetProcessHeap () returned 0x630000 [0075.004] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.004] GetProcessHeap () returned 0x630000 [0075.004] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0075.004] GetProcessHeap () returned 0x630000 [0075.004] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0075.004] GetProcessHeap () returned 0x630000 [0075.004] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.004] GetProcessHeap () returned 0x630000 [0075.004] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.004] GetProcessHeap () returned 0x630000 [0075.004] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0075.004] GetProcessHeap () returned 0x630000 [0075.004] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0075.004] GetProcessHeap () returned 0x630000 [0075.004] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.004] GetProcessHeap () returned 0x630000 [0075.004] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.004] GetProcessHeap () returned 0x630000 [0075.004] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.004] GetProcessHeap () returned 0x630000 [0075.004] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.004] GetProcessHeap () returned 0x630000 [0075.005] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0075.005] GetProcessHeap () returned 0x630000 [0075.005] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0075.005] GetProcessHeap () returned 0x630000 [0075.005] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0075.005] GetProcessHeap () returned 0x630000 [0075.005] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0075.005] GetProcessHeap () returned 0x630000 [0075.005] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0075.005] GetProcessHeap () returned 0x630000 [0075.005] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0075.005] GetProcessHeap () returned 0x630000 [0075.005] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0075.005] GetProcessHeap () returned 0x630000 [0075.005] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0075.005] GetProcessHeap () returned 0x630000 [0075.005] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0075.005] GetProcessHeap () returned 0x630000 [0075.005] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.005] GetProcessHeap () returned 0x630000 [0075.005] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0075.005] WriteFile (in: hFile=0x230, lpBuffer=0x6726e0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6726e0*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0075.006] GetProcessHeap () returned 0x630000 [0075.006] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6726e0, Size=0x30) returned 0x6726e0 [0075.006] GetProcessHeap () returned 0x630000 [0075.006] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0075.006] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.007] GetProcessHeap () returned 0x630000 [0075.007] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xba25) returned 0x672718 [0075.007] ReadFile (in: hFile=0x230, lpBuffer=0x672718, nNumberOfBytesToRead=0xba25, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x672718*, lpNumberOfBytesRead=0x243d7e8*=0xba25, lpOverlapped=0x0) returned 1 [0075.007] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.007] WriteFile (in: hFile=0x230, lpBuffer=0x672718*, nNumberOfBytesToWrite=0xba25, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x672718*, lpNumberOfBytesWritten=0x243d7e4*=0xba25, lpOverlapped=0x0) returned 1 [0075.008] GetProcessHeap () returned 0x630000 [0075.008] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672718 | out: hHeap=0x630000) returned 1 [0075.010] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.010] WriteFile (in: hFile=0x230, lpBuffer=0x6726e0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6726e0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0075.011] CloseHandle (hObject=0x230) returned 1 [0075.011] GetProcessHeap () returned 0x630000 [0075.011] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f10 | out: hHeap=0x630000) returned 1 [0075.011] GetProcessHeap () returned 0x630000 [0075.011] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655b20 | out: hHeap=0x630000) returned 1 [0075.011] GetProcessHeap () returned 0x630000 [0075.011] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0075.011] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\_CsHR_-UguLHOpdJY.avi" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\_CsHR_-UguLHOpdJY.avi") returned="C:\\Users\\FD1HVy\\Desktop\\_CsHR_-UguLHOpdJY.avi" [0075.011] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\_CsHR_-UguLHOpdJY.avi", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\_CsHR_-UguLHOpdJY.avi.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\_CsHR_-UguLHOpdJY.avi.happythreechoose" [0075.011] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\_CsHR_-UguLHOpdJY.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\_cshr_-ugulhopdjy.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\_CsHR_-UguLHOpdJY.avi.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\_cshr_-ugulhopdjy.avi.happythreechoose"), dwFlags=0x1) returned 1 [0075.012] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\_CsHR_-UguLHOpdJY.avi" | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0075.012] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\") returned="" [0075.012] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" [0075.012] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\decryption info.html")) returned 0x20 [0075.012] GetProcessHeap () returned 0x630000 [0075.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645cd8 | out: hHeap=0x630000) returned 1 [0075.012] FindNextFileW (in: hFindFile=0x648810, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x391c18f0, ftCreationTime.dwHighDateTime=0x1d5d653, ftLastAccessTime.dwLowDateTime=0x43778b60, ftLastAccessTime.dwHighDateTime=0x1d5c8c8, ftLastWriteTime.dwLowDateTime=0x43778b60, ftLastWriteTime.dwHighDateTime=0x1d5c8c8, nFileSizeHigh=0x0, nFileSizeLow=0xba25, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_CsHR_-UguLHOpdJY.avi", cAlternateFileName="_CSHR_~1.AVI")) returned 0 [0075.012] FindClose (in: hFindFile=0x648810 | out: hFindFile=0x648810) returned 1 [0075.012] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\") returned="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\" [0075.012] GetProcessHeap () returned 0x630000 [0075.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6539f0 | out: hHeap=0x630000) returned 1 [0075.012] GetProcessHeap () returned 0x630000 [0075.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.012] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\") returned 42 [0075.012] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\*") returned="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\*" [0075.012] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea65df40, ftCreationTime.dwHighDateTime=0x1d5d709, ftLastAccessTime.dwLowDateTime=0xa8af5340, ftLastAccessTime.dwHighDateTime=0x1d5d3c8, ftLastWriteTime.dwLowDateTime=0xa8af5340, ftLastWriteTime.dwHighDateTime=0x1d5d3c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648a90 [0075.012] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0075.013] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea65df40, ftCreationTime.dwHighDateTime=0x1d5d709, ftLastAccessTime.dwLowDateTime=0xa8af5340, ftLastAccessTime.dwHighDateTime=0x1d5d3c8, ftLastWriteTime.dwLowDateTime=0xa8af5340, ftLastWriteTime.dwHighDateTime=0x1d5d3c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.013] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0075.013] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0075.013] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb82775d0, ftCreationTime.dwHighDateTime=0x1d5d253, ftLastAccessTime.dwLowDateTime=0x5bdf01d0, ftLastAccessTime.dwHighDateTime=0x1d5d325, ftLastWriteTime.dwLowDateTime=0x5bdf01d0, ftLastWriteTime.dwHighDateTime=0x1d5d325, nFileSizeHigh=0x0, nFileSizeLow=0xe0de, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="2I0gPBE.swf", cAlternateFileName="")) returned 1 [0075.013] lstrcmpiW (lpString1="2I0gPBE.swf", lpString2=".") returned 1 [0075.013] lstrcmpiW (lpString1="2I0gPBE.swf", lpString2="..") returned 1 [0075.013] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\", lpString2="2I0gPBE.swf" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\2I0gPBE.swf") returned="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\2I0gPBE.swf" [0075.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="2I0gPBE.swf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0075.013] GetProcessHeap () returned 0x630000 [0075.013] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0075.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="2I0gPBE.swf", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2I0gPBE.swf", lpUsedDefaultChar=0x0) returned 12 [0075.013] lstrlenA (lpString="2I0gPBE.swf") returned 11 [0075.013] lstrlenA (lpString=".happythreechoose") returned 17 [0075.013] lstrcmpiW (lpString1="2I0gPBE.swf", lpString2="Decryption INFO.html") returned -1 [0075.013] lstrcmpiW (lpString1="2I0gPBE.swf", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned -1 [0075.013] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0075.013] lstrcmpiW (lpString1="2I0gPBE.swf", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0075.013] GetProcessHeap () returned 0x630000 [0075.013] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0075.013] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\2I0gPBE.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\yb4howqifgmj-cuky\\2i0gpbe.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0075.013] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=57566) returned 1 [0075.013] GetProcessHeap () returned 0x630000 [0075.013] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655670 [0075.013] GetProcessHeap () returned 0x630000 [0075.013] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0075.013] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\2I0gPBE.swf") returned 53 [0075.013] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.013] GetProcessHeap () returned 0x630000 [0075.013] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0075.013] GetProcessHeap () returned 0x630000 [0075.013] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x672718 [0075.014] lstrlenA (lpString="rsa_encrypt") returned 11 [0075.015] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0075.015] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0075.015] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0075.015] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0075.015] GetProcessHeap () returned 0x630000 [0075.015] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0075.015] lstrlenA (lpString="010001") returned 6 [0075.015] GetProcessHeap () returned 0x630000 [0075.015] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0075.015] GetProcessHeap () returned 0x630000 [0075.015] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0075.015] GetProcessHeap () returned 0x630000 [0075.016] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e610 [0075.016] GetProcessHeap () returned 0x630000 [0075.016] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0075.016] GetProcessHeap () returned 0x630000 [0075.016] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e6a0 [0075.016] GetProcessHeap () returned 0x630000 [0075.016] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657440 [0075.016] GetProcessHeap () returned 0x630000 [0075.016] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a318 [0075.016] GetProcessHeap () returned 0x630000 [0075.016] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0075.016] GetProcessHeap () returned 0x630000 [0075.016] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.016] GetProcessHeap () returned 0x630000 [0075.016] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0075.016] GetProcessHeap () returned 0x630000 [0075.016] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0075.016] GetProcessHeap () returned 0x630000 [0075.016] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657670 [0075.016] GetProcessHeap () returned 0x630000 [0075.016] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.016] GetProcessHeap () returned 0x630000 [0075.016] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0075.016] GetProcessHeap () returned 0x630000 [0075.016] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e100 [0075.016] GetProcessHeap () returned 0x630000 [0075.016] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0075.016] GetProcessHeap () returned 0x630000 [0075.016] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0075.016] GetProcessHeap () returned 0x630000 [0075.016] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0075.016] GetProcessHeap () returned 0x630000 [0075.016] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.016] GetProcessHeap () returned 0x630000 [0075.016] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65d000 [0075.016] GetProcessHeap () returned 0x630000 [0075.016] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.016] GetProcessHeap () returned 0x630000 [0075.016] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.017] GetProcessHeap () returned 0x630000 [0075.017] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.017] GetProcessHeap () returned 0x630000 [0075.017] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.017] GetProcessHeap () returned 0x630000 [0075.017] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65dec0 [0075.017] GetProcessHeap () returned 0x630000 [0075.017] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65d000 | out: hHeap=0x630000) returned 1 [0075.017] GetProcessHeap () returned 0x630000 [0075.017] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0075.017] GetProcessHeap () returned 0x630000 [0075.017] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0075.017] GetProcessHeap () returned 0x630000 [0075.017] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.017] GetProcessHeap () returned 0x630000 [0075.017] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.017] GetProcessHeap () returned 0x630000 [0075.017] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.017] GetProcessHeap () returned 0x630000 [0075.017] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.017] GetProcessHeap () returned 0x630000 [0075.017] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.017] GetProcessHeap () returned 0x630000 [0075.017] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.017] GetProcessHeap () returned 0x630000 [0075.017] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.017] GetProcessHeap () returned 0x630000 [0075.017] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.017] GetProcessHeap () returned 0x630000 [0075.017] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.017] GetProcessHeap () returned 0x630000 [0075.017] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.017] GetProcessHeap () returned 0x630000 [0075.017] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0075.017] GetProcessHeap () returned 0x630000 [0075.017] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0075.017] GetProcessHeap () returned 0x630000 [0075.017] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.017] GetProcessHeap () returned 0x630000 [0075.017] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.017] GetProcessHeap () returned 0x630000 [0075.017] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.018] GetProcessHeap () returned 0x630000 [0075.018] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.018] GetProcessHeap () returned 0x630000 [0075.018] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.018] GetProcessHeap () returned 0x630000 [0075.018] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.018] GetProcessHeap () returned 0x630000 [0075.018] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.018] GetProcessHeap () returned 0x630000 [0075.018] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.018] GetProcessHeap () returned 0x630000 [0075.018] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.018] GetProcessHeap () returned 0x630000 [0075.018] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.018] GetProcessHeap () returned 0x630000 [0075.018] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.018] GetProcessHeap () returned 0x630000 [0075.018] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.018] GetProcessHeap () returned 0x630000 [0075.018] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0075.018] GetProcessHeap () returned 0x630000 [0075.018] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0075.018] GetProcessHeap () returned 0x630000 [0075.018] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.018] GetProcessHeap () returned 0x630000 [0075.018] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.018] GetProcessHeap () returned 0x630000 [0075.018] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.018] GetProcessHeap () returned 0x630000 [0075.018] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.018] GetProcessHeap () returned 0x630000 [0075.018] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.018] GetProcessHeap () returned 0x630000 [0075.018] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.018] GetProcessHeap () returned 0x630000 [0075.018] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.018] GetProcessHeap () returned 0x630000 [0075.018] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.019] GetProcessHeap () returned 0x630000 [0075.019] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.019] GetProcessHeap () returned 0x630000 [0075.019] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.019] GetProcessHeap () returned 0x630000 [0075.019] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.019] GetProcessHeap () returned 0x630000 [0075.019] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.019] GetProcessHeap () returned 0x630000 [0075.019] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.019] GetProcessHeap () returned 0x630000 [0075.019] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.019] GetProcessHeap () returned 0x630000 [0075.019] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.019] GetProcessHeap () returned 0x630000 [0075.019] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.019] GetProcessHeap () returned 0x630000 [0075.019] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.019] GetProcessHeap () returned 0x630000 [0075.019] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.019] GetProcessHeap () returned 0x630000 [0075.019] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.019] GetProcessHeap () returned 0x630000 [0075.019] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.019] GetProcessHeap () returned 0x630000 [0075.019] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.019] GetProcessHeap () returned 0x630000 [0075.019] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.019] GetProcessHeap () returned 0x630000 [0075.019] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.019] GetProcessHeap () returned 0x630000 [0075.019] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.019] GetProcessHeap () returned 0x630000 [0075.019] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.019] GetProcessHeap () returned 0x630000 [0075.019] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.019] GetProcessHeap () returned 0x630000 [0075.019] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.019] GetProcessHeap () returned 0x630000 [0075.020] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.020] GetProcessHeap () returned 0x630000 [0075.020] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0075.020] GetProcessHeap () returned 0x630000 [0075.020] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0075.020] GetProcessHeap () returned 0x630000 [0075.020] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.020] GetProcessHeap () returned 0x630000 [0075.020] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.020] GetProcessHeap () returned 0x630000 [0075.020] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.020] GetProcessHeap () returned 0x630000 [0075.020] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.020] GetProcessHeap () returned 0x630000 [0075.020] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.020] GetProcessHeap () returned 0x630000 [0075.020] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.020] GetProcessHeap () returned 0x630000 [0075.020] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.020] GetProcessHeap () returned 0x630000 [0075.020] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.020] GetProcessHeap () returned 0x630000 [0075.020] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0075.020] GetProcessHeap () returned 0x630000 [0075.020] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0075.020] GetProcessHeap () returned 0x630000 [0075.020] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.020] GetProcessHeap () returned 0x630000 [0075.020] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.020] GetProcessHeap () returned 0x630000 [0075.020] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.020] GetProcessHeap () returned 0x630000 [0075.020] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.020] GetProcessHeap () returned 0x630000 [0075.020] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.020] GetProcessHeap () returned 0x630000 [0075.020] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.020] GetProcessHeap () returned 0x630000 [0075.020] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.021] GetProcessHeap () returned 0x630000 [0075.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.021] GetProcessHeap () returned 0x630000 [0075.021] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0075.021] GetProcessHeap () returned 0x630000 [0075.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0075.021] GetProcessHeap () returned 0x630000 [0075.021] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.021] GetProcessHeap () returned 0x630000 [0075.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.021] GetProcessHeap () returned 0x630000 [0075.021] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.021] GetProcessHeap () returned 0x630000 [0075.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.021] GetProcessHeap () returned 0x630000 [0075.021] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.021] GetProcessHeap () returned 0x630000 [0075.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.021] GetProcessHeap () returned 0x630000 [0075.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0075.021] GetProcessHeap () returned 0x630000 [0075.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0075.021] GetProcessHeap () returned 0x630000 [0075.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0075.021] GetProcessHeap () returned 0x630000 [0075.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0075.021] GetProcessHeap () returned 0x630000 [0075.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0075.021] GetProcessHeap () returned 0x630000 [0075.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e6a0 | out: hHeap=0x630000) returned 1 [0075.021] GetProcessHeap () returned 0x630000 [0075.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0075.021] GetProcessHeap () returned 0x630000 [0075.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0075.021] GetProcessHeap () returned 0x630000 [0075.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0075.021] GetProcessHeap () returned 0x630000 [0075.021] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0075.021] GetProcessHeap () returned 0x630000 [0075.022] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0075.022] WriteFile (in: hFile=0x230, lpBuffer=0x672718*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672718*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0075.023] GetProcessHeap () returned 0x630000 [0075.023] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x672718, Size=0x30) returned 0x672718 [0075.023] GetProcessHeap () returned 0x630000 [0075.023] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0075.023] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.023] GetProcessHeap () returned 0x630000 [0075.023] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe0de) returned 0x672750 [0075.024] ReadFile (in: hFile=0x230, lpBuffer=0x672750, nNumberOfBytesToRead=0xe0de, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x672750*, lpNumberOfBytesRead=0x243d7e8*=0xe0de, lpOverlapped=0x0) returned 1 [0075.025] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.025] WriteFile (in: hFile=0x230, lpBuffer=0x672750*, nNumberOfBytesToWrite=0xe0de, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x672750*, lpNumberOfBytesWritten=0x243d7e4*=0xe0de, lpOverlapped=0x0) returned 1 [0075.026] GetProcessHeap () returned 0x630000 [0075.026] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672750 | out: hHeap=0x630000) returned 1 [0075.027] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.027] WriteFile (in: hFile=0x230, lpBuffer=0x672718*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672718*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0075.028] CloseHandle (hObject=0x230) returned 1 [0075.028] GetProcessHeap () returned 0x630000 [0075.028] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0075.028] GetProcessHeap () returned 0x630000 [0075.029] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655670 | out: hHeap=0x630000) returned 1 [0075.029] GetProcessHeap () returned 0x630000 [0075.029] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0075.029] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\2I0gPBE.swf" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\2I0gPBE.swf") returned="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\2I0gPBE.swf" [0075.029] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\2I0gPBE.swf", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\2I0gPBE.swf.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\2I0gPBE.swf.happythreechoose" [0075.029] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\2I0gPBE.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\yb4howqifgmj-cuky\\2i0gpbe.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\2I0gPBE.swf.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\yb4howqifgmj-cuky\\2i0gpbe.swf.happythreechoose"), dwFlags=0x1) returned 1 [0075.029] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\2I0gPBE.swf" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY") returned 1 [0075.029] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\") returned="" [0075.029] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\Decryption INFO.html" [0075.029] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\yb4howqifgmj-cuky\\decryption info.html")) returned 0xffffffff [0075.029] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\yb4howqifgmj-cuky\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0075.029] GetProcessHeap () returned 0x630000 [0075.030] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6559b8 [0075.030] GetProcessHeap () returned 0x630000 [0075.030] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0075.036] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.038] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.038] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.038] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.038] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.038] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.038] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.038] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.038] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.038] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.038] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.038] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.039] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.039] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.039] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.039] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.039] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.039] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.039] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.039] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.039] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.039] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.039] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.039] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.039] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.039] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.040] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.040] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.040] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.040] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.040] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.040] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.040] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.040] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.040] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.040] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.040] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.041] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.041] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.041] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.041] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.041] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.041] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.041] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.041] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.042] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.042] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.042] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.042] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.042] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.042] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.042] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.042] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.042] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.042] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.043] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.043] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.043] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.043] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.043] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.043] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.043] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.043] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.043] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.043] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.043] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.043] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.043] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.044] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.044] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.044] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.044] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.044] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.044] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.044] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.044] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.044] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.044] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.044] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.044] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.044] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.044] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.045] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.045] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.045] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.045] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.045] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.045] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.045] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.045] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.045] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.045] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.045] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.045] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.045] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.045] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.046] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.046] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.046] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.046] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.046] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.046] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.046] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.046] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.046] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.047] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.047] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.047] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.047] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.047] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.047] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.047] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.047] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.047] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.047] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.047] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.048] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.048] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.048] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.048] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.048] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.048] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.048] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.048] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.048] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.048] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.049] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.049] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.049] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.049] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.049] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.049] GetProcessHeap () returned 0x630000 [0075.049] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6559b8 | out: hHeap=0x630000) returned 1 [0075.049] GetProcessHeap () returned 0x630000 [0075.049] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0075.049] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0075.049] GetProcessHeap () returned 0x630000 [0075.049] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655b20 [0075.049] GetProcessHeap () returned 0x630000 [0075.049] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0075.056] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.056] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.056] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.056] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.056] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.057] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.057] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.057] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.057] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.057] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.057] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.057] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.057] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.057] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.057] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.057] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.057] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.057] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.058] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.058] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.058] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.058] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.058] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.058] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.058] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.058] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.058] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.058] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.058] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.058] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.058] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.058] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.059] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.059] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.059] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.059] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.059] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.059] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.059] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.059] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.059] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.059] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.059] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.059] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.059] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.060] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.060] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.060] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.060] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.060] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.060] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.060] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.060] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.060] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.060] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.060] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.060] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.060] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.060] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.060] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.061] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.061] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.061] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.061] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.061] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.061] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.061] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.061] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.061] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.061] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.061] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.061] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.101] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.101] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.101] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.101] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.101] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.101] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.101] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.101] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.101] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.101] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.101] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.101] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.102] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.102] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.102] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.102] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.102] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.102] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.102] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.102] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.102] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.102] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.102] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.102] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.102] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.102] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.103] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.103] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.103] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.103] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.103] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.103] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.103] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.103] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.103] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.103] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.103] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.103] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.103] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.104] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.104] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.104] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.104] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.104] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.104] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.104] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.105] GetProcessHeap () returned 0x630000 [0075.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655b20 | out: hHeap=0x630000) returned 1 [0075.105] GetProcessHeap () returned 0x630000 [0075.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0075.105] CloseHandle (hObject=0x230) returned 1 [0075.105] GetProcessHeap () returned 0x630000 [0075.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0075.105] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc06cbf90, ftCreationTime.dwHighDateTime=0x1d5cc75, ftLastAccessTime.dwLowDateTime=0x3cb8d1a0, ftLastAccessTime.dwHighDateTime=0x1d5c803, ftLastWriteTime.dwLowDateTime=0x3cb8d1a0, ftLastWriteTime.dwHighDateTime=0x1d5c803, nFileSizeHigh=0x0, nFileSizeLow=0x60c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7qAvBCGZzqsQM_F.xlsx", cAlternateFileName="7QAVBC~1.XLS")) returned 1 [0075.105] lstrcmpiW (lpString1="7qAvBCGZzqsQM_F.xlsx", lpString2=".") returned 1 [0075.105] lstrcmpiW (lpString1="7qAvBCGZzqsQM_F.xlsx", lpString2="..") returned 1 [0075.105] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\", lpString2="7qAvBCGZzqsQM_F.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\7qAvBCGZzqsQM_F.xlsx") returned="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\7qAvBCGZzqsQM_F.xlsx" [0075.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="7qAvBCGZzqsQM_F.xlsx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0075.105] GetProcessHeap () returned 0x630000 [0075.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x15) returned 0x645d18 [0075.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="7qAvBCGZzqsQM_F.xlsx", cchWideChar=-1, lpMultiByteStr=0x645d18, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7qAvBCGZzqsQM_F.xlsx", lpUsedDefaultChar=0x0) returned 21 [0075.105] lstrlenA (lpString="7qAvBCGZzqsQM_F.xlsx") returned 20 [0075.105] lstrlenA (lpString=".happythreechoose") returned 17 [0075.105] lstrlenA (lpString=".happythreechoose") returned 17 [0075.105] lstrlenA (lpString="7qAvBCGZzqsQM_F.xlsx") returned 20 [0075.105] lstrcmpiA (lpString1="vBCGZzqsQM_F.xlsx", lpString2=".happythreechoose") returned 1 [0075.105] lstrcmpiW (lpString1="7qAvBCGZzqsQM_F.xlsx", lpString2="Decryption INFO.html") returned -1 [0075.105] lstrcmpiW (lpString1="7qAvBCGZzqsQM_F.xlsx", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0075.105] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0075.105] lstrcmpiW (lpString1="7qAvBCGZzqsQM_F.xlsx", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0075.105] GetProcessHeap () returned 0x630000 [0075.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0075.106] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\7qAvBCGZzqsQM_F.xlsx" (normalized: "c:\\users\\fd1hvy\\desktop\\yb4howqifgmj-cuky\\7qavbcgzzqsqm_f.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0075.106] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=24768) returned 1 [0075.106] GetProcessHeap () returned 0x630000 [0075.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655a30 [0075.106] GetProcessHeap () returned 0x630000 [0075.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0075.106] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\7qAvBCGZzqsQM_F.xlsx") returned 62 [0075.106] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.106] GetProcessHeap () returned 0x630000 [0075.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0075.106] GetProcessHeap () returned 0x630000 [0075.106] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x672750 [0075.107] lstrlenA (lpString="rsa_encrypt") returned 11 [0075.107] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0075.108] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0075.108] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0075.108] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0075.108] GetProcessHeap () returned 0x630000 [0075.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0075.108] lstrlenA (lpString="010001") returned 6 [0075.108] GetProcessHeap () returned 0x630000 [0075.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0075.108] GetProcessHeap () returned 0x630000 [0075.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0075.108] GetProcessHeap () returned 0x630000 [0075.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ec40 [0075.108] GetProcessHeap () returned 0x630000 [0075.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0075.108] GetProcessHeap () returned 0x630000 [0075.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e4f0 [0075.108] GetProcessHeap () returned 0x630000 [0075.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657558 [0075.108] GetProcessHeap () returned 0x630000 [0075.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0075.108] GetProcessHeap () returned 0x630000 [0075.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0075.108] GetProcessHeap () returned 0x630000 [0075.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.108] GetProcessHeap () returned 0x630000 [0075.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0075.109] GetProcessHeap () returned 0x630000 [0075.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0075.109] GetProcessHeap () returned 0x630000 [0075.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656fe0 [0075.109] GetProcessHeap () returned 0x630000 [0075.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.109] GetProcessHeap () returned 0x630000 [0075.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0075.109] GetProcessHeap () returned 0x630000 [0075.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0075.109] GetProcessHeap () returned 0x630000 [0075.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0075.109] GetProcessHeap () returned 0x630000 [0075.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0075.109] GetProcessHeap () returned 0x630000 [0075.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0075.109] GetProcessHeap () returned 0x630000 [0075.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.109] GetProcessHeap () returned 0x630000 [0075.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0075.109] GetProcessHeap () returned 0x630000 [0075.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.109] GetProcessHeap () returned 0x630000 [0075.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.110] GetProcessHeap () returned 0x630000 [0075.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.110] GetProcessHeap () returned 0x630000 [0075.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.110] GetProcessHeap () returned 0x630000 [0075.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65eb20 [0075.110] GetProcessHeap () returned 0x630000 [0075.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0075.110] GetProcessHeap () returned 0x630000 [0075.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0075.110] GetProcessHeap () returned 0x630000 [0075.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0075.110] GetProcessHeap () returned 0x630000 [0075.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.110] GetProcessHeap () returned 0x630000 [0075.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.110] GetProcessHeap () returned 0x630000 [0075.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.110] GetProcessHeap () returned 0x630000 [0075.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.110] GetProcessHeap () returned 0x630000 [0075.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.110] GetProcessHeap () returned 0x630000 [0075.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.110] GetProcessHeap () returned 0x630000 [0075.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.110] GetProcessHeap () returned 0x630000 [0075.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.110] GetProcessHeap () returned 0x630000 [0075.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.110] GetProcessHeap () returned 0x630000 [0075.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.110] GetProcessHeap () returned 0x630000 [0075.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.110] GetProcessHeap () returned 0x630000 [0075.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.110] GetProcessHeap () returned 0x630000 [0075.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.110] GetProcessHeap () returned 0x630000 [0075.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.111] GetProcessHeap () returned 0x630000 [0075.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.111] GetProcessHeap () returned 0x630000 [0075.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.111] GetProcessHeap () returned 0x630000 [0075.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0075.111] GetProcessHeap () returned 0x630000 [0075.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0075.111] GetProcessHeap () returned 0x630000 [0075.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.111] GetProcessHeap () returned 0x630000 [0075.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.111] GetProcessHeap () returned 0x630000 [0075.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.111] GetProcessHeap () returned 0x630000 [0075.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.111] GetProcessHeap () returned 0x630000 [0075.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.111] GetProcessHeap () returned 0x630000 [0075.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.111] GetProcessHeap () returned 0x630000 [0075.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.111] GetProcessHeap () returned 0x630000 [0075.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.111] GetProcessHeap () returned 0x630000 [0075.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.111] GetProcessHeap () returned 0x630000 [0075.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.111] GetProcessHeap () returned 0x630000 [0075.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.111] GetProcessHeap () returned 0x630000 [0075.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.111] GetProcessHeap () returned 0x630000 [0075.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.111] GetProcessHeap () returned 0x630000 [0075.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.111] GetProcessHeap () returned 0x630000 [0075.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.111] GetProcessHeap () returned 0x630000 [0075.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.111] GetProcessHeap () returned 0x630000 [0075.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.112] GetProcessHeap () returned 0x630000 [0075.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.112] GetProcessHeap () returned 0x630000 [0075.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.112] GetProcessHeap () returned 0x630000 [0075.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.112] GetProcessHeap () returned 0x630000 [0075.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.112] GetProcessHeap () returned 0x630000 [0075.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.112] GetProcessHeap () returned 0x630000 [0075.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.112] GetProcessHeap () returned 0x630000 [0075.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.112] GetProcessHeap () returned 0x630000 [0075.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.112] GetProcessHeap () returned 0x630000 [0075.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.112] GetProcessHeap () returned 0x630000 [0075.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.112] GetProcessHeap () returned 0x630000 [0075.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.112] GetProcessHeap () returned 0x630000 [0075.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.112] GetProcessHeap () returned 0x630000 [0075.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.112] GetProcessHeap () returned 0x630000 [0075.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.112] GetProcessHeap () returned 0x630000 [0075.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.112] GetProcessHeap () returned 0x630000 [0075.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.112] GetProcessHeap () returned 0x630000 [0075.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.112] GetProcessHeap () returned 0x630000 [0075.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.112] GetProcessHeap () returned 0x630000 [0075.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.112] GetProcessHeap () returned 0x630000 [0075.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.113] GetProcessHeap () returned 0x630000 [0075.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.113] GetProcessHeap () returned 0x630000 [0075.113] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.113] GetProcessHeap () returned 0x630000 [0075.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.113] GetProcessHeap () returned 0x630000 [0075.113] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0075.113] GetProcessHeap () returned 0x630000 [0075.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0075.113] GetProcessHeap () returned 0x630000 [0075.113] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.113] GetProcessHeap () returned 0x630000 [0075.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.113] GetProcessHeap () returned 0x630000 [0075.113] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.113] GetProcessHeap () returned 0x630000 [0075.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.113] GetProcessHeap () returned 0x630000 [0075.113] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.113] GetProcessHeap () returned 0x630000 [0075.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.113] GetProcessHeap () returned 0x630000 [0075.113] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.113] GetProcessHeap () returned 0x630000 [0075.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.113] GetProcessHeap () returned 0x630000 [0075.113] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.113] GetProcessHeap () returned 0x630000 [0075.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.113] GetProcessHeap () returned 0x630000 [0075.113] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.113] GetProcessHeap () returned 0x630000 [0075.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.113] GetProcessHeap () returned 0x630000 [0075.113] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.113] GetProcessHeap () returned 0x630000 [0075.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.113] GetProcessHeap () returned 0x630000 [0075.113] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.113] GetProcessHeap () returned 0x630000 [0075.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.114] GetProcessHeap () returned 0x630000 [0075.114] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.114] GetProcessHeap () returned 0x630000 [0075.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.114] GetProcessHeap () returned 0x630000 [0075.114] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.114] GetProcessHeap () returned 0x630000 [0075.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.114] GetProcessHeap () returned 0x630000 [0075.114] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.114] GetProcessHeap () returned 0x630000 [0075.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.114] GetProcessHeap () returned 0x630000 [0075.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0075.114] GetProcessHeap () returned 0x630000 [0075.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0075.114] GetProcessHeap () returned 0x630000 [0075.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0075.114] GetProcessHeap () returned 0x630000 [0075.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0075.114] GetProcessHeap () returned 0x630000 [0075.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0075.114] GetProcessHeap () returned 0x630000 [0075.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0075.114] GetProcessHeap () returned 0x630000 [0075.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0075.114] GetProcessHeap () returned 0x630000 [0075.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ec40 | out: hHeap=0x630000) returned 1 [0075.114] GetProcessHeap () returned 0x630000 [0075.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0075.114] GetProcessHeap () returned 0x630000 [0075.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.114] GetProcessHeap () returned 0x630000 [0075.114] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0075.114] WriteFile (in: hFile=0x230, lpBuffer=0x672750*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672750*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0075.120] GetProcessHeap () returned 0x630000 [0075.120] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x672750, Size=0x30) returned 0x672750 [0075.120] GetProcessHeap () returned 0x630000 [0075.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0075.120] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.120] GetProcessHeap () returned 0x630000 [0075.120] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x60c0) returned 0x672788 [0075.121] ReadFile (in: hFile=0x230, lpBuffer=0x672788, nNumberOfBytesToRead=0x60c0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x672788*, lpNumberOfBytesRead=0x243d7e8*=0x60c0, lpOverlapped=0x0) returned 1 [0075.121] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.121] WriteFile (in: hFile=0x230, lpBuffer=0x672788*, nNumberOfBytesToWrite=0x60c0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x672788*, lpNumberOfBytesWritten=0x243d7e4*=0x60c0, lpOverlapped=0x0) returned 1 [0075.122] GetProcessHeap () returned 0x630000 [0075.122] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672788 | out: hHeap=0x630000) returned 1 [0075.122] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.122] WriteFile (in: hFile=0x230, lpBuffer=0x672750*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672750*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0075.123] CloseHandle (hObject=0x230) returned 1 [0075.124] GetProcessHeap () returned 0x630000 [0075.124] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0075.124] GetProcessHeap () returned 0x630000 [0075.124] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655a30 | out: hHeap=0x630000) returned 1 [0075.124] GetProcessHeap () returned 0x630000 [0075.124] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0075.124] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\7qAvBCGZzqsQM_F.xlsx" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\7qAvBCGZzqsQM_F.xlsx") returned="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\7qAvBCGZzqsQM_F.xlsx" [0075.124] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\7qAvBCGZzqsQM_F.xlsx", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\7qAvBCGZzqsQM_F.xlsx.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\7qAvBCGZzqsQM_F.xlsx.happythreechoose" [0075.124] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\7qAvBCGZzqsQM_F.xlsx" (normalized: "c:\\users\\fd1hvy\\desktop\\yb4howqifgmj-cuky\\7qavbcgzzqsqm_f.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\7qAvBCGZzqsQM_F.xlsx.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\yb4howqifgmj-cuky\\7qavbcgzzqsqm_f.xlsx.happythreechoose"), dwFlags=0x1) returned 1 [0075.125] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\7qAvBCGZzqsQM_F.xlsx" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY") returned 1 [0075.125] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\") returned="" [0075.125] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\Decryption INFO.html" [0075.125] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\yb4howqifgmj-cuky\\decryption info.html")) returned 0x20 [0075.125] GetProcessHeap () returned 0x630000 [0075.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645d18 | out: hHeap=0x630000) returned 1 [0075.125] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd66440f0, ftCreationTime.dwHighDateTime=0x1d5d370, ftLastAccessTime.dwLowDateTime=0xc888eb10, ftLastAccessTime.dwHighDateTime=0x1d5c7d7, ftLastWriteTime.dwLowDateTime=0xc888eb10, ftLastWriteTime.dwHighDateTime=0x1d5c7d7, nFileSizeHigh=0x0, nFileSizeLow=0x1b90, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="e 8Lnfx9.mkv", cAlternateFileName="E8LNFX~1.MKV")) returned 1 [0075.125] lstrcmpiW (lpString1="e 8Lnfx9.mkv", lpString2=".") returned 1 [0075.125] lstrcmpiW (lpString1="e 8Lnfx9.mkv", lpString2="..") returned 1 [0075.125] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\", lpString2="e 8Lnfx9.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\e 8Lnfx9.mkv") returned="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\e 8Lnfx9.mkv" [0075.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e 8Lnfx9.mkv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0075.125] GetProcessHeap () returned 0x630000 [0075.125] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd) returned 0x64c9f0 [0075.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e 8Lnfx9.mkv", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="e 8Lnfx9.mkv", lpUsedDefaultChar=0x0) returned 13 [0075.125] lstrlenA (lpString="e 8Lnfx9.mkv") returned 12 [0075.125] lstrlenA (lpString=".happythreechoose") returned 17 [0075.125] lstrcmpiW (lpString1="e 8Lnfx9.mkv", lpString2="Decryption INFO.html") returned 1 [0075.125] lstrcmpiW (lpString1="e 8Lnfx9.mkv", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0075.125] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0075.125] lstrcmpiW (lpString1="e 8Lnfx9.mkv", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0075.125] GetProcessHeap () returned 0x630000 [0075.125] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f10 [0075.125] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\e 8Lnfx9.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\yb4howqifgmj-cuky\\e 8lnfx9.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0075.126] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=7056) returned 1 [0075.126] GetProcessHeap () returned 0x630000 [0075.126] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655a30 [0075.126] GetProcessHeap () returned 0x630000 [0075.126] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0075.126] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\e 8Lnfx9.mkv") returned 54 [0075.126] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.126] GetProcessHeap () returned 0x630000 [0075.126] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0075.126] GetProcessHeap () returned 0x630000 [0075.126] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x672788 [0075.126] lstrlenA (lpString="rsa_encrypt") returned 11 [0075.126] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0075.126] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0075.127] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0075.127] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0075.127] GetProcessHeap () returned 0x630000 [0075.127] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0075.127] lstrlenA (lpString="010001") returned 6 [0075.127] GetProcessHeap () returned 0x630000 [0075.127] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2f8 [0075.127] GetProcessHeap () returned 0x630000 [0075.127] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0075.127] GetProcessHeap () returned 0x630000 [0075.127] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e3d0 [0075.127] GetProcessHeap () returned 0x630000 [0075.127] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0075.127] GetProcessHeap () returned 0x630000 [0075.127] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0075.127] GetProcessHeap () returned 0x630000 [0075.127] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x6570f8 [0075.127] GetProcessHeap () returned 0x630000 [0075.127] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a318 [0075.127] GetProcessHeap () returned 0x630000 [0075.127] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0075.127] GetProcessHeap () returned 0x630000 [0075.127] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.127] GetProcessHeap () returned 0x630000 [0075.127] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0075.127] GetProcessHeap () returned 0x630000 [0075.127] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0075.127] GetProcessHeap () returned 0x630000 [0075.127] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656a68 [0075.127] GetProcessHeap () returned 0x630000 [0075.127] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.127] GetProcessHeap () returned 0x630000 [0075.127] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0075.127] GetProcessHeap () returned 0x630000 [0075.127] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e6a0 [0075.127] GetProcessHeap () returned 0x630000 [0075.127] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0075.127] GetProcessHeap () returned 0x630000 [0075.127] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0075.127] GetProcessHeap () returned 0x630000 [0075.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e6a0 | out: hHeap=0x630000) returned 1 [0075.128] GetProcessHeap () returned 0x630000 [0075.128] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.128] GetProcessHeap () returned 0x630000 [0075.128] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cf10 [0075.128] GetProcessHeap () returned 0x630000 [0075.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.128] GetProcessHeap () returned 0x630000 [0075.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.128] GetProcessHeap () returned 0x630000 [0075.128] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.128] GetProcessHeap () returned 0x630000 [0075.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.128] GetProcessHeap () returned 0x630000 [0075.128] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e4f0 [0075.128] GetProcessHeap () returned 0x630000 [0075.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cf10 | out: hHeap=0x630000) returned 1 [0075.128] GetProcessHeap () returned 0x630000 [0075.128] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0075.128] GetProcessHeap () returned 0x630000 [0075.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0075.128] GetProcessHeap () returned 0x630000 [0075.128] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.128] GetProcessHeap () returned 0x630000 [0075.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.128] GetProcessHeap () returned 0x630000 [0075.128] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.128] GetProcessHeap () returned 0x630000 [0075.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.128] GetProcessHeap () returned 0x630000 [0075.128] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.128] GetProcessHeap () returned 0x630000 [0075.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.128] GetProcessHeap () returned 0x630000 [0075.128] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.128] GetProcessHeap () returned 0x630000 [0075.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.128] GetProcessHeap () returned 0x630000 [0075.128] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.128] GetProcessHeap () returned 0x630000 [0075.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.128] GetProcessHeap () returned 0x630000 [0075.129] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.129] GetProcessHeap () returned 0x630000 [0075.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.129] GetProcessHeap () returned 0x630000 [0075.129] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.129] GetProcessHeap () returned 0x630000 [0075.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.129] GetProcessHeap () returned 0x630000 [0075.129] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.129] GetProcessHeap () returned 0x630000 [0075.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.129] GetProcessHeap () returned 0x630000 [0075.129] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.129] GetProcessHeap () returned 0x630000 [0075.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.129] GetProcessHeap () returned 0x630000 [0075.129] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0075.129] GetProcessHeap () returned 0x630000 [0075.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0075.129] GetProcessHeap () returned 0x630000 [0075.129] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.129] GetProcessHeap () returned 0x630000 [0075.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.129] GetProcessHeap () returned 0x630000 [0075.129] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.129] GetProcessHeap () returned 0x630000 [0075.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.129] GetProcessHeap () returned 0x630000 [0075.129] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.129] GetProcessHeap () returned 0x630000 [0075.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.129] GetProcessHeap () returned 0x630000 [0075.129] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.129] GetProcessHeap () returned 0x630000 [0075.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.129] GetProcessHeap () returned 0x630000 [0075.129] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.129] GetProcessHeap () returned 0x630000 [0075.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.129] GetProcessHeap () returned 0x630000 [0075.130] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.130] GetProcessHeap () returned 0x630000 [0075.130] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.130] GetProcessHeap () returned 0x630000 [0075.130] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.130] GetProcessHeap () returned 0x630000 [0075.130] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.130] GetProcessHeap () returned 0x630000 [0075.130] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.130] GetProcessHeap () returned 0x630000 [0075.130] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.130] GetProcessHeap () returned 0x630000 [0075.130] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0075.130] GetProcessHeap () returned 0x630000 [0075.130] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0075.130] GetProcessHeap () returned 0x630000 [0075.130] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.130] GetProcessHeap () returned 0x630000 [0075.130] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.130] GetProcessHeap () returned 0x630000 [0075.130] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.130] GetProcessHeap () returned 0x630000 [0075.130] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.130] GetProcessHeap () returned 0x630000 [0075.130] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.130] GetProcessHeap () returned 0x630000 [0075.130] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.130] GetProcessHeap () returned 0x630000 [0075.130] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.130] GetProcessHeap () returned 0x630000 [0075.130] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.130] GetProcessHeap () returned 0x630000 [0075.130] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.130] GetProcessHeap () returned 0x630000 [0075.130] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.130] GetProcessHeap () returned 0x630000 [0075.130] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.130] GetProcessHeap () returned 0x630000 [0075.130] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.130] GetProcessHeap () returned 0x630000 [0075.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.131] GetProcessHeap () returned 0x630000 [0075.131] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.131] GetProcessHeap () returned 0x630000 [0075.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.131] GetProcessHeap () returned 0x630000 [0075.131] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.131] GetProcessHeap () returned 0x630000 [0075.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0075.131] GetProcessHeap () returned 0x630000 [0075.131] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0075.131] GetProcessHeap () returned 0x630000 [0075.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.131] GetProcessHeap () returned 0x630000 [0075.131] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.131] GetProcessHeap () returned 0x630000 [0075.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.131] GetProcessHeap () returned 0x630000 [0075.131] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.131] GetProcessHeap () returned 0x630000 [0075.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.131] GetProcessHeap () returned 0x630000 [0075.131] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.131] GetProcessHeap () returned 0x630000 [0075.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0075.131] GetProcessHeap () returned 0x630000 [0075.131] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0075.131] GetProcessHeap () returned 0x630000 [0075.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.131] GetProcessHeap () returned 0x630000 [0075.131] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.131] GetProcessHeap () returned 0x630000 [0075.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.131] GetProcessHeap () returned 0x630000 [0075.131] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.131] GetProcessHeap () returned 0x630000 [0075.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.131] GetProcessHeap () returned 0x630000 [0075.131] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.131] GetProcessHeap () returned 0x630000 [0075.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.131] GetProcessHeap () returned 0x630000 [0075.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.132] GetProcessHeap () returned 0x630000 [0075.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.132] GetProcessHeap () returned 0x630000 [0075.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.132] GetProcessHeap () returned 0x630000 [0075.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.132] GetProcessHeap () returned 0x630000 [0075.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.132] GetProcessHeap () returned 0x630000 [0075.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0075.132] GetProcessHeap () returned 0x630000 [0075.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0075.132] GetProcessHeap () returned 0x630000 [0075.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.132] GetProcessHeap () returned 0x630000 [0075.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.132] GetProcessHeap () returned 0x630000 [0075.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.132] GetProcessHeap () returned 0x630000 [0075.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.132] GetProcessHeap () returned 0x630000 [0075.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0075.132] GetProcessHeap () returned 0x630000 [0075.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0075.132] GetProcessHeap () returned 0x630000 [0075.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0075.132] GetProcessHeap () returned 0x630000 [0075.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0075.132] GetProcessHeap () returned 0x630000 [0075.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0075.132] GetProcessHeap () returned 0x630000 [0075.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0075.132] GetProcessHeap () returned 0x630000 [0075.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0075.132] GetProcessHeap () returned 0x630000 [0075.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0075.132] GetProcessHeap () returned 0x630000 [0075.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0075.133] GetProcessHeap () returned 0x630000 [0075.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.133] GetProcessHeap () returned 0x630000 [0075.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0075.133] WriteFile (in: hFile=0x230, lpBuffer=0x672788*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672788*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0075.134] GetProcessHeap () returned 0x630000 [0075.134] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x672788, Size=0x30) returned 0x672788 [0075.134] GetProcessHeap () returned 0x630000 [0075.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0075.134] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.134] GetProcessHeap () returned 0x630000 [0075.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1b90) returned 0x6727c0 [0075.134] ReadFile (in: hFile=0x230, lpBuffer=0x6727c0, nNumberOfBytesToRead=0x1b90, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x6727c0*, lpNumberOfBytesRead=0x243d7e8*=0x1b90, lpOverlapped=0x0) returned 1 [0075.134] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.134] WriteFile (in: hFile=0x230, lpBuffer=0x6727c0*, nNumberOfBytesToWrite=0x1b90, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x6727c0*, lpNumberOfBytesWritten=0x243d7e4*=0x1b90, lpOverlapped=0x0) returned 1 [0075.135] GetProcessHeap () returned 0x630000 [0075.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6727c0 | out: hHeap=0x630000) returned 1 [0075.135] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.135] WriteFile (in: hFile=0x230, lpBuffer=0x672788*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672788*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0075.136] CloseHandle (hObject=0x230) returned 1 [0075.137] GetProcessHeap () returned 0x630000 [0075.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f10 | out: hHeap=0x630000) returned 1 [0075.137] GetProcessHeap () returned 0x630000 [0075.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655a30 | out: hHeap=0x630000) returned 1 [0075.137] GetProcessHeap () returned 0x630000 [0075.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0075.137] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\e 8Lnfx9.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\e 8Lnfx9.mkv") returned="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\e 8Lnfx9.mkv" [0075.137] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\e 8Lnfx9.mkv", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\e 8Lnfx9.mkv.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\e 8Lnfx9.mkv.happythreechoose" [0075.137] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\e 8Lnfx9.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\yb4howqifgmj-cuky\\e 8lnfx9.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\e 8Lnfx9.mkv.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\yb4howqifgmj-cuky\\e 8lnfx9.mkv.happythreechoose"), dwFlags=0x1) returned 1 [0075.137] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\e 8Lnfx9.mkv" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY") returned 1 [0075.137] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\") returned="" [0075.138] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\Decryption INFO.html" [0075.138] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\yb4howqifgmj-cuky\\decryption info.html")) returned 0x20 [0075.138] GetProcessHeap () returned 0x630000 [0075.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0075.138] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ae20cb0, ftCreationTime.dwHighDateTime=0x1d5ca8a, ftLastAccessTime.dwLowDateTime=0x8310b030, ftLastAccessTime.dwHighDateTime=0x1d5d19c, ftLastWriteTime.dwLowDateTime=0x8310b030, ftLastWriteTime.dwHighDateTime=0x1d5d19c, nFileSizeHigh=0x0, nFileSizeLow=0x54cf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="kqCnkvJjZ-tTJ.docx", cAlternateFileName="KQCNKV~1.DOC")) returned 1 [0075.138] lstrcmpiW (lpString1="kqCnkvJjZ-tTJ.docx", lpString2=".") returned 1 [0075.138] lstrcmpiW (lpString1="kqCnkvJjZ-tTJ.docx", lpString2="..") returned 1 [0075.138] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\", lpString2="kqCnkvJjZ-tTJ.docx" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\kqCnkvJjZ-tTJ.docx") returned="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\kqCnkvJjZ-tTJ.docx" [0075.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kqCnkvJjZ-tTJ.docx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0075.138] GetProcessHeap () returned 0x630000 [0075.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x13) returned 0x645fd8 [0075.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kqCnkvJjZ-tTJ.docx", cchWideChar=-1, lpMultiByteStr=0x645fd8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kqCnkvJjZ-tTJ.docx", lpUsedDefaultChar=0x0) returned 19 [0075.138] lstrlenA (lpString="kqCnkvJjZ-tTJ.docx") returned 18 [0075.138] lstrlenA (lpString=".happythreechoose") returned 17 [0075.138] lstrlenA (lpString=".happythreechoose") returned 17 [0075.138] lstrlenA (lpString="kqCnkvJjZ-tTJ.docx") returned 18 [0075.138] lstrcmpiA (lpString1="qCnkvJjZ-tTJ.docx", lpString2=".happythreechoose") returned 1 [0075.138] lstrcmpiW (lpString1="kqCnkvJjZ-tTJ.docx", lpString2="Decryption INFO.html") returned 1 [0075.138] lstrcmpiW (lpString1="kqCnkvJjZ-tTJ.docx", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0075.138] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0075.138] lstrcmpiW (lpString1="kqCnkvJjZ-tTJ.docx", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0075.138] GetProcessHeap () returned 0x630000 [0075.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0075.138] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\kqCnkvJjZ-tTJ.docx" (normalized: "c:\\users\\fd1hvy\\desktop\\yb4howqifgmj-cuky\\kqcnkvjjz-ttj.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0075.138] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=21711) returned 1 [0075.138] GetProcessHeap () returned 0x630000 [0075.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655580 [0075.138] GetProcessHeap () returned 0x630000 [0075.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0075.139] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\kqCnkvJjZ-tTJ.docx") returned 60 [0075.139] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.139] GetProcessHeap () returned 0x630000 [0075.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0075.139] GetProcessHeap () returned 0x630000 [0075.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x381) returned 0x6727c0 [0075.139] lstrlenA (lpString="rsa_encrypt") returned 11 [0075.139] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0075.139] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0075.139] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0075.139] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0075.139] GetProcessHeap () returned 0x630000 [0075.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0075.139] lstrlenA (lpString="010001") returned 6 [0075.139] GetProcessHeap () returned 0x630000 [0075.139] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0075.139] GetProcessHeap () returned 0x630000 [0075.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0075.140] GetProcessHeap () returned 0x630000 [0075.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ebb0 [0075.140] GetProcessHeap () returned 0x630000 [0075.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0075.140] GetProcessHeap () returned 0x630000 [0075.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0075.140] GetProcessHeap () returned 0x630000 [0075.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657328 [0075.140] GetProcessHeap () returned 0x630000 [0075.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a318 [0075.140] GetProcessHeap () returned 0x630000 [0075.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0075.140] GetProcessHeap () returned 0x630000 [0075.140] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.140] GetProcessHeap () returned 0x630000 [0075.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0075.140] GetProcessHeap () returned 0x630000 [0075.140] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0075.140] GetProcessHeap () returned 0x630000 [0075.141] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656a68 [0075.141] GetProcessHeap () returned 0x630000 [0075.141] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.141] GetProcessHeap () returned 0x630000 [0075.141] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0075.141] GetProcessHeap () returned 0x630000 [0075.141] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e2b0 [0075.141] GetProcessHeap () returned 0x630000 [0075.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0075.141] GetProcessHeap () returned 0x630000 [0075.141] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0075.141] GetProcessHeap () returned 0x630000 [0075.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e2b0 | out: hHeap=0x630000) returned 1 [0075.141] GetProcessHeap () returned 0x630000 [0075.141] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0075.141] GetProcessHeap () returned 0x630000 [0075.141] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0075.141] GetProcessHeap () returned 0x630000 [0075.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.141] GetProcessHeap () returned 0x630000 [0075.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0075.141] GetProcessHeap () returned 0x630000 [0075.141] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.141] GetProcessHeap () returned 0x630000 [0075.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.141] GetProcessHeap () returned 0x630000 [0075.141] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e340 [0075.141] GetProcessHeap () returned 0x630000 [0075.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0075.141] GetProcessHeap () returned 0x630000 [0075.141] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0075.141] GetProcessHeap () returned 0x630000 [0075.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0075.141] GetProcessHeap () returned 0x630000 [0075.141] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.141] GetProcessHeap () returned 0x630000 [0075.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.141] GetProcessHeap () returned 0x630000 [0075.141] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0075.141] GetProcessHeap () returned 0x630000 [0075.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0075.141] GetProcessHeap () returned 0x630000 [0075.142] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.142] GetProcessHeap () returned 0x630000 [0075.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.142] GetProcessHeap () returned 0x630000 [0075.142] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.142] GetProcessHeap () returned 0x630000 [0075.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.142] GetProcessHeap () returned 0x630000 [0075.142] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.142] GetProcessHeap () returned 0x630000 [0075.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.142] GetProcessHeap () returned 0x630000 [0075.142] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.142] GetProcessHeap () returned 0x630000 [0075.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.142] GetProcessHeap () returned 0x630000 [0075.142] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.142] GetProcessHeap () returned 0x630000 [0075.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.142] GetProcessHeap () returned 0x630000 [0075.142] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.142] GetProcessHeap () returned 0x630000 [0075.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.142] GetProcessHeap () returned 0x630000 [0075.142] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0075.142] GetProcessHeap () returned 0x630000 [0075.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0075.142] GetProcessHeap () returned 0x630000 [0075.142] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.142] GetProcessHeap () returned 0x630000 [0075.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.142] GetProcessHeap () returned 0x630000 [0075.142] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.142] GetProcessHeap () returned 0x630000 [0075.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.142] GetProcessHeap () returned 0x630000 [0075.142] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.142] GetProcessHeap () returned 0x630000 [0075.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.142] GetProcessHeap () returned 0x630000 [0075.143] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.143] GetProcessHeap () returned 0x630000 [0075.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.143] GetProcessHeap () returned 0x630000 [0075.143] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.143] GetProcessHeap () returned 0x630000 [0075.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.143] GetProcessHeap () returned 0x630000 [0075.143] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.143] GetProcessHeap () returned 0x630000 [0075.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.143] GetProcessHeap () returned 0x630000 [0075.143] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.143] GetProcessHeap () returned 0x630000 [0075.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.143] GetProcessHeap () returned 0x630000 [0075.143] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.143] GetProcessHeap () returned 0x630000 [0075.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.143] GetProcessHeap () returned 0x630000 [0075.143] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.143] GetProcessHeap () returned 0x630000 [0075.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.143] GetProcessHeap () returned 0x630000 [0075.143] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.143] GetProcessHeap () returned 0x630000 [0075.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.143] GetProcessHeap () returned 0x630000 [0075.143] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.143] GetProcessHeap () returned 0x630000 [0075.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.143] GetProcessHeap () returned 0x630000 [0075.143] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.143] GetProcessHeap () returned 0x630000 [0075.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.143] GetProcessHeap () returned 0x630000 [0075.143] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.143] GetProcessHeap () returned 0x630000 [0075.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.144] GetProcessHeap () returned 0x630000 [0075.144] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.144] GetProcessHeap () returned 0x630000 [0075.144] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.144] GetProcessHeap () returned 0x630000 [0075.144] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.144] GetProcessHeap () returned 0x630000 [0075.144] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.144] GetProcessHeap () returned 0x630000 [0075.144] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.144] GetProcessHeap () returned 0x630000 [0075.144] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.144] GetProcessHeap () returned 0x630000 [0075.144] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.144] GetProcessHeap () returned 0x630000 [0075.144] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.144] GetProcessHeap () returned 0x630000 [0075.144] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.144] GetProcessHeap () returned 0x630000 [0075.144] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.144] GetProcessHeap () returned 0x630000 [0075.144] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.144] GetProcessHeap () returned 0x630000 [0075.144] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.144] GetProcessHeap () returned 0x630000 [0075.144] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.144] GetProcessHeap () returned 0x630000 [0075.144] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.144] GetProcessHeap () returned 0x630000 [0075.144] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.144] GetProcessHeap () returned 0x630000 [0075.144] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.144] GetProcessHeap () returned 0x630000 [0075.144] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.144] GetProcessHeap () returned 0x630000 [0075.144] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.144] GetProcessHeap () returned 0x630000 [0075.144] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.144] GetProcessHeap () returned 0x630000 [0075.144] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.145] GetProcessHeap () returned 0x630000 [0075.145] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.145] GetProcessHeap () returned 0x630000 [0075.145] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.145] GetProcessHeap () returned 0x630000 [0075.145] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0075.145] GetProcessHeap () returned 0x630000 [0075.145] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0075.145] GetProcessHeap () returned 0x630000 [0075.145] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.145] GetProcessHeap () returned 0x630000 [0075.145] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.145] GetProcessHeap () returned 0x630000 [0075.145] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.145] GetProcessHeap () returned 0x630000 [0075.145] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.145] GetProcessHeap () returned 0x630000 [0075.145] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.145] GetProcessHeap () returned 0x630000 [0075.145] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.145] GetProcessHeap () returned 0x630000 [0075.145] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.145] GetProcessHeap () returned 0x630000 [0075.145] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.145] GetProcessHeap () returned 0x630000 [0075.145] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.145] GetProcessHeap () returned 0x630000 [0075.145] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.145] GetProcessHeap () returned 0x630000 [0075.145] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.145] GetProcessHeap () returned 0x630000 [0075.145] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.145] GetProcessHeap () returned 0x630000 [0075.145] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.145] GetProcessHeap () returned 0x630000 [0075.145] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.145] GetProcessHeap () returned 0x630000 [0075.145] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0075.145] GetProcessHeap () returned 0x630000 [0075.145] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0075.145] GetProcessHeap () returned 0x630000 [0075.146] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0075.146] GetProcessHeap () returned 0x630000 [0075.146] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0075.146] GetProcessHeap () returned 0x630000 [0075.146] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0075.146] GetProcessHeap () returned 0x630000 [0075.146] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0075.146] GetProcessHeap () returned 0x630000 [0075.146] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0075.146] GetProcessHeap () returned 0x630000 [0075.146] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0075.146] GetProcessHeap () returned 0x630000 [0075.146] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0075.146] GetProcessHeap () returned 0x630000 [0075.146] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.146] GetProcessHeap () returned 0x630000 [0075.146] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0075.146] WriteFile (in: hFile=0x230, lpBuffer=0x6727c0*, nNumberOfBytesToWrite=0x381, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6727c0*, lpNumberOfBytesWritten=0x243d864*=0x381, lpOverlapped=0x0) returned 1 [0075.148] GetProcessHeap () returned 0x630000 [0075.148] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6727c0, Size=0x30) returned 0x6727c0 [0075.148] GetProcessHeap () returned 0x630000 [0075.148] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0075.148] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.148] GetProcessHeap () returned 0x630000 [0075.148] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x54d0) returned 0x6727f8 [0075.148] ReadFile (in: hFile=0x230, lpBuffer=0x6727f8, nNumberOfBytesToRead=0x54d0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x6727f8*, lpNumberOfBytesRead=0x243d7e8*=0x54d0, lpOverlapped=0x0) returned 1 [0075.149] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.149] WriteFile (in: hFile=0x230, lpBuffer=0x6727f8*, nNumberOfBytesToWrite=0x54d0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x6727f8*, lpNumberOfBytesWritten=0x243d7e4*=0x54d0, lpOverlapped=0x0) returned 1 [0075.150] GetProcessHeap () returned 0x630000 [0075.150] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6727f8 | out: hHeap=0x630000) returned 1 [0075.150] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.150] WriteFile (in: hFile=0x230, lpBuffer=0x6727c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6727c0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0075.151] CloseHandle (hObject=0x230) returned 1 [0075.151] GetProcessHeap () returned 0x630000 [0075.151] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0075.151] GetProcessHeap () returned 0x630000 [0075.151] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655580 | out: hHeap=0x630000) returned 1 [0075.151] GetProcessHeap () returned 0x630000 [0075.151] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0075.151] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\kqCnkvJjZ-tTJ.docx" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\kqCnkvJjZ-tTJ.docx") returned="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\kqCnkvJjZ-tTJ.docx" [0075.151] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\kqCnkvJjZ-tTJ.docx", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\kqCnkvJjZ-tTJ.docx.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\kqCnkvJjZ-tTJ.docx.happythreechoose" [0075.151] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\kqCnkvJjZ-tTJ.docx" (normalized: "c:\\users\\fd1hvy\\desktop\\yb4howqifgmj-cuky\\kqcnkvjjz-ttj.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\kqCnkvJjZ-tTJ.docx.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\yb4howqifgmj-cuky\\kqcnkvjjz-ttj.docx.happythreechoose"), dwFlags=0x1) returned 1 [0075.152] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\kqCnkvJjZ-tTJ.docx" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY") returned 1 [0075.152] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\") returned="" [0075.152] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\Decryption INFO.html" [0075.152] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\yb4howqifgmj-cuky\\decryption info.html")) returned 0x20 [0075.152] GetProcessHeap () returned 0x630000 [0075.152] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645fd8 | out: hHeap=0x630000) returned 1 [0075.152] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x466c0a60, ftCreationTime.dwHighDateTime=0x1d5d167, ftLastAccessTime.dwLowDateTime=0x82b2b540, ftLastAccessTime.dwHighDateTime=0x1d5ca97, ftLastWriteTime.dwLowDateTime=0x82b2b540, ftLastWriteTime.dwHighDateTime=0x1d5ca97, nFileSizeHigh=0x0, nFileSizeLow=0xd967, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WGqiflbPLssFBA-oju-0.png", cAlternateFileName="WGQIFL~1.PNG")) returned 1 [0075.152] lstrcmpiW (lpString1="WGqiflbPLssFBA-oju-0.png", lpString2=".") returned 1 [0075.152] lstrcmpiW (lpString1="WGqiflbPLssFBA-oju-0.png", lpString2="..") returned 1 [0075.152] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\", lpString2="WGqiflbPLssFBA-oju-0.png" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\WGqiflbPLssFBA-oju-0.png") returned="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\WGqiflbPLssFBA-oju-0.png" [0075.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WGqiflbPLssFBA-oju-0.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0075.152] GetProcessHeap () returned 0x630000 [0075.152] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x19) returned 0x651e48 [0075.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WGqiflbPLssFBA-oju-0.png", cchWideChar=-1, lpMultiByteStr=0x651e48, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WGqiflbPLssFBA-oju-0.png", lpUsedDefaultChar=0x0) returned 25 [0075.152] lstrlenA (lpString="WGqiflbPLssFBA-oju-0.png") returned 24 [0075.152] lstrlenA (lpString=".happythreechoose") returned 17 [0075.152] lstrlenA (lpString=".happythreechoose") returned 17 [0075.152] lstrlenA (lpString="WGqiflbPLssFBA-oju-0.png") returned 24 [0075.152] lstrcmpiA (lpString1="PLssFBA-oju-0.png", lpString2=".happythreechoose") returned 1 [0075.152] lstrcmpiW (lpString1="WGqiflbPLssFBA-oju-0.png", lpString2="Decryption INFO.html") returned 1 [0075.152] lstrcmpiW (lpString1="WGqiflbPLssFBA-oju-0.png", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0075.152] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0075.152] lstrcmpiW (lpString1="WGqiflbPLssFBA-oju-0.png", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0075.153] GetProcessHeap () returned 0x630000 [0075.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0075.153] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\WGqiflbPLssFBA-oju-0.png" (normalized: "c:\\users\\fd1hvy\\desktop\\yb4howqifgmj-cuky\\wgqiflbplssfba-oju-0.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0075.153] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=55655) returned 1 [0075.153] GetProcessHeap () returned 0x630000 [0075.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655aa8 [0075.153] GetProcessHeap () returned 0x630000 [0075.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0075.153] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\WGqiflbPLssFBA-oju-0.png") returned 66 [0075.153] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.153] GetProcessHeap () returned 0x630000 [0075.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0075.153] GetProcessHeap () returned 0x630000 [0075.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x389) returned 0x6727f8 [0075.153] lstrlenA (lpString="rsa_encrypt") returned 11 [0075.153] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0075.154] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0075.154] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0075.154] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0075.154] GetProcessHeap () returned 0x630000 [0075.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0075.154] lstrlenA (lpString="010001") returned 6 [0075.154] GetProcessHeap () returned 0x630000 [0075.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0075.154] GetProcessHeap () returned 0x630000 [0075.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0075.154] GetProcessHeap () returned 0x630000 [0075.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e8e0 [0075.154] GetProcessHeap () returned 0x630000 [0075.154] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0075.154] GetProcessHeap () returned 0x630000 [0075.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e850 [0075.154] GetProcessHeap () returned 0x630000 [0075.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657210 [0075.154] GetProcessHeap () returned 0x630000 [0075.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a298 [0075.154] GetProcessHeap () returned 0x630000 [0075.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0075.154] GetProcessHeap () returned 0x630000 [0075.154] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.154] GetProcessHeap () returned 0x630000 [0075.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0075.154] GetProcessHeap () returned 0x630000 [0075.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0075.154] GetProcessHeap () returned 0x630000 [0075.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657328 [0075.154] GetProcessHeap () returned 0x630000 [0075.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.154] GetProcessHeap () returned 0x630000 [0075.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0075.154] GetProcessHeap () returned 0x630000 [0075.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0075.154] GetProcessHeap () returned 0x630000 [0075.154] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0075.154] GetProcessHeap () returned 0x630000 [0075.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0075.155] GetProcessHeap () returned 0x630000 [0075.155] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0075.155] GetProcessHeap () returned 0x630000 [0075.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0075.155] GetProcessHeap () returned 0x630000 [0075.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0075.155] GetProcessHeap () returned 0x630000 [0075.155] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.155] GetProcessHeap () returned 0x630000 [0075.155] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0075.155] GetProcessHeap () returned 0x630000 [0075.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.155] GetProcessHeap () returned 0x630000 [0075.155] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.155] GetProcessHeap () returned 0x630000 [0075.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65eb20 [0075.155] GetProcessHeap () returned 0x630000 [0075.155] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0075.155] GetProcessHeap () returned 0x630000 [0075.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0075.155] GetProcessHeap () returned 0x630000 [0075.155] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0075.155] GetProcessHeap () returned 0x630000 [0075.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.155] GetProcessHeap () returned 0x630000 [0075.155] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.155] GetProcessHeap () returned 0x630000 [0075.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.155] GetProcessHeap () returned 0x630000 [0075.155] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.155] GetProcessHeap () returned 0x630000 [0075.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.155] GetProcessHeap () returned 0x630000 [0075.155] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.155] GetProcessHeap () returned 0x630000 [0075.155] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.155] GetProcessHeap () returned 0x630000 [0075.155] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.156] GetProcessHeap () returned 0x630000 [0075.156] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.156] GetProcessHeap () returned 0x630000 [0075.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.156] GetProcessHeap () returned 0x630000 [0075.156] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.156] GetProcessHeap () returned 0x630000 [0075.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.156] GetProcessHeap () returned 0x630000 [0075.156] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.156] GetProcessHeap () returned 0x630000 [0075.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.156] GetProcessHeap () returned 0x630000 [0075.156] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.156] GetProcessHeap () returned 0x630000 [0075.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.156] GetProcessHeap () returned 0x630000 [0075.156] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.156] GetProcessHeap () returned 0x630000 [0075.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.156] GetProcessHeap () returned 0x630000 [0075.156] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.156] GetProcessHeap () returned 0x630000 [0075.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.156] GetProcessHeap () returned 0x630000 [0075.156] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0075.156] GetProcessHeap () returned 0x630000 [0075.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0075.156] GetProcessHeap () returned 0x630000 [0075.156] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.156] GetProcessHeap () returned 0x630000 [0075.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.156] GetProcessHeap () returned 0x630000 [0075.156] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0075.156] GetProcessHeap () returned 0x630000 [0075.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0075.156] GetProcessHeap () returned 0x630000 [0075.156] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.156] GetProcessHeap () returned 0x630000 [0075.156] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.157] GetProcessHeap () returned 0x630000 [0075.157] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.157] GetProcessHeap () returned 0x630000 [0075.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.157] GetProcessHeap () returned 0x630000 [0075.157] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.157] GetProcessHeap () returned 0x630000 [0075.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.157] GetProcessHeap () returned 0x630000 [0075.157] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.157] GetProcessHeap () returned 0x630000 [0075.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.157] GetProcessHeap () returned 0x630000 [0075.157] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.157] GetProcessHeap () returned 0x630000 [0075.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.157] GetProcessHeap () returned 0x630000 [0075.157] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.157] GetProcessHeap () returned 0x630000 [0075.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.157] GetProcessHeap () returned 0x630000 [0075.157] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0075.157] GetProcessHeap () returned 0x630000 [0075.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0075.157] GetProcessHeap () returned 0x630000 [0075.157] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.157] GetProcessHeap () returned 0x630000 [0075.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.157] GetProcessHeap () returned 0x630000 [0075.157] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.157] GetProcessHeap () returned 0x630000 [0075.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.157] GetProcessHeap () returned 0x630000 [0075.157] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.157] GetProcessHeap () returned 0x630000 [0075.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.157] GetProcessHeap () returned 0x630000 [0075.157] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.157] GetProcessHeap () returned 0x630000 [0075.157] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.158] GetProcessHeap () returned 0x630000 [0075.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.158] GetProcessHeap () returned 0x630000 [0075.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.158] GetProcessHeap () returned 0x630000 [0075.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.158] GetProcessHeap () returned 0x630000 [0075.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.158] GetProcessHeap () returned 0x630000 [0075.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0075.158] GetProcessHeap () returned 0x630000 [0075.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0075.158] GetProcessHeap () returned 0x630000 [0075.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.158] GetProcessHeap () returned 0x630000 [0075.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.158] GetProcessHeap () returned 0x630000 [0075.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.158] GetProcessHeap () returned 0x630000 [0075.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.158] GetProcessHeap () returned 0x630000 [0075.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.158] GetProcessHeap () returned 0x630000 [0075.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.158] GetProcessHeap () returned 0x630000 [0075.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.158] GetProcessHeap () returned 0x630000 [0075.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.158] GetProcessHeap () returned 0x630000 [0075.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.158] GetProcessHeap () returned 0x630000 [0075.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.158] GetProcessHeap () returned 0x630000 [0075.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0075.158] GetProcessHeap () returned 0x630000 [0075.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0075.158] GetProcessHeap () returned 0x630000 [0075.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.158] GetProcessHeap () returned 0x630000 [0075.158] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.158] GetProcessHeap () returned 0x630000 [0075.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.159] GetProcessHeap () returned 0x630000 [0075.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.159] GetProcessHeap () returned 0x630000 [0075.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.159] GetProcessHeap () returned 0x630000 [0075.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.159] GetProcessHeap () returned 0x630000 [0075.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.159] GetProcessHeap () returned 0x630000 [0075.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.159] GetProcessHeap () returned 0x630000 [0075.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0075.159] GetProcessHeap () returned 0x630000 [0075.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0075.159] GetProcessHeap () returned 0x630000 [0075.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.159] GetProcessHeap () returned 0x630000 [0075.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.159] GetProcessHeap () returned 0x630000 [0075.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.159] GetProcessHeap () returned 0x630000 [0075.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.159] GetProcessHeap () returned 0x630000 [0075.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.159] GetProcessHeap () returned 0x630000 [0075.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.159] GetProcessHeap () returned 0x630000 [0075.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0075.159] GetProcessHeap () returned 0x630000 [0075.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0075.159] GetProcessHeap () returned 0x630000 [0075.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0075.159] GetProcessHeap () returned 0x630000 [0075.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0075.159] GetProcessHeap () returned 0x630000 [0075.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0075.159] GetProcessHeap () returned 0x630000 [0075.159] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0075.160] GetProcessHeap () returned 0x630000 [0075.160] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0075.160] GetProcessHeap () returned 0x630000 [0075.160] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0075.160] GetProcessHeap () returned 0x630000 [0075.160] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0075.160] GetProcessHeap () returned 0x630000 [0075.160] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.160] GetProcessHeap () returned 0x630000 [0075.160] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0075.160] WriteFile (in: hFile=0x230, lpBuffer=0x6727f8*, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6727f8*, lpNumberOfBytesWritten=0x243d864*=0x389, lpOverlapped=0x0) returned 1 [0075.161] GetProcessHeap () returned 0x630000 [0075.161] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6727f8, Size=0x30) returned 0x6727f8 [0075.161] GetProcessHeap () returned 0x630000 [0075.161] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0075.161] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.162] GetProcessHeap () returned 0x630000 [0075.162] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd970) returned 0x672830 [0075.162] ReadFile (in: hFile=0x230, lpBuffer=0x672830, nNumberOfBytesToRead=0xd970, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x672830*, lpNumberOfBytesRead=0x243d7e8*=0xd970, lpOverlapped=0x0) returned 1 [0075.163] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.163] WriteFile (in: hFile=0x230, lpBuffer=0x672830*, nNumberOfBytesToWrite=0xd970, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x672830*, lpNumberOfBytesWritten=0x243d7e4*=0xd970, lpOverlapped=0x0) returned 1 [0075.165] GetProcessHeap () returned 0x630000 [0075.165] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672830 | out: hHeap=0x630000) returned 1 [0075.166] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.166] WriteFile (in: hFile=0x230, lpBuffer=0x6727f8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6727f8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0075.167] CloseHandle (hObject=0x230) returned 1 [0075.167] GetProcessHeap () returned 0x630000 [0075.167] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0075.167] GetProcessHeap () returned 0x630000 [0075.167] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655aa8 | out: hHeap=0x630000) returned 1 [0075.167] GetProcessHeap () returned 0x630000 [0075.167] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0075.167] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\WGqiflbPLssFBA-oju-0.png" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\WGqiflbPLssFBA-oju-0.png") returned="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\WGqiflbPLssFBA-oju-0.png" [0075.167] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\WGqiflbPLssFBA-oju-0.png", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\WGqiflbPLssFBA-oju-0.png.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\WGqiflbPLssFBA-oju-0.png.happythreechoose" [0075.167] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\WGqiflbPLssFBA-oju-0.png" (normalized: "c:\\users\\fd1hvy\\desktop\\yb4howqifgmj-cuky\\wgqiflbplssfba-oju-0.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\WGqiflbPLssFBA-oju-0.png.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\yb4howqifgmj-cuky\\wgqiflbplssfba-oju-0.png.happythreechoose"), dwFlags=0x1) returned 1 [0075.168] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\WGqiflbPLssFBA-oju-0.png" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY") returned 1 [0075.168] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\") returned="" [0075.168] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\Decryption INFO.html" [0075.168] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\YB4HOwQiFgMJ-CuKY\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\yb4howqifgmj-cuky\\decryption info.html")) returned 0x20 [0075.168] GetProcessHeap () returned 0x630000 [0075.168] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0075.168] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x466c0a60, ftCreationTime.dwHighDateTime=0x1d5d167, ftLastAccessTime.dwLowDateTime=0x82b2b540, ftLastAccessTime.dwHighDateTime=0x1d5ca97, ftLastWriteTime.dwLowDateTime=0x82b2b540, ftLastWriteTime.dwHighDateTime=0x1d5ca97, nFileSizeHigh=0x0, nFileSizeLow=0xd967, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WGqiflbPLssFBA-oju-0.png", cAlternateFileName="WGQIFL~1.PNG")) returned 0 [0075.168] FindClose (in: hFindFile=0x648a90 | out: hFindFile=0x648a90) returned 1 [0075.168] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\" [0075.168] GetProcessHeap () returned 0x630000 [0075.168] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65fcf0 | out: hHeap=0x630000) returned 1 [0075.168] GetProcessHeap () returned 0x630000 [0075.168] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0075.168] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\") returned 35 [0075.168] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\*") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\*" [0075.168] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47f30350, ftCreationTime.dwHighDateTime=0x1d5c976, ftLastAccessTime.dwLowDateTime=0x13a76070, ftLastAccessTime.dwHighDateTime=0x1d5d766, ftLastWriteTime.dwLowDateTime=0x13a76070, ftLastWriteTime.dwHighDateTime=0x1d5d766, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648b10 [0075.168] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0075.169] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47f30350, ftCreationTime.dwHighDateTime=0x1d5c976, ftLastAccessTime.dwLowDateTime=0x13a76070, ftLastAccessTime.dwHighDateTime=0x1d5d766, ftLastWriteTime.dwLowDateTime=0x13a76070, ftLastWriteTime.dwHighDateTime=0x1d5d766, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.169] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0075.169] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0075.169] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13495020, ftCreationTime.dwHighDateTime=0x1d5ce8d, ftLastAccessTime.dwLowDateTime=0xc311e0e0, ftLastAccessTime.dwHighDateTime=0x1d5d797, ftLastWriteTime.dwLowDateTime=0xc311e0e0, ftLastWriteTime.dwHighDateTime=0x1d5d797, nFileSizeHigh=0x0, nFileSizeLow=0x1629c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-2A7 LeN21.bmp", cAlternateFileName="-2A7LE~1.BMP")) returned 1 [0075.169] lstrcmpiW (lpString1="-2A7 LeN21.bmp", lpString2=".") returned 1 [0075.169] lstrcmpiW (lpString1="-2A7 LeN21.bmp", lpString2="..") returned 1 [0075.169] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\", lpString2="-2A7 LeN21.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\-2A7 LeN21.bmp") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\-2A7 LeN21.bmp" [0075.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="-2A7 LeN21.bmp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0075.169] GetProcessHeap () returned 0x630000 [0075.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0075.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="-2A7 LeN21.bmp", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="-2A7 LeN21.bmp", lpUsedDefaultChar=0x0) returned 15 [0075.169] lstrlenA (lpString="-2A7 LeN21.bmp") returned 14 [0075.169] lstrlenA (lpString=".happythreechoose") returned 17 [0075.169] lstrcmpiW (lpString1="-2A7 LeN21.bmp", lpString2="Decryption INFO.html") returned -1 [0075.169] lstrcmpiW (lpString1="-2A7 LeN21.bmp", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned -1 [0075.169] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0075.169] lstrcmpiW (lpString1="-2A7 LeN21.bmp", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0075.169] GetProcessHeap () returned 0x630000 [0075.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0075.169] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\-2A7 LeN21.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\-2a7 len21.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0075.169] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=90780) returned 1 [0075.169] GetProcessHeap () returned 0x630000 [0075.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655940 [0075.169] GetProcessHeap () returned 0x630000 [0075.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0075.169] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\-2A7 LeN21.bmp") returned 49 [0075.169] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.169] GetProcessHeap () returned 0x630000 [0075.169] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0075.170] GetProcessHeap () returned 0x630000 [0075.170] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x672830 [0075.171] lstrlenA (lpString="rsa_encrypt") returned 11 [0075.171] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0075.171] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0075.171] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0075.171] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0075.171] GetProcessHeap () returned 0x630000 [0075.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0075.171] lstrlenA (lpString="010001") returned 6 [0075.171] GetProcessHeap () returned 0x630000 [0075.171] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2f8 [0075.172] GetProcessHeap () returned 0x630000 [0075.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0075.172] GetProcessHeap () returned 0x630000 [0075.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dec0 [0075.172] GetProcessHeap () returned 0x630000 [0075.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0075.172] GetProcessHeap () returned 0x630000 [0075.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e2b0 [0075.172] GetProcessHeap () returned 0x630000 [0075.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x6570f8 [0075.172] GetProcessHeap () returned 0x630000 [0075.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0075.172] GetProcessHeap () returned 0x630000 [0075.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0075.172] GetProcessHeap () returned 0x630000 [0075.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.172] GetProcessHeap () returned 0x630000 [0075.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0075.172] GetProcessHeap () returned 0x630000 [0075.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0075.172] GetProcessHeap () returned 0x630000 [0075.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656fe0 [0075.172] GetProcessHeap () returned 0x630000 [0075.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.172] GetProcessHeap () returned 0x630000 [0075.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0075.172] GetProcessHeap () returned 0x630000 [0075.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e850 [0075.172] GetProcessHeap () returned 0x630000 [0075.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0075.172] GetProcessHeap () returned 0x630000 [0075.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0075.172] GetProcessHeap () returned 0x630000 [0075.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0075.172] GetProcessHeap () returned 0x630000 [0075.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.172] GetProcessHeap () returned 0x630000 [0075.172] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65d090 [0075.172] GetProcessHeap () returned 0x630000 [0075.172] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.173] GetProcessHeap () returned 0x630000 [0075.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.173] GetProcessHeap () returned 0x630000 [0075.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.173] GetProcessHeap () returned 0x630000 [0075.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.173] GetProcessHeap () returned 0x630000 [0075.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65de30 [0075.173] GetProcessHeap () returned 0x630000 [0075.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65d090 | out: hHeap=0x630000) returned 1 [0075.173] GetProcessHeap () returned 0x630000 [0075.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0075.173] GetProcessHeap () returned 0x630000 [0075.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0075.173] GetProcessHeap () returned 0x630000 [0075.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.173] GetProcessHeap () returned 0x630000 [0075.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.173] GetProcessHeap () returned 0x630000 [0075.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.173] GetProcessHeap () returned 0x630000 [0075.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.173] GetProcessHeap () returned 0x630000 [0075.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.173] GetProcessHeap () returned 0x630000 [0075.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.173] GetProcessHeap () returned 0x630000 [0075.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.173] GetProcessHeap () returned 0x630000 [0075.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.173] GetProcessHeap () returned 0x630000 [0075.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.173] GetProcessHeap () returned 0x630000 [0075.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.173] GetProcessHeap () returned 0x630000 [0075.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0075.173] GetProcessHeap () returned 0x630000 [0075.173] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0075.173] GetProcessHeap () returned 0x630000 [0075.173] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.173] GetProcessHeap () returned 0x630000 [0075.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.174] GetProcessHeap () returned 0x630000 [0075.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0075.174] GetProcessHeap () returned 0x630000 [0075.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0075.174] GetProcessHeap () returned 0x630000 [0075.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.174] GetProcessHeap () returned 0x630000 [0075.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.174] GetProcessHeap () returned 0x630000 [0075.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.174] GetProcessHeap () returned 0x630000 [0075.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.174] GetProcessHeap () returned 0x630000 [0075.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.174] GetProcessHeap () returned 0x630000 [0075.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.174] GetProcessHeap () returned 0x630000 [0075.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.174] GetProcessHeap () returned 0x630000 [0075.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.174] GetProcessHeap () returned 0x630000 [0075.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.174] GetProcessHeap () returned 0x630000 [0075.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.174] GetProcessHeap () returned 0x630000 [0075.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.174] GetProcessHeap () returned 0x630000 [0075.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.174] GetProcessHeap () returned 0x630000 [0075.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.174] GetProcessHeap () returned 0x630000 [0075.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.174] GetProcessHeap () returned 0x630000 [0075.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.174] GetProcessHeap () returned 0x630000 [0075.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.174] GetProcessHeap () returned 0x630000 [0075.174] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.174] GetProcessHeap () returned 0x630000 [0075.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.175] GetProcessHeap () returned 0x630000 [0075.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.175] GetProcessHeap () returned 0x630000 [0075.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.175] GetProcessHeap () returned 0x630000 [0075.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.175] GetProcessHeap () returned 0x630000 [0075.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.175] GetProcessHeap () returned 0x630000 [0075.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0075.175] GetProcessHeap () returned 0x630000 [0075.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0075.175] GetProcessHeap () returned 0x630000 [0075.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.175] GetProcessHeap () returned 0x630000 [0075.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.175] GetProcessHeap () returned 0x630000 [0075.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.175] GetProcessHeap () returned 0x630000 [0075.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.175] GetProcessHeap () returned 0x630000 [0075.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.175] GetProcessHeap () returned 0x630000 [0075.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.175] GetProcessHeap () returned 0x630000 [0075.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.175] GetProcessHeap () returned 0x630000 [0075.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.175] GetProcessHeap () returned 0x630000 [0075.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.175] GetProcessHeap () returned 0x630000 [0075.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.175] GetProcessHeap () returned 0x630000 [0075.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.175] GetProcessHeap () returned 0x630000 [0075.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.175] GetProcessHeap () returned 0x630000 [0075.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0075.175] GetProcessHeap () returned 0x630000 [0075.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0075.176] GetProcessHeap () returned 0x630000 [0075.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.176] GetProcessHeap () returned 0x630000 [0075.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.176] GetProcessHeap () returned 0x630000 [0075.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.176] GetProcessHeap () returned 0x630000 [0075.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.176] GetProcessHeap () returned 0x630000 [0075.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.176] GetProcessHeap () returned 0x630000 [0075.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.176] GetProcessHeap () returned 0x630000 [0075.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.176] GetProcessHeap () returned 0x630000 [0075.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.176] GetProcessHeap () returned 0x630000 [0075.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.176] GetProcessHeap () returned 0x630000 [0075.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.176] GetProcessHeap () returned 0x630000 [0075.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.176] GetProcessHeap () returned 0x630000 [0075.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.176] GetProcessHeap () returned 0x630000 [0075.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.176] GetProcessHeap () returned 0x630000 [0075.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.176] GetProcessHeap () returned 0x630000 [0075.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.176] GetProcessHeap () returned 0x630000 [0075.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.176] GetProcessHeap () returned 0x630000 [0075.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.176] GetProcessHeap () returned 0x630000 [0075.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.176] GetProcessHeap () returned 0x630000 [0075.176] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.176] GetProcessHeap () returned 0x630000 [0075.176] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.177] GetProcessHeap () returned 0x630000 [0075.177] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.177] GetProcessHeap () returned 0x630000 [0075.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.177] GetProcessHeap () returned 0x630000 [0075.177] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.177] GetProcessHeap () returned 0x630000 [0075.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.177] GetProcessHeap () returned 0x630000 [0075.177] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.177] GetProcessHeap () returned 0x630000 [0075.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.177] GetProcessHeap () returned 0x630000 [0075.177] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.177] GetProcessHeap () returned 0x630000 [0075.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.177] GetProcessHeap () returned 0x630000 [0075.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0075.177] GetProcessHeap () returned 0x630000 [0075.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0075.177] GetProcessHeap () returned 0x630000 [0075.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0075.177] GetProcessHeap () returned 0x630000 [0075.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0075.177] GetProcessHeap () returned 0x630000 [0075.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0075.177] GetProcessHeap () returned 0x630000 [0075.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e2b0 | out: hHeap=0x630000) returned 1 [0075.177] GetProcessHeap () returned 0x630000 [0075.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0075.177] GetProcessHeap () returned 0x630000 [0075.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0075.177] GetProcessHeap () returned 0x630000 [0075.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0075.177] GetProcessHeap () returned 0x630000 [0075.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.177] GetProcessHeap () returned 0x630000 [0075.177] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0075.178] WriteFile (in: hFile=0x230, lpBuffer=0x672830*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672830*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0075.179] GetProcessHeap () returned 0x630000 [0075.179] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x672830, Size=0x30) returned 0x672830 [0075.179] GetProcessHeap () returned 0x630000 [0075.180] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0075.180] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.180] GetProcessHeap () returned 0x630000 [0075.180] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1629c) returned 0x672868 [0075.181] ReadFile (in: hFile=0x230, lpBuffer=0x672868, nNumberOfBytesToRead=0x1629c, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x672868*, lpNumberOfBytesRead=0x243d7e8*=0x1629c, lpOverlapped=0x0) returned 1 [0075.182] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.182] WriteFile (in: hFile=0x230, lpBuffer=0x672868*, nNumberOfBytesToWrite=0x1629c, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x672868*, lpNumberOfBytesWritten=0x243d7e4*=0x1629c, lpOverlapped=0x0) returned 1 [0075.184] GetProcessHeap () returned 0x630000 [0075.184] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672868 | out: hHeap=0x630000) returned 1 [0075.184] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.184] WriteFile (in: hFile=0x230, lpBuffer=0x672830*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672830*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0075.185] CloseHandle (hObject=0x230) returned 1 [0075.186] GetProcessHeap () returned 0x630000 [0075.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0075.186] GetProcessHeap () returned 0x630000 [0075.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655940 | out: hHeap=0x630000) returned 1 [0075.186] GetProcessHeap () returned 0x630000 [0075.186] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0075.186] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\-2A7 LeN21.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\-2A7 LeN21.bmp") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\-2A7 LeN21.bmp" [0075.186] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\-2A7 LeN21.bmp", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\-2A7 LeN21.bmp.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\-2A7 LeN21.bmp.happythreechoose" [0075.186] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\-2A7 LeN21.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\-2a7 len21.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\-2A7 LeN21.bmp.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\-2a7 len21.bmp.happythreechoose"), dwFlags=0x1) returned 1 [0075.187] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\-2A7 LeN21.bmp" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG") returned 1 [0075.187] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\") returned="" [0075.187] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\Decryption INFO.html" [0075.187] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\decryption info.html")) returned 0xffffffff [0075.187] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0075.187] GetProcessHeap () returned 0x630000 [0075.187] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6556e8 [0075.187] GetProcessHeap () returned 0x630000 [0075.187] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0075.194] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.195] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.195] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.195] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.195] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.195] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.195] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.195] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.195] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.195] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.195] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.195] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.196] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.196] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.196] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.196] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.196] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.196] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.196] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.196] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.196] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.196] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.196] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.196] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.196] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.197] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.197] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.197] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.197] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.197] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.197] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.197] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.197] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.197] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.197] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.198] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.198] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.198] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.198] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.199] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.199] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.199] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.199] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.199] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.199] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.199] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.199] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.199] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.199] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.199] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.199] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.200] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.200] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.200] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.200] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.200] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.200] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.200] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.200] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.200] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.200] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.200] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.200] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.200] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.200] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.200] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.201] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.201] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.201] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.201] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.201] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.201] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.201] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.201] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.201] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.201] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.201] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.201] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.201] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.201] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.202] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.202] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.202] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.202] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.202] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.202] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.202] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.202] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.202] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.202] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.202] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.203] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.203] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.203] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.203] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.203] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.203] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.203] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.203] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.203] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.203] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.203] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.203] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.203] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.203] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.204] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.204] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.204] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.204] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.204] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.204] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.204] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.204] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.204] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.204] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.204] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.204] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.204] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.204] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.204] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.205] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.205] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.205] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.205] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.205] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.205] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.205] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.205] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.205] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.205] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.205] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.205] GetProcessHeap () returned 0x630000 [0075.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6556e8 | out: hHeap=0x630000) returned 1 [0075.205] GetProcessHeap () returned 0x630000 [0075.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0075.205] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0075.206] GetProcessHeap () returned 0x630000 [0075.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655418 [0075.206] GetProcessHeap () returned 0x630000 [0075.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0075.212] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.212] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.212] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.212] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.213] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.213] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.213] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.213] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.213] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.213] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.213] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.213] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.213] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.213] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.213] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.213] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.213] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.214] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.214] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.214] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.214] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.214] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.214] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.214] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.214] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.214] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.214] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.214] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.214] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.214] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.214] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.215] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.215] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.215] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.215] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.215] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.215] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.215] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.215] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.215] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.215] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.215] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.215] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.215] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.215] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.216] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.216] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.216] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.216] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.216] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.216] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.216] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.216] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.216] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.216] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.216] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.216] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.216] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.216] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.217] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.217] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.217] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.217] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.217] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.217] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.217] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.217] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.217] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.217] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.217] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.217] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.217] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.217] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.218] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.218] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.303] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.303] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.303] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.304] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.304] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.304] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.304] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.304] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.304] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.304] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.304] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.304] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.304] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.304] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.304] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.305] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.305] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.305] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.305] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.305] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.305] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.305] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.305] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.305] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.305] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.305] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.305] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.305] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.305] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.305] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.306] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.306] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.306] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.306] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.306] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.306] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.306] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.306] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.306] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.306] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.306] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.306] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.306] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.307] GetProcessHeap () returned 0x630000 [0075.307] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655418 | out: hHeap=0x630000) returned 1 [0075.307] GetProcessHeap () returned 0x630000 [0075.307] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0075.307] CloseHandle (hObject=0x230) returned 1 [0075.307] GetProcessHeap () returned 0x630000 [0075.308] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0075.308] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77966670, ftCreationTime.dwHighDateTime=0x1d5d064, ftLastAccessTime.dwLowDateTime=0xa5ae8d90, ftLastAccessTime.dwHighDateTime=0x1d5d6c1, ftLastWriteTime.dwLowDateTime=0xa5ae8d90, ftLastWriteTime.dwHighDateTime=0x1d5d6c1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="304hYv_gE_J", cAlternateFileName="304HYV~1")) returned 1 [0075.308] lstrcmpiW (lpString1="304hYv_gE_J", lpString2=".") returned 1 [0075.308] lstrcmpiW (lpString1="304hYv_gE_J", lpString2="..") returned 1 [0075.308] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\", lpString2="304hYv_gE_J" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J" [0075.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="304hYv_gE_J", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0075.308] GetProcessHeap () returned 0x630000 [0075.308] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0075.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="304hYv_gE_J", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="304hYv_gE_J", lpUsedDefaultChar=0x0) returned 12 [0075.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="304hYv_gE_J", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0075.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="304hYv_gE_J", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0075.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="304hYv_gE_J", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0075.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="304hYv_gE_J", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0075.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="304hYv_gE_J", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0075.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="304hYv_gE_J", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0075.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="304hYv_gE_J", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0075.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="304hYv_gE_J", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0075.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="304hYv_gE_J", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0075.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="304hYv_gE_J", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0075.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="304hYv_gE_J", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0075.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="304hYv_gE_J", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0075.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="304hYv_gE_J", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0075.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="304hYv_gE_J", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0075.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="304hYv_gE_J", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0075.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="304hYv_gE_J", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0075.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="304hYv_gE_J", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0075.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="304hYv_gE_J", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0075.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="304hYv_gE_J", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0075.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="304hYv_gE_J", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0075.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="304hYv_gE_J", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0075.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="304hYv_gE_J", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0075.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="304hYv_gE_J", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0075.309] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="304hYv_gE_J", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 1 [0075.309] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="304hYv_gE_J", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0075.309] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="304hYv_gE_J", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0075.309] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="304hYv_gE_J", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 1 [0075.309] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="304hYv_gE_J", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0075.309] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="304hYv_gE_J", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0075.309] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="304hYv_gE_J", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0075.309] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="304hYv_gE_J", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0075.309] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="304hYv_gE_J", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 1 [0075.309] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="304hYv_gE_J", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0075.309] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="304hYv_gE_J", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0075.309] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="304hYv_gE_J", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0075.309] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="304hYv_gE_J", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0075.309] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="304hYv_gE_J", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0075.309] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="304hYv_gE_J", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0075.309] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="304hYv_gE_J", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0075.309] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="304hYv_gE_J", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0075.309] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="304hYv_gE_J", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0075.309] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="304hYv_gE_J", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0075.309] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="304hYv_gE_J", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0075.309] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\" [0075.309] GetProcessHeap () returned 0x630000 [0075.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a268 [0075.309] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\") returned 47 [0075.309] GetProcessHeap () returned 0x630000 [0075.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x60) returned 0x63e830 [0075.309] lstrcpyW (in: lpString1=0x63e830, lpString2="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\" [0075.309] GetProcessHeap () returned 0x630000 [0075.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0075.309] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc333ead0, ftCreationTime.dwHighDateTime=0x1d5d294, ftLastAccessTime.dwLowDateTime=0xf8bbe690, ftLastAccessTime.dwHighDateTime=0x1d5d671, ftLastWriteTime.dwLowDateTime=0xf8bbe690, ftLastWriteTime.dwHighDateTime=0x1d5d671, nFileSizeHigh=0x0, nFileSizeLow=0x3b73, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GIbw_1buJ4k.bmp", cAlternateFileName="GIBW_1~1.BMP")) returned 1 [0075.309] lstrcmpiW (lpString1="GIbw_1buJ4k.bmp", lpString2=".") returned 1 [0075.309] lstrcmpiW (lpString1="GIbw_1buJ4k.bmp", lpString2="..") returned 1 [0075.309] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\", lpString2="GIbw_1buJ4k.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\GIbw_1buJ4k.bmp") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\GIbw_1buJ4k.bmp" [0075.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GIbw_1buJ4k.bmp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0075.309] GetProcessHeap () returned 0x630000 [0075.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x64ca20 [0075.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GIbw_1buJ4k.bmp", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GIbw_1buJ4k.bmp", lpUsedDefaultChar=0x0) returned 16 [0075.310] lstrlenA (lpString="GIbw_1buJ4k.bmp") returned 15 [0075.310] lstrlenA (lpString=".happythreechoose") returned 17 [0075.310] lstrcmpiW (lpString1="GIbw_1buJ4k.bmp", lpString2="Decryption INFO.html") returned 1 [0075.310] lstrcmpiW (lpString1="GIbw_1buJ4k.bmp", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0075.310] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0075.310] lstrcmpiW (lpString1="GIbw_1buJ4k.bmp", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0075.310] GetProcessHeap () returned 0x630000 [0075.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0075.310] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\GIbw_1buJ4k.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\gibw_1buj4k.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0075.310] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=15219) returned 1 [0075.310] GetProcessHeap () returned 0x630000 [0075.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655670 [0075.310] GetProcessHeap () returned 0x630000 [0075.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0075.310] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\GIbw_1buJ4k.bmp") returned 50 [0075.310] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.310] GetProcessHeap () returned 0x630000 [0075.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0075.310] GetProcessHeap () returned 0x630000 [0075.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x672868 [0075.310] lstrlenA (lpString="rsa_encrypt") returned 11 [0075.310] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0075.311] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0075.311] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0075.311] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0075.311] GetProcessHeap () returned 0x630000 [0075.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0075.311] lstrlenA (lpString="010001") returned 6 [0075.311] GetProcessHeap () returned 0x630000 [0075.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a298 [0075.311] GetProcessHeap () returned 0x630000 [0075.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0075.311] GetProcessHeap () returned 0x630000 [0075.311] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0075.312] GetProcessHeap () returned 0x630000 [0075.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0075.312] GetProcessHeap () returned 0x630000 [0075.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dec0 [0075.312] GetProcessHeap () returned 0x630000 [0075.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657788 [0075.312] GetProcessHeap () returned 0x630000 [0075.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2a8 [0075.312] GetProcessHeap () returned 0x630000 [0075.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0075.312] GetProcessHeap () returned 0x630000 [0075.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.312] GetProcessHeap () returned 0x630000 [0075.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0075.312] GetProcessHeap () returned 0x630000 [0075.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0075.312] GetProcessHeap () returned 0x630000 [0075.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656950 [0075.312] GetProcessHeap () returned 0x630000 [0075.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.312] GetProcessHeap () returned 0x630000 [0075.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0075.312] GetProcessHeap () returned 0x630000 [0075.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e100 [0075.312] GetProcessHeap () returned 0x630000 [0075.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0075.312] GetProcessHeap () returned 0x630000 [0075.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0075.312] GetProcessHeap () returned 0x630000 [0075.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0075.312] GetProcessHeap () returned 0x630000 [0075.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.312] GetProcessHeap () returned 0x630000 [0075.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cfb8 [0075.312] GetProcessHeap () returned 0x630000 [0075.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.312] GetProcessHeap () returned 0x630000 [0075.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.313] GetProcessHeap () returned 0x630000 [0075.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.313] GetProcessHeap () returned 0x630000 [0075.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.313] GetProcessHeap () returned 0x630000 [0075.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e580 [0075.313] GetProcessHeap () returned 0x630000 [0075.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cfb8 | out: hHeap=0x630000) returned 1 [0075.313] GetProcessHeap () returned 0x630000 [0075.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0075.313] GetProcessHeap () returned 0x630000 [0075.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0075.313] GetProcessHeap () returned 0x630000 [0075.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.313] GetProcessHeap () returned 0x630000 [0075.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.313] GetProcessHeap () returned 0x630000 [0075.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.313] GetProcessHeap () returned 0x630000 [0075.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.313] GetProcessHeap () returned 0x630000 [0075.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.313] GetProcessHeap () returned 0x630000 [0075.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.313] GetProcessHeap () returned 0x630000 [0075.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.313] GetProcessHeap () returned 0x630000 [0075.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.313] GetProcessHeap () returned 0x630000 [0075.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.313] GetProcessHeap () returned 0x630000 [0075.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.313] GetProcessHeap () returned 0x630000 [0075.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.313] GetProcessHeap () returned 0x630000 [0075.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.313] GetProcessHeap () returned 0x630000 [0075.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.313] GetProcessHeap () returned 0x630000 [0075.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.314] GetProcessHeap () returned 0x630000 [0075.314] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.314] GetProcessHeap () returned 0x630000 [0075.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.314] GetProcessHeap () returned 0x630000 [0075.314] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.314] GetProcessHeap () returned 0x630000 [0075.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.314] GetProcessHeap () returned 0x630000 [0075.314] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.314] GetProcessHeap () returned 0x630000 [0075.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.314] GetProcessHeap () returned 0x630000 [0075.314] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.314] GetProcessHeap () returned 0x630000 [0075.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.314] GetProcessHeap () returned 0x630000 [0075.314] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.314] GetProcessHeap () returned 0x630000 [0075.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.314] GetProcessHeap () returned 0x630000 [0075.314] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.314] GetProcessHeap () returned 0x630000 [0075.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.314] GetProcessHeap () returned 0x630000 [0075.314] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.314] GetProcessHeap () returned 0x630000 [0075.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.314] GetProcessHeap () returned 0x630000 [0075.314] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.314] GetProcessHeap () returned 0x630000 [0075.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.314] GetProcessHeap () returned 0x630000 [0075.314] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.314] GetProcessHeap () returned 0x630000 [0075.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.314] GetProcessHeap () returned 0x630000 [0075.314] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.314] GetProcessHeap () returned 0x630000 [0075.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.315] GetProcessHeap () returned 0x630000 [0075.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.315] GetProcessHeap () returned 0x630000 [0075.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.315] GetProcessHeap () returned 0x630000 [0075.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.315] GetProcessHeap () returned 0x630000 [0075.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.315] GetProcessHeap () returned 0x630000 [0075.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0075.315] GetProcessHeap () returned 0x630000 [0075.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0075.315] GetProcessHeap () returned 0x630000 [0075.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.315] GetProcessHeap () returned 0x630000 [0075.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.315] GetProcessHeap () returned 0x630000 [0075.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.315] GetProcessHeap () returned 0x630000 [0075.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.315] GetProcessHeap () returned 0x630000 [0075.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.315] GetProcessHeap () returned 0x630000 [0075.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.315] GetProcessHeap () returned 0x630000 [0075.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.315] GetProcessHeap () returned 0x630000 [0075.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.315] GetProcessHeap () returned 0x630000 [0075.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.315] GetProcessHeap () returned 0x630000 [0075.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.315] GetProcessHeap () returned 0x630000 [0075.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.315] GetProcessHeap () returned 0x630000 [0075.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.315] GetProcessHeap () returned 0x630000 [0075.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.315] GetProcessHeap () returned 0x630000 [0075.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.316] GetProcessHeap () returned 0x630000 [0075.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.316] GetProcessHeap () returned 0x630000 [0075.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.316] GetProcessHeap () returned 0x630000 [0075.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.316] GetProcessHeap () returned 0x630000 [0075.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.316] GetProcessHeap () returned 0x630000 [0075.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.316] GetProcessHeap () returned 0x630000 [0075.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.316] GetProcessHeap () returned 0x630000 [0075.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.316] GetProcessHeap () returned 0x630000 [0075.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.316] GetProcessHeap () returned 0x630000 [0075.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.316] GetProcessHeap () returned 0x630000 [0075.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.316] GetProcessHeap () returned 0x630000 [0075.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.316] GetProcessHeap () returned 0x630000 [0075.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.316] GetProcessHeap () returned 0x630000 [0075.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.316] GetProcessHeap () returned 0x630000 [0075.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.316] GetProcessHeap () returned 0x630000 [0075.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.316] GetProcessHeap () returned 0x630000 [0075.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.316] GetProcessHeap () returned 0x630000 [0075.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.316] GetProcessHeap () returned 0x630000 [0075.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.316] GetProcessHeap () returned 0x630000 [0075.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.316] GetProcessHeap () returned 0x630000 [0075.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.317] GetProcessHeap () returned 0x630000 [0075.317] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.317] GetProcessHeap () returned 0x630000 [0075.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.317] GetProcessHeap () returned 0x630000 [0075.317] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.317] GetProcessHeap () returned 0x630000 [0075.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.317] GetProcessHeap () returned 0x630000 [0075.317] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.317] GetProcessHeap () returned 0x630000 [0075.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.317] GetProcessHeap () returned 0x630000 [0075.317] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0075.317] GetProcessHeap () returned 0x630000 [0075.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0075.317] GetProcessHeap () returned 0x630000 [0075.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0075.317] GetProcessHeap () returned 0x630000 [0075.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0075.317] GetProcessHeap () returned 0x630000 [0075.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0075.317] GetProcessHeap () returned 0x630000 [0075.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0075.317] GetProcessHeap () returned 0x630000 [0075.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0075.317] GetProcessHeap () returned 0x630000 [0075.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0075.317] GetProcessHeap () returned 0x630000 [0075.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0075.317] GetProcessHeap () returned 0x630000 [0075.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0075.317] GetProcessHeap () returned 0x630000 [0075.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0075.317] GetProcessHeap () returned 0x630000 [0075.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.317] GetProcessHeap () returned 0x630000 [0075.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0075.317] WriteFile (in: hFile=0x230, lpBuffer=0x672868*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672868*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0075.319] GetProcessHeap () returned 0x630000 [0075.319] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x672868, Size=0x30) returned 0x672868 [0075.319] GetProcessHeap () returned 0x630000 [0075.319] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0075.319] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.319] GetProcessHeap () returned 0x630000 [0075.319] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3b73) returned 0x6728a0 [0075.320] ReadFile (in: hFile=0x230, lpBuffer=0x6728a0, nNumberOfBytesToRead=0x3b73, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x6728a0*, lpNumberOfBytesRead=0x243d7e8*=0x3b73, lpOverlapped=0x0) returned 1 [0075.320] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.320] WriteFile (in: hFile=0x230, lpBuffer=0x6728a0*, nNumberOfBytesToWrite=0x3b73, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x6728a0*, lpNumberOfBytesWritten=0x243d7e4*=0x3b73, lpOverlapped=0x0) returned 1 [0075.321] GetProcessHeap () returned 0x630000 [0075.321] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6728a0 | out: hHeap=0x630000) returned 1 [0075.321] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.321] WriteFile (in: hFile=0x230, lpBuffer=0x672868*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x672868*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0075.322] CloseHandle (hObject=0x230) returned 1 [0075.323] GetProcessHeap () returned 0x630000 [0075.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0075.323] GetProcessHeap () returned 0x630000 [0075.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655670 | out: hHeap=0x630000) returned 1 [0075.323] GetProcessHeap () returned 0x630000 [0075.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0075.323] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\GIbw_1buJ4k.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\GIbw_1buJ4k.bmp") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\GIbw_1buJ4k.bmp" [0075.323] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\GIbw_1buJ4k.bmp", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\GIbw_1buJ4k.bmp.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\GIbw_1buJ4k.bmp.happythreechoose" [0075.323] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\GIbw_1buJ4k.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\gibw_1buj4k.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\GIbw_1buJ4k.bmp.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\gibw_1buj4k.bmp.happythreechoose"), dwFlags=0x1) returned 1 [0075.323] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\GIbw_1buJ4k.bmp" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG") returned 1 [0075.323] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\") returned="" [0075.323] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\Decryption INFO.html" [0075.323] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\decryption info.html")) returned 0x20 [0075.324] GetProcessHeap () returned 0x630000 [0075.324] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0075.324] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6267a0, ftCreationTime.dwHighDateTime=0x1d5d6ba, ftLastAccessTime.dwLowDateTime=0x2051a1f0, ftLastAccessTime.dwHighDateTime=0x1d5d08b, ftLastWriteTime.dwLowDateTime=0x2051a1f0, ftLastWriteTime.dwHighDateTime=0x1d5d08b, nFileSizeHigh=0x0, nFileSizeLow=0x100f5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="JXNTlvRBNXu w6lFjLIV.gif", cAlternateFileName="JXNTLV~1.GIF")) returned 1 [0075.324] lstrcmpiW (lpString1="JXNTlvRBNXu w6lFjLIV.gif", lpString2=".") returned 1 [0075.324] lstrcmpiW (lpString1="JXNTlvRBNXu w6lFjLIV.gif", lpString2="..") returned 1 [0075.324] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\", lpString2="JXNTlvRBNXu w6lFjLIV.gif" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\JXNTlvRBNXu w6lFjLIV.gif") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\JXNTlvRBNXu w6lFjLIV.gif" [0075.324] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="JXNTlvRBNXu w6lFjLIV.gif", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0075.324] GetProcessHeap () returned 0x630000 [0075.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x19) returned 0x651e48 [0075.324] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="JXNTlvRBNXu w6lFjLIV.gif", cchWideChar=-1, lpMultiByteStr=0x651e48, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="JXNTlvRBNXu w6lFjLIV.gif", lpUsedDefaultChar=0x0) returned 25 [0075.324] lstrlenA (lpString="JXNTlvRBNXu w6lFjLIV.gif") returned 24 [0075.324] lstrlenA (lpString=".happythreechoose") returned 17 [0075.324] lstrlenA (lpString=".happythreechoose") returned 17 [0075.324] lstrlenA (lpString="JXNTlvRBNXu w6lFjLIV.gif") returned 24 [0075.324] lstrcmpiA (lpString1="BNXu w6lFjLIV.gif", lpString2=".happythreechoose") returned 1 [0075.324] lstrcmpiW (lpString1="JXNTlvRBNXu w6lFjLIV.gif", lpString2="Decryption INFO.html") returned 1 [0075.324] lstrcmpiW (lpString1="JXNTlvRBNXu w6lFjLIV.gif", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0075.324] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0075.324] lstrcmpiW (lpString1="JXNTlvRBNXu w6lFjLIV.gif", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0075.324] GetProcessHeap () returned 0x630000 [0075.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0075.324] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\JXNTlvRBNXu w6lFjLIV.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\jxntlvrbnxu w6lfjliv.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0075.324] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=65781) returned 1 [0075.324] GetProcessHeap () returned 0x630000 [0075.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655508 [0075.324] GetProcessHeap () returned 0x630000 [0075.324] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640fb0 [0075.324] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\JXNTlvRBNXu w6lFjLIV.gif") returned 59 [0075.324] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.325] GetProcessHeap () returned 0x630000 [0075.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0075.325] GetProcessHeap () returned 0x630000 [0075.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38b) returned 0x6728a0 [0075.325] lstrlenA (lpString="rsa_encrypt") returned 11 [0075.325] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x64ce80) returned 1 [0075.325] CryptGenRandom (in: hProv=0x64ce80, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0075.325] CryptReleaseContext (hProv=0x64ce80, dwFlags=0x0) returned 1 [0075.325] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0075.325] GetProcessHeap () returned 0x630000 [0075.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x64ce80 [0075.325] lstrlenA (lpString="010001") returned 6 [0075.325] GetProcessHeap () returned 0x630000 [0075.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0075.325] GetProcessHeap () returned 0x630000 [0075.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0075.325] GetProcessHeap () returned 0x630000 [0075.325] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e6a0 [0075.326] GetProcessHeap () returned 0x630000 [0075.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0075.326] GetProcessHeap () returned 0x630000 [0075.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e190 [0075.326] GetProcessHeap () returned 0x630000 [0075.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657558 [0075.326] GetProcessHeap () returned 0x630000 [0075.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a328 [0075.326] GetProcessHeap () returned 0x630000 [0075.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0075.326] GetProcessHeap () returned 0x630000 [0075.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0075.326] GetProcessHeap () returned 0x630000 [0075.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0075.326] GetProcessHeap () returned 0x630000 [0075.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x640c90 [0075.326] GetProcessHeap () returned 0x630000 [0075.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657788 [0075.326] GetProcessHeap () returned 0x630000 [0075.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.326] GetProcessHeap () returned 0x630000 [0075.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0075.326] GetProcessHeap () returned 0x630000 [0075.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0075.326] GetProcessHeap () returned 0x630000 [0075.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640c90 | out: hHeap=0x630000) returned 1 [0075.326] GetProcessHeap () returned 0x630000 [0075.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0075.326] GetProcessHeap () returned 0x630000 [0075.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0075.326] GetProcessHeap () returned 0x630000 [0075.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0075.326] GetProcessHeap () returned 0x630000 [0075.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0075.326] GetProcessHeap () returned 0x630000 [0075.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.326] GetProcessHeap () returned 0x630000 [0075.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0075.326] GetProcessHeap () returned 0x630000 [0075.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0075.326] GetProcessHeap () returned 0x630000 [0075.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0075.327] GetProcessHeap () returned 0x630000 [0075.327] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e580 [0075.327] GetProcessHeap () returned 0x630000 [0075.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0075.327] GetProcessHeap () returned 0x630000 [0075.327] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0075.327] GetProcessHeap () returned 0x630000 [0075.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0075.327] GetProcessHeap () returned 0x630000 [0075.327] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.327] GetProcessHeap () returned 0x630000 [0075.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.327] GetProcessHeap () returned 0x630000 [0075.327] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.327] GetProcessHeap () returned 0x630000 [0075.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.327] GetProcessHeap () returned 0x630000 [0075.327] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.327] GetProcessHeap () returned 0x630000 [0075.327] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.327] GetProcessHeap () returned 0x630000 [0075.327] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.328] GetProcessHeap () returned 0x630000 [0075.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.328] GetProcessHeap () returned 0x630000 [0075.328] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.328] GetProcessHeap () returned 0x630000 [0075.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.328] GetProcessHeap () returned 0x630000 [0075.328] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.328] GetProcessHeap () returned 0x630000 [0075.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.328] GetProcessHeap () returned 0x630000 [0075.328] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.328] GetProcessHeap () returned 0x630000 [0075.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.328] GetProcessHeap () returned 0x630000 [0075.328] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.328] GetProcessHeap () returned 0x630000 [0075.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.328] GetProcessHeap () returned 0x630000 [0075.328] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.328] GetProcessHeap () returned 0x630000 [0075.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.328] GetProcessHeap () returned 0x630000 [0075.328] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0075.328] GetProcessHeap () returned 0x630000 [0075.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0075.328] GetProcessHeap () returned 0x630000 [0075.328] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.328] GetProcessHeap () returned 0x630000 [0075.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.328] GetProcessHeap () returned 0x630000 [0075.329] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0075.329] GetProcessHeap () returned 0x630000 [0075.329] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0075.329] GetProcessHeap () returned 0x630000 [0075.329] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0075.329] GetProcessHeap () returned 0x630000 [0075.329] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0075.329] GetProcessHeap () returned 0x630000 [0075.329] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.329] GetProcessHeap () returned 0x630000 [0075.329] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.329] GetProcessHeap () returned 0x630000 [0075.329] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0075.329] GetProcessHeap () returned 0x630000 [0075.329] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0075.329] GetProcessHeap () returned 0x630000 [0075.329] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.329] GetProcessHeap () returned 0x630000 [0075.329] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.329] GetProcessHeap () returned 0x630000 [0075.329] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.329] GetProcessHeap () returned 0x630000 [0075.329] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.329] GetProcessHeap () returned 0x630000 [0075.329] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.329] GetProcessHeap () returned 0x630000 [0075.329] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.329] GetProcessHeap () returned 0x630000 [0075.329] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.329] GetProcessHeap () returned 0x630000 [0075.329] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.329] GetProcessHeap () returned 0x630000 [0075.329] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.330] GetProcessHeap () returned 0x630000 [0075.330] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.330] GetProcessHeap () returned 0x630000 [0075.330] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.330] GetProcessHeap () returned 0x630000 [0075.330] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.330] GetProcessHeap () returned 0x630000 [0075.330] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.330] GetProcessHeap () returned 0x630000 [0075.330] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.330] GetProcessHeap () returned 0x630000 [0075.330] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.330] GetProcessHeap () returned 0x630000 [0075.330] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.330] GetProcessHeap () returned 0x630000 [0075.330] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.330] GetProcessHeap () returned 0x630000 [0075.330] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.330] GetProcessHeap () returned 0x630000 [0075.330] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.330] GetProcessHeap () returned 0x630000 [0075.330] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.330] GetProcessHeap () returned 0x630000 [0075.330] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.330] GetProcessHeap () returned 0x630000 [0075.330] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.330] GetProcessHeap () returned 0x630000 [0075.330] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.330] GetProcessHeap () returned 0x630000 [0075.330] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.330] GetProcessHeap () returned 0x630000 [0075.330] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.330] GetProcessHeap () returned 0x630000 [0075.330] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.330] GetProcessHeap () returned 0x630000 [0075.330] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.330] GetProcessHeap () returned 0x630000 [0075.330] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.331] GetProcessHeap () returned 0x630000 [0075.331] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.331] GetProcessHeap () returned 0x630000 [0075.331] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.331] GetProcessHeap () returned 0x630000 [0075.331] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0075.331] GetProcessHeap () returned 0x630000 [0075.331] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0075.331] GetProcessHeap () returned 0x630000 [0075.331] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.331] GetProcessHeap () returned 0x630000 [0075.331] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.331] GetProcessHeap () returned 0x630000 [0075.331] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.331] GetProcessHeap () returned 0x630000 [0075.331] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.331] GetProcessHeap () returned 0x630000 [0075.331] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.331] GetProcessHeap () returned 0x630000 [0075.331] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.331] GetProcessHeap () returned 0x630000 [0075.331] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.331] GetProcessHeap () returned 0x630000 [0075.331] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.331] GetProcessHeap () returned 0x630000 [0075.331] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.331] GetProcessHeap () returned 0x630000 [0075.331] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.331] GetProcessHeap () returned 0x630000 [0075.331] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.331] GetProcessHeap () returned 0x630000 [0075.331] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.331] GetProcessHeap () returned 0x630000 [0075.331] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.331] GetProcessHeap () returned 0x630000 [0075.331] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.331] GetProcessHeap () returned 0x630000 [0075.331] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.331] GetProcessHeap () returned 0x630000 [0075.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.332] GetProcessHeap () returned 0x630000 [0075.332] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.332] GetProcessHeap () returned 0x630000 [0075.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.332] GetProcessHeap () returned 0x630000 [0075.332] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.332] GetProcessHeap () returned 0x630000 [0075.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.332] GetProcessHeap () returned 0x630000 [0075.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0075.332] GetProcessHeap () returned 0x630000 [0075.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0075.332] GetProcessHeap () returned 0x630000 [0075.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0075.332] GetProcessHeap () returned 0x630000 [0075.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0075.332] GetProcessHeap () returned 0x630000 [0075.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0075.332] GetProcessHeap () returned 0x630000 [0075.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0075.332] GetProcessHeap () returned 0x630000 [0075.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0075.332] GetProcessHeap () returned 0x630000 [0075.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e6a0 | out: hHeap=0x630000) returned 1 [0075.332] GetProcessHeap () returned 0x630000 [0075.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0075.332] GetProcessHeap () returned 0x630000 [0075.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.332] GetProcessHeap () returned 0x630000 [0075.333] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ce80 | out: hHeap=0x630000) returned 1 [0075.333] WriteFile (in: hFile=0x230, lpBuffer=0x6728a0*, nNumberOfBytesToWrite=0x38b, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6728a0*, lpNumberOfBytesWritten=0x243d864*=0x38b, lpOverlapped=0x0) returned 1 [0075.334] GetProcessHeap () returned 0x630000 [0075.334] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6728a0, Size=0x30) returned 0x6728a0 [0075.334] GetProcessHeap () returned 0x630000 [0075.334] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0075.335] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.335] GetProcessHeap () returned 0x630000 [0075.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10100) returned 0x6728d8 [0075.335] ReadFile (in: hFile=0x230, lpBuffer=0x6728d8, nNumberOfBytesToRead=0x10100, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x6728d8*, lpNumberOfBytesRead=0x243d7e8*=0x10100, lpOverlapped=0x0) returned 1 [0075.335] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.335] WriteFile (in: hFile=0x230, lpBuffer=0x6728d8*, nNumberOfBytesToWrite=0x10100, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x6728d8*, lpNumberOfBytesWritten=0x243d7e4*=0x10100, lpOverlapped=0x0) returned 1 [0075.337] GetProcessHeap () returned 0x630000 [0075.337] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6728d8 | out: hHeap=0x630000) returned 1 [0075.338] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.338] WriteFile (in: hFile=0x230, lpBuffer=0x6728a0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6728a0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0075.339] CloseHandle (hObject=0x230) returned 1 [0075.339] GetProcessHeap () returned 0x630000 [0075.339] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0075.339] GetProcessHeap () returned 0x630000 [0075.339] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655508 | out: hHeap=0x630000) returned 1 [0075.339] GetProcessHeap () returned 0x630000 [0075.339] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0075.340] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\JXNTlvRBNXu w6lFjLIV.gif" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\JXNTlvRBNXu w6lFjLIV.gif") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\JXNTlvRBNXu w6lFjLIV.gif" [0075.340] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\JXNTlvRBNXu w6lFjLIV.gif", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\JXNTlvRBNXu w6lFjLIV.gif.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\JXNTlvRBNXu w6lFjLIV.gif.happythreechoose" [0075.340] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\JXNTlvRBNXu w6lFjLIV.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\jxntlvrbnxu w6lfjliv.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\JXNTlvRBNXu w6lFjLIV.gif.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\jxntlvrbnxu w6lfjliv.gif.happythreechoose"), dwFlags=0x1) returned 1 [0075.346] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\JXNTlvRBNXu w6lFjLIV.gif" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG") returned 1 [0075.346] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\") returned="" [0075.346] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\Decryption INFO.html" [0075.346] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\decryption info.html")) returned 0x20 [0075.346] GetProcessHeap () returned 0x630000 [0075.346] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0075.346] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0f81d40, ftCreationTime.dwHighDateTime=0x1d5c947, ftLastAccessTime.dwLowDateTime=0x2234650, ftLastAccessTime.dwHighDateTime=0x1d5ce1c, ftLastWriteTime.dwLowDateTime=0x2234650, ftLastWriteTime.dwHighDateTime=0x1d5ce1c, nFileSizeHigh=0x0, nFileSizeLow=0xbb62, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="KOMWDxRj.doc", cAlternateFileName="")) returned 1 [0075.346] lstrcmpiW (lpString1="KOMWDxRj.doc", lpString2=".") returned 1 [0075.346] lstrcmpiW (lpString1="KOMWDxRj.doc", lpString2="..") returned 1 [0075.346] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\", lpString2="KOMWDxRj.doc" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\KOMWDxRj.doc") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\KOMWDxRj.doc" [0075.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="KOMWDxRj.doc", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0075.346] GetProcessHeap () returned 0x630000 [0075.346] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd) returned 0x64c9f0 [0075.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="KOMWDxRj.doc", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KOMWDxRj.doc", lpUsedDefaultChar=0x0) returned 13 [0075.346] lstrlenA (lpString="KOMWDxRj.doc") returned 12 [0075.346] lstrlenA (lpString=".happythreechoose") returned 17 [0075.346] lstrcmpiW (lpString1="KOMWDxRj.doc", lpString2="Decryption INFO.html") returned 1 [0075.346] lstrcmpiW (lpString1="KOMWDxRj.doc", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0075.346] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0075.346] lstrcmpiW (lpString1="KOMWDxRj.doc", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0075.346] GetProcessHeap () returned 0x630000 [0075.346] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651ec0 [0075.346] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\KOMWDxRj.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\komwdxrj.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0075.347] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=47970) returned 1 [0075.347] GetProcessHeap () returned 0x630000 [0075.347] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655760 [0075.347] GetProcessHeap () returned 0x630000 [0075.347] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6736d0 [0075.349] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\KOMWDxRj.doc") returned 47 [0075.349] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.350] GetProcessHeap () returned 0x630000 [0075.350] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0075.350] GetProcessHeap () returned 0x630000 [0075.350] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x6738e0 [0075.350] lstrlenA (lpString="rsa_encrypt") returned 11 [0075.350] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x672a10) returned 1 [0075.350] CryptGenRandom (in: hProv=0x672a10, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0075.350] CryptReleaseContext (hProv=0x672a10, dwFlags=0x0) returned 1 [0075.350] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0075.351] GetProcessHeap () returned 0x630000 [0075.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672fe8 [0075.351] lstrlenA (lpString="010001") returned 6 [0075.351] GetProcessHeap () returned 0x630000 [0075.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0075.351] GetProcessHeap () returned 0x630000 [0075.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673648 [0075.351] GetProcessHeap () returned 0x630000 [0075.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e6a0 [0075.351] GetProcessHeap () returned 0x630000 [0075.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673648 | out: hHeap=0x630000) returned 1 [0075.351] GetProcessHeap () returned 0x630000 [0075.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e340 [0075.351] GetProcessHeap () returned 0x630000 [0075.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657670 [0075.351] GetProcessHeap () returned 0x630000 [0075.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a318 [0075.351] GetProcessHeap () returned 0x630000 [0075.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0075.351] GetProcessHeap () returned 0x630000 [0075.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.351] GetProcessHeap () returned 0x630000 [0075.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0075.351] GetProcessHeap () returned 0x630000 [0075.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6733a0 [0075.351] GetProcessHeap () returned 0x630000 [0075.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657210 [0075.351] GetProcessHeap () returned 0x630000 [0075.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.352] GetProcessHeap () returned 0x630000 [0075.352] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0075.352] GetProcessHeap () returned 0x630000 [0075.352] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e730 [0075.352] GetProcessHeap () returned 0x630000 [0075.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6733a0 | out: hHeap=0x630000) returned 1 [0075.352] GetProcessHeap () returned 0x630000 [0075.352] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0075.352] GetProcessHeap () returned 0x630000 [0075.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0075.352] GetProcessHeap () returned 0x630000 [0075.352] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.352] GetProcessHeap () returned 0x630000 [0075.352] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65ce38 [0075.352] GetProcessHeap () returned 0x630000 [0075.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.352] GetProcessHeap () returned 0x630000 [0075.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.352] GetProcessHeap () returned 0x630000 [0075.352] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.352] GetProcessHeap () returned 0x630000 [0075.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.352] GetProcessHeap () returned 0x630000 [0075.352] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65dda0 [0075.352] GetProcessHeap () returned 0x630000 [0075.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ce38 | out: hHeap=0x630000) returned 1 [0075.352] GetProcessHeap () returned 0x630000 [0075.352] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0075.352] GetProcessHeap () returned 0x630000 [0075.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0075.352] GetProcessHeap () returned 0x630000 [0075.352] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.352] GetProcessHeap () returned 0x630000 [0075.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.352] GetProcessHeap () returned 0x630000 [0075.352] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.352] GetProcessHeap () returned 0x630000 [0075.352] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.352] GetProcessHeap () returned 0x630000 [0075.352] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.352] GetProcessHeap () returned 0x630000 [0075.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.353] GetProcessHeap () returned 0x630000 [0075.353] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0075.353] GetProcessHeap () returned 0x630000 [0075.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0075.353] GetProcessHeap () returned 0x630000 [0075.353] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.353] GetProcessHeap () returned 0x630000 [0075.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.353] GetProcessHeap () returned 0x630000 [0075.353] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.353] GetProcessHeap () returned 0x630000 [0075.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.353] GetProcessHeap () returned 0x630000 [0075.353] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.353] GetProcessHeap () returned 0x630000 [0075.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.353] GetProcessHeap () returned 0x630000 [0075.353] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.353] GetProcessHeap () returned 0x630000 [0075.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.353] GetProcessHeap () returned 0x630000 [0075.353] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.353] GetProcessHeap () returned 0x630000 [0075.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.353] GetProcessHeap () returned 0x630000 [0075.353] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0075.353] GetProcessHeap () returned 0x630000 [0075.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0075.353] GetProcessHeap () returned 0x630000 [0075.353] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.353] GetProcessHeap () returned 0x630000 [0075.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.353] GetProcessHeap () returned 0x630000 [0075.353] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.353] GetProcessHeap () returned 0x630000 [0075.353] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.353] GetProcessHeap () returned 0x630000 [0075.353] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0075.354] GetProcessHeap () returned 0x630000 [0075.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0075.354] GetProcessHeap () returned 0x630000 [0075.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.354] GetProcessHeap () returned 0x630000 [0075.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.354] GetProcessHeap () returned 0x630000 [0075.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0075.354] GetProcessHeap () returned 0x630000 [0075.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0075.354] GetProcessHeap () returned 0x630000 [0075.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.354] GetProcessHeap () returned 0x630000 [0075.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.354] GetProcessHeap () returned 0x630000 [0075.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0075.354] GetProcessHeap () returned 0x630000 [0075.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0075.354] GetProcessHeap () returned 0x630000 [0075.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.354] GetProcessHeap () returned 0x630000 [0075.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.354] GetProcessHeap () returned 0x630000 [0075.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.354] GetProcessHeap () returned 0x630000 [0075.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.354] GetProcessHeap () returned 0x630000 [0075.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.354] GetProcessHeap () returned 0x630000 [0075.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.355] GetProcessHeap () returned 0x630000 [0075.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.355] GetProcessHeap () returned 0x630000 [0075.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.355] GetProcessHeap () returned 0x630000 [0075.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.355] GetProcessHeap () returned 0x630000 [0075.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.355] GetProcessHeap () returned 0x630000 [0075.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.355] GetProcessHeap () returned 0x630000 [0075.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.355] GetProcessHeap () returned 0x630000 [0075.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.355] GetProcessHeap () returned 0x630000 [0075.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.355] GetProcessHeap () returned 0x630000 [0075.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.355] GetProcessHeap () returned 0x630000 [0075.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.355] GetProcessHeap () returned 0x630000 [0075.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.355] GetProcessHeap () returned 0x630000 [0075.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.355] GetProcessHeap () returned 0x630000 [0075.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.355] GetProcessHeap () returned 0x630000 [0075.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.355] GetProcessHeap () returned 0x630000 [0075.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.355] GetProcessHeap () returned 0x630000 [0075.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.355] GetProcessHeap () returned 0x630000 [0075.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.355] GetProcessHeap () returned 0x630000 [0075.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.355] GetProcessHeap () returned 0x630000 [0075.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.355] GetProcessHeap () returned 0x630000 [0075.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.356] GetProcessHeap () returned 0x630000 [0075.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.356] GetProcessHeap () returned 0x630000 [0075.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.356] GetProcessHeap () returned 0x630000 [0075.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.356] GetProcessHeap () returned 0x630000 [0075.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.356] GetProcessHeap () returned 0x630000 [0075.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.356] GetProcessHeap () returned 0x630000 [0075.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.356] GetProcessHeap () returned 0x630000 [0075.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.356] GetProcessHeap () returned 0x630000 [0075.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.356] GetProcessHeap () returned 0x630000 [0075.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.356] GetProcessHeap () returned 0x630000 [0075.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.356] GetProcessHeap () returned 0x630000 [0075.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.356] GetProcessHeap () returned 0x630000 [0075.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.356] GetProcessHeap () returned 0x630000 [0075.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.356] GetProcessHeap () returned 0x630000 [0075.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.356] GetProcessHeap () returned 0x630000 [0075.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.356] GetProcessHeap () returned 0x630000 [0075.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.356] GetProcessHeap () returned 0x630000 [0075.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.356] GetProcessHeap () returned 0x630000 [0075.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.356] GetProcessHeap () returned 0x630000 [0075.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.356] GetProcessHeap () returned 0x630000 [0075.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.357] GetProcessHeap () returned 0x630000 [0075.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.357] GetProcessHeap () returned 0x630000 [0075.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.357] GetProcessHeap () returned 0x630000 [0075.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0075.357] GetProcessHeap () returned 0x630000 [0075.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0075.357] GetProcessHeap () returned 0x630000 [0075.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0075.357] GetProcessHeap () returned 0x630000 [0075.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0075.357] GetProcessHeap () returned 0x630000 [0075.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0075.357] GetProcessHeap () returned 0x630000 [0075.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0075.357] GetProcessHeap () returned 0x630000 [0075.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0075.357] GetProcessHeap () returned 0x630000 [0075.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e6a0 | out: hHeap=0x630000) returned 1 [0075.357] GetProcessHeap () returned 0x630000 [0075.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0075.357] GetProcessHeap () returned 0x630000 [0075.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.357] GetProcessHeap () returned 0x630000 [0075.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672fe8 | out: hHeap=0x630000) returned 1 [0075.357] WriteFile (in: hFile=0x230, lpBuffer=0x6738e0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6738e0*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0075.361] GetProcessHeap () returned 0x630000 [0075.361] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6738e0, Size=0x30) returned 0x6738e0 [0075.361] GetProcessHeap () returned 0x630000 [0075.361] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0075.361] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.361] GetProcessHeap () returned 0x630000 [0075.361] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xbb62) returned 0x673918 [0075.362] ReadFile (in: hFile=0x230, lpBuffer=0x673918, nNumberOfBytesToRead=0xbb62, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x673918*, lpNumberOfBytesRead=0x243d7e8*=0xbb62, lpOverlapped=0x0) returned 1 [0075.363] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.363] WriteFile (in: hFile=0x230, lpBuffer=0x673918*, nNumberOfBytesToWrite=0xbb62, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x673918*, lpNumberOfBytesWritten=0x243d7e4*=0xbb62, lpOverlapped=0x0) returned 1 [0075.364] GetProcessHeap () returned 0x630000 [0075.364] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673918 | out: hHeap=0x630000) returned 1 [0075.365] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.366] WriteFile (in: hFile=0x230, lpBuffer=0x6738e0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6738e0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0075.366] CloseHandle (hObject=0x230) returned 1 [0075.367] GetProcessHeap () returned 0x630000 [0075.367] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651ec0 | out: hHeap=0x630000) returned 1 [0075.367] GetProcessHeap () returned 0x630000 [0075.367] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655760 | out: hHeap=0x630000) returned 1 [0075.367] GetProcessHeap () returned 0x630000 [0075.367] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6736d0 | out: hHeap=0x630000) returned 1 [0075.367] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\KOMWDxRj.doc" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\KOMWDxRj.doc") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\KOMWDxRj.doc" [0075.367] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\KOMWDxRj.doc", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\KOMWDxRj.doc.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\KOMWDxRj.doc.happythreechoose" [0075.367] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\KOMWDxRj.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\komwdxrj.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\KOMWDxRj.doc.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\komwdxrj.doc.happythreechoose"), dwFlags=0x1) returned 1 [0075.368] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\KOMWDxRj.doc" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG") returned 1 [0075.368] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\") returned="" [0075.368] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\Decryption INFO.html" [0075.368] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\decryption info.html")) returned 0x20 [0075.368] GetProcessHeap () returned 0x630000 [0075.368] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0075.368] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e9ea2a0, ftCreationTime.dwHighDateTime=0x1d5c7f7, ftLastAccessTime.dwLowDateTime=0x17fd8c70, ftLastAccessTime.dwHighDateTime=0x1d5cda8, ftLastWriteTime.dwLowDateTime=0x17fd8c70, ftLastWriteTime.dwHighDateTime=0x1d5cda8, nFileSizeHigh=0x0, nFileSizeLow=0x2270, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="lh_Wq3HnvX.png", cAlternateFileName="LH_WQ3~1.PNG")) returned 1 [0075.368] lstrcmpiW (lpString1="lh_Wq3HnvX.png", lpString2=".") returned 1 [0075.368] lstrcmpiW (lpString1="lh_Wq3HnvX.png", lpString2="..") returned 1 [0075.368] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\", lpString2="lh_Wq3HnvX.png" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\lh_Wq3HnvX.png") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\lh_Wq3HnvX.png" [0075.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lh_Wq3HnvX.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0075.368] GetProcessHeap () returned 0x630000 [0075.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0075.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lh_Wq3HnvX.png", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lh_Wq3HnvX.png", lpUsedDefaultChar=0x0) returned 15 [0075.368] lstrlenA (lpString="lh_Wq3HnvX.png") returned 14 [0075.368] lstrlenA (lpString=".happythreechoose") returned 17 [0075.368] lstrcmpiW (lpString1="lh_Wq3HnvX.png", lpString2="Decryption INFO.html") returned 1 [0075.368] lstrcmpiW (lpString1="lh_Wq3HnvX.png", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0075.368] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0075.368] lstrcmpiW (lpString1="lh_Wq3HnvX.png", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0075.368] GetProcessHeap () returned 0x630000 [0075.368] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0075.368] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\lh_Wq3HnvX.png" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\lh_wq3hnvx.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0075.369] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=8816) returned 1 [0075.369] GetProcessHeap () returned 0x630000 [0075.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655508 [0075.369] GetProcessHeap () returned 0x630000 [0075.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672d40 [0075.369] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\lh_Wq3HnvX.png") returned 49 [0075.369] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.369] GetProcessHeap () returned 0x630000 [0075.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0075.369] GetProcessHeap () returned 0x630000 [0075.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x673918 [0075.370] lstrlenA (lpString="rsa_encrypt") returned 11 [0075.370] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x672cb8) returned 1 [0075.370] CryptGenRandom (in: hProv=0x672cb8, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0075.371] CryptReleaseContext (hProv=0x672cb8, dwFlags=0x0) returned 1 [0075.371] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0075.371] GetProcessHeap () returned 0x630000 [0075.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673180 [0075.371] lstrlenA (lpString="010001") returned 6 [0075.371] GetProcessHeap () returned 0x630000 [0075.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0075.371] GetProcessHeap () returned 0x630000 [0075.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6736d0 [0075.371] GetProcessHeap () returned 0x630000 [0075.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65df50 [0075.371] GetProcessHeap () returned 0x630000 [0075.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6736d0 | out: hHeap=0x630000) returned 1 [0075.371] GetProcessHeap () returned 0x630000 [0075.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0075.371] GetProcessHeap () returned 0x630000 [0075.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656a68 [0075.371] GetProcessHeap () returned 0x630000 [0075.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2a8 [0075.371] GetProcessHeap () returned 0x630000 [0075.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0075.371] GetProcessHeap () returned 0x630000 [0075.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.371] GetProcessHeap () returned 0x630000 [0075.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0075.371] GetProcessHeap () returned 0x630000 [0075.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6733a0 [0075.371] GetProcessHeap () returned 0x630000 [0075.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657210 [0075.371] GetProcessHeap () returned 0x630000 [0075.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.371] GetProcessHeap () returned 0x630000 [0075.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0075.371] GetProcessHeap () returned 0x630000 [0075.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e580 [0075.371] GetProcessHeap () returned 0x630000 [0075.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6733a0 | out: hHeap=0x630000) returned 1 [0075.371] GetProcessHeap () returned 0x630000 [0075.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0075.372] GetProcessHeap () returned 0x630000 [0075.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0075.372] GetProcessHeap () returned 0x630000 [0075.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.372] GetProcessHeap () returned 0x630000 [0075.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cf88 [0075.372] GetProcessHeap () returned 0x630000 [0075.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.372] GetProcessHeap () returned 0x630000 [0075.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.372] GetProcessHeap () returned 0x630000 [0075.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.372] GetProcessHeap () returned 0x630000 [0075.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.372] GetProcessHeap () returned 0x630000 [0075.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ecd0 [0075.372] GetProcessHeap () returned 0x630000 [0075.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cf88 | out: hHeap=0x630000) returned 1 [0075.372] GetProcessHeap () returned 0x630000 [0075.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0075.372] GetProcessHeap () returned 0x630000 [0075.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ecd0 | out: hHeap=0x630000) returned 1 [0075.372] GetProcessHeap () returned 0x630000 [0075.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.372] GetProcessHeap () returned 0x630000 [0075.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.372] GetProcessHeap () returned 0x630000 [0075.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.372] GetProcessHeap () returned 0x630000 [0075.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.372] GetProcessHeap () returned 0x630000 [0075.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.372] GetProcessHeap () returned 0x630000 [0075.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.372] GetProcessHeap () returned 0x630000 [0075.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.372] GetProcessHeap () returned 0x630000 [0075.372] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.372] GetProcessHeap () returned 0x630000 [0075.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.372] GetProcessHeap () returned 0x630000 [0075.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.373] GetProcessHeap () returned 0x630000 [0075.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.373] GetProcessHeap () returned 0x630000 [0075.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.373] GetProcessHeap () returned 0x630000 [0075.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.373] GetProcessHeap () returned 0x630000 [0075.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.373] GetProcessHeap () returned 0x630000 [0075.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.373] GetProcessHeap () returned 0x630000 [0075.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.373] GetProcessHeap () returned 0x630000 [0075.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.373] GetProcessHeap () returned 0x630000 [0075.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.373] GetProcessHeap () returned 0x630000 [0075.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.373] GetProcessHeap () returned 0x630000 [0075.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.373] GetProcessHeap () returned 0x630000 [0075.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.373] GetProcessHeap () returned 0x630000 [0075.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.373] GetProcessHeap () returned 0x630000 [0075.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.373] GetProcessHeap () returned 0x630000 [0075.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.373] GetProcessHeap () returned 0x630000 [0075.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0075.373] GetProcessHeap () returned 0x630000 [0075.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0075.373] GetProcessHeap () returned 0x630000 [0075.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.373] GetProcessHeap () returned 0x630000 [0075.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.373] GetProcessHeap () returned 0x630000 [0075.373] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0075.373] GetProcessHeap () returned 0x630000 [0075.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0075.374] GetProcessHeap () returned 0x630000 [0075.374] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.374] GetProcessHeap () returned 0x630000 [0075.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.374] GetProcessHeap () returned 0x630000 [0075.374] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.374] GetProcessHeap () returned 0x630000 [0075.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.374] GetProcessHeap () returned 0x630000 [0075.374] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.374] GetProcessHeap () returned 0x630000 [0075.374] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.374] GetProcessHeap () returned 0x630000 [0075.374] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.374] GetProcessHeap () returned 0x630000 [0075.379] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.379] GetProcessHeap () returned 0x630000 [0075.379] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.379] GetProcessHeap () returned 0x630000 [0075.379] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.380] GetProcessHeap () returned 0x630000 [0075.380] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.380] GetProcessHeap () returned 0x630000 [0075.380] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.380] GetProcessHeap () returned 0x630000 [0075.380] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0075.380] GetProcessHeap () returned 0x630000 [0075.380] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0075.380] GetProcessHeap () returned 0x630000 [0075.380] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.380] GetProcessHeap () returned 0x630000 [0075.380] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.380] GetProcessHeap () returned 0x630000 [0075.380] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.380] GetProcessHeap () returned 0x630000 [0075.380] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.380] GetProcessHeap () returned 0x630000 [0075.380] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.380] GetProcessHeap () returned 0x630000 [0075.380] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.380] GetProcessHeap () returned 0x630000 [0075.380] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.380] GetProcessHeap () returned 0x630000 [0075.380] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.380] GetProcessHeap () returned 0x630000 [0075.380] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.380] GetProcessHeap () returned 0x630000 [0075.380] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.380] GetProcessHeap () returned 0x630000 [0075.380] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.380] GetProcessHeap () returned 0x630000 [0075.380] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.380] GetProcessHeap () returned 0x630000 [0075.380] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0075.380] GetProcessHeap () returned 0x630000 [0075.380] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0075.380] GetProcessHeap () returned 0x630000 [0075.381] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.381] GetProcessHeap () returned 0x630000 [0075.381] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.381] GetProcessHeap () returned 0x630000 [0075.381] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.381] GetProcessHeap () returned 0x630000 [0075.381] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.382] GetProcessHeap () returned 0x630000 [0075.382] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.382] GetProcessHeap () returned 0x630000 [0075.382] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.382] GetProcessHeap () returned 0x630000 [0075.382] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.382] GetProcessHeap () returned 0x630000 [0075.382] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.382] GetProcessHeap () returned 0x630000 [0075.382] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.382] GetProcessHeap () returned 0x630000 [0075.382] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.382] GetProcessHeap () returned 0x630000 [0075.382] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0075.382] GetProcessHeap () returned 0x630000 [0075.382] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0075.382] GetProcessHeap () returned 0x630000 [0075.382] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.382] GetProcessHeap () returned 0x630000 [0075.383] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.383] GetProcessHeap () returned 0x630000 [0075.383] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.383] GetProcessHeap () returned 0x630000 [0075.383] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.383] GetProcessHeap () returned 0x630000 [0075.383] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.383] GetProcessHeap () returned 0x630000 [0075.383] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.383] GetProcessHeap () returned 0x630000 [0075.383] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.383] GetProcessHeap () returned 0x630000 [0075.383] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.383] GetProcessHeap () returned 0x630000 [0075.383] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0075.383] GetProcessHeap () returned 0x630000 [0075.383] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0075.383] GetProcessHeap () returned 0x630000 [0075.383] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.383] GetProcessHeap () returned 0x630000 [0075.383] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.383] GetProcessHeap () returned 0x630000 [0075.383] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0075.383] GetProcessHeap () returned 0x630000 [0075.383] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0075.383] GetProcessHeap () returned 0x630000 [0075.383] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0075.383] GetProcessHeap () returned 0x630000 [0075.383] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0075.383] GetProcessHeap () returned 0x630000 [0075.383] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0075.383] GetProcessHeap () returned 0x630000 [0075.383] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0075.383] GetProcessHeap () returned 0x630000 [0075.383] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0075.383] GetProcessHeap () returned 0x630000 [0075.383] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0075.384] GetProcessHeap () returned 0x630000 [0075.384] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0075.384] GetProcessHeap () returned 0x630000 [0075.384] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.384] GetProcessHeap () returned 0x630000 [0075.384] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673180 | out: hHeap=0x630000) returned 1 [0075.384] WriteFile (in: hFile=0x230, lpBuffer=0x673918*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673918*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0075.385] GetProcessHeap () returned 0x630000 [0075.385] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x673918, Size=0x30) returned 0x673918 [0075.385] GetProcessHeap () returned 0x630000 [0075.385] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0075.385] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.386] GetProcessHeap () returned 0x630000 [0075.386] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2270) returned 0x673950 [0075.386] ReadFile (in: hFile=0x230, lpBuffer=0x673950, nNumberOfBytesToRead=0x2270, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x673950*, lpNumberOfBytesRead=0x243d7e8*=0x2270, lpOverlapped=0x0) returned 1 [0075.386] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.386] WriteFile (in: hFile=0x230, lpBuffer=0x673950*, nNumberOfBytesToWrite=0x2270, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x673950*, lpNumberOfBytesWritten=0x243d7e4*=0x2270, lpOverlapped=0x0) returned 1 [0075.387] GetProcessHeap () returned 0x630000 [0075.387] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673950 | out: hHeap=0x630000) returned 1 [0075.387] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.387] WriteFile (in: hFile=0x230, lpBuffer=0x673918*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673918*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0075.388] CloseHandle (hObject=0x230) returned 1 [0075.389] GetProcessHeap () returned 0x630000 [0075.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0075.389] GetProcessHeap () returned 0x630000 [0075.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655508 | out: hHeap=0x630000) returned 1 [0075.389] GetProcessHeap () returned 0x630000 [0075.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672d40 | out: hHeap=0x630000) returned 1 [0075.389] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\lh_Wq3HnvX.png" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\lh_Wq3HnvX.png") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\lh_Wq3HnvX.png" [0075.389] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\lh_Wq3HnvX.png", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\lh_Wq3HnvX.png.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\lh_Wq3HnvX.png.happythreechoose" [0075.389] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\lh_Wq3HnvX.png" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\lh_wq3hnvx.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\lh_Wq3HnvX.png.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\lh_wq3hnvx.png.happythreechoose"), dwFlags=0x1) returned 1 [0075.389] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\lh_Wq3HnvX.png" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG") returned 1 [0075.389] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\") returned="" [0075.389] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\Decryption INFO.html" [0075.389] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\decryption info.html")) returned 0x20 [0075.390] GetProcessHeap () returned 0x630000 [0075.390] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0075.390] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb685d20, ftCreationTime.dwHighDateTime=0x1d5d45b, ftLastAccessTime.dwLowDateTime=0xd8bd84c0, ftLastAccessTime.dwHighDateTime=0x1d5d324, ftLastWriteTime.dwLowDateTime=0xd8bd84c0, ftLastWriteTime.dwHighDateTime=0x1d5d324, nFileSizeHigh=0x0, nFileSizeLow=0x10571, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pLtpvZsa.ots", cAlternateFileName="")) returned 1 [0075.390] lstrcmpiW (lpString1="pLtpvZsa.ots", lpString2=".") returned 1 [0075.390] lstrcmpiW (lpString1="pLtpvZsa.ots", lpString2="..") returned 1 [0075.390] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\", lpString2="pLtpvZsa.ots" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\pLtpvZsa.ots") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\pLtpvZsa.ots" [0075.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pLtpvZsa.ots", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0075.390] GetProcessHeap () returned 0x630000 [0075.390] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd) returned 0x64c9f0 [0075.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pLtpvZsa.ots", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pLtpvZsa.ots", lpUsedDefaultChar=0x0) returned 13 [0075.390] lstrlenA (lpString="pLtpvZsa.ots") returned 12 [0075.390] lstrlenA (lpString=".happythreechoose") returned 17 [0075.390] lstrcmpiW (lpString1="pLtpvZsa.ots", lpString2="Decryption INFO.html") returned 1 [0075.390] lstrcmpiW (lpString1="pLtpvZsa.ots", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0075.390] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0075.390] lstrcmpiW (lpString1="pLtpvZsa.ots", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0075.390] GetProcessHeap () returned 0x630000 [0075.390] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651ec0 [0075.390] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\pLtpvZsa.ots" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\pltpvzsa.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0075.390] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=66929) returned 1 [0075.391] GetProcessHeap () returned 0x630000 [0075.391] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6556e8 [0075.391] GetProcessHeap () returned 0x630000 [0075.391] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672900 [0075.391] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\pLtpvZsa.ots") returned 47 [0075.391] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.391] GetProcessHeap () returned 0x630000 [0075.391] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0075.391] GetProcessHeap () returned 0x630000 [0075.391] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38f) returned 0x673950 [0075.391] lstrlenA (lpString="rsa_encrypt") returned 11 [0075.391] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x673538) returned 1 [0075.391] CryptGenRandom (in: hProv=0x673538, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0075.391] CryptReleaseContext (hProv=0x673538, dwFlags=0x0) returned 1 [0075.391] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0075.391] GetProcessHeap () returned 0x630000 [0075.391] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672d40 [0075.391] lstrlenA (lpString="010001") returned 6 [0075.392] GetProcessHeap () returned 0x630000 [0075.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0075.392] GetProcessHeap () returned 0x630000 [0075.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673758 [0075.392] GetProcessHeap () returned 0x630000 [0075.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e2b0 [0075.392] GetProcessHeap () returned 0x630000 [0075.392] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673758 | out: hHeap=0x630000) returned 1 [0075.392] GetProcessHeap () returned 0x630000 [0075.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dec0 [0075.392] GetProcessHeap () returned 0x630000 [0075.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656db0 [0075.392] GetProcessHeap () returned 0x630000 [0075.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0075.392] GetProcessHeap () returned 0x630000 [0075.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0075.392] GetProcessHeap () returned 0x630000 [0075.392] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.392] GetProcessHeap () returned 0x630000 [0075.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0075.392] GetProcessHeap () returned 0x630000 [0075.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672e50 [0075.392] GetProcessHeap () returned 0x630000 [0075.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656a68 [0075.392] GetProcessHeap () returned 0x630000 [0075.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.392] GetProcessHeap () returned 0x630000 [0075.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0075.392] GetProcessHeap () returned 0x630000 [0075.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ebb0 [0075.392] GetProcessHeap () returned 0x630000 [0075.392] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672e50 | out: hHeap=0x630000) returned 1 [0075.392] GetProcessHeap () returned 0x630000 [0075.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0075.392] GetProcessHeap () returned 0x630000 [0075.392] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0075.392] GetProcessHeap () returned 0x630000 [0075.392] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.392] GetProcessHeap () returned 0x630000 [0075.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65d000 [0075.393] GetProcessHeap () returned 0x630000 [0075.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.393] GetProcessHeap () returned 0x630000 [0075.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.393] GetProcessHeap () returned 0x630000 [0075.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.393] GetProcessHeap () returned 0x630000 [0075.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.393] GetProcessHeap () returned 0x630000 [0075.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ebb0 [0075.393] GetProcessHeap () returned 0x630000 [0075.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65d000 | out: hHeap=0x630000) returned 1 [0075.393] GetProcessHeap () returned 0x630000 [0075.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0075.393] GetProcessHeap () returned 0x630000 [0075.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0075.393] GetProcessHeap () returned 0x630000 [0075.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.393] GetProcessHeap () returned 0x630000 [0075.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.393] GetProcessHeap () returned 0x630000 [0075.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.393] GetProcessHeap () returned 0x630000 [0075.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.393] GetProcessHeap () returned 0x630000 [0075.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.393] GetProcessHeap () returned 0x630000 [0075.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.393] GetProcessHeap () returned 0x630000 [0075.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.393] GetProcessHeap () returned 0x630000 [0075.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.393] GetProcessHeap () returned 0x630000 [0075.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.393] GetProcessHeap () returned 0x630000 [0075.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.393] GetProcessHeap () returned 0x630000 [0075.393] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.393] GetProcessHeap () returned 0x630000 [0075.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.394] GetProcessHeap () returned 0x630000 [0075.394] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.394] GetProcessHeap () returned 0x630000 [0075.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.394] GetProcessHeap () returned 0x630000 [0075.394] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.394] GetProcessHeap () returned 0x630000 [0075.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.394] GetProcessHeap () returned 0x630000 [0075.394] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.394] GetProcessHeap () returned 0x630000 [0075.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.394] GetProcessHeap () returned 0x630000 [0075.394] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.394] GetProcessHeap () returned 0x630000 [0075.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.394] GetProcessHeap () returned 0x630000 [0075.394] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.394] GetProcessHeap () returned 0x630000 [0075.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.394] GetProcessHeap () returned 0x630000 [0075.394] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.394] GetProcessHeap () returned 0x630000 [0075.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.394] GetProcessHeap () returned 0x630000 [0075.394] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.394] GetProcessHeap () returned 0x630000 [0075.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.394] GetProcessHeap () returned 0x630000 [0075.394] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.394] GetProcessHeap () returned 0x630000 [0075.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.394] GetProcessHeap () returned 0x630000 [0075.394] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0075.394] GetProcessHeap () returned 0x630000 [0075.394] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0075.394] GetProcessHeap () returned 0x630000 [0075.395] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.395] GetProcessHeap () returned 0x630000 [0075.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.395] GetProcessHeap () returned 0x630000 [0075.395] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.395] GetProcessHeap () returned 0x630000 [0075.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.395] GetProcessHeap () returned 0x630000 [0075.395] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.395] GetProcessHeap () returned 0x630000 [0075.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.395] GetProcessHeap () returned 0x630000 [0075.395] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.395] GetProcessHeap () returned 0x630000 [0075.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.395] GetProcessHeap () returned 0x630000 [0075.395] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.395] GetProcessHeap () returned 0x630000 [0075.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.395] GetProcessHeap () returned 0x630000 [0075.395] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.395] GetProcessHeap () returned 0x630000 [0075.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.395] GetProcessHeap () returned 0x630000 [0075.395] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.395] GetProcessHeap () returned 0x630000 [0075.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.395] GetProcessHeap () returned 0x630000 [0075.395] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.395] GetProcessHeap () returned 0x630000 [0075.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.395] GetProcessHeap () returned 0x630000 [0075.395] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0075.395] GetProcessHeap () returned 0x630000 [0075.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0075.395] GetProcessHeap () returned 0x630000 [0075.395] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.395] GetProcessHeap () returned 0x630000 [0075.395] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.396] GetProcessHeap () returned 0x630000 [0075.396] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.396] GetProcessHeap () returned 0x630000 [0075.396] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.396] GetProcessHeap () returned 0x630000 [0075.396] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0075.396] GetProcessHeap () returned 0x630000 [0075.396] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0075.396] GetProcessHeap () returned 0x630000 [0075.396] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.396] GetProcessHeap () returned 0x630000 [0075.396] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.396] GetProcessHeap () returned 0x630000 [0075.396] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.396] GetProcessHeap () returned 0x630000 [0075.396] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.396] GetProcessHeap () returned 0x630000 [0075.396] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.396] GetProcessHeap () returned 0x630000 [0075.396] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.396] GetProcessHeap () returned 0x630000 [0075.396] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0075.396] GetProcessHeap () returned 0x630000 [0075.396] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0075.396] GetProcessHeap () returned 0x630000 [0075.396] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.396] GetProcessHeap () returned 0x630000 [0075.396] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.396] GetProcessHeap () returned 0x630000 [0075.396] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0075.396] GetProcessHeap () returned 0x630000 [0075.396] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0075.396] GetProcessHeap () returned 0x630000 [0075.396] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.396] GetProcessHeap () returned 0x630000 [0075.396] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.396] GetProcessHeap () returned 0x630000 [0075.396] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.396] GetProcessHeap () returned 0x630000 [0075.396] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.397] GetProcessHeap () returned 0x630000 [0075.397] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.397] GetProcessHeap () returned 0x630000 [0075.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.397] GetProcessHeap () returned 0x630000 [0075.397] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.397] GetProcessHeap () returned 0x630000 [0075.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.397] GetProcessHeap () returned 0x630000 [0075.397] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.397] GetProcessHeap () returned 0x630000 [0075.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.397] GetProcessHeap () returned 0x630000 [0075.397] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.397] GetProcessHeap () returned 0x630000 [0075.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.397] GetProcessHeap () returned 0x630000 [0075.397] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.397] GetProcessHeap () returned 0x630000 [0075.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.397] GetProcessHeap () returned 0x630000 [0075.397] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.397] GetProcessHeap () returned 0x630000 [0075.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.397] GetProcessHeap () returned 0x630000 [0075.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0075.397] GetProcessHeap () returned 0x630000 [0075.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0075.397] GetProcessHeap () returned 0x630000 [0075.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0075.397] GetProcessHeap () returned 0x630000 [0075.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0075.397] GetProcessHeap () returned 0x630000 [0075.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0075.397] GetProcessHeap () returned 0x630000 [0075.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0075.397] GetProcessHeap () returned 0x630000 [0075.397] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0075.398] GetProcessHeap () returned 0x630000 [0075.398] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e2b0 | out: hHeap=0x630000) returned 1 [0075.398] GetProcessHeap () returned 0x630000 [0075.398] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0075.398] GetProcessHeap () returned 0x630000 [0075.398] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.398] GetProcessHeap () returned 0x630000 [0075.398] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672d40 | out: hHeap=0x630000) returned 1 [0075.398] WriteFile (in: hFile=0x230, lpBuffer=0x673950*, nNumberOfBytesToWrite=0x38f, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673950*, lpNumberOfBytesWritten=0x243d864*=0x38f, lpOverlapped=0x0) returned 1 [0075.400] GetProcessHeap () returned 0x630000 [0075.400] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x673950, Size=0x30) returned 0x673950 [0075.400] GetProcessHeap () returned 0x630000 [0075.400] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0075.400] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.400] GetProcessHeap () returned 0x630000 [0075.400] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10580) returned 0x673988 [0075.401] ReadFile (in: hFile=0x230, lpBuffer=0x673988, nNumberOfBytesToRead=0x10580, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x673988*, lpNumberOfBytesRead=0x243d7e8*=0x10580, lpOverlapped=0x0) returned 1 [0075.402] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.402] WriteFile (in: hFile=0x230, lpBuffer=0x673988*, nNumberOfBytesToWrite=0x10580, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x673988*, lpNumberOfBytesWritten=0x243d7e4*=0x10580, lpOverlapped=0x0) returned 1 [0075.403] GetProcessHeap () returned 0x630000 [0075.403] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673988 | out: hHeap=0x630000) returned 1 [0075.404] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.404] WriteFile (in: hFile=0x230, lpBuffer=0x673950*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673950*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0075.405] CloseHandle (hObject=0x230) returned 1 [0075.406] GetProcessHeap () returned 0x630000 [0075.406] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651ec0 | out: hHeap=0x630000) returned 1 [0075.406] GetProcessHeap () returned 0x630000 [0075.406] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6556e8 | out: hHeap=0x630000) returned 1 [0075.406] GetProcessHeap () returned 0x630000 [0075.406] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672900 | out: hHeap=0x630000) returned 1 [0075.406] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\pLtpvZsa.ots" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\pLtpvZsa.ots") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\pLtpvZsa.ots" [0075.406] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\pLtpvZsa.ots", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\pLtpvZsa.ots.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\pLtpvZsa.ots.happythreechoose" [0075.406] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\pLtpvZsa.ots" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\pltpvzsa.ots"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\pLtpvZsa.ots.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\pltpvzsa.ots.happythreechoose"), dwFlags=0x1) returned 1 [0075.407] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\pLtpvZsa.ots" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG") returned 1 [0075.407] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\") returned="" [0075.407] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\Decryption INFO.html" [0075.407] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\decryption info.html")) returned 0x20 [0075.407] GetProcessHeap () returned 0x630000 [0075.407] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0075.407] FindNextFileW (in: hFindFile=0x648b10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb685d20, ftCreationTime.dwHighDateTime=0x1d5d45b, ftLastAccessTime.dwLowDateTime=0xd8bd84c0, ftLastAccessTime.dwHighDateTime=0x1d5d324, ftLastWriteTime.dwLowDateTime=0xd8bd84c0, ftLastWriteTime.dwHighDateTime=0x1d5d324, nFileSizeHigh=0x0, nFileSizeLow=0x10571, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pLtpvZsa.ots", cAlternateFileName="")) returned 0 [0075.407] FindClose (in: hFindFile=0x648b10 | out: hFindFile=0x648b10) returned 1 [0075.407] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\" [0075.407] GetProcessHeap () returned 0x630000 [0075.407] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63e830 | out: hHeap=0x630000) returned 1 [0075.407] GetProcessHeap () returned 0x630000 [0075.407] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0075.407] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\") returned 47 [0075.407] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\*") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\*" [0075.407] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77966670, ftCreationTime.dwHighDateTime=0x1d5d064, ftLastAccessTime.dwLowDateTime=0xa5ae8d90, ftLastAccessTime.dwHighDateTime=0x1d5d6c1, ftLastWriteTime.dwLowDateTime=0xa5ae8d90, ftLastWriteTime.dwHighDateTime=0x1d5d6c1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648a90 [0075.407] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0075.407] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77966670, ftCreationTime.dwHighDateTime=0x1d5d064, ftLastAccessTime.dwLowDateTime=0xa5ae8d90, ftLastAccessTime.dwHighDateTime=0x1d5d6c1, ftLastWriteTime.dwLowDateTime=0xa5ae8d90, ftLastWriteTime.dwHighDateTime=0x1d5d6c1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.408] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0075.408] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0075.408] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74e0a2b0, ftCreationTime.dwHighDateTime=0x1d5ccea, ftLastAccessTime.dwLowDateTime=0xeae0b910, ftLastAccessTime.dwHighDateTime=0x1d5d32e, ftLastWriteTime.dwLowDateTime=0xeae0b910, ftLastWriteTime.dwHighDateTime=0x1d5d32e, nFileSizeHigh=0x0, nFileSizeLow=0x27d2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9oZ--Mep3WCZX2qSn.mkv", cAlternateFileName="9OZ--M~1.MKV")) returned 1 [0075.408] lstrcmpiW (lpString1="9oZ--Mep3WCZX2qSn.mkv", lpString2=".") returned 1 [0075.408] lstrcmpiW (lpString1="9oZ--Mep3WCZX2qSn.mkv", lpString2="..") returned 1 [0075.408] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\", lpString2="9oZ--Mep3WCZX2qSn.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\9oZ--Mep3WCZX2qSn.mkv") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\9oZ--Mep3WCZX2qSn.mkv" [0075.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="9oZ--Mep3WCZX2qSn.mkv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0075.408] GetProcessHeap () returned 0x630000 [0075.408] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x645c58 [0075.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="9oZ--Mep3WCZX2qSn.mkv", cchWideChar=-1, lpMultiByteStr=0x645c58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9oZ--Mep3WCZX2qSn.mkv", lpUsedDefaultChar=0x0) returned 22 [0075.408] lstrlenA (lpString="9oZ--Mep3WCZX2qSn.mkv") returned 21 [0075.408] lstrlenA (lpString=".happythreechoose") returned 17 [0075.408] lstrlenA (lpString=".happythreechoose") returned 17 [0075.408] lstrlenA (lpString="9oZ--Mep3WCZX2qSn.mkv") returned 21 [0075.408] lstrcmpiA (lpString1="-Mep3WCZX2qSn.mkv", lpString2=".happythreechoose") returned 1 [0075.408] lstrcmpiW (lpString1="9oZ--Mep3WCZX2qSn.mkv", lpString2="Decryption INFO.html") returned -1 [0075.408] lstrcmpiW (lpString1="9oZ--Mep3WCZX2qSn.mkv", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0075.408] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0075.408] lstrcmpiW (lpString1="9oZ--Mep3WCZX2qSn.mkv", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0075.408] GetProcessHeap () returned 0x630000 [0075.408] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f10 [0075.408] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\9oZ--Mep3WCZX2qSn.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\304hyv_ge_j\\9oz--mep3wczx2qsn.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0075.408] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=10194) returned 1 [0075.408] GetProcessHeap () returned 0x630000 [0075.408] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655670 [0075.408] GetProcessHeap () returned 0x630000 [0075.408] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673070 [0075.408] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\9oZ--Mep3WCZX2qSn.mkv") returned 68 [0075.408] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.409] GetProcessHeap () returned 0x630000 [0075.409] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0075.409] GetProcessHeap () returned 0x630000 [0075.409] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x673988 [0075.410] lstrlenA (lpString="rsa_encrypt") returned 11 [0075.410] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x6736d0) returned 1 [0075.410] CryptGenRandom (in: hProv=0x6736d0, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0075.410] CryptReleaseContext (hProv=0x6736d0, dwFlags=0x0) returned 1 [0075.410] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0075.410] GetProcessHeap () returned 0x630000 [0075.410] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672a10 [0075.410] lstrlenA (lpString="010001") returned 6 [0075.410] GetProcessHeap () returned 0x630000 [0075.410] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0075.410] GetProcessHeap () returned 0x630000 [0075.410] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672ba8 [0075.410] GetProcessHeap () returned 0x630000 [0075.410] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e4f0 [0075.410] GetProcessHeap () returned 0x630000 [0075.411] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672ba8 | out: hHeap=0x630000) returned 1 [0075.411] GetProcessHeap () returned 0x630000 [0075.411] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e190 [0075.411] GetProcessHeap () returned 0x630000 [0075.411] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656950 [0075.411] GetProcessHeap () returned 0x630000 [0075.411] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0075.411] GetProcessHeap () returned 0x630000 [0075.411] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0075.411] GetProcessHeap () returned 0x630000 [0075.411] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.411] GetProcessHeap () returned 0x630000 [0075.411] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0075.411] GetProcessHeap () returned 0x630000 [0075.411] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672d40 [0075.411] GetProcessHeap () returned 0x630000 [0075.411] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656ec8 [0075.411] GetProcessHeap () returned 0x630000 [0075.411] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.411] GetProcessHeap () returned 0x630000 [0075.411] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0075.411] GetProcessHeap () returned 0x630000 [0075.411] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65eb20 [0075.411] GetProcessHeap () returned 0x630000 [0075.411] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672d40 | out: hHeap=0x630000) returned 1 [0075.411] GetProcessHeap () returned 0x630000 [0075.411] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0075.411] GetProcessHeap () returned 0x630000 [0075.411] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0075.411] GetProcessHeap () returned 0x630000 [0075.411] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0075.411] GetProcessHeap () returned 0x630000 [0075.411] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0075.411] GetProcessHeap () returned 0x630000 [0075.411] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.411] GetProcessHeap () returned 0x630000 [0075.411] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0075.411] GetProcessHeap () returned 0x630000 [0075.411] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.411] GetProcessHeap () returned 0x630000 [0075.411] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.411] GetProcessHeap () returned 0x630000 [0075.411] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e610 [0075.412] GetProcessHeap () returned 0x630000 [0075.412] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0075.412] GetProcessHeap () returned 0x630000 [0075.412] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0075.412] GetProcessHeap () returned 0x630000 [0075.412] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0075.412] GetProcessHeap () returned 0x630000 [0075.412] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.412] GetProcessHeap () returned 0x630000 [0075.412] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.412] GetProcessHeap () returned 0x630000 [0075.412] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.412] GetProcessHeap () returned 0x630000 [0075.412] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.412] GetProcessHeap () returned 0x630000 [0075.412] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.412] GetProcessHeap () returned 0x630000 [0075.412] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.412] GetProcessHeap () returned 0x630000 [0075.412] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.412] GetProcessHeap () returned 0x630000 [0075.412] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.412] GetProcessHeap () returned 0x630000 [0075.412] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.412] GetProcessHeap () returned 0x630000 [0075.412] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.412] GetProcessHeap () returned 0x630000 [0075.412] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.412] GetProcessHeap () returned 0x630000 [0075.412] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.412] GetProcessHeap () returned 0x630000 [0075.412] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.412] GetProcessHeap () returned 0x630000 [0075.412] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.412] GetProcessHeap () returned 0x630000 [0075.412] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.412] GetProcessHeap () returned 0x630000 [0075.412] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.412] GetProcessHeap () returned 0x630000 [0075.412] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0075.413] GetProcessHeap () returned 0x630000 [0075.413] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0075.413] GetProcessHeap () returned 0x630000 [0075.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.413] GetProcessHeap () returned 0x630000 [0075.413] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.413] GetProcessHeap () returned 0x630000 [0075.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.413] GetProcessHeap () returned 0x630000 [0075.413] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.413] GetProcessHeap () returned 0x630000 [0075.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.413] GetProcessHeap () returned 0x630000 [0075.413] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.413] GetProcessHeap () returned 0x630000 [0075.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0075.413] GetProcessHeap () returned 0x630000 [0075.413] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0075.413] GetProcessHeap () returned 0x630000 [0075.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.413] GetProcessHeap () returned 0x630000 [0075.413] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.413] GetProcessHeap () returned 0x630000 [0075.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.413] GetProcessHeap () returned 0x630000 [0075.413] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.413] GetProcessHeap () returned 0x630000 [0075.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0075.413] GetProcessHeap () returned 0x630000 [0075.413] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0075.413] GetProcessHeap () returned 0x630000 [0075.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0075.413] GetProcessHeap () returned 0x630000 [0075.413] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0075.413] GetProcessHeap () returned 0x630000 [0075.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0075.413] GetProcessHeap () returned 0x630000 [0075.413] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0075.413] GetProcessHeap () returned 0x630000 [0075.413] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.413] GetProcessHeap () returned 0x630000 [0075.414] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.414] GetProcessHeap () returned 0x630000 [0075.414] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.414] GetProcessHeap () returned 0x630000 [0075.414] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.414] GetProcessHeap () returned 0x630000 [0075.414] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.414] GetProcessHeap () returned 0x630000 [0075.414] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.414] GetProcessHeap () returned 0x630000 [0075.414] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.414] GetProcessHeap () returned 0x630000 [0075.414] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.414] GetProcessHeap () returned 0x630000 [0075.414] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.414] GetProcessHeap () returned 0x630000 [0075.414] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.414] GetProcessHeap () returned 0x630000 [0075.414] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.414] GetProcessHeap () returned 0x630000 [0075.414] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.414] GetProcessHeap () returned 0x630000 [0075.414] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.414] GetProcessHeap () returned 0x630000 [0075.414] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.414] GetProcessHeap () returned 0x630000 [0075.414] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.414] GetProcessHeap () returned 0x630000 [0075.414] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.414] GetProcessHeap () returned 0x630000 [0075.414] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.414] GetProcessHeap () returned 0x630000 [0075.414] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.414] GetProcessHeap () returned 0x630000 [0075.414] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.414] GetProcessHeap () returned 0x630000 [0075.414] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.414] GetProcessHeap () returned 0x630000 [0075.414] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0075.414] GetProcessHeap () returned 0x630000 [0075.415] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0075.415] GetProcessHeap () returned 0x630000 [0075.415] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.415] GetProcessHeap () returned 0x630000 [0075.415] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.415] GetProcessHeap () returned 0x630000 [0075.415] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0075.415] GetProcessHeap () returned 0x630000 [0075.415] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0075.415] GetProcessHeap () returned 0x630000 [0075.415] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.415] GetProcessHeap () returned 0x630000 [0075.415] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.415] GetProcessHeap () returned 0x630000 [0075.415] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.415] GetProcessHeap () returned 0x630000 [0075.415] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.415] GetProcessHeap () returned 0x630000 [0075.415] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.415] GetProcessHeap () returned 0x630000 [0075.415] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.415] GetProcessHeap () returned 0x630000 [0075.415] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.415] GetProcessHeap () returned 0x630000 [0075.415] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.415] GetProcessHeap () returned 0x630000 [0075.415] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.415] GetProcessHeap () returned 0x630000 [0075.415] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.415] GetProcessHeap () returned 0x630000 [0075.415] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.415] GetProcessHeap () returned 0x630000 [0075.415] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.415] GetProcessHeap () returned 0x630000 [0075.415] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.415] GetProcessHeap () returned 0x630000 [0075.415] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.415] GetProcessHeap () returned 0x630000 [0075.415] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.416] GetProcessHeap () returned 0x630000 [0075.416] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.416] GetProcessHeap () returned 0x630000 [0075.416] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0075.416] GetProcessHeap () returned 0x630000 [0075.416] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0075.416] GetProcessHeap () returned 0x630000 [0075.416] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.416] GetProcessHeap () returned 0x630000 [0075.416] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.416] GetProcessHeap () returned 0x630000 [0075.416] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0075.416] GetProcessHeap () returned 0x630000 [0075.416] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0075.416] GetProcessHeap () returned 0x630000 [0075.416] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0075.416] GetProcessHeap () returned 0x630000 [0075.416] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0075.416] GetProcessHeap () returned 0x630000 [0075.416] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0075.416] GetProcessHeap () returned 0x630000 [0075.416] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0075.416] GetProcessHeap () returned 0x630000 [0075.416] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0075.416] GetProcessHeap () returned 0x630000 [0075.416] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0075.416] GetProcessHeap () returned 0x630000 [0075.416] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0075.416] GetProcessHeap () returned 0x630000 [0075.416] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.416] GetProcessHeap () returned 0x630000 [0075.416] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672a10 | out: hHeap=0x630000) returned 1 [0075.416] WriteFile (in: hFile=0x230, lpBuffer=0x673988*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673988*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0075.418] GetProcessHeap () returned 0x630000 [0075.418] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x673988, Size=0x30) returned 0x673988 [0075.418] GetProcessHeap () returned 0x630000 [0075.418] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0075.418] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.418] GetProcessHeap () returned 0x630000 [0075.418] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x27d2) returned 0x6739c0 [0075.419] ReadFile (in: hFile=0x230, lpBuffer=0x6739c0, nNumberOfBytesToRead=0x27d2, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x6739c0*, lpNumberOfBytesRead=0x243d7e8*=0x27d2, lpOverlapped=0x0) returned 1 [0075.419] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.419] WriteFile (in: hFile=0x230, lpBuffer=0x6739c0*, nNumberOfBytesToWrite=0x27d2, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x6739c0*, lpNumberOfBytesWritten=0x243d7e4*=0x27d2, lpOverlapped=0x0) returned 1 [0075.420] GetProcessHeap () returned 0x630000 [0075.420] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6739c0 | out: hHeap=0x630000) returned 1 [0075.420] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.420] WriteFile (in: hFile=0x230, lpBuffer=0x673988*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673988*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0075.421] CloseHandle (hObject=0x230) returned 1 [0075.422] GetProcessHeap () returned 0x630000 [0075.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f10 | out: hHeap=0x630000) returned 1 [0075.422] GetProcessHeap () returned 0x630000 [0075.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655670 | out: hHeap=0x630000) returned 1 [0075.422] GetProcessHeap () returned 0x630000 [0075.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673070 | out: hHeap=0x630000) returned 1 [0075.422] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\9oZ--Mep3WCZX2qSn.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\9oZ--Mep3WCZX2qSn.mkv") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\9oZ--Mep3WCZX2qSn.mkv" [0075.422] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\9oZ--Mep3WCZX2qSn.mkv", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\9oZ--Mep3WCZX2qSn.mkv.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\9oZ--Mep3WCZX2qSn.mkv.happythreechoose" [0075.422] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\9oZ--Mep3WCZX2qSn.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\304hyv_ge_j\\9oz--mep3wczx2qsn.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\9oZ--Mep3WCZX2qSn.mkv.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\304hyv_ge_j\\9oz--mep3wczx2qsn.mkv.happythreechoose"), dwFlags=0x1) returned 1 [0075.422] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\9oZ--Mep3WCZX2qSn.mkv" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J") returned 1 [0075.423] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\") returned="" [0075.423] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Decryption INFO.html" [0075.423] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\304hyv_ge_j\\decryption info.html")) returned 0xffffffff [0075.423] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\304hyv_ge_j\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0075.423] GetProcessHeap () returned 0x630000 [0075.423] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6556e8 [0075.423] GetProcessHeap () returned 0x630000 [0075.423] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6737e0 [0075.430] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.431] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.431] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.431] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.432] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.432] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.432] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.432] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.432] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.432] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.432] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.432] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.432] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.432] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.432] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.432] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.432] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.433] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.433] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.433] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.433] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.433] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.433] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.433] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.433] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.433] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.433] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.433] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.433] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.433] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.434] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.434] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.434] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.434] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.434] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.434] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.434] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.435] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.435] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.435] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.435] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.435] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.435] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.436] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.436] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.436] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.436] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.436] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.436] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.436] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.436] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.436] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.436] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.436] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.437] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.437] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.437] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.437] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.437] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.437] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.437] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.437] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.437] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.437] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.437] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.437] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.437] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.438] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.438] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.438] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.438] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.438] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.438] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.438] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.438] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.438] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.438] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.438] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.438] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.438] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.438] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.439] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.439] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.439] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.439] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.439] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.439] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.439] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.439] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.439] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.439] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.439] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.439] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.439] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.440] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.440] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.440] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.440] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.440] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.440] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.440] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.440] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.440] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.440] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.440] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.440] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.440] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.441] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.441] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.441] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.441] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.441] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.441] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.441] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.441] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.441] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.441] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.441] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.441] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.441] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.441] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.442] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.442] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.442] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.442] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.442] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.442] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.442] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.442] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.442] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.442] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.442] GetProcessHeap () returned 0x630000 [0075.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6556e8 | out: hHeap=0x630000) returned 1 [0075.442] GetProcessHeap () returned 0x630000 [0075.442] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6737e0 | out: hHeap=0x630000) returned 1 [0075.442] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0075.443] GetProcessHeap () returned 0x630000 [0075.443] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655850 [0075.443] GetProcessHeap () returned 0x630000 [0075.443] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672d40 [0075.449] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.449] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.450] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.450] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.450] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.450] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.450] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.450] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.450] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.450] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.450] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.450] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.450] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.450] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.450] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.451] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.451] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.451] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.451] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.451] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.451] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.451] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.451] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.451] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.451] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.451] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.451] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.452] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.452] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.452] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.452] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.452] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.452] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.452] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.452] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.452] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.453] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.453] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.453] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.453] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.453] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.453] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.453] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.453] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.453] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.453] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.453] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.453] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.453] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.453] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.454] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.454] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.454] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.454] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.454] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.454] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.454] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.454] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.454] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.454] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.454] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.454] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.454] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.455] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.455] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.455] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.455] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.455] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.455] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.455] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.455] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.455] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.455] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.455] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.455] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.455] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.455] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.456] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.456] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.456] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.456] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.456] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.456] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.456] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.456] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.456] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.456] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.456] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.456] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.457] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.457] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.457] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.457] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.457] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.457] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.457] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.457] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.457] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.457] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.457] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.457] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.457] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.457] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.458] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.458] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.458] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.458] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.458] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.458] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.458] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.458] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.458] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.458] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.458] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.458] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.458] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.459] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.459] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.459] GetProcessHeap () returned 0x630000 [0075.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655850 | out: hHeap=0x630000) returned 1 [0075.459] GetProcessHeap () returned 0x630000 [0075.459] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672d40 | out: hHeap=0x630000) returned 1 [0075.459] CloseHandle (hObject=0x230) returned 1 [0075.460] GetProcessHeap () returned 0x630000 [0075.460] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645c58 | out: hHeap=0x630000) returned 1 [0075.460] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd46645c0, ftCreationTime.dwHighDateTime=0x1d5d2ba, ftLastAccessTime.dwLowDateTime=0x870abea0, ftLastAccessTime.dwHighDateTime=0x1d5c9f0, ftLastWriteTime.dwLowDateTime=0x870abea0, ftLastWriteTime.dwHighDateTime=0x1d5c9f0, nFileSizeHigh=0x0, nFileSizeLow=0xd773, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BtVqPz-G.swf", cAlternateFileName="")) returned 1 [0075.460] lstrcmpiW (lpString1="BtVqPz-G.swf", lpString2=".") returned 1 [0075.460] lstrcmpiW (lpString1="BtVqPz-G.swf", lpString2="..") returned 1 [0075.460] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\", lpString2="BtVqPz-G.swf" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\BtVqPz-G.swf") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\BtVqPz-G.swf" [0075.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BtVqPz-G.swf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0075.460] GetProcessHeap () returned 0x630000 [0075.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd) returned 0x64c9f0 [0075.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BtVqPz-G.swf", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BtVqPz-G.swf", lpUsedDefaultChar=0x0) returned 13 [0075.460] lstrlenA (lpString="BtVqPz-G.swf") returned 12 [0075.460] lstrlenA (lpString=".happythreechoose") returned 17 [0075.460] lstrcmpiW (lpString1="BtVqPz-G.swf", lpString2="Decryption INFO.html") returned -1 [0075.460] lstrcmpiW (lpString1="BtVqPz-G.swf", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0075.460] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0075.460] lstrcmpiW (lpString1="BtVqPz-G.swf", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0075.460] GetProcessHeap () returned 0x630000 [0075.460] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0075.460] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\BtVqPz-G.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\304hyv_ge_j\\btvqpz-g.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0075.460] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=55155) returned 1 [0075.461] GetProcessHeap () returned 0x630000 [0075.461] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655850 [0075.461] GetProcessHeap () returned 0x630000 [0075.461] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673180 [0075.461] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\BtVqPz-G.swf") returned 59 [0075.461] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.461] GetProcessHeap () returned 0x630000 [0075.461] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0075.461] GetProcessHeap () returned 0x630000 [0075.461] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38d) returned 0x6739c0 [0075.461] lstrlenA (lpString="rsa_encrypt") returned 11 [0075.461] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x672cb8) returned 1 [0075.461] CryptGenRandom (in: hProv=0x672cb8, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0075.461] CryptReleaseContext (hProv=0x672cb8, dwFlags=0x0) returned 1 [0075.461] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0075.461] GetProcessHeap () returned 0x630000 [0075.461] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672d40 [0075.462] lstrlenA (lpString="010001") returned 6 [0075.462] GetProcessHeap () returned 0x630000 [0075.462] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2f8 [0075.462] GetProcessHeap () returned 0x630000 [0075.462] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672c30 [0075.462] GetProcessHeap () returned 0x630000 [0075.462] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e3d0 [0075.462] GetProcessHeap () returned 0x630000 [0075.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672c30 | out: hHeap=0x630000) returned 1 [0075.462] GetProcessHeap () returned 0x630000 [0075.462] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0075.462] GetProcessHeap () returned 0x630000 [0075.462] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x6570f8 [0075.462] GetProcessHeap () returned 0x630000 [0075.462] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a318 [0075.462] GetProcessHeap () returned 0x630000 [0075.462] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0075.462] GetProcessHeap () returned 0x630000 [0075.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.462] GetProcessHeap () returned 0x630000 [0075.462] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0075.462] GetProcessHeap () returned 0x630000 [0075.462] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672900 [0075.462] GetProcessHeap () returned 0x630000 [0075.462] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657670 [0075.462] GetProcessHeap () returned 0x630000 [0075.462] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.462] GetProcessHeap () returned 0x630000 [0075.462] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0075.462] GetProcessHeap () returned 0x630000 [0075.462] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e100 [0075.462] GetProcessHeap () returned 0x630000 [0075.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672900 | out: hHeap=0x630000) returned 1 [0075.462] GetProcessHeap () returned 0x630000 [0075.462] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0075.462] GetProcessHeap () returned 0x630000 [0075.462] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0075.462] GetProcessHeap () returned 0x630000 [0075.463] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.463] GetProcessHeap () returned 0x630000 [0075.463] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cf10 [0075.463] GetProcessHeap () returned 0x630000 [0075.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.463] GetProcessHeap () returned 0x630000 [0075.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.463] GetProcessHeap () returned 0x630000 [0075.463] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.463] GetProcessHeap () returned 0x630000 [0075.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.463] GetProcessHeap () returned 0x630000 [0075.463] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ea00 [0075.463] GetProcessHeap () returned 0x630000 [0075.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cf10 | out: hHeap=0x630000) returned 1 [0075.463] GetProcessHeap () returned 0x630000 [0075.463] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0075.463] GetProcessHeap () returned 0x630000 [0075.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0075.463] GetProcessHeap () returned 0x630000 [0075.463] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.463] GetProcessHeap () returned 0x630000 [0075.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.463] GetProcessHeap () returned 0x630000 [0075.463] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.463] GetProcessHeap () returned 0x630000 [0075.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.463] GetProcessHeap () returned 0x630000 [0075.463] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.463] GetProcessHeap () returned 0x630000 [0075.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.463] GetProcessHeap () returned 0x630000 [0075.463] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.463] GetProcessHeap () returned 0x630000 [0075.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.463] GetProcessHeap () returned 0x630000 [0075.463] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.463] GetProcessHeap () returned 0x630000 [0075.463] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.463] GetProcessHeap () returned 0x630000 [0075.464] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.464] GetProcessHeap () returned 0x630000 [0075.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.464] GetProcessHeap () returned 0x630000 [0075.464] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.464] GetProcessHeap () returned 0x630000 [0075.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.464] GetProcessHeap () returned 0x630000 [0075.464] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.464] GetProcessHeap () returned 0x630000 [0075.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.464] GetProcessHeap () returned 0x630000 [0075.464] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0075.464] GetProcessHeap () returned 0x630000 [0075.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0075.464] GetProcessHeap () returned 0x630000 [0075.464] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.464] GetProcessHeap () returned 0x630000 [0075.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.464] GetProcessHeap () returned 0x630000 [0075.464] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.464] GetProcessHeap () returned 0x630000 [0075.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.464] GetProcessHeap () returned 0x630000 [0075.464] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.464] GetProcessHeap () returned 0x630000 [0075.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.464] GetProcessHeap () returned 0x630000 [0075.464] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.464] GetProcessHeap () returned 0x630000 [0075.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.464] GetProcessHeap () returned 0x630000 [0075.464] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.464] GetProcessHeap () returned 0x630000 [0075.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.464] GetProcessHeap () returned 0x630000 [0075.464] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.464] GetProcessHeap () returned 0x630000 [0075.464] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.464] GetProcessHeap () returned 0x630000 [0075.465] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0075.465] GetProcessHeap () returned 0x630000 [0075.465] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0075.465] GetProcessHeap () returned 0x630000 [0075.465] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.465] GetProcessHeap () returned 0x630000 [0075.465] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.465] GetProcessHeap () returned 0x630000 [0075.465] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0075.465] GetProcessHeap () returned 0x630000 [0075.465] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0075.465] GetProcessHeap () returned 0x630000 [0075.465] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.465] GetProcessHeap () returned 0x630000 [0075.465] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.465] GetProcessHeap () returned 0x630000 [0075.465] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.465] GetProcessHeap () returned 0x630000 [0075.465] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.465] GetProcessHeap () returned 0x630000 [0075.465] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.465] GetProcessHeap () returned 0x630000 [0075.465] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.465] GetProcessHeap () returned 0x630000 [0075.465] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.465] GetProcessHeap () returned 0x630000 [0075.465] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.465] GetProcessHeap () returned 0x630000 [0075.465] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.465] GetProcessHeap () returned 0x630000 [0075.465] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.465] GetProcessHeap () returned 0x630000 [0075.465] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.465] GetProcessHeap () returned 0x630000 [0075.465] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.465] GetProcessHeap () returned 0x630000 [0075.465] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.465] GetProcessHeap () returned 0x630000 [0075.466] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.466] GetProcessHeap () returned 0x630000 [0075.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.466] GetProcessHeap () returned 0x630000 [0075.466] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.466] GetProcessHeap () returned 0x630000 [0075.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0075.466] GetProcessHeap () returned 0x630000 [0075.466] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0075.466] GetProcessHeap () returned 0x630000 [0075.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.466] GetProcessHeap () returned 0x630000 [0075.466] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.466] GetProcessHeap () returned 0x630000 [0075.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.466] GetProcessHeap () returned 0x630000 [0075.466] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.466] GetProcessHeap () returned 0x630000 [0075.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.466] GetProcessHeap () returned 0x630000 [0075.466] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.466] GetProcessHeap () returned 0x630000 [0075.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.466] GetProcessHeap () returned 0x630000 [0075.466] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.466] GetProcessHeap () returned 0x630000 [0075.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.466] GetProcessHeap () returned 0x630000 [0075.466] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.466] GetProcessHeap () returned 0x630000 [0075.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.466] GetProcessHeap () returned 0x630000 [0075.466] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.466] GetProcessHeap () returned 0x630000 [0075.466] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.466] GetProcessHeap () returned 0x630000 [0075.466] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.466] GetProcessHeap () returned 0x630000 [0075.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.467] GetProcessHeap () returned 0x630000 [0075.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.467] GetProcessHeap () returned 0x630000 [0075.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0075.467] GetProcessHeap () returned 0x630000 [0075.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0075.467] GetProcessHeap () returned 0x630000 [0075.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.467] GetProcessHeap () returned 0x630000 [0075.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.467] GetProcessHeap () returned 0x630000 [0075.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.467] GetProcessHeap () returned 0x630000 [0075.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.467] GetProcessHeap () returned 0x630000 [0075.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.467] GetProcessHeap () returned 0x630000 [0075.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.467] GetProcessHeap () returned 0x630000 [0075.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.467] GetProcessHeap () returned 0x630000 [0075.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.467] GetProcessHeap () returned 0x630000 [0075.467] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.467] GetProcessHeap () returned 0x630000 [0075.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.467] GetProcessHeap () returned 0x630000 [0075.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0075.467] GetProcessHeap () returned 0x630000 [0075.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0075.467] GetProcessHeap () returned 0x630000 [0075.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0075.467] GetProcessHeap () returned 0x630000 [0075.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0075.467] GetProcessHeap () returned 0x630000 [0075.467] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0075.468] GetProcessHeap () returned 0x630000 [0075.468] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0075.468] GetProcessHeap () returned 0x630000 [0075.468] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0075.468] GetProcessHeap () returned 0x630000 [0075.468] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0075.468] GetProcessHeap () returned 0x630000 [0075.502] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0075.502] GetProcessHeap () returned 0x630000 [0075.502] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.502] GetProcessHeap () returned 0x630000 [0075.503] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672d40 | out: hHeap=0x630000) returned 1 [0075.503] WriteFile (in: hFile=0x230, lpBuffer=0x6739c0*, nNumberOfBytesToWrite=0x38d, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6739c0*, lpNumberOfBytesWritten=0x243d864*=0x38d, lpOverlapped=0x0) returned 1 [0075.505] GetProcessHeap () returned 0x630000 [0075.505] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6739c0, Size=0x30) returned 0x6739c0 [0075.505] GetProcessHeap () returned 0x630000 [0075.505] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0075.505] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.505] GetProcessHeap () returned 0x630000 [0075.505] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd780) returned 0x6739f8 [0075.505] ReadFile (in: hFile=0x230, lpBuffer=0x6739f8, nNumberOfBytesToRead=0xd780, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x6739f8*, lpNumberOfBytesRead=0x243d7e8*=0xd780, lpOverlapped=0x0) returned 1 [0075.506] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.506] WriteFile (in: hFile=0x230, lpBuffer=0x6739f8*, nNumberOfBytesToWrite=0xd780, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x6739f8*, lpNumberOfBytesWritten=0x243d7e4*=0xd780, lpOverlapped=0x0) returned 1 [0075.507] GetProcessHeap () returned 0x630000 [0075.508] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6739f8 | out: hHeap=0x630000) returned 1 [0075.508] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.508] WriteFile (in: hFile=0x230, lpBuffer=0x6739c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6739c0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0075.509] CloseHandle (hObject=0x230) returned 1 [0075.509] GetProcessHeap () returned 0x630000 [0075.509] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0075.509] GetProcessHeap () returned 0x630000 [0075.509] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655850 | out: hHeap=0x630000) returned 1 [0075.509] GetProcessHeap () returned 0x630000 [0075.509] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673180 | out: hHeap=0x630000) returned 1 [0075.509] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\BtVqPz-G.swf" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\BtVqPz-G.swf") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\BtVqPz-G.swf" [0075.509] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\BtVqPz-G.swf", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\BtVqPz-G.swf.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\BtVqPz-G.swf.happythreechoose" [0075.509] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\BtVqPz-G.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\304hyv_ge_j\\btvqpz-g.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\BtVqPz-G.swf.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\304hyv_ge_j\\btvqpz-g.swf.happythreechoose"), dwFlags=0x1) returned 1 [0075.510] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\BtVqPz-G.swf" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J") returned 1 [0075.510] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\") returned="" [0075.510] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Decryption INFO.html" [0075.510] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\304hyv_ge_j\\decryption info.html")) returned 0x20 [0075.510] GetProcessHeap () returned 0x630000 [0075.510] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0075.510] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed8495f0, ftCreationTime.dwHighDateTime=0x1d5ca88, ftLastAccessTime.dwLowDateTime=0x83669990, ftLastAccessTime.dwHighDateTime=0x1d5c7f2, ftLastWriteTime.dwLowDateTime=0x83669990, ftLastWriteTime.dwHighDateTime=0x1d5c7f2, nFileSizeHigh=0x0, nFileSizeLow=0x588d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FkM2tsUA z9Nvp59r.swf", cAlternateFileName="FKM2TS~1.SWF")) returned 1 [0075.510] lstrcmpiW (lpString1="FkM2tsUA z9Nvp59r.swf", lpString2=".") returned 1 [0075.510] lstrcmpiW (lpString1="FkM2tsUA z9Nvp59r.swf", lpString2="..") returned 1 [0075.510] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\", lpString2="FkM2tsUA z9Nvp59r.swf" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\FkM2tsUA z9Nvp59r.swf") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\FkM2tsUA z9Nvp59r.swf" [0075.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FkM2tsUA z9Nvp59r.swf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0075.510] GetProcessHeap () returned 0x630000 [0075.510] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x645fd8 [0075.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FkM2tsUA z9Nvp59r.swf", cchWideChar=-1, lpMultiByteStr=0x645fd8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FkM2tsUA z9Nvp59r.swf", lpUsedDefaultChar=0x0) returned 22 [0075.511] lstrlenA (lpString="FkM2tsUA z9Nvp59r.swf") returned 21 [0075.511] lstrlenA (lpString=".happythreechoose") returned 17 [0075.511] lstrlenA (lpString=".happythreechoose") returned 17 [0075.511] lstrlenA (lpString="FkM2tsUA z9Nvp59r.swf") returned 21 [0075.511] lstrcmpiA (lpString1="tsUA z9Nvp59r.swf", lpString2=".happythreechoose") returned 1 [0075.511] lstrcmpiW (lpString1="FkM2tsUA z9Nvp59r.swf", lpString2="Decryption INFO.html") returned 1 [0075.511] lstrcmpiW (lpString1="FkM2tsUA z9Nvp59r.swf", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0075.511] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0075.511] lstrcmpiW (lpString1="FkM2tsUA z9Nvp59r.swf", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0075.511] GetProcessHeap () returned 0x630000 [0075.511] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0075.511] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\FkM2tsUA z9Nvp59r.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\304hyv_ge_j\\fkm2tsua z9nvp59r.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0075.511] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=22669) returned 1 [0075.511] GetProcessHeap () returned 0x630000 [0075.511] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655940 [0075.511] GetProcessHeap () returned 0x630000 [0075.511] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672c30 [0075.511] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\FkM2tsUA z9Nvp59r.swf") returned 68 [0075.511] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.511] GetProcessHeap () returned 0x630000 [0075.511] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0075.511] GetProcessHeap () returned 0x630000 [0075.511] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x383) returned 0x6739f8 [0075.511] lstrlenA (lpString="rsa_encrypt") returned 11 [0075.511] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x672fe8) returned 1 [0075.512] CryptGenRandom (in: hProv=0x672fe8, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0075.512] CryptReleaseContext (hProv=0x672fe8, dwFlags=0x0) returned 1 [0075.512] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0075.512] GetProcessHeap () returned 0x630000 [0075.512] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6736d0 [0075.512] lstrlenA (lpString="010001") returned 6 [0075.512] GetProcessHeap () returned 0x630000 [0075.512] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0075.512] GetProcessHeap () returned 0x630000 [0075.512] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673648 [0075.512] GetProcessHeap () returned 0x630000 [0075.512] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e730 [0075.512] GetProcessHeap () returned 0x630000 [0075.512] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673648 | out: hHeap=0x630000) returned 1 [0075.512] GetProcessHeap () returned 0x630000 [0075.512] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0075.512] GetProcessHeap () returned 0x630000 [0075.512] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656950 [0075.512] GetProcessHeap () returned 0x630000 [0075.512] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2b8 [0075.513] GetProcessHeap () returned 0x630000 [0075.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0075.513] GetProcessHeap () returned 0x630000 [0075.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0075.513] GetProcessHeap () returned 0x630000 [0075.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0075.513] GetProcessHeap () returned 0x630000 [0075.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673070 [0075.513] GetProcessHeap () returned 0x630000 [0075.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656fe0 [0075.513] GetProcessHeap () returned 0x630000 [0075.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.513] GetProcessHeap () returned 0x630000 [0075.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0075.513] GetProcessHeap () returned 0x630000 [0075.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea90 [0075.513] GetProcessHeap () returned 0x630000 [0075.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673070 | out: hHeap=0x630000) returned 1 [0075.513] GetProcessHeap () returned 0x630000 [0075.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0075.513] GetProcessHeap () returned 0x630000 [0075.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea90 | out: hHeap=0x630000) returned 1 [0075.513] GetProcessHeap () returned 0x630000 [0075.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0075.513] GetProcessHeap () returned 0x630000 [0075.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0075.513] GetProcessHeap () returned 0x630000 [0075.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.513] GetProcessHeap () returned 0x630000 [0075.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0075.513] GetProcessHeap () returned 0x630000 [0075.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.513] GetProcessHeap () returned 0x630000 [0075.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.513] GetProcessHeap () returned 0x630000 [0075.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e100 [0075.513] GetProcessHeap () returned 0x630000 [0075.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0075.513] GetProcessHeap () returned 0x630000 [0075.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0075.513] GetProcessHeap () returned 0x630000 [0075.513] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0075.513] GetProcessHeap () returned 0x630000 [0075.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0075.514] GetProcessHeap () returned 0x630000 [0075.514] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0075.514] GetProcessHeap () returned 0x630000 [0075.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.514] GetProcessHeap () returned 0x630000 [0075.514] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.514] GetProcessHeap () returned 0x630000 [0075.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0075.514] GetProcessHeap () returned 0x630000 [0075.514] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0075.514] GetProcessHeap () returned 0x630000 [0075.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.514] GetProcessHeap () returned 0x630000 [0075.514] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.514] GetProcessHeap () returned 0x630000 [0075.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.514] GetProcessHeap () returned 0x630000 [0075.514] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.514] GetProcessHeap () returned 0x630000 [0075.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.514] GetProcessHeap () returned 0x630000 [0075.514] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.514] GetProcessHeap () returned 0x630000 [0075.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.514] GetProcessHeap () returned 0x630000 [0075.514] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.514] GetProcessHeap () returned 0x630000 [0075.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.514] GetProcessHeap () returned 0x630000 [0075.514] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.514] GetProcessHeap () returned 0x630000 [0075.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.514] GetProcessHeap () returned 0x630000 [0075.514] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.514] GetProcessHeap () returned 0x630000 [0075.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.514] GetProcessHeap () returned 0x630000 [0075.514] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.515] GetProcessHeap () returned 0x630000 [0075.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.515] GetProcessHeap () returned 0x630000 [0075.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.515] GetProcessHeap () returned 0x630000 [0075.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.515] GetProcessHeap () returned 0x630000 [0075.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.515] GetProcessHeap () returned 0x630000 [0075.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.515] GetProcessHeap () returned 0x630000 [0075.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.515] GetProcessHeap () returned 0x630000 [0075.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.515] GetProcessHeap () returned 0x630000 [0075.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.515] GetProcessHeap () returned 0x630000 [0075.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.515] GetProcessHeap () returned 0x630000 [0075.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.515] GetProcessHeap () returned 0x630000 [0075.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.515] GetProcessHeap () returned 0x630000 [0075.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.515] GetProcessHeap () returned 0x630000 [0075.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.515] GetProcessHeap () returned 0x630000 [0075.515] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.515] GetProcessHeap () returned 0x630000 [0075.515] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.516] GetProcessHeap () returned 0x630000 [0075.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.516] GetProcessHeap () returned 0x630000 [0075.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.516] GetProcessHeap () returned 0x630000 [0075.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.516] GetProcessHeap () returned 0x630000 [0075.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.516] GetProcessHeap () returned 0x630000 [0075.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.516] GetProcessHeap () returned 0x630000 [0075.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.516] GetProcessHeap () returned 0x630000 [0075.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.516] GetProcessHeap () returned 0x630000 [0075.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.516] GetProcessHeap () returned 0x630000 [0075.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.516] GetProcessHeap () returned 0x630000 [0075.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.516] GetProcessHeap () returned 0x630000 [0075.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.516] GetProcessHeap () returned 0x630000 [0075.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.516] GetProcessHeap () returned 0x630000 [0075.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.516] GetProcessHeap () returned 0x630000 [0075.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.516] GetProcessHeap () returned 0x630000 [0075.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.516] GetProcessHeap () returned 0x630000 [0075.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.516] GetProcessHeap () returned 0x630000 [0075.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.517] GetProcessHeap () returned 0x630000 [0075.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.517] GetProcessHeap () returned 0x630000 [0075.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.517] GetProcessHeap () returned 0x630000 [0075.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0075.517] GetProcessHeap () returned 0x630000 [0075.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0075.517] GetProcessHeap () returned 0x630000 [0075.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.517] GetProcessHeap () returned 0x630000 [0075.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.517] GetProcessHeap () returned 0x630000 [0075.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.517] GetProcessHeap () returned 0x630000 [0075.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.517] GetProcessHeap () returned 0x630000 [0075.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.517] GetProcessHeap () returned 0x630000 [0075.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.517] GetProcessHeap () returned 0x630000 [0075.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.517] GetProcessHeap () returned 0x630000 [0075.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.517] GetProcessHeap () returned 0x630000 [0075.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.517] GetProcessHeap () returned 0x630000 [0075.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.517] GetProcessHeap () returned 0x630000 [0075.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.517] GetProcessHeap () returned 0x630000 [0075.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.517] GetProcessHeap () returned 0x630000 [0075.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.517] GetProcessHeap () returned 0x630000 [0075.517] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.518] GetProcessHeap () returned 0x630000 [0075.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.518] GetProcessHeap () returned 0x630000 [0075.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.518] GetProcessHeap () returned 0x630000 [0075.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0075.518] GetProcessHeap () returned 0x630000 [0075.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0075.518] GetProcessHeap () returned 0x630000 [0075.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.518] GetProcessHeap () returned 0x630000 [0075.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.518] GetProcessHeap () returned 0x630000 [0075.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.518] GetProcessHeap () returned 0x630000 [0075.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.518] GetProcessHeap () returned 0x630000 [0075.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0075.518] GetProcessHeap () returned 0x630000 [0075.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0075.518] GetProcessHeap () returned 0x630000 [0075.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.518] GetProcessHeap () returned 0x630000 [0075.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.518] GetProcessHeap () returned 0x630000 [0075.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0075.518] GetProcessHeap () returned 0x630000 [0075.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0075.518] GetProcessHeap () returned 0x630000 [0075.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0075.518] GetProcessHeap () returned 0x630000 [0075.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0075.518] GetProcessHeap () returned 0x630000 [0075.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0075.518] GetProcessHeap () returned 0x630000 [0075.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0075.518] GetProcessHeap () returned 0x630000 [0075.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0075.519] GetProcessHeap () returned 0x630000 [0075.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0075.519] GetProcessHeap () returned 0x630000 [0075.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0075.519] GetProcessHeap () returned 0x630000 [0075.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0075.519] GetProcessHeap () returned 0x630000 [0075.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6736d0 | out: hHeap=0x630000) returned 1 [0075.519] WriteFile (in: hFile=0x230, lpBuffer=0x6739f8*, nNumberOfBytesToWrite=0x383, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6739f8*, lpNumberOfBytesWritten=0x243d864*=0x383, lpOverlapped=0x0) returned 1 [0075.520] GetProcessHeap () returned 0x630000 [0075.520] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6739f8, Size=0x30) returned 0x6739f8 [0075.520] GetProcessHeap () returned 0x630000 [0075.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0075.520] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.521] GetProcessHeap () returned 0x630000 [0075.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5890) returned 0x673a30 [0075.521] ReadFile (in: hFile=0x230, lpBuffer=0x673a30, nNumberOfBytesToRead=0x5890, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x673a30*, lpNumberOfBytesRead=0x243d7e8*=0x5890, lpOverlapped=0x0) returned 1 [0075.521] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.521] WriteFile (in: hFile=0x230, lpBuffer=0x673a30*, nNumberOfBytesToWrite=0x5890, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x673a30*, lpNumberOfBytesWritten=0x243d7e4*=0x5890, lpOverlapped=0x0) returned 1 [0075.522] GetProcessHeap () returned 0x630000 [0075.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673a30 | out: hHeap=0x630000) returned 1 [0075.523] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.523] WriteFile (in: hFile=0x230, lpBuffer=0x6739f8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6739f8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0075.524] CloseHandle (hObject=0x230) returned 1 [0075.525] GetProcessHeap () returned 0x630000 [0075.525] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0075.525] GetProcessHeap () returned 0x630000 [0075.525] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655940 | out: hHeap=0x630000) returned 1 [0075.525] GetProcessHeap () returned 0x630000 [0075.525] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672c30 | out: hHeap=0x630000) returned 1 [0075.525] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\FkM2tsUA z9Nvp59r.swf" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\FkM2tsUA z9Nvp59r.swf") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\FkM2tsUA z9Nvp59r.swf" [0075.525] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\FkM2tsUA z9Nvp59r.swf", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\FkM2tsUA z9Nvp59r.swf.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\FkM2tsUA z9Nvp59r.swf.happythreechoose" [0075.525] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\FkM2tsUA z9Nvp59r.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\304hyv_ge_j\\fkm2tsua z9nvp59r.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\FkM2tsUA z9Nvp59r.swf.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\304hyv_ge_j\\fkm2tsua z9nvp59r.swf.happythreechoose"), dwFlags=0x1) returned 1 [0075.525] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\FkM2tsUA z9Nvp59r.swf" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J") returned 1 [0075.525] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\") returned="" [0075.526] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Decryption INFO.html" [0075.526] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\304hyv_ge_j\\decryption info.html")) returned 0x20 [0075.526] GetProcessHeap () returned 0x630000 [0075.526] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645fd8 | out: hHeap=0x630000) returned 1 [0075.526] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19894fc0, ftCreationTime.dwHighDateTime=0x1d5cbeb, ftLastAccessTime.dwLowDateTime=0x52047550, ftLastAccessTime.dwHighDateTime=0x1d5cc0e, ftLastWriteTime.dwLowDateTime=0x52047550, ftLastWriteTime.dwHighDateTime=0x1d5cc0e, nFileSizeHigh=0x0, nFileSizeLow=0x4a20, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jFv7.png", cAlternateFileName="")) returned 1 [0075.526] lstrcmpiW (lpString1="jFv7.png", lpString2=".") returned 1 [0075.526] lstrcmpiW (lpString1="jFv7.png", lpString2="..") returned 1 [0075.526] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\", lpString2="jFv7.png" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\jFv7.png") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\jFv7.png" [0075.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="jFv7.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0075.526] GetProcessHeap () returned 0x630000 [0075.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9) returned 0x64c9f0 [0075.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="jFv7.png", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jFv7.png", lpUsedDefaultChar=0x0) returned 9 [0075.526] lstrlenA (lpString="jFv7.png") returned 8 [0075.526] lstrlenA (lpString=".happythreechoose") returned 17 [0075.526] lstrcmpiW (lpString1="jFv7.png", lpString2="Decryption INFO.html") returned 1 [0075.526] lstrcmpiW (lpString1="jFv7.png", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0075.526] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0075.526] lstrcmpiW (lpString1="jFv7.png", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0075.526] GetProcessHeap () returned 0x630000 [0075.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x652000 [0075.526] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\jFv7.png" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\304hyv_ge_j\\jfv7.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0075.526] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=18976) returned 1 [0075.526] GetProcessHeap () returned 0x630000 [0075.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655850 [0075.526] GetProcessHeap () returned 0x630000 [0075.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672988 [0075.526] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\jFv7.png") returned 55 [0075.526] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.527] GetProcessHeap () returned 0x630000 [0075.527] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0075.527] GetProcessHeap () returned 0x630000 [0075.527] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x673a30 [0075.528] lstrlenA (lpString="rsa_encrypt") returned 11 [0075.528] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x672ed8) returned 1 [0075.528] CryptGenRandom (in: hProv=0x672ed8, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0075.528] CryptReleaseContext (hProv=0x672ed8, dwFlags=0x0) returned 1 [0075.528] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0075.528] GetProcessHeap () returned 0x630000 [0075.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6735c0 [0075.528] lstrlenA (lpString="010001") returned 6 [0075.528] GetProcessHeap () returned 0x630000 [0075.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a348 [0075.528] GetProcessHeap () returned 0x630000 [0075.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673208 [0075.528] GetProcessHeap () returned 0x630000 [0075.528] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e3d0 [0075.528] GetProcessHeap () returned 0x630000 [0075.528] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673208 | out: hHeap=0x630000) returned 1 [0075.529] GetProcessHeap () returned 0x630000 [0075.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e7c0 [0075.529] GetProcessHeap () returned 0x630000 [0075.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657210 [0075.529] GetProcessHeap () returned 0x630000 [0075.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0075.529] GetProcessHeap () returned 0x630000 [0075.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0075.529] GetProcessHeap () returned 0x630000 [0075.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.529] GetProcessHeap () returned 0x630000 [0075.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0075.529] GetProcessHeap () returned 0x630000 [0075.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673208 [0075.529] GetProcessHeap () returned 0x630000 [0075.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656db0 [0075.529] GetProcessHeap () returned 0x630000 [0075.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.529] GetProcessHeap () returned 0x630000 [0075.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0075.529] GetProcessHeap () returned 0x630000 [0075.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e460 [0075.529] GetProcessHeap () returned 0x630000 [0075.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673208 | out: hHeap=0x630000) returned 1 [0075.529] GetProcessHeap () returned 0x630000 [0075.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0075.529] GetProcessHeap () returned 0x630000 [0075.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e460 | out: hHeap=0x630000) returned 1 [0075.529] GetProcessHeap () returned 0x630000 [0075.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.529] GetProcessHeap () returned 0x630000 [0075.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65ce80 [0075.529] GetProcessHeap () returned 0x630000 [0075.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.529] GetProcessHeap () returned 0x630000 [0075.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.529] GetProcessHeap () returned 0x630000 [0075.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0075.529] GetProcessHeap () returned 0x630000 [0075.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0075.529] GetProcessHeap () returned 0x630000 [0075.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65dfe0 [0075.529] GetProcessHeap () returned 0x630000 [0075.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ce80 | out: hHeap=0x630000) returned 1 [0075.530] GetProcessHeap () returned 0x630000 [0075.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0075.530] GetProcessHeap () returned 0x630000 [0075.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0075.530] GetProcessHeap () returned 0x630000 [0075.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0075.530] GetProcessHeap () returned 0x630000 [0075.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0075.530] GetProcessHeap () returned 0x630000 [0075.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.530] GetProcessHeap () returned 0x630000 [0075.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.530] GetProcessHeap () returned 0x630000 [0075.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.530] GetProcessHeap () returned 0x630000 [0075.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.530] GetProcessHeap () returned 0x630000 [0075.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.530] GetProcessHeap () returned 0x630000 [0075.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.530] GetProcessHeap () returned 0x630000 [0075.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.530] GetProcessHeap () returned 0x630000 [0075.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.530] GetProcessHeap () returned 0x630000 [0075.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.530] GetProcessHeap () returned 0x630000 [0075.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.530] GetProcessHeap () returned 0x630000 [0075.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.530] GetProcessHeap () returned 0x630000 [0075.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.530] GetProcessHeap () returned 0x630000 [0075.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.530] GetProcessHeap () returned 0x630000 [0075.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.530] GetProcessHeap () returned 0x630000 [0075.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.531] GetProcessHeap () returned 0x630000 [0075.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.531] GetProcessHeap () returned 0x630000 [0075.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0075.531] GetProcessHeap () returned 0x630000 [0075.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0075.531] GetProcessHeap () returned 0x630000 [0075.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.531] GetProcessHeap () returned 0x630000 [0075.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.531] GetProcessHeap () returned 0x630000 [0075.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.531] GetProcessHeap () returned 0x630000 [0075.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.531] GetProcessHeap () returned 0x630000 [0075.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.531] GetProcessHeap () returned 0x630000 [0075.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.531] GetProcessHeap () returned 0x630000 [0075.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.531] GetProcessHeap () returned 0x630000 [0075.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.531] GetProcessHeap () returned 0x630000 [0075.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.531] GetProcessHeap () returned 0x630000 [0075.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.531] GetProcessHeap () returned 0x630000 [0075.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.531] GetProcessHeap () returned 0x630000 [0075.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.531] GetProcessHeap () returned 0x630000 [0075.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0075.531] GetProcessHeap () returned 0x630000 [0075.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0075.531] GetProcessHeap () returned 0x630000 [0075.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.531] GetProcessHeap () returned 0x630000 [0075.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.531] GetProcessHeap () returned 0x630000 [0075.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.532] GetProcessHeap () returned 0x630000 [0075.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.532] GetProcessHeap () returned 0x630000 [0075.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.532] GetProcessHeap () returned 0x630000 [0075.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.532] GetProcessHeap () returned 0x630000 [0075.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.532] GetProcessHeap () returned 0x630000 [0075.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.532] GetProcessHeap () returned 0x630000 [0075.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.532] GetProcessHeap () returned 0x630000 [0075.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.532] GetProcessHeap () returned 0x630000 [0075.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0075.532] GetProcessHeap () returned 0x630000 [0075.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0075.532] GetProcessHeap () returned 0x630000 [0075.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.532] GetProcessHeap () returned 0x630000 [0075.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.532] GetProcessHeap () returned 0x630000 [0075.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.532] GetProcessHeap () returned 0x630000 [0075.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.532] GetProcessHeap () returned 0x630000 [0075.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.532] GetProcessHeap () returned 0x630000 [0075.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.532] GetProcessHeap () returned 0x630000 [0075.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.532] GetProcessHeap () returned 0x630000 [0075.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.532] GetProcessHeap () returned 0x630000 [0075.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0075.532] GetProcessHeap () returned 0x630000 [0075.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0075.532] GetProcessHeap () returned 0x630000 [0075.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.533] GetProcessHeap () returned 0x630000 [0075.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.533] GetProcessHeap () returned 0x630000 [0075.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.533] GetProcessHeap () returned 0x630000 [0075.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.533] GetProcessHeap () returned 0x630000 [0075.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0075.533] GetProcessHeap () returned 0x630000 [0075.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0075.533] GetProcessHeap () returned 0x630000 [0075.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.533] GetProcessHeap () returned 0x630000 [0075.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.533] GetProcessHeap () returned 0x630000 [0075.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0075.533] GetProcessHeap () returned 0x630000 [0075.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0075.533] GetProcessHeap () returned 0x630000 [0075.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0075.533] GetProcessHeap () returned 0x630000 [0075.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0075.533] GetProcessHeap () returned 0x630000 [0075.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.533] GetProcessHeap () returned 0x630000 [0075.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.533] GetProcessHeap () returned 0x630000 [0075.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.533] GetProcessHeap () returned 0x630000 [0075.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.533] GetProcessHeap () returned 0x630000 [0075.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.533] GetProcessHeap () returned 0x630000 [0075.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.533] GetProcessHeap () returned 0x630000 [0075.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.533] GetProcessHeap () returned 0x630000 [0075.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.533] GetProcessHeap () returned 0x630000 [0075.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.534] GetProcessHeap () returned 0x630000 [0075.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.534] GetProcessHeap () returned 0x630000 [0075.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.534] GetProcessHeap () returned 0x630000 [0075.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.534] GetProcessHeap () returned 0x630000 [0075.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.534] GetProcessHeap () returned 0x630000 [0075.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.534] GetProcessHeap () returned 0x630000 [0075.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0075.534] GetProcessHeap () returned 0x630000 [0075.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0075.534] GetProcessHeap () returned 0x630000 [0075.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0075.534] GetProcessHeap () returned 0x630000 [0075.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0075.534] GetProcessHeap () returned 0x630000 [0075.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0075.534] GetProcessHeap () returned 0x630000 [0075.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e7c0 | out: hHeap=0x630000) returned 1 [0075.534] GetProcessHeap () returned 0x630000 [0075.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0075.534] GetProcessHeap () returned 0x630000 [0075.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0075.534] GetProcessHeap () returned 0x630000 [0075.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0075.534] GetProcessHeap () returned 0x630000 [0075.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0075.534] GetProcessHeap () returned 0x630000 [0075.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6735c0 | out: hHeap=0x630000) returned 1 [0075.534] WriteFile (in: hFile=0x230, lpBuffer=0x673a30*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673a30*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0075.536] GetProcessHeap () returned 0x630000 [0075.536] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x673a30, Size=0x30) returned 0x673a30 [0075.536] GetProcessHeap () returned 0x630000 [0075.536] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0075.536] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.536] GetProcessHeap () returned 0x630000 [0075.536] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4a20) returned 0x673a68 [0075.536] ReadFile (in: hFile=0x230, lpBuffer=0x673a68, nNumberOfBytesToRead=0x4a20, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x673a68*, lpNumberOfBytesRead=0x243d7e8*=0x4a20, lpOverlapped=0x0) returned 1 [0075.537] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.537] WriteFile (in: hFile=0x230, lpBuffer=0x673a68*, nNumberOfBytesToWrite=0x4a20, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x673a68*, lpNumberOfBytesWritten=0x243d7e4*=0x4a20, lpOverlapped=0x0) returned 1 [0075.538] GetProcessHeap () returned 0x630000 [0075.538] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673a68 | out: hHeap=0x630000) returned 1 [0075.538] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.538] WriteFile (in: hFile=0x230, lpBuffer=0x673a30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673a30*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0075.539] CloseHandle (hObject=0x230) returned 1 [0075.539] GetProcessHeap () returned 0x630000 [0075.539] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x652000 | out: hHeap=0x630000) returned 1 [0075.539] GetProcessHeap () returned 0x630000 [0075.539] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655850 | out: hHeap=0x630000) returned 1 [0075.539] GetProcessHeap () returned 0x630000 [0075.539] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672988 | out: hHeap=0x630000) returned 1 [0075.539] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\jFv7.png" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\jFv7.png") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\jFv7.png" [0075.539] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\jFv7.png", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\jFv7.png.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\jFv7.png.happythreechoose" [0075.540] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\jFv7.png" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\304hyv_ge_j\\jfv7.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\jFv7.png.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\304hyv_ge_j\\jfv7.png.happythreechoose"), dwFlags=0x1) returned 1 [0075.540] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\jFv7.png" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J") returned 1 [0075.540] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\") returned="" [0075.540] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Decryption INFO.html" [0075.540] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\304hyv_ge_j\\decryption info.html")) returned 0x20 [0075.540] GetProcessHeap () returned 0x630000 [0075.540] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0075.540] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x684979b0, ftCreationTime.dwHighDateTime=0x1d5d275, ftLastAccessTime.dwLowDateTime=0xd9474630, ftLastAccessTime.dwHighDateTime=0x1d5c9b8, ftLastWriteTime.dwLowDateTime=0xd9474630, ftLastWriteTime.dwHighDateTime=0x1d5c9b8, nFileSizeHigh=0x0, nFileSizeLow=0xf5be, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MU0pjasqJIWUlQ8qIz8.doc", cAlternateFileName="MU0PJA~1.DOC")) returned 1 [0075.540] lstrcmpiW (lpString1="MU0pjasqJIWUlQ8qIz8.doc", lpString2=".") returned 1 [0075.540] lstrcmpiW (lpString1="MU0pjasqJIWUlQ8qIz8.doc", lpString2="..") returned 1 [0075.540] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\", lpString2="MU0pjasqJIWUlQ8qIz8.doc" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\MU0pjasqJIWUlQ8qIz8.doc") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\MU0pjasqJIWUlQ8qIz8.doc" [0075.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MU0pjasqJIWUlQ8qIz8.doc", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0075.541] GetProcessHeap () returned 0x630000 [0075.541] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18) returned 0x645cd8 [0075.541] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MU0pjasqJIWUlQ8qIz8.doc", cchWideChar=-1, lpMultiByteStr=0x645cd8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MU0pjasqJIWUlQ8qIz8.doc", lpUsedDefaultChar=0x0) returned 24 [0075.541] lstrlenA (lpString="MU0pjasqJIWUlQ8qIz8.doc") returned 23 [0075.541] lstrlenA (lpString=".happythreechoose") returned 17 [0075.541] lstrlenA (lpString=".happythreechoose") returned 17 [0075.541] lstrlenA (lpString="MU0pjasqJIWUlQ8qIz8.doc") returned 23 [0075.541] lstrcmpiA (lpString1="sqJIWUlQ8qIz8.doc", lpString2=".happythreechoose") returned 1 [0075.541] lstrcmpiW (lpString1="MU0pjasqJIWUlQ8qIz8.doc", lpString2="Decryption INFO.html") returned 1 [0075.541] lstrcmpiW (lpString1="MU0pjasqJIWUlQ8qIz8.doc", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0075.541] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0075.541] lstrcmpiW (lpString1="MU0pjasqJIWUlQ8qIz8.doc", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0075.541] GetProcessHeap () returned 0x630000 [0075.541] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0075.541] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\MU0pjasqJIWUlQ8qIz8.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\304hyv_ge_j\\mu0pjasqjiwulq8qiz8.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0075.541] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=62910) returned 1 [0075.541] GetProcessHeap () returned 0x630000 [0075.541] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6558c8 [0075.541] GetProcessHeap () returned 0x630000 [0075.541] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673290 [0075.541] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\MU0pjasqJIWUlQ8qIz8.doc") returned 70 [0075.541] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.541] GetProcessHeap () returned 0x630000 [0075.541] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0075.541] GetProcessHeap () returned 0x630000 [0075.541] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x673a68 [0075.541] lstrlenA (lpString="rsa_encrypt") returned 11 [0075.541] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x672988) returned 1 [0075.542] CryptGenRandom (in: hProv=0x672988, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0075.542] CryptReleaseContext (hProv=0x672988, dwFlags=0x0) returned 1 [0075.542] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0075.542] GetProcessHeap () returned 0x630000 [0075.542] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673538 [0075.542] lstrlenA (lpString="010001") returned 6 [0075.542] GetProcessHeap () returned 0x630000 [0075.542] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2f8 [0075.542] GetProcessHeap () returned 0x630000 [0075.542] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6736d0 [0075.542] GetProcessHeap () returned 0x630000 [0075.542] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0075.542] GetProcessHeap () returned 0x630000 [0075.542] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6736d0 | out: hHeap=0x630000) returned 1 [0075.542] GetProcessHeap () returned 0x630000 [0075.542] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0075.542] GetProcessHeap () returned 0x630000 [0075.542] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656c98 [0075.542] GetProcessHeap () returned 0x630000 [0075.542] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0075.542] GetProcessHeap () returned 0x630000 [0075.542] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0075.543] GetProcessHeap () returned 0x630000 [0075.543] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.543] GetProcessHeap () returned 0x630000 [0075.543] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0075.543] GetProcessHeap () returned 0x630000 [0075.543] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6736d0 [0075.543] GetProcessHeap () returned 0x630000 [0075.543] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656950 [0075.543] GetProcessHeap () returned 0x630000 [0075.543] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.543] GetProcessHeap () returned 0x630000 [0075.543] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0075.543] GetProcessHeap () returned 0x630000 [0075.543] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ebb0 [0075.543] GetProcessHeap () returned 0x630000 [0075.543] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6736d0 | out: hHeap=0x630000) returned 1 [0075.543] GetProcessHeap () returned 0x630000 [0075.543] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0075.543] GetProcessHeap () returned 0x630000 [0075.543] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0075.543] GetProcessHeap () returned 0x630000 [0075.543] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.543] GetProcessHeap () returned 0x630000 [0075.543] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0075.543] GetProcessHeap () returned 0x630000 [0075.543] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.543] GetProcessHeap () returned 0x630000 [0075.543] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.543] GetProcessHeap () returned 0x630000 [0075.543] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.543] GetProcessHeap () returned 0x630000 [0075.543] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.543] GetProcessHeap () returned 0x630000 [0075.543] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e070 [0075.543] GetProcessHeap () returned 0x630000 [0075.543] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0075.543] GetProcessHeap () returned 0x630000 [0075.543] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0075.543] GetProcessHeap () returned 0x630000 [0075.543] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0075.543] GetProcessHeap () returned 0x630000 [0075.543] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.544] GetProcessHeap () returned 0x630000 [0075.544] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.544] GetProcessHeap () returned 0x630000 [0075.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.544] GetProcessHeap () returned 0x630000 [0075.544] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.544] GetProcessHeap () returned 0x630000 [0075.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.544] GetProcessHeap () returned 0x630000 [0075.544] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.544] GetProcessHeap () returned 0x630000 [0075.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.544] GetProcessHeap () returned 0x630000 [0075.544] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.544] GetProcessHeap () returned 0x630000 [0075.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.544] GetProcessHeap () returned 0x630000 [0075.544] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.544] GetProcessHeap () returned 0x630000 [0075.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.544] GetProcessHeap () returned 0x630000 [0075.544] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.544] GetProcessHeap () returned 0x630000 [0075.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.544] GetProcessHeap () returned 0x630000 [0075.544] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.544] GetProcessHeap () returned 0x630000 [0075.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.544] GetProcessHeap () returned 0x630000 [0075.544] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.544] GetProcessHeap () returned 0x630000 [0075.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.544] GetProcessHeap () returned 0x630000 [0075.544] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.544] GetProcessHeap () returned 0x630000 [0075.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.544] GetProcessHeap () returned 0x630000 [0075.544] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.544] GetProcessHeap () returned 0x630000 [0075.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0075.544] GetProcessHeap () returned 0x630000 [0075.545] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0075.545] GetProcessHeap () returned 0x630000 [0075.545] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.545] GetProcessHeap () returned 0x630000 [0075.545] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.545] GetProcessHeap () returned 0x630000 [0075.545] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.545] GetProcessHeap () returned 0x630000 [0075.545] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.545] GetProcessHeap () returned 0x630000 [0075.545] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.545] GetProcessHeap () returned 0x630000 [0075.545] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.545] GetProcessHeap () returned 0x630000 [0075.545] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.545] GetProcessHeap () returned 0x630000 [0075.545] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.545] GetProcessHeap () returned 0x630000 [0075.545] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.545] GetProcessHeap () returned 0x630000 [0075.545] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.545] GetProcessHeap () returned 0x630000 [0075.545] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.545] GetProcessHeap () returned 0x630000 [0075.545] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.545] GetProcessHeap () returned 0x630000 [0075.545] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0075.545] GetProcessHeap () returned 0x630000 [0075.545] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0075.545] GetProcessHeap () returned 0x630000 [0075.545] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.545] GetProcessHeap () returned 0x630000 [0075.545] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.545] GetProcessHeap () returned 0x630000 [0075.545] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.545] GetProcessHeap () returned 0x630000 [0075.545] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.545] GetProcessHeap () returned 0x630000 [0075.545] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.546] GetProcessHeap () returned 0x630000 [0075.546] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.546] GetProcessHeap () returned 0x630000 [0075.546] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.546] GetProcessHeap () returned 0x630000 [0075.546] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.546] GetProcessHeap () returned 0x630000 [0075.546] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.546] GetProcessHeap () returned 0x630000 [0075.546] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.546] GetProcessHeap () returned 0x630000 [0075.546] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.546] GetProcessHeap () returned 0x630000 [0075.546] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.546] GetProcessHeap () returned 0x630000 [0075.546] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.546] GetProcessHeap () returned 0x630000 [0075.546] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.546] GetProcessHeap () returned 0x630000 [0075.546] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.546] GetProcessHeap () returned 0x630000 [0075.546] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.546] GetProcessHeap () returned 0x630000 [0075.546] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.546] GetProcessHeap () returned 0x630000 [0075.547] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.547] GetProcessHeap () returned 0x630000 [0075.547] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.547] GetProcessHeap () returned 0x630000 [0075.547] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.547] GetProcessHeap () returned 0x630000 [0075.547] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.547] GetProcessHeap () returned 0x630000 [0075.547] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.547] GetProcessHeap () returned 0x630000 [0075.547] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.547] GetProcessHeap () returned 0x630000 [0075.547] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.547] GetProcessHeap () returned 0x630000 [0075.547] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.547] GetProcessHeap () returned 0x630000 [0075.547] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.547] GetProcessHeap () returned 0x630000 [0075.547] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.547] GetProcessHeap () returned 0x630000 [0075.547] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.547] GetProcessHeap () returned 0x630000 [0075.547] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0075.547] GetProcessHeap () returned 0x630000 [0075.547] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0075.547] GetProcessHeap () returned 0x630000 [0075.547] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.547] GetProcessHeap () returned 0x630000 [0075.547] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.547] GetProcessHeap () returned 0x630000 [0075.547] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.547] GetProcessHeap () returned 0x630000 [0075.547] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.547] GetProcessHeap () returned 0x630000 [0075.547] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.547] GetProcessHeap () returned 0x630000 [0075.547] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.547] GetProcessHeap () returned 0x630000 [0075.547] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.548] GetProcessHeap () returned 0x630000 [0075.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.548] GetProcessHeap () returned 0x630000 [0075.548] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.548] GetProcessHeap () returned 0x630000 [0075.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.548] GetProcessHeap () returned 0x630000 [0075.548] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.548] GetProcessHeap () returned 0x630000 [0075.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.548] GetProcessHeap () returned 0x630000 [0075.548] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0075.548] GetProcessHeap () returned 0x630000 [0075.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0075.548] GetProcessHeap () returned 0x630000 [0075.548] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0075.548] GetProcessHeap () returned 0x630000 [0075.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0075.548] GetProcessHeap () returned 0x630000 [0075.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0075.548] GetProcessHeap () returned 0x630000 [0075.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0075.548] GetProcessHeap () returned 0x630000 [0075.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0075.548] GetProcessHeap () returned 0x630000 [0075.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0075.548] GetProcessHeap () returned 0x630000 [0075.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0075.548] GetProcessHeap () returned 0x630000 [0075.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0075.548] GetProcessHeap () returned 0x630000 [0075.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0075.548] GetProcessHeap () returned 0x630000 [0075.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0075.548] GetProcessHeap () returned 0x630000 [0075.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0075.548] GetProcessHeap () returned 0x630000 [0075.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.549] GetProcessHeap () returned 0x630000 [0075.549] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673538 | out: hHeap=0x630000) returned 1 [0075.549] WriteFile (in: hFile=0x230, lpBuffer=0x673a68*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673a68*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0075.550] GetProcessHeap () returned 0x630000 [0075.550] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x673a68, Size=0x30) returned 0x673a68 [0075.550] GetProcessHeap () returned 0x630000 [0075.550] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0075.550] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.551] GetProcessHeap () returned 0x630000 [0075.551] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf5be) returned 0x673aa0 [0075.551] ReadFile (in: hFile=0x230, lpBuffer=0x673aa0, nNumberOfBytesToRead=0xf5be, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x673aa0*, lpNumberOfBytesRead=0x243d7e8*=0xf5be, lpOverlapped=0x0) returned 1 [0075.552] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.552] WriteFile (in: hFile=0x230, lpBuffer=0x673aa0*, nNumberOfBytesToWrite=0xf5be, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x673aa0*, lpNumberOfBytesWritten=0x243d7e4*=0xf5be, lpOverlapped=0x0) returned 1 [0075.553] GetProcessHeap () returned 0x630000 [0075.553] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673aa0 | out: hHeap=0x630000) returned 1 [0075.554] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.554] WriteFile (in: hFile=0x230, lpBuffer=0x673a68*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673a68*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0075.555] CloseHandle (hObject=0x230) returned 1 [0075.556] GetProcessHeap () returned 0x630000 [0075.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0075.556] GetProcessHeap () returned 0x630000 [0075.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6558c8 | out: hHeap=0x630000) returned 1 [0075.556] GetProcessHeap () returned 0x630000 [0075.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673290 | out: hHeap=0x630000) returned 1 [0075.556] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\MU0pjasqJIWUlQ8qIz8.doc" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\MU0pjasqJIWUlQ8qIz8.doc") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\MU0pjasqJIWUlQ8qIz8.doc" [0075.556] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\MU0pjasqJIWUlQ8qIz8.doc", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\MU0pjasqJIWUlQ8qIz8.doc.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\MU0pjasqJIWUlQ8qIz8.doc.happythreechoose" [0075.556] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\MU0pjasqJIWUlQ8qIz8.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\304hyv_ge_j\\mu0pjasqjiwulq8qiz8.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\MU0pjasqJIWUlQ8qIz8.doc.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\304hyv_ge_j\\mu0pjasqjiwulq8qiz8.doc.happythreechoose"), dwFlags=0x1) returned 1 [0075.557] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\MU0pjasqJIWUlQ8qIz8.doc" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J") returned 1 [0075.557] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\") returned="" [0075.557] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Decryption INFO.html" [0075.557] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\304hyv_ge_j\\decryption info.html")) returned 0x20 [0075.557] GetProcessHeap () returned 0x630000 [0075.557] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645cd8 | out: hHeap=0x630000) returned 1 [0075.557] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8341990, ftCreationTime.dwHighDateTime=0x1d5d0c5, ftLastAccessTime.dwLowDateTime=0x1cacb080, ftLastAccessTime.dwHighDateTime=0x1d5c861, ftLastWriteTime.dwLowDateTime=0x1cacb080, ftLastWriteTime.dwHighDateTime=0x1d5c861, nFileSizeHigh=0x0, nFileSizeLow=0x6b6c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ofRIy5.doc", cAlternateFileName="")) returned 1 [0075.557] lstrcmpiW (lpString1="ofRIy5.doc", lpString2=".") returned 1 [0075.557] lstrcmpiW (lpString1="ofRIy5.doc", lpString2="..") returned 1 [0075.557] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\", lpString2="ofRIy5.doc" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\ofRIy5.doc") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\ofRIy5.doc" [0075.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ofRIy5.doc", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0075.557] GetProcessHeap () returned 0x630000 [0075.557] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb) returned 0x64c9f0 [0075.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ofRIy5.doc", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ofRIy5.doc", lpUsedDefaultChar=0x0) returned 11 [0075.557] lstrlenA (lpString="ofRIy5.doc") returned 10 [0075.557] lstrlenA (lpString=".happythreechoose") returned 17 [0075.557] lstrcmpiW (lpString1="ofRIy5.doc", lpString2="Decryption INFO.html") returned 1 [0075.557] lstrcmpiW (lpString1="ofRIy5.doc", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0075.557] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0075.557] lstrcmpiW (lpString1="ofRIy5.doc", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0075.557] GetProcessHeap () returned 0x630000 [0075.557] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f10 [0075.557] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\ofRIy5.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\304hyv_ge_j\\ofriy5.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0075.558] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=27500) returned 1 [0075.558] GetProcessHeap () returned 0x630000 [0075.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6556e8 [0075.558] GetProcessHeap () returned 0x630000 [0075.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6735c0 [0075.558] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\ofRIy5.doc") returned 57 [0075.558] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.558] GetProcessHeap () returned 0x630000 [0075.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0075.558] GetProcessHeap () returned 0x630000 [0075.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x673aa0 [0075.559] lstrlenA (lpString="rsa_encrypt") returned 11 [0075.559] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x672900) returned 1 [0075.559] CryptGenRandom (in: hProv=0x672900, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0075.559] CryptReleaseContext (hProv=0x672900, dwFlags=0x0) returned 1 [0075.559] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0075.560] GetProcessHeap () returned 0x630000 [0075.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672cb8 [0075.560] lstrlenA (lpString="010001") returned 6 [0075.560] GetProcessHeap () returned 0x630000 [0075.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0075.560] GetProcessHeap () returned 0x630000 [0075.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673428 [0075.560] GetProcessHeap () returned 0x630000 [0075.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e190 [0075.560] GetProcessHeap () returned 0x630000 [0075.560] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673428 | out: hHeap=0x630000) returned 1 [0075.560] GetProcessHeap () returned 0x630000 [0075.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0075.560] GetProcessHeap () returned 0x630000 [0075.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656db0 [0075.560] GetProcessHeap () returned 0x630000 [0075.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2f8 [0075.560] GetProcessHeap () returned 0x630000 [0075.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0075.560] GetProcessHeap () returned 0x630000 [0075.560] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.560] GetProcessHeap () returned 0x630000 [0075.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0075.560] GetProcessHeap () returned 0x630000 [0075.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673648 [0075.560] GetProcessHeap () returned 0x630000 [0075.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656950 [0075.560] GetProcessHeap () returned 0x630000 [0075.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0075.560] GetProcessHeap () returned 0x630000 [0075.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0075.560] GetProcessHeap () returned 0x630000 [0075.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dfe0 [0075.560] GetProcessHeap () returned 0x630000 [0075.560] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673648 | out: hHeap=0x630000) returned 1 [0075.560] GetProcessHeap () returned 0x630000 [0075.560] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0075.560] GetProcessHeap () returned 0x630000 [0075.560] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0075.560] GetProcessHeap () returned 0x630000 [0075.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.561] GetProcessHeap () returned 0x630000 [0075.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cdc0 [0075.561] GetProcessHeap () returned 0x630000 [0075.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0075.561] GetProcessHeap () returned 0x630000 [0075.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.561] GetProcessHeap () returned 0x630000 [0075.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.561] GetProcessHeap () returned 0x630000 [0075.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.561] GetProcessHeap () returned 0x630000 [0075.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e6a0 [0075.561] GetProcessHeap () returned 0x630000 [0075.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cdc0 | out: hHeap=0x630000) returned 1 [0075.561] GetProcessHeap () returned 0x630000 [0075.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0075.561] GetProcessHeap () returned 0x630000 [0075.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e6a0 | out: hHeap=0x630000) returned 1 [0075.561] GetProcessHeap () returned 0x630000 [0075.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.561] GetProcessHeap () returned 0x630000 [0075.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.561] GetProcessHeap () returned 0x630000 [0075.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.561] GetProcessHeap () returned 0x630000 [0075.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.561] GetProcessHeap () returned 0x630000 [0075.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0075.561] GetProcessHeap () returned 0x630000 [0075.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0075.561] GetProcessHeap () returned 0x630000 [0075.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.561] GetProcessHeap () returned 0x630000 [0075.561] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.561] GetProcessHeap () returned 0x630000 [0075.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.618] GetProcessHeap () returned 0x630000 [0075.618] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.618] GetProcessHeap () returned 0x630000 [0075.618] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.618] GetProcessHeap () returned 0x630000 [0075.618] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.618] GetProcessHeap () returned 0x630000 [0075.618] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0075.618] GetProcessHeap () returned 0x630000 [0075.618] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0075.618] GetProcessHeap () returned 0x630000 [0075.618] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.618] GetProcessHeap () returned 0x630000 [0075.618] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.618] GetProcessHeap () returned 0x630000 [0075.618] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.618] GetProcessHeap () returned 0x630000 [0075.618] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.618] GetProcessHeap () returned 0x630000 [0075.618] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0075.618] GetProcessHeap () returned 0x630000 [0075.618] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0075.618] GetProcessHeap () returned 0x630000 [0075.618] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0075.618] GetProcessHeap () returned 0x630000 [0075.618] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0075.618] GetProcessHeap () returned 0x630000 [0075.618] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0075.618] GetProcessHeap () returned 0x630000 [0075.618] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0075.618] GetProcessHeap () returned 0x630000 [0075.618] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.619] GetProcessHeap () returned 0x630000 [0075.619] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.619] GetProcessHeap () returned 0x630000 [0075.619] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.619] GetProcessHeap () returned 0x630000 [0075.619] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.619] GetProcessHeap () returned 0x630000 [0075.619] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.619] GetProcessHeap () returned 0x630000 [0075.619] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.619] GetProcessHeap () returned 0x630000 [0075.619] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.619] GetProcessHeap () returned 0x630000 [0075.619] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.619] GetProcessHeap () returned 0x630000 [0075.619] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.619] GetProcessHeap () returned 0x630000 [0075.619] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.619] GetProcessHeap () returned 0x630000 [0075.619] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.619] GetProcessHeap () returned 0x630000 [0075.619] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.619] GetProcessHeap () returned 0x630000 [0075.619] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.619] GetProcessHeap () returned 0x630000 [0075.619] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.619] GetProcessHeap () returned 0x630000 [0075.619] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.619] GetProcessHeap () returned 0x630000 [0075.619] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.619] GetProcessHeap () returned 0x630000 [0075.619] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.619] GetProcessHeap () returned 0x630000 [0075.619] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.619] GetProcessHeap () returned 0x630000 [0075.619] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.619] GetProcessHeap () returned 0x630000 [0075.619] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.620] GetProcessHeap () returned 0x630000 [0075.620] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0075.620] GetProcessHeap () returned 0x630000 [0075.620] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0075.620] GetProcessHeap () returned 0x630000 [0075.620] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.620] GetProcessHeap () returned 0x630000 [0075.620] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.620] GetProcessHeap () returned 0x630000 [0075.620] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0075.620] GetProcessHeap () returned 0x630000 [0075.620] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0075.620] GetProcessHeap () returned 0x630000 [0075.620] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.620] GetProcessHeap () returned 0x630000 [0075.620] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.620] GetProcessHeap () returned 0x630000 [0075.620] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.620] GetProcessHeap () returned 0x630000 [0075.620] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.620] GetProcessHeap () returned 0x630000 [0075.620] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.620] GetProcessHeap () returned 0x630000 [0075.620] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.620] GetProcessHeap () returned 0x630000 [0075.620] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.620] GetProcessHeap () returned 0x630000 [0075.620] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.620] GetProcessHeap () returned 0x630000 [0075.620] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.620] GetProcessHeap () returned 0x630000 [0075.620] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.620] GetProcessHeap () returned 0x630000 [0075.620] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.620] GetProcessHeap () returned 0x630000 [0075.620] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.620] GetProcessHeap () returned 0x630000 [0075.620] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.620] GetProcessHeap () returned 0x630000 [0075.620] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.621] GetProcessHeap () returned 0x630000 [0075.621] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.621] GetProcessHeap () returned 0x630000 [0075.621] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.621] GetProcessHeap () returned 0x630000 [0075.621] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0075.621] GetProcessHeap () returned 0x630000 [0075.621] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0075.621] GetProcessHeap () returned 0x630000 [0075.621] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.621] GetProcessHeap () returned 0x630000 [0075.621] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.621] GetProcessHeap () returned 0x630000 [0075.621] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.621] GetProcessHeap () returned 0x630000 [0075.621] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.621] GetProcessHeap () returned 0x630000 [0075.621] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.621] GetProcessHeap () returned 0x630000 [0075.621] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.621] GetProcessHeap () returned 0x630000 [0075.621] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.621] GetProcessHeap () returned 0x630000 [0075.621] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.621] GetProcessHeap () returned 0x630000 [0075.621] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0075.621] GetProcessHeap () returned 0x630000 [0075.621] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0075.621] GetProcessHeap () returned 0x630000 [0075.621] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.621] GetProcessHeap () returned 0x630000 [0075.621] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.621] GetProcessHeap () returned 0x630000 [0075.621] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.621] GetProcessHeap () returned 0x630000 [0075.621] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.621] GetProcessHeap () returned 0x630000 [0075.621] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0075.622] GetProcessHeap () returned 0x630000 [0075.622] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0075.622] GetProcessHeap () returned 0x630000 [0075.622] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0075.622] GetProcessHeap () returned 0x630000 [0075.622] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0075.622] GetProcessHeap () returned 0x630000 [0075.622] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0075.622] GetProcessHeap () returned 0x630000 [0075.622] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0075.622] GetProcessHeap () returned 0x630000 [0075.622] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0075.622] GetProcessHeap () returned 0x630000 [0075.622] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0075.622] GetProcessHeap () returned 0x630000 [0075.622] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0075.622] GetProcessHeap () returned 0x630000 [0075.622] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.622] GetProcessHeap () returned 0x630000 [0075.622] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672cb8 | out: hHeap=0x630000) returned 1 [0075.622] WriteFile (in: hFile=0x230, lpBuffer=0x673aa0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673aa0*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0075.625] GetProcessHeap () returned 0x630000 [0075.625] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x673aa0, Size=0x30) returned 0x673aa0 [0075.625] GetProcessHeap () returned 0x630000 [0075.625] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0075.625] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.625] GetProcessHeap () returned 0x630000 [0075.625] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6b6c) returned 0x673ad8 [0075.626] ReadFile (in: hFile=0x230, lpBuffer=0x673ad8, nNumberOfBytesToRead=0x6b6c, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x673ad8*, lpNumberOfBytesRead=0x243d7e8*=0x6b6c, lpOverlapped=0x0) returned 1 [0075.626] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.626] WriteFile (in: hFile=0x230, lpBuffer=0x673ad8*, nNumberOfBytesToWrite=0x6b6c, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x673ad8*, lpNumberOfBytesWritten=0x243d7e4*=0x6b6c, lpOverlapped=0x0) returned 1 [0075.627] GetProcessHeap () returned 0x630000 [0075.627] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673ad8 | out: hHeap=0x630000) returned 1 [0075.627] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.627] WriteFile (in: hFile=0x230, lpBuffer=0x673aa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673aa0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0075.628] CloseHandle (hObject=0x230) returned 1 [0075.629] GetProcessHeap () returned 0x630000 [0075.629] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f10 | out: hHeap=0x630000) returned 1 [0075.629] GetProcessHeap () returned 0x630000 [0075.629] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6556e8 | out: hHeap=0x630000) returned 1 [0075.629] GetProcessHeap () returned 0x630000 [0075.629] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6735c0 | out: hHeap=0x630000) returned 1 [0075.629] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\ofRIy5.doc" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\ofRIy5.doc") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\ofRIy5.doc" [0075.629] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\ofRIy5.doc", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\ofRIy5.doc.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\ofRIy5.doc.happythreechoose" [0075.629] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\ofRIy5.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\304hyv_ge_j\\ofriy5.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\ofRIy5.doc.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\304hyv_ge_j\\ofriy5.doc.happythreechoose"), dwFlags=0x1) returned 1 [0075.630] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\ofRIy5.doc" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J") returned 1 [0075.630] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\") returned="" [0075.630] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Decryption INFO.html" [0075.630] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\304hyv_ge_j\\decryption info.html")) returned 0x20 [0075.630] GetProcessHeap () returned 0x630000 [0075.630] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0075.630] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x608374e0, ftCreationTime.dwHighDateTime=0x1d5ce49, ftLastAccessTime.dwLowDateTime=0xd4acd720, ftLastAccessTime.dwHighDateTime=0x1d5d0b6, ftLastWriteTime.dwLowDateTime=0xd4acd720, ftLastWriteTime.dwHighDateTime=0x1d5d0b6, nFileSizeHigh=0x0, nFileSizeLow=0x7625, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="smnxsuU.gif", cAlternateFileName="")) returned 1 [0075.630] lstrcmpiW (lpString1="smnxsuU.gif", lpString2=".") returned 1 [0075.630] lstrcmpiW (lpString1="smnxsuU.gif", lpString2="..") returned 1 [0075.630] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\", lpString2="smnxsuU.gif" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\smnxsuU.gif") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\smnxsuU.gif" [0075.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="smnxsuU.gif", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0075.630] GetProcessHeap () returned 0x630000 [0075.630] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0075.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="smnxsuU.gif", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="smnxsuU.gif", lpUsedDefaultChar=0x0) returned 12 [0075.630] lstrlenA (lpString="smnxsuU.gif") returned 11 [0075.630] lstrlenA (lpString=".happythreechoose") returned 17 [0075.630] lstrcmpiW (lpString1="smnxsuU.gif", lpString2="Decryption INFO.html") returned 1 [0075.630] lstrcmpiW (lpString1="smnxsuU.gif", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0075.630] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0075.630] lstrcmpiW (lpString1="smnxsuU.gif", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0075.630] GetProcessHeap () returned 0x630000 [0075.630] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f10 [0075.631] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\smnxsuU.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\304hyv_ge_j\\smnxsuu.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0075.631] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=30245) returned 1 [0075.631] GetProcessHeap () returned 0x630000 [0075.631] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6559b8 [0075.631] GetProcessHeap () returned 0x630000 [0075.631] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672fe8 [0075.631] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\smnxsuU.gif") returned 58 [0075.631] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.631] GetProcessHeap () returned 0x630000 [0075.631] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0075.631] GetProcessHeap () returned 0x630000 [0075.631] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x673ad8 [0075.631] lstrlenA (lpString="rsa_encrypt") returned 11 [0075.631] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x673070) returned 1 [0075.632] CryptGenRandom (in: hProv=0x673070, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0075.632] CryptReleaseContext (hProv=0x673070, dwFlags=0x0) returned 1 [0075.632] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0075.632] GetProcessHeap () returned 0x630000 [0075.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672c30 [0075.632] lstrlenA (lpString="010001") returned 6 [0075.632] GetProcessHeap () returned 0x630000 [0075.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a318 [0075.632] GetProcessHeap () returned 0x630000 [0075.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672cb8 [0075.632] GetProcessHeap () returned 0x630000 [0075.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e580 [0075.632] GetProcessHeap () returned 0x630000 [0075.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672cb8 | out: hHeap=0x630000) returned 1 [0075.632] GetProcessHeap () returned 0x630000 [0075.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e3d0 [0075.632] GetProcessHeap () returned 0x630000 [0075.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656950 [0075.632] GetProcessHeap () returned 0x630000 [0075.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0075.632] GetProcessHeap () returned 0x630000 [0075.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0075.632] GetProcessHeap () returned 0x630000 [0075.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.632] GetProcessHeap () returned 0x630000 [0075.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0075.632] GetProcessHeap () returned 0x630000 [0075.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673428 [0075.632] GetProcessHeap () returned 0x630000 [0075.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657328 [0075.632] GetProcessHeap () returned 0x630000 [0075.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.632] GetProcessHeap () returned 0x630000 [0075.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0075.632] GetProcessHeap () returned 0x630000 [0075.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dfe0 [0075.632] GetProcessHeap () returned 0x630000 [0075.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673428 | out: hHeap=0x630000) returned 1 [0075.633] GetProcessHeap () returned 0x630000 [0075.633] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0075.633] GetProcessHeap () returned 0x630000 [0075.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0075.633] GetProcessHeap () returned 0x630000 [0075.633] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.633] GetProcessHeap () returned 0x630000 [0075.633] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cef8 [0075.633] GetProcessHeap () returned 0x630000 [0075.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.633] GetProcessHeap () returned 0x630000 [0075.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.633] GetProcessHeap () returned 0x630000 [0075.633] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.633] GetProcessHeap () returned 0x630000 [0075.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.633] GetProcessHeap () returned 0x630000 [0075.633] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65eb20 [0075.633] GetProcessHeap () returned 0x630000 [0075.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cef8 | out: hHeap=0x630000) returned 1 [0075.633] GetProcessHeap () returned 0x630000 [0075.633] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0075.633] GetProcessHeap () returned 0x630000 [0075.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0075.633] GetProcessHeap () returned 0x630000 [0075.633] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.633] GetProcessHeap () returned 0x630000 [0075.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.633] GetProcessHeap () returned 0x630000 [0075.633] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.633] GetProcessHeap () returned 0x630000 [0075.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.633] GetProcessHeap () returned 0x630000 [0075.633] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.633] GetProcessHeap () returned 0x630000 [0075.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.634] GetProcessHeap () returned 0x630000 [0075.634] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.634] GetProcessHeap () returned 0x630000 [0075.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.634] GetProcessHeap () returned 0x630000 [0075.634] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.634] GetProcessHeap () returned 0x630000 [0075.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.634] GetProcessHeap () returned 0x630000 [0075.634] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.634] GetProcessHeap () returned 0x630000 [0075.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.634] GetProcessHeap () returned 0x630000 [0075.634] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0075.634] GetProcessHeap () returned 0x630000 [0075.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0075.634] GetProcessHeap () returned 0x630000 [0075.634] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.634] GetProcessHeap () returned 0x630000 [0075.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.634] GetProcessHeap () returned 0x630000 [0075.634] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.634] GetProcessHeap () returned 0x630000 [0075.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.634] GetProcessHeap () returned 0x630000 [0075.634] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.634] GetProcessHeap () returned 0x630000 [0075.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.634] GetProcessHeap () returned 0x630000 [0075.634] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.634] GetProcessHeap () returned 0x630000 [0075.634] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.635] GetProcessHeap () returned 0x630000 [0075.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.635] GetProcessHeap () returned 0x630000 [0075.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.635] GetProcessHeap () returned 0x630000 [0075.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.635] GetProcessHeap () returned 0x630000 [0075.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.635] GetProcessHeap () returned 0x630000 [0075.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0075.635] GetProcessHeap () returned 0x630000 [0075.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0075.635] GetProcessHeap () returned 0x630000 [0075.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.635] GetProcessHeap () returned 0x630000 [0075.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.635] GetProcessHeap () returned 0x630000 [0075.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0075.635] GetProcessHeap () returned 0x630000 [0075.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0075.635] GetProcessHeap () returned 0x630000 [0075.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.635] GetProcessHeap () returned 0x630000 [0075.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.635] GetProcessHeap () returned 0x630000 [0075.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.635] GetProcessHeap () returned 0x630000 [0075.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.635] GetProcessHeap () returned 0x630000 [0075.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.635] GetProcessHeap () returned 0x630000 [0075.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.635] GetProcessHeap () returned 0x630000 [0075.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.635] GetProcessHeap () returned 0x630000 [0075.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.635] GetProcessHeap () returned 0x630000 [0075.635] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.635] GetProcessHeap () returned 0x630000 [0075.635] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.636] GetProcessHeap () returned 0x630000 [0075.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.636] GetProcessHeap () returned 0x630000 [0075.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.636] GetProcessHeap () returned 0x630000 [0075.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.636] GetProcessHeap () returned 0x630000 [0075.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.636] GetProcessHeap () returned 0x630000 [0075.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.636] GetProcessHeap () returned 0x630000 [0075.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.636] GetProcessHeap () returned 0x630000 [0075.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0075.636] GetProcessHeap () returned 0x630000 [0075.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0075.636] GetProcessHeap () returned 0x630000 [0075.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.636] GetProcessHeap () returned 0x630000 [0075.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.636] GetProcessHeap () returned 0x630000 [0075.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.636] GetProcessHeap () returned 0x630000 [0075.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.636] GetProcessHeap () returned 0x630000 [0075.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.636] GetProcessHeap () returned 0x630000 [0075.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.636] GetProcessHeap () returned 0x630000 [0075.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.636] GetProcessHeap () returned 0x630000 [0075.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.636] GetProcessHeap () returned 0x630000 [0075.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.636] GetProcessHeap () returned 0x630000 [0075.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.636] GetProcessHeap () returned 0x630000 [0075.636] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.636] GetProcessHeap () returned 0x630000 [0075.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.637] GetProcessHeap () returned 0x630000 [0075.637] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.637] GetProcessHeap () returned 0x630000 [0075.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.637] GetProcessHeap () returned 0x630000 [0075.637] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.637] GetProcessHeap () returned 0x630000 [0075.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.637] GetProcessHeap () returned 0x630000 [0075.637] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0075.637] GetProcessHeap () returned 0x630000 [0075.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0075.637] GetProcessHeap () returned 0x630000 [0075.637] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.637] GetProcessHeap () returned 0x630000 [0075.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.637] GetProcessHeap () returned 0x630000 [0075.637] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.637] GetProcessHeap () returned 0x630000 [0075.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.637] GetProcessHeap () returned 0x630000 [0075.637] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.637] GetProcessHeap () returned 0x630000 [0075.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.637] GetProcessHeap () returned 0x630000 [0075.637] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.637] GetProcessHeap () returned 0x630000 [0075.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.637] GetProcessHeap () returned 0x630000 [0075.637] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.637] GetProcessHeap () returned 0x630000 [0075.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.637] GetProcessHeap () returned 0x630000 [0075.637] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.637] GetProcessHeap () returned 0x630000 [0075.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.637] GetProcessHeap () returned 0x630000 [0075.637] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.637] GetProcessHeap () returned 0x630000 [0075.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.638] GetProcessHeap () returned 0x630000 [0075.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0075.638] GetProcessHeap () returned 0x630000 [0075.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0075.638] GetProcessHeap () returned 0x630000 [0075.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0075.638] GetProcessHeap () returned 0x630000 [0075.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0075.638] GetProcessHeap () returned 0x630000 [0075.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0075.638] GetProcessHeap () returned 0x630000 [0075.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0075.638] GetProcessHeap () returned 0x630000 [0075.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0075.638] GetProcessHeap () returned 0x630000 [0075.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0075.638] GetProcessHeap () returned 0x630000 [0075.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0075.638] GetProcessHeap () returned 0x630000 [0075.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.638] GetProcessHeap () returned 0x630000 [0075.638] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672c30 | out: hHeap=0x630000) returned 1 [0075.638] WriteFile (in: hFile=0x230, lpBuffer=0x673ad8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673ad8*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0075.643] GetProcessHeap () returned 0x630000 [0075.643] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x673ad8, Size=0x30) returned 0x673ad8 [0075.643] GetProcessHeap () returned 0x630000 [0075.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0075.643] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.643] GetProcessHeap () returned 0x630000 [0075.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7625) returned 0x673b10 [0075.643] ReadFile (in: hFile=0x230, lpBuffer=0x673b10, nNumberOfBytesToRead=0x7625, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x673b10*, lpNumberOfBytesRead=0x243d7e8*=0x7625, lpOverlapped=0x0) returned 1 [0075.644] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.644] WriteFile (in: hFile=0x230, lpBuffer=0x673b10*, nNumberOfBytesToWrite=0x7625, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x673b10*, lpNumberOfBytesWritten=0x243d7e4*=0x7625, lpOverlapped=0x0) returned 1 [0075.645] GetProcessHeap () returned 0x630000 [0075.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673b10 | out: hHeap=0x630000) returned 1 [0075.646] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.646] WriteFile (in: hFile=0x230, lpBuffer=0x673ad8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673ad8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0075.647] CloseHandle (hObject=0x230) returned 1 [0075.647] GetProcessHeap () returned 0x630000 [0075.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f10 | out: hHeap=0x630000) returned 1 [0075.647] GetProcessHeap () returned 0x630000 [0075.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6559b8 | out: hHeap=0x630000) returned 1 [0075.647] GetProcessHeap () returned 0x630000 [0075.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672fe8 | out: hHeap=0x630000) returned 1 [0075.647] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\smnxsuU.gif" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\smnxsuU.gif") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\smnxsuU.gif" [0075.647] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\smnxsuU.gif", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\smnxsuU.gif.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\smnxsuU.gif.happythreechoose" [0075.647] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\smnxsuU.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\304hyv_ge_j\\smnxsuu.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\smnxsuU.gif.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\304hyv_ge_j\\smnxsuu.gif.happythreechoose"), dwFlags=0x1) returned 1 [0075.648] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\smnxsuU.gif" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J") returned 1 [0075.648] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\") returned="" [0075.648] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Decryption INFO.html" [0075.648] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\304hyv_ge_j\\decryption info.html")) returned 0x20 [0075.648] GetProcessHeap () returned 0x630000 [0075.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0075.648] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb30b9850, ftCreationTime.dwHighDateTime=0x1d5d7bd, ftLastAccessTime.dwLowDateTime=0xef1baf80, ftLastAccessTime.dwHighDateTime=0x1d5cf50, ftLastWriteTime.dwLowDateTime=0xef1baf80, ftLastWriteTime.dwHighDateTime=0x1d5cf50, nFileSizeHigh=0x0, nFileSizeLow=0x1728c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WsmeOTt.odt", cAlternateFileName="")) returned 1 [0075.648] lstrcmpiW (lpString1="WsmeOTt.odt", lpString2=".") returned 1 [0075.648] lstrcmpiW (lpString1="WsmeOTt.odt", lpString2="..") returned 1 [0075.648] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\", lpString2="WsmeOTt.odt" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\WsmeOTt.odt") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\WsmeOTt.odt" [0075.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WsmeOTt.odt", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0075.648] GetProcessHeap () returned 0x630000 [0075.648] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0075.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WsmeOTt.odt", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WsmeOTt.odt", lpUsedDefaultChar=0x0) returned 12 [0075.649] lstrlenA (lpString="WsmeOTt.odt") returned 11 [0075.649] lstrlenA (lpString=".happythreechoose") returned 17 [0075.649] lstrcmpiW (lpString1="WsmeOTt.odt", lpString2="Decryption INFO.html") returned 1 [0075.649] lstrcmpiW (lpString1="WsmeOTt.odt", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0075.649] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0075.649] lstrcmpiW (lpString1="WsmeOTt.odt", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0075.649] GetProcessHeap () returned 0x630000 [0075.649] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0075.649] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\WsmeOTt.odt" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\304hyv_ge_j\\wsmeott.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0075.649] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=94860) returned 1 [0075.649] GetProcessHeap () returned 0x630000 [0075.649] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6555f8 [0075.649] GetProcessHeap () returned 0x630000 [0075.649] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672c30 [0075.649] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\WsmeOTt.odt") returned 58 [0075.649] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.649] GetProcessHeap () returned 0x630000 [0075.649] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0075.649] GetProcessHeap () returned 0x630000 [0075.649] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x673b10 [0075.650] lstrlenA (lpString="rsa_encrypt") returned 11 [0075.650] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x672ed8) returned 1 [0075.651] CryptGenRandom (in: hProv=0x672ed8, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0075.651] CryptReleaseContext (hProv=0x672ed8, dwFlags=0x0) returned 1 [0075.651] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0075.651] GetProcessHeap () returned 0x630000 [0075.651] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673318 [0075.651] lstrlenA (lpString="010001") returned 6 [0075.651] GetProcessHeap () returned 0x630000 [0075.651] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a278 [0075.651] GetProcessHeap () returned 0x630000 [0075.651] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672e50 [0075.651] GetProcessHeap () returned 0x630000 [0075.651] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0075.651] GetProcessHeap () returned 0x630000 [0075.651] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672e50 | out: hHeap=0x630000) returned 1 [0075.651] GetProcessHeap () returned 0x630000 [0075.651] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e100 [0075.651] GetProcessHeap () returned 0x630000 [0075.651] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656fe0 [0075.651] GetProcessHeap () returned 0x630000 [0075.651] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2f8 [0075.651] GetProcessHeap () returned 0x630000 [0075.651] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0075.651] GetProcessHeap () returned 0x630000 [0075.651] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.651] GetProcessHeap () returned 0x630000 [0075.652] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0075.652] GetProcessHeap () returned 0x630000 [0075.652] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673180 [0075.652] GetProcessHeap () returned 0x630000 [0075.652] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656ec8 [0075.652] GetProcessHeap () returned 0x630000 [0075.652] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.652] GetProcessHeap () returned 0x630000 [0075.652] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0075.652] GetProcessHeap () returned 0x630000 [0075.652] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e4f0 [0075.652] GetProcessHeap () returned 0x630000 [0075.652] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673180 | out: hHeap=0x630000) returned 1 [0075.652] GetProcessHeap () returned 0x630000 [0075.652] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0075.652] GetProcessHeap () returned 0x630000 [0075.652] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0075.652] GetProcessHeap () returned 0x630000 [0075.652] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.652] GetProcessHeap () returned 0x630000 [0075.652] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cf28 [0075.652] GetProcessHeap () returned 0x630000 [0075.652] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.652] GetProcessHeap () returned 0x630000 [0075.652] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.652] GetProcessHeap () returned 0x630000 [0075.652] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0075.652] GetProcessHeap () returned 0x630000 [0075.652] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0075.652] GetProcessHeap () returned 0x630000 [0075.652] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65dec0 [0075.652] GetProcessHeap () returned 0x630000 [0075.652] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cf28 | out: hHeap=0x630000) returned 1 [0075.652] GetProcessHeap () returned 0x630000 [0075.652] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0075.652] GetProcessHeap () returned 0x630000 [0075.652] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0075.652] GetProcessHeap () returned 0x630000 [0075.652] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.652] GetProcessHeap () returned 0x630000 [0075.653] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.653] GetProcessHeap () returned 0x630000 [0075.653] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.653] GetProcessHeap () returned 0x630000 [0075.653] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.653] GetProcessHeap () returned 0x630000 [0075.653] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.653] GetProcessHeap () returned 0x630000 [0075.653] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.653] GetProcessHeap () returned 0x630000 [0075.653] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.653] GetProcessHeap () returned 0x630000 [0075.653] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.653] GetProcessHeap () returned 0x630000 [0075.653] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.653] GetProcessHeap () returned 0x630000 [0075.653] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.653] GetProcessHeap () returned 0x630000 [0075.653] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.653] GetProcessHeap () returned 0x630000 [0075.653] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.653] GetProcessHeap () returned 0x630000 [0075.653] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.653] GetProcessHeap () returned 0x630000 [0075.653] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.653] GetProcessHeap () returned 0x630000 [0075.653] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.653] GetProcessHeap () returned 0x630000 [0075.653] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.653] GetProcessHeap () returned 0x630000 [0075.653] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.653] GetProcessHeap () returned 0x630000 [0075.653] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.653] GetProcessHeap () returned 0x630000 [0075.653] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.653] GetProcessHeap () returned 0x630000 [0075.653] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.653] GetProcessHeap () returned 0x630000 [0075.653] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.653] GetProcessHeap () returned 0x630000 [0075.654] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.654] GetProcessHeap () returned 0x630000 [0075.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.654] GetProcessHeap () returned 0x630000 [0075.654] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.654] GetProcessHeap () returned 0x630000 [0075.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.654] GetProcessHeap () returned 0x630000 [0075.654] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.654] GetProcessHeap () returned 0x630000 [0075.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.654] GetProcessHeap () returned 0x630000 [0075.654] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.654] GetProcessHeap () returned 0x630000 [0075.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.654] GetProcessHeap () returned 0x630000 [0075.654] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.654] GetProcessHeap () returned 0x630000 [0075.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.654] GetProcessHeap () returned 0x630000 [0075.654] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.654] GetProcessHeap () returned 0x630000 [0075.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.654] GetProcessHeap () returned 0x630000 [0075.654] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.654] GetProcessHeap () returned 0x630000 [0075.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.654] GetProcessHeap () returned 0x630000 [0075.654] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.654] GetProcessHeap () returned 0x630000 [0075.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.654] GetProcessHeap () returned 0x630000 [0075.654] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.654] GetProcessHeap () returned 0x630000 [0075.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.654] GetProcessHeap () returned 0x630000 [0075.654] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.654] GetProcessHeap () returned 0x630000 [0075.655] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.655] GetProcessHeap () returned 0x630000 [0075.655] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.655] GetProcessHeap () returned 0x630000 [0075.655] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.655] GetProcessHeap () returned 0x630000 [0075.655] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.655] GetProcessHeap () returned 0x630000 [0075.655] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.655] GetProcessHeap () returned 0x630000 [0075.655] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.655] GetProcessHeap () returned 0x630000 [0075.655] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0075.655] GetProcessHeap () returned 0x630000 [0075.655] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0075.655] GetProcessHeap () returned 0x630000 [0075.655] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.655] GetProcessHeap () returned 0x630000 [0075.655] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.655] GetProcessHeap () returned 0x630000 [0075.655] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.655] GetProcessHeap () returned 0x630000 [0075.655] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.655] GetProcessHeap () returned 0x630000 [0075.655] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.656] GetProcessHeap () returned 0x630000 [0075.656] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.656] GetProcessHeap () returned 0x630000 [0075.656] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.656] GetProcessHeap () returned 0x630000 [0075.656] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.656] GetProcessHeap () returned 0x630000 [0075.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.657] GetProcessHeap () returned 0x630000 [0075.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.657] GetProcessHeap () returned 0x630000 [0075.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.657] GetProcessHeap () returned 0x630000 [0075.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.657] GetProcessHeap () returned 0x630000 [0075.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.657] GetProcessHeap () returned 0x630000 [0075.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.657] GetProcessHeap () returned 0x630000 [0075.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.657] GetProcessHeap () returned 0x630000 [0075.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.657] GetProcessHeap () returned 0x630000 [0075.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0075.657] GetProcessHeap () returned 0x630000 [0075.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0075.657] GetProcessHeap () returned 0x630000 [0075.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.657] GetProcessHeap () returned 0x630000 [0075.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.657] GetProcessHeap () returned 0x630000 [0075.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.657] GetProcessHeap () returned 0x630000 [0075.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.657] GetProcessHeap () returned 0x630000 [0075.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0075.657] GetProcessHeap () returned 0x630000 [0075.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0075.657] GetProcessHeap () returned 0x630000 [0075.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.657] GetProcessHeap () returned 0x630000 [0075.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.657] GetProcessHeap () returned 0x630000 [0075.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.658] GetProcessHeap () returned 0x630000 [0075.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.658] GetProcessHeap () returned 0x630000 [0075.658] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.658] GetProcessHeap () returned 0x630000 [0075.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.658] GetProcessHeap () returned 0x630000 [0075.658] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.658] GetProcessHeap () returned 0x630000 [0075.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.658] GetProcessHeap () returned 0x630000 [0075.658] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.658] GetProcessHeap () returned 0x630000 [0075.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.658] GetProcessHeap () returned 0x630000 [0075.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0075.658] GetProcessHeap () returned 0x630000 [0075.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0075.658] GetProcessHeap () returned 0x630000 [0075.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0075.658] GetProcessHeap () returned 0x630000 [0075.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0075.658] GetProcessHeap () returned 0x630000 [0075.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0075.658] GetProcessHeap () returned 0x630000 [0075.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0075.658] GetProcessHeap () returned 0x630000 [0075.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0075.658] GetProcessHeap () returned 0x630000 [0075.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0075.658] GetProcessHeap () returned 0x630000 [0075.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0075.658] GetProcessHeap () returned 0x630000 [0075.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.658] GetProcessHeap () returned 0x630000 [0075.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673318 | out: hHeap=0x630000) returned 1 [0075.658] WriteFile (in: hFile=0x230, lpBuffer=0x673b10*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673b10*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0075.660] GetProcessHeap () returned 0x630000 [0075.660] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x673b10, Size=0x30) returned 0x673b10 [0075.660] GetProcessHeap () returned 0x630000 [0075.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0075.660] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.660] GetProcessHeap () returned 0x630000 [0075.660] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1728c) returned 0x673b48 [0075.662] ReadFile (in: hFile=0x230, lpBuffer=0x673b48, nNumberOfBytesToRead=0x1728c, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x673b48*, lpNumberOfBytesRead=0x243d7e8*=0x1728c, lpOverlapped=0x0) returned 1 [0075.663] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.663] WriteFile (in: hFile=0x230, lpBuffer=0x673b48*, nNumberOfBytesToWrite=0x1728c, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x673b48*, lpNumberOfBytesWritten=0x243d7e4*=0x1728c, lpOverlapped=0x0) returned 1 [0075.664] GetProcessHeap () returned 0x630000 [0075.664] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673b48 | out: hHeap=0x630000) returned 1 [0075.664] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.664] WriteFile (in: hFile=0x230, lpBuffer=0x673b10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673b10*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0075.665] CloseHandle (hObject=0x230) returned 1 [0075.666] GetProcessHeap () returned 0x630000 [0075.666] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0075.666] GetProcessHeap () returned 0x630000 [0075.666] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6555f8 | out: hHeap=0x630000) returned 1 [0075.666] GetProcessHeap () returned 0x630000 [0075.666] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672c30 | out: hHeap=0x630000) returned 1 [0075.666] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\WsmeOTt.odt" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\WsmeOTt.odt") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\WsmeOTt.odt" [0075.666] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\WsmeOTt.odt", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\WsmeOTt.odt.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\WsmeOTt.odt.happythreechoose" [0075.666] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\WsmeOTt.odt" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\304hyv_ge_j\\wsmeott.odt"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\WsmeOTt.odt.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\304hyv_ge_j\\wsmeott.odt.happythreechoose"), dwFlags=0x1) returned 1 [0075.667] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\WsmeOTt.odt" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J") returned 1 [0075.667] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\") returned="" [0075.667] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Decryption INFO.html" [0075.667] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\304hyv_ge_j\\decryption info.html")) returned 0x20 [0075.667] GetProcessHeap () returned 0x630000 [0075.667] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0075.667] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e35a240, ftCreationTime.dwHighDateTime=0x1d5d68a, ftLastAccessTime.dwLowDateTime=0x60cfaa10, ftLastAccessTime.dwHighDateTime=0x1d5cd8e, ftLastWriteTime.dwLowDateTime=0x60cfaa10, ftLastWriteTime.dwHighDateTime=0x1d5cd8e, nFileSizeHigh=0x0, nFileSizeLow=0x5b7c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WyovaDyIHHN1FOzJ3o.swf", cAlternateFileName="WYOVAD~1.SWF")) returned 1 [0075.667] lstrcmpiW (lpString1="WyovaDyIHHN1FOzJ3o.swf", lpString2=".") returned 1 [0075.667] lstrcmpiW (lpString1="WyovaDyIHHN1FOzJ3o.swf", lpString2="..") returned 1 [0075.667] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\", lpString2="WyovaDyIHHN1FOzJ3o.swf" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\WyovaDyIHHN1FOzJ3o.swf") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\WyovaDyIHHN1FOzJ3o.swf" [0075.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WyovaDyIHHN1FOzJ3o.swf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0075.667] GetProcessHeap () returned 0x630000 [0075.667] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x17) returned 0x645cd8 [0075.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WyovaDyIHHN1FOzJ3o.swf", cchWideChar=-1, lpMultiByteStr=0x645cd8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WyovaDyIHHN1FOzJ3o.swf", lpUsedDefaultChar=0x0) returned 23 [0075.667] lstrlenA (lpString="WyovaDyIHHN1FOzJ3o.swf") returned 22 [0075.667] lstrlenA (lpString=".happythreechoose") returned 17 [0075.667] lstrlenA (lpString=".happythreechoose") returned 17 [0075.668] lstrlenA (lpString="WyovaDyIHHN1FOzJ3o.swf") returned 22 [0075.668] lstrcmpiA (lpString1="DyIHHN1FOzJ3o.swf", lpString2=".happythreechoose") returned 1 [0075.668] lstrcmpiW (lpString1="WyovaDyIHHN1FOzJ3o.swf", lpString2="Decryption INFO.html") returned 1 [0075.668] lstrcmpiW (lpString1="WyovaDyIHHN1FOzJ3o.swf", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0075.668] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0075.668] lstrcmpiW (lpString1="WyovaDyIHHN1FOzJ3o.swf", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0075.668] GetProcessHeap () returned 0x630000 [0075.668] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0075.668] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\WyovaDyIHHN1FOzJ3o.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\304hyv_ge_j\\wyovadyihhn1fozj3o.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0075.668] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=23420) returned 1 [0075.668] GetProcessHeap () returned 0x630000 [0075.668] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6555f8 [0075.668] GetProcessHeap () returned 0x630000 [0075.668] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673290 [0075.668] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\WyovaDyIHHN1FOzJ3o.swf") returned 69 [0075.668] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.668] GetProcessHeap () returned 0x630000 [0075.668] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0075.668] GetProcessHeap () returned 0x630000 [0075.668] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x384) returned 0x673b48 [0075.668] lstrlenA (lpString="rsa_encrypt") returned 11 [0075.668] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x672a98) returned 1 [0075.669] CryptGenRandom (in: hProv=0x672a98, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0075.669] CryptReleaseContext (hProv=0x672a98, dwFlags=0x0) returned 1 [0075.669] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0075.669] GetProcessHeap () returned 0x630000 [0075.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673180 [0075.669] lstrlenA (lpString="010001") returned 6 [0075.669] GetProcessHeap () returned 0x630000 [0075.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0075.669] GetProcessHeap () returned 0x630000 [0075.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672e50 [0075.669] GetProcessHeap () returned 0x630000 [0075.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ecd0 [0075.669] GetProcessHeap () returned 0x630000 [0075.669] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672e50 | out: hHeap=0x630000) returned 1 [0075.669] GetProcessHeap () returned 0x630000 [0075.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e730 [0075.669] GetProcessHeap () returned 0x630000 [0075.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656db0 [0075.669] GetProcessHeap () returned 0x630000 [0075.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0075.669] GetProcessHeap () returned 0x630000 [0075.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0075.669] GetProcessHeap () returned 0x630000 [0075.670] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.670] GetProcessHeap () returned 0x630000 [0075.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0075.670] GetProcessHeap () returned 0x630000 [0075.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672c30 [0075.670] GetProcessHeap () returned 0x630000 [0075.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656950 [0075.670] GetProcessHeap () returned 0x630000 [0075.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.670] GetProcessHeap () returned 0x630000 [0075.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0075.670] GetProcessHeap () returned 0x630000 [0075.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e460 [0075.670] GetProcessHeap () returned 0x630000 [0075.670] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672c30 | out: hHeap=0x630000) returned 1 [0075.670] GetProcessHeap () returned 0x630000 [0075.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0075.670] GetProcessHeap () returned 0x630000 [0075.670] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e460 | out: hHeap=0x630000) returned 1 [0075.670] GetProcessHeap () returned 0x630000 [0075.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.670] GetProcessHeap () returned 0x630000 [0075.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0075.670] GetProcessHeap () returned 0x630000 [0075.670] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.670] GetProcessHeap () returned 0x630000 [0075.670] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.670] GetProcessHeap () returned 0x630000 [0075.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0075.670] GetProcessHeap () returned 0x630000 [0075.670] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0075.670] GetProcessHeap () returned 0x630000 [0075.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65dda0 [0075.670] GetProcessHeap () returned 0x630000 [0075.670] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0075.670] GetProcessHeap () returned 0x630000 [0075.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0075.670] GetProcessHeap () returned 0x630000 [0075.670] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0075.670] GetProcessHeap () returned 0x630000 [0075.671] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.671] GetProcessHeap () returned 0x630000 [0075.671] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.671] GetProcessHeap () returned 0x630000 [0075.671] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.671] GetProcessHeap () returned 0x630000 [0075.671] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.671] GetProcessHeap () returned 0x630000 [0075.671] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.671] GetProcessHeap () returned 0x630000 [0075.671] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.671] GetProcessHeap () returned 0x630000 [0075.671] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.671] GetProcessHeap () returned 0x630000 [0075.671] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.671] GetProcessHeap () returned 0x630000 [0075.671] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.671] GetProcessHeap () returned 0x630000 [0075.671] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.671] GetProcessHeap () returned 0x630000 [0075.671] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.671] GetProcessHeap () returned 0x630000 [0075.671] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.672] GetProcessHeap () returned 0x630000 [0075.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0075.672] GetProcessHeap () returned 0x630000 [0075.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0075.672] GetProcessHeap () returned 0x630000 [0075.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.672] GetProcessHeap () returned 0x630000 [0075.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.672] GetProcessHeap () returned 0x630000 [0075.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.672] GetProcessHeap () returned 0x630000 [0075.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.672] GetProcessHeap () returned 0x630000 [0075.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.672] GetProcessHeap () returned 0x630000 [0075.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.672] GetProcessHeap () returned 0x630000 [0075.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.672] GetProcessHeap () returned 0x630000 [0075.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.672] GetProcessHeap () returned 0x630000 [0075.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.672] GetProcessHeap () returned 0x630000 [0075.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.672] GetProcessHeap () returned 0x630000 [0075.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.672] GetProcessHeap () returned 0x630000 [0075.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.672] GetProcessHeap () returned 0x630000 [0075.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0075.672] GetProcessHeap () returned 0x630000 [0075.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0075.672] GetProcessHeap () returned 0x630000 [0075.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.672] GetProcessHeap () returned 0x630000 [0075.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.672] GetProcessHeap () returned 0x630000 [0075.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.673] GetProcessHeap () returned 0x630000 [0075.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.673] GetProcessHeap () returned 0x630000 [0075.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.673] GetProcessHeap () returned 0x630000 [0075.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.673] GetProcessHeap () returned 0x630000 [0075.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.673] GetProcessHeap () returned 0x630000 [0075.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.673] GetProcessHeap () returned 0x630000 [0075.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.673] GetProcessHeap () returned 0x630000 [0075.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.673] GetProcessHeap () returned 0x630000 [0075.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0075.673] GetProcessHeap () returned 0x630000 [0075.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0075.673] GetProcessHeap () returned 0x630000 [0075.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.673] GetProcessHeap () returned 0x630000 [0075.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.673] GetProcessHeap () returned 0x630000 [0075.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.673] GetProcessHeap () returned 0x630000 [0075.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.673] GetProcessHeap () returned 0x630000 [0075.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.673] GetProcessHeap () returned 0x630000 [0075.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.673] GetProcessHeap () returned 0x630000 [0075.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.673] GetProcessHeap () returned 0x630000 [0075.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.673] GetProcessHeap () returned 0x630000 [0075.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0075.673] GetProcessHeap () returned 0x630000 [0075.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0075.674] GetProcessHeap () returned 0x630000 [0075.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.674] GetProcessHeap () returned 0x630000 [0075.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.674] GetProcessHeap () returned 0x630000 [0075.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.674] GetProcessHeap () returned 0x630000 [0075.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.674] GetProcessHeap () returned 0x630000 [0075.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0075.674] GetProcessHeap () returned 0x630000 [0075.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0075.674] GetProcessHeap () returned 0x630000 [0075.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.674] GetProcessHeap () returned 0x630000 [0075.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.674] GetProcessHeap () returned 0x630000 [0075.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0075.674] GetProcessHeap () returned 0x630000 [0075.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0075.674] GetProcessHeap () returned 0x630000 [0075.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0075.674] GetProcessHeap () returned 0x630000 [0075.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0075.674] GetProcessHeap () returned 0x630000 [0075.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.674] GetProcessHeap () returned 0x630000 [0075.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.674] GetProcessHeap () returned 0x630000 [0075.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.674] GetProcessHeap () returned 0x630000 [0075.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.674] GetProcessHeap () returned 0x630000 [0075.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.675] GetProcessHeap () returned 0x630000 [0075.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.675] GetProcessHeap () returned 0x630000 [0075.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.675] GetProcessHeap () returned 0x630000 [0075.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.675] GetProcessHeap () returned 0x630000 [0075.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.675] GetProcessHeap () returned 0x630000 [0075.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.675] GetProcessHeap () returned 0x630000 [0075.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.675] GetProcessHeap () returned 0x630000 [0075.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.675] GetProcessHeap () returned 0x630000 [0075.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.675] GetProcessHeap () returned 0x630000 [0075.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.675] GetProcessHeap () returned 0x630000 [0075.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.675] GetProcessHeap () returned 0x630000 [0075.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.675] GetProcessHeap () returned 0x630000 [0075.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.675] GetProcessHeap () returned 0x630000 [0075.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.675] GetProcessHeap () returned 0x630000 [0075.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.675] GetProcessHeap () returned 0x630000 [0075.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.675] GetProcessHeap () returned 0x630000 [0075.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0075.676] GetProcessHeap () returned 0x630000 [0075.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0075.676] GetProcessHeap () returned 0x630000 [0075.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0075.676] GetProcessHeap () returned 0x630000 [0075.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0075.676] GetProcessHeap () returned 0x630000 [0075.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0075.676] GetProcessHeap () returned 0x630000 [0075.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0075.676] GetProcessHeap () returned 0x630000 [0075.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0075.676] GetProcessHeap () returned 0x630000 [0075.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ecd0 | out: hHeap=0x630000) returned 1 [0075.676] GetProcessHeap () returned 0x630000 [0075.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0075.676] GetProcessHeap () returned 0x630000 [0075.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.676] GetProcessHeap () returned 0x630000 [0075.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673180 | out: hHeap=0x630000) returned 1 [0075.676] WriteFile (in: hFile=0x230, lpBuffer=0x673b48*, nNumberOfBytesToWrite=0x384, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673b48*, lpNumberOfBytesWritten=0x243d864*=0x384, lpOverlapped=0x0) returned 1 [0075.679] GetProcessHeap () returned 0x630000 [0075.679] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x673b48, Size=0x30) returned 0x673b48 [0075.679] GetProcessHeap () returned 0x630000 [0075.679] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0075.679] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.679] GetProcessHeap () returned 0x630000 [0075.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5b80) returned 0x673b80 [0075.679] ReadFile (in: hFile=0x230, lpBuffer=0x673b80, nNumberOfBytesToRead=0x5b80, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x673b80*, lpNumberOfBytesRead=0x243d7e8*=0x5b80, lpOverlapped=0x0) returned 1 [0075.679] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.679] WriteFile (in: hFile=0x230, lpBuffer=0x673b80*, nNumberOfBytesToWrite=0x5b80, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x673b80*, lpNumberOfBytesWritten=0x243d7e4*=0x5b80, lpOverlapped=0x0) returned 1 [0075.680] GetProcessHeap () returned 0x630000 [0075.680] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673b80 | out: hHeap=0x630000) returned 1 [0075.681] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.681] WriteFile (in: hFile=0x230, lpBuffer=0x673b48*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673b48*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0075.682] CloseHandle (hObject=0x230) returned 1 [0075.683] GetProcessHeap () returned 0x630000 [0075.683] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0075.683] GetProcessHeap () returned 0x630000 [0075.683] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6555f8 | out: hHeap=0x630000) returned 1 [0075.683] GetProcessHeap () returned 0x630000 [0075.683] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673290 | out: hHeap=0x630000) returned 1 [0075.683] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\WyovaDyIHHN1FOzJ3o.swf" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\WyovaDyIHHN1FOzJ3o.swf") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\WyovaDyIHHN1FOzJ3o.swf" [0075.683] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\WyovaDyIHHN1FOzJ3o.swf", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\WyovaDyIHHN1FOzJ3o.swf.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\WyovaDyIHHN1FOzJ3o.swf.happythreechoose" [0075.683] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\WyovaDyIHHN1FOzJ3o.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\304hyv_ge_j\\wyovadyihhn1fozj3o.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\WyovaDyIHHN1FOzJ3o.swf.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\304hyv_ge_j\\wyovadyihhn1fozj3o.swf.happythreechoose"), dwFlags=0x1) returned 1 [0075.684] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\WyovaDyIHHN1FOzJ3o.swf" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J") returned 1 [0075.684] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\") returned="" [0075.684] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Decryption INFO.html" [0075.684] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\304hyv_ge_j\\decryption info.html")) returned 0x20 [0075.684] GetProcessHeap () returned 0x630000 [0075.684] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645cd8 | out: hHeap=0x630000) returned 1 [0075.684] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c4d1520, ftCreationTime.dwHighDateTime=0x1d5cd9b, ftLastAccessTime.dwLowDateTime=0xdf9183e0, ftLastAccessTime.dwHighDateTime=0x1d5d49c, ftLastWriteTime.dwLowDateTime=0xdf9183e0, ftLastWriteTime.dwHighDateTime=0x1d5d49c, nFileSizeHigh=0x0, nFileSizeLow=0x2dae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Zqxk 7bXknANnbyOr8.mp3", cAlternateFileName="ZQXK7B~1.MP3")) returned 1 [0075.684] lstrcmpiW (lpString1="Zqxk 7bXknANnbyOr8.mp3", lpString2=".") returned 1 [0075.684] lstrcmpiW (lpString1="Zqxk 7bXknANnbyOr8.mp3", lpString2="..") returned 1 [0075.684] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\", lpString2="Zqxk 7bXknANnbyOr8.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Zqxk 7bXknANnbyOr8.mp3") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Zqxk 7bXknANnbyOr8.mp3" [0075.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Zqxk 7bXknANnbyOr8.mp3", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0075.684] GetProcessHeap () returned 0x630000 [0075.684] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x17) returned 0x645eb8 [0075.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Zqxk 7bXknANnbyOr8.mp3", cchWideChar=-1, lpMultiByteStr=0x645eb8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Zqxk 7bXknANnbyOr8.mp3", lpUsedDefaultChar=0x0) returned 23 [0075.684] lstrlenA (lpString="Zqxk 7bXknANnbyOr8.mp3") returned 22 [0075.684] lstrlenA (lpString=".happythreechoose") returned 17 [0075.684] lstrlenA (lpString=".happythreechoose") returned 17 [0075.684] lstrlenA (lpString="Zqxk 7bXknANnbyOr8.mp3") returned 22 [0075.684] lstrcmpiA (lpString1="7bXknANnbyOr8.mp3", lpString2=".happythreechoose") returned 1 [0075.684] lstrcmpiW (lpString1="Zqxk 7bXknANnbyOr8.mp3", lpString2="Decryption INFO.html") returned 1 [0075.684] lstrcmpiW (lpString1="Zqxk 7bXknANnbyOr8.mp3", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0075.685] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0075.685] lstrcmpiW (lpString1="Zqxk 7bXknANnbyOr8.mp3", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0075.685] GetProcessHeap () returned 0x630000 [0075.685] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0075.685] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Zqxk 7bXknANnbyOr8.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\304hyv_ge_j\\zqxk 7bxknannbyor8.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0075.685] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=11694) returned 1 [0075.685] GetProcessHeap () returned 0x630000 [0075.685] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6555f8 [0075.685] GetProcessHeap () returned 0x630000 [0075.685] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673208 [0075.685] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Zqxk 7bXknANnbyOr8.mp3") returned 69 [0075.685] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.685] GetProcessHeap () returned 0x630000 [0075.685] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0075.685] GetProcessHeap () returned 0x630000 [0075.685] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x673b80 [0075.686] lstrlenA (lpString="rsa_encrypt") returned 11 [0075.686] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x672a98) returned 1 [0075.687] CryptGenRandom (in: hProv=0x672a98, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0075.687] CryptReleaseContext (hProv=0x672a98, dwFlags=0x0) returned 1 [0075.687] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0075.687] GetProcessHeap () returned 0x630000 [0075.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6736d0 [0075.687] lstrlenA (lpString="010001") returned 6 [0075.687] GetProcessHeap () returned 0x630000 [0075.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2f8 [0075.687] GetProcessHeap () returned 0x630000 [0075.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672988 [0075.687] GetProcessHeap () returned 0x630000 [0075.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e190 [0075.687] GetProcessHeap () returned 0x630000 [0075.687] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672988 | out: hHeap=0x630000) returned 1 [0075.687] GetProcessHeap () returned 0x630000 [0075.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e970 [0075.687] GetProcessHeap () returned 0x630000 [0075.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657788 [0075.687] GetProcessHeap () returned 0x630000 [0075.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0075.687] GetProcessHeap () returned 0x630000 [0075.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0075.687] GetProcessHeap () returned 0x630000 [0075.687] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.687] GetProcessHeap () returned 0x630000 [0075.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0075.687] GetProcessHeap () returned 0x630000 [0075.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672a10 [0075.688] GetProcessHeap () returned 0x630000 [0075.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656a68 [0075.688] GetProcessHeap () returned 0x630000 [0075.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.688] GetProcessHeap () returned 0x630000 [0075.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0075.688] GetProcessHeap () returned 0x630000 [0075.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e850 [0075.688] GetProcessHeap () returned 0x630000 [0075.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672a10 | out: hHeap=0x630000) returned 1 [0075.688] GetProcessHeap () returned 0x630000 [0075.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0075.688] GetProcessHeap () returned 0x630000 [0075.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0075.688] GetProcessHeap () returned 0x630000 [0075.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.688] GetProcessHeap () returned 0x630000 [0075.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0075.688] GetProcessHeap () returned 0x630000 [0075.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.688] GetProcessHeap () returned 0x630000 [0075.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.688] GetProcessHeap () returned 0x630000 [0075.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.688] GetProcessHeap () returned 0x630000 [0075.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.688] GetProcessHeap () returned 0x630000 [0075.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ecd0 [0075.688] GetProcessHeap () returned 0x630000 [0075.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0075.688] GetProcessHeap () returned 0x630000 [0075.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0075.688] GetProcessHeap () returned 0x630000 [0075.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ecd0 | out: hHeap=0x630000) returned 1 [0075.688] GetProcessHeap () returned 0x630000 [0075.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0075.688] GetProcessHeap () returned 0x630000 [0075.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0075.688] GetProcessHeap () returned 0x630000 [0075.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.688] GetProcessHeap () returned 0x630000 [0075.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.689] GetProcessHeap () returned 0x630000 [0075.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.689] GetProcessHeap () returned 0x630000 [0075.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.689] GetProcessHeap () returned 0x630000 [0075.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.689] GetProcessHeap () returned 0x630000 [0075.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.689] GetProcessHeap () returned 0x630000 [0075.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0075.689] GetProcessHeap () returned 0x630000 [0075.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0075.689] GetProcessHeap () returned 0x630000 [0075.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.689] GetProcessHeap () returned 0x630000 [0075.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.689] GetProcessHeap () returned 0x630000 [0075.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.689] GetProcessHeap () returned 0x630000 [0075.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.689] GetProcessHeap () returned 0x630000 [0075.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.689] GetProcessHeap () returned 0x630000 [0075.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.689] GetProcessHeap () returned 0x630000 [0075.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0075.689] GetProcessHeap () returned 0x630000 [0075.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0075.689] GetProcessHeap () returned 0x630000 [0075.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.689] GetProcessHeap () returned 0x630000 [0075.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.689] GetProcessHeap () returned 0x630000 [0075.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.689] GetProcessHeap () returned 0x630000 [0075.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.689] GetProcessHeap () returned 0x630000 [0075.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.690] GetProcessHeap () returned 0x630000 [0075.690] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.690] GetProcessHeap () returned 0x630000 [0075.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.690] GetProcessHeap () returned 0x630000 [0075.690] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.690] GetProcessHeap () returned 0x630000 [0075.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.690] GetProcessHeap () returned 0x630000 [0075.690] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.690] GetProcessHeap () returned 0x630000 [0075.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.690] GetProcessHeap () returned 0x630000 [0075.690] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.690] GetProcessHeap () returned 0x630000 [0075.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0075.690] GetProcessHeap () returned 0x630000 [0075.690] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0075.690] GetProcessHeap () returned 0x630000 [0075.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.690] GetProcessHeap () returned 0x630000 [0075.690] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.690] GetProcessHeap () returned 0x630000 [0075.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.690] GetProcessHeap () returned 0x630000 [0075.690] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.690] GetProcessHeap () returned 0x630000 [0075.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.690] GetProcessHeap () returned 0x630000 [0075.690] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.690] GetProcessHeap () returned 0x630000 [0075.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.690] GetProcessHeap () returned 0x630000 [0075.690] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.690] GetProcessHeap () returned 0x630000 [0075.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.690] GetProcessHeap () returned 0x630000 [0075.690] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.691] GetProcessHeap () returned 0x630000 [0075.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.691] GetProcessHeap () returned 0x630000 [0075.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.691] GetProcessHeap () returned 0x630000 [0075.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.691] GetProcessHeap () returned 0x630000 [0075.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.691] GetProcessHeap () returned 0x630000 [0075.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.691] GetProcessHeap () returned 0x630000 [0075.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.691] GetProcessHeap () returned 0x630000 [0075.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.691] GetProcessHeap () returned 0x630000 [0075.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.691] GetProcessHeap () returned 0x630000 [0075.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.691] GetProcessHeap () returned 0x630000 [0075.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.691] GetProcessHeap () returned 0x630000 [0075.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.691] GetProcessHeap () returned 0x630000 [0075.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.691] GetProcessHeap () returned 0x630000 [0075.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.691] GetProcessHeap () returned 0x630000 [0075.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.691] GetProcessHeap () returned 0x630000 [0075.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.691] GetProcessHeap () returned 0x630000 [0075.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.691] GetProcessHeap () returned 0x630000 [0075.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.691] GetProcessHeap () returned 0x630000 [0075.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.691] GetProcessHeap () returned 0x630000 [0075.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0075.692] GetProcessHeap () returned 0x630000 [0075.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0075.692] GetProcessHeap () returned 0x630000 [0075.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.692] GetProcessHeap () returned 0x630000 [0075.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.692] GetProcessHeap () returned 0x630000 [0075.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.692] GetProcessHeap () returned 0x630000 [0075.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.692] GetProcessHeap () returned 0x630000 [0075.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.692] GetProcessHeap () returned 0x630000 [0075.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.692] GetProcessHeap () returned 0x630000 [0075.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.692] GetProcessHeap () returned 0x630000 [0075.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.692] GetProcessHeap () returned 0x630000 [0075.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.692] GetProcessHeap () returned 0x630000 [0075.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.692] GetProcessHeap () returned 0x630000 [0075.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.692] GetProcessHeap () returned 0x630000 [0075.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.692] GetProcessHeap () returned 0x630000 [0075.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0075.692] GetProcessHeap () returned 0x630000 [0075.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0075.692] GetProcessHeap () returned 0x630000 [0075.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0075.692] GetProcessHeap () returned 0x630000 [0075.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0075.692] GetProcessHeap () returned 0x630000 [0075.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.692] GetProcessHeap () returned 0x630000 [0075.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.692] GetProcessHeap () returned 0x630000 [0075.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0075.693] GetProcessHeap () returned 0x630000 [0075.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0075.693] GetProcessHeap () returned 0x630000 [0075.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0075.693] GetProcessHeap () returned 0x630000 [0075.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0075.693] GetProcessHeap () returned 0x630000 [0075.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0075.693] GetProcessHeap () returned 0x630000 [0075.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0075.693] GetProcessHeap () returned 0x630000 [0075.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0075.693] GetProcessHeap () returned 0x630000 [0075.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0075.693] GetProcessHeap () returned 0x630000 [0075.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0075.693] GetProcessHeap () returned 0x630000 [0075.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0075.693] GetProcessHeap () returned 0x630000 [0075.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0075.693] GetProcessHeap () returned 0x630000 [0075.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.693] GetProcessHeap () returned 0x630000 [0075.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6736d0 | out: hHeap=0x630000) returned 1 [0075.693] WriteFile (in: hFile=0x230, lpBuffer=0x673b80*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673b80*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0075.696] GetProcessHeap () returned 0x630000 [0075.696] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x673b80, Size=0x30) returned 0x673b80 [0075.696] GetProcessHeap () returned 0x630000 [0075.696] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0075.696] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.696] GetProcessHeap () returned 0x630000 [0075.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2dae) returned 0x673bb8 [0075.696] ReadFile (in: hFile=0x230, lpBuffer=0x673bb8, nNumberOfBytesToRead=0x2dae, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x673bb8*, lpNumberOfBytesRead=0x243d7e8*=0x2dae, lpOverlapped=0x0) returned 1 [0075.696] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.696] WriteFile (in: hFile=0x230, lpBuffer=0x673bb8*, nNumberOfBytesToWrite=0x2dae, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x673bb8*, lpNumberOfBytesWritten=0x243d7e4*=0x2dae, lpOverlapped=0x0) returned 1 [0075.697] GetProcessHeap () returned 0x630000 [0075.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673bb8 | out: hHeap=0x630000) returned 1 [0075.697] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.697] WriteFile (in: hFile=0x230, lpBuffer=0x673b80*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673b80*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0075.698] CloseHandle (hObject=0x230) returned 1 [0075.699] GetProcessHeap () returned 0x630000 [0075.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0075.699] GetProcessHeap () returned 0x630000 [0075.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6555f8 | out: hHeap=0x630000) returned 1 [0075.699] GetProcessHeap () returned 0x630000 [0075.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673208 | out: hHeap=0x630000) returned 1 [0075.699] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Zqxk 7bXknANnbyOr8.mp3" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Zqxk 7bXknANnbyOr8.mp3") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Zqxk 7bXknANnbyOr8.mp3" [0075.699] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Zqxk 7bXknANnbyOr8.mp3", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Zqxk 7bXknANnbyOr8.mp3.happythreechoose") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Zqxk 7bXknANnbyOr8.mp3.happythreechoose" [0075.699] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Zqxk 7bXknANnbyOr8.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\304hyv_ge_j\\zqxk 7bxknannbyor8.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Zqxk 7bXknANnbyOr8.mp3.happythreechoose" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\304hyv_ge_j\\zqxk 7bxknannbyor8.mp3.happythreechoose"), dwFlags=0x1) returned 1 [0075.700] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Zqxk 7bXknANnbyOr8.mp3" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J") returned 1 [0075.700] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J" | out: pszPath="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\") returned="" [0075.700] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Decryption INFO.html" [0075.700] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\6uhgnxQGWG\\304hYv_gE_J\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\desktop\\6uhgnxqgwg\\304hyv_ge_j\\decryption info.html")) returned 0x20 [0075.700] GetProcessHeap () returned 0x630000 [0075.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645eb8 | out: hHeap=0x630000) returned 1 [0075.700] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c4d1520, ftCreationTime.dwHighDateTime=0x1d5cd9b, ftLastAccessTime.dwLowDateTime=0xdf9183e0, ftLastAccessTime.dwHighDateTime=0x1d5d49c, ftLastWriteTime.dwLowDateTime=0xdf9183e0, ftLastWriteTime.dwHighDateTime=0x1d5d49c, nFileSizeHigh=0x0, nFileSizeLow=0x2dae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Zqxk 7bXknANnbyOr8.mp3", cAlternateFileName="ZQXK7B~1.MP3")) returned 0 [0075.700] FindClose (in: hFindFile=0x648a90 | out: hFindFile=0x648a90) returned 1 [0075.700] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\Cookies\\" | out: lpString1="C:\\Users\\FD1HVy\\Cookies\\") returned="C:\\Users\\FD1HVy\\Cookies\\" [0075.700] GetProcessHeap () returned 0x630000 [0075.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6487d0 | out: hHeap=0x630000) returned 1 [0075.700] GetProcessHeap () returned 0x630000 [0075.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0075.700] lstrlenW (lpString="C:\\Users\\FD1HVy\\Cookies\\") returned 24 [0075.700] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Cookies\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Cookies\\*") returned="C:\\Users\\FD1HVy\\Cookies\\*" [0075.700] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Cookies\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c4d1520, ftCreationTime.dwHighDateTime=0x1d5cd9b, ftLastAccessTime.dwLowDateTime=0xdf9183e0, ftLastAccessTime.dwHighDateTime=0x1d5d49c, ftLastWriteTime.dwLowDateTime=0xdf9183e0, ftLastWriteTime.dwHighDateTime=0x1d5d49c, nFileSizeHigh=0x0, nFileSizeLow=0x2dae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Zqxk 7bXknANnbyOr8.mp3", cAlternateFileName="ZQXK7B~1.MP3")) returned 0xffffffff [0075.700] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\Contacts\\" | out: lpString1="C:\\Users\\FD1HVy\\Contacts\\") returned="C:\\Users\\FD1HVy\\Contacts\\" [0075.700] GetProcessHeap () returned 0x630000 [0075.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x648a10 | out: hHeap=0x630000) returned 1 [0075.700] GetProcessHeap () returned 0x630000 [0075.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0075.701] lstrlenW (lpString="C:\\Users\\FD1HVy\\Contacts\\") returned 25 [0075.701] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Contacts\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Contacts\\*") returned="C:\\Users\\FD1HVy\\Contacts\\*" [0075.701] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Contacts\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6487d0 [0075.701] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0075.701] FindNextFileW (in: hFindFile=0x6487d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.701] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0075.701] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0075.701] FindNextFileW (in: hFindFile=0x6487d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0075.701] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0075.701] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0075.701] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Contacts\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Contacts\\desktop.ini") returned="C:\\Users\\FD1HVy\\Contacts\\desktop.ini" [0075.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0075.701] GetProcessHeap () returned 0x630000 [0075.701] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0075.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0075.701] lstrlenA (lpString="desktop.ini") returned 11 [0075.701] lstrlenA (lpString=".happythreechoose") returned 17 [0075.701] lstrcmpiW (lpString1="desktop.ini", lpString2="Decryption INFO.html") returned 1 [0075.701] lstrcmpiW (lpString1="desktop.ini", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0075.701] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0075.701] lstrcmpiW (lpString1="desktop.ini", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0075.701] GetProcessHeap () returned 0x630000 [0075.701] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0075.701] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Contacts\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\contacts\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0075.701] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=412) returned 1 [0075.702] GetProcessHeap () returned 0x630000 [0075.702] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655418 [0075.702] GetProcessHeap () returned 0x630000 [0075.702] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673538 [0075.702] lstrlenW (lpString="C:\\Users\\FD1HVy\\Contacts\\desktop.ini") returned 36 [0075.702] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.702] GetProcessHeap () returned 0x630000 [0075.702] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0075.702] GetProcessHeap () returned 0x630000 [0075.702] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x384) returned 0x673bb8 [0075.702] lstrlenA (lpString="rsa_encrypt") returned 11 [0075.702] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x6735c0) returned 1 [0075.703] CryptGenRandom (in: hProv=0x6735c0, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0075.703] CryptReleaseContext (hProv=0x6735c0, dwFlags=0x0) returned 1 [0075.703] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0075.703] GetProcessHeap () returned 0x630000 [0075.703] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672d40 [0075.703] lstrlenA (lpString="010001") returned 6 [0075.703] GetProcessHeap () returned 0x630000 [0075.703] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0075.703] GetProcessHeap () returned 0x630000 [0075.703] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673070 [0075.703] GetProcessHeap () returned 0x630000 [0075.703] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65eb20 [0075.703] GetProcessHeap () returned 0x630000 [0075.703] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673070 | out: hHeap=0x630000) returned 1 [0075.703] GetProcessHeap () returned 0x630000 [0075.703] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0075.703] GetProcessHeap () returned 0x630000 [0075.703] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x6570f8 [0075.703] GetProcessHeap () returned 0x630000 [0075.703] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a378 [0075.703] GetProcessHeap () returned 0x630000 [0075.703] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0075.703] GetProcessHeap () returned 0x630000 [0075.703] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0075.703] GetProcessHeap () returned 0x630000 [0075.703] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0075.703] GetProcessHeap () returned 0x630000 [0075.703] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673290 [0075.703] GetProcessHeap () returned 0x630000 [0075.703] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657440 [0075.703] GetProcessHeap () returned 0x630000 [0075.703] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.703] GetProcessHeap () returned 0x630000 [0075.703] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0075.703] GetProcessHeap () returned 0x630000 [0075.704] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dfe0 [0075.704] GetProcessHeap () returned 0x630000 [0075.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673290 | out: hHeap=0x630000) returned 1 [0075.704] GetProcessHeap () returned 0x630000 [0075.704] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0075.704] GetProcessHeap () returned 0x630000 [0075.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0075.704] GetProcessHeap () returned 0x630000 [0075.704] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.704] GetProcessHeap () returned 0x630000 [0075.704] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cfd0 [0075.704] GetProcessHeap () returned 0x630000 [0075.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.704] GetProcessHeap () returned 0x630000 [0075.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.704] GetProcessHeap () returned 0x630000 [0075.704] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.704] GetProcessHeap () returned 0x630000 [0075.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.704] GetProcessHeap () returned 0x630000 [0075.704] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e610 [0075.704] GetProcessHeap () returned 0x630000 [0075.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cfd0 | out: hHeap=0x630000) returned 1 [0075.704] GetProcessHeap () returned 0x630000 [0075.704] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0075.704] GetProcessHeap () returned 0x630000 [0075.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0075.704] GetProcessHeap () returned 0x630000 [0075.704] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a278 [0075.704] GetProcessHeap () returned 0x630000 [0075.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a278 | out: hHeap=0x630000) returned 1 [0075.704] GetProcessHeap () returned 0x630000 [0075.704] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.704] GetProcessHeap () returned 0x630000 [0075.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.704] GetProcessHeap () returned 0x630000 [0075.704] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0075.704] GetProcessHeap () returned 0x630000 [0075.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0075.704] GetProcessHeap () returned 0x630000 [0075.704] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0075.704] GetProcessHeap () returned 0x630000 [0075.704] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0075.705] GetProcessHeap () returned 0x630000 [0075.705] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0075.705] GetProcessHeap () returned 0x630000 [0075.705] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0075.705] GetProcessHeap () returned 0x630000 [0075.705] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.705] GetProcessHeap () returned 0x630000 [0075.705] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.705] GetProcessHeap () returned 0x630000 [0075.705] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.705] GetProcessHeap () returned 0x630000 [0075.705] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.705] GetProcessHeap () returned 0x630000 [0075.705] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.705] GetProcessHeap () returned 0x630000 [0075.705] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.705] GetProcessHeap () returned 0x630000 [0075.705] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0075.705] GetProcessHeap () returned 0x630000 [0075.705] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0075.705] GetProcessHeap () returned 0x630000 [0075.705] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.705] GetProcessHeap () returned 0x630000 [0075.705] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.705] GetProcessHeap () returned 0x630000 [0075.705] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.705] GetProcessHeap () returned 0x630000 [0075.705] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.705] GetProcessHeap () returned 0x630000 [0075.705] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.705] GetProcessHeap () returned 0x630000 [0075.705] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.705] GetProcessHeap () returned 0x630000 [0075.705] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0075.705] GetProcessHeap () returned 0x630000 [0075.705] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0075.705] GetProcessHeap () returned 0x630000 [0075.705] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.705] GetProcessHeap () returned 0x630000 [0075.705] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.706] GetProcessHeap () returned 0x630000 [0075.706] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.706] GetProcessHeap () returned 0x630000 [0075.706] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.706] GetProcessHeap () returned 0x630000 [0075.706] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.706] GetProcessHeap () returned 0x630000 [0075.706] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.706] GetProcessHeap () returned 0x630000 [0075.706] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.706] GetProcessHeap () returned 0x630000 [0075.706] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.706] GetProcessHeap () returned 0x630000 [0075.706] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.706] GetProcessHeap () returned 0x630000 [0075.706] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.706] GetProcessHeap () returned 0x630000 [0075.706] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.706] GetProcessHeap () returned 0x630000 [0075.706] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.706] GetProcessHeap () returned 0x630000 [0075.706] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0075.706] GetProcessHeap () returned 0x630000 [0075.706] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0075.706] GetProcessHeap () returned 0x630000 [0075.706] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.706] GetProcessHeap () returned 0x630000 [0075.706] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.706] GetProcessHeap () returned 0x630000 [0075.706] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0075.706] GetProcessHeap () returned 0x630000 [0075.706] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0075.706] GetProcessHeap () returned 0x630000 [0075.706] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0075.706] GetProcessHeap () returned 0x630000 [0075.706] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0075.706] GetProcessHeap () returned 0x630000 [0075.707] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.707] GetProcessHeap () returned 0x630000 [0075.707] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.707] GetProcessHeap () returned 0x630000 [0075.707] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.707] GetProcessHeap () returned 0x630000 [0075.707] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.707] GetProcessHeap () returned 0x630000 [0075.707] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0075.707] GetProcessHeap () returned 0x630000 [0075.707] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0075.707] GetProcessHeap () returned 0x630000 [0075.707] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0075.707] GetProcessHeap () returned 0x630000 [0075.707] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0075.707] GetProcessHeap () returned 0x630000 [0075.707] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0075.707] GetProcessHeap () returned 0x630000 [0075.707] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.707] GetProcessHeap () returned 0x630000 [0075.707] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0075.707] GetProcessHeap () returned 0x630000 [0075.707] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0075.707] GetProcessHeap () returned 0x630000 [0075.707] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0075.707] GetProcessHeap () returned 0x630000 [0075.707] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0075.707] GetProcessHeap () returned 0x630000 [0075.707] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.707] GetProcessHeap () returned 0x630000 [0075.707] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.707] GetProcessHeap () returned 0x630000 [0075.707] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.707] GetProcessHeap () returned 0x630000 [0075.707] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.707] GetProcessHeap () returned 0x630000 [0075.707] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.707] GetProcessHeap () returned 0x630000 [0075.707] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.707] GetProcessHeap () returned 0x630000 [0075.707] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0075.708] GetProcessHeap () returned 0x630000 [0075.708] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0075.708] GetProcessHeap () returned 0x630000 [0075.708] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2f8 [0075.708] GetProcessHeap () returned 0x630000 [0075.708] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2f8 | out: hHeap=0x630000) returned 1 [0075.708] GetProcessHeap () returned 0x630000 [0075.708] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.708] GetProcessHeap () returned 0x630000 [0075.708] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.708] GetProcessHeap () returned 0x630000 [0075.708] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.708] GetProcessHeap () returned 0x630000 [0075.708] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.708] GetProcessHeap () returned 0x630000 [0075.708] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.708] GetProcessHeap () returned 0x630000 [0075.708] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.708] GetProcessHeap () returned 0x630000 [0075.708] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0075.708] GetProcessHeap () returned 0x630000 [0075.708] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0075.708] GetProcessHeap () returned 0x630000 [0075.708] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.708] GetProcessHeap () returned 0x630000 [0075.708] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.708] GetProcessHeap () returned 0x630000 [0075.708] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.708] GetProcessHeap () returned 0x630000 [0075.708] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.708] GetProcessHeap () returned 0x630000 [0075.708] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0075.708] GetProcessHeap () returned 0x630000 [0075.708] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0075.708] GetProcessHeap () returned 0x630000 [0075.708] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0075.708] GetProcessHeap () returned 0x630000 [0075.708] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0075.708] GetProcessHeap () returned 0x630000 [0075.708] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0075.709] GetProcessHeap () returned 0x630000 [0075.709] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0075.709] GetProcessHeap () returned 0x630000 [0075.709] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0075.709] GetProcessHeap () returned 0x630000 [0075.709] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0075.709] GetProcessHeap () returned 0x630000 [0075.709] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0075.709] GetProcessHeap () returned 0x630000 [0075.709] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.709] GetProcessHeap () returned 0x630000 [0075.709] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672d40 | out: hHeap=0x630000) returned 1 [0075.709] WriteFile (in: hFile=0x230, lpBuffer=0x673bb8*, nNumberOfBytesToWrite=0x384, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673bb8*, lpNumberOfBytesWritten=0x243d864*=0x384, lpOverlapped=0x0) returned 1 [0075.712] GetProcessHeap () returned 0x630000 [0075.712] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x673bb8, Size=0x30) returned 0x673bb8 [0075.712] GetProcessHeap () returned 0x630000 [0075.712] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0075.712] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.712] GetProcessHeap () returned 0x630000 [0075.712] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a0) returned 0x63f408 [0075.712] ReadFile (in: hFile=0x230, lpBuffer=0x63f408, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x63f408*, lpNumberOfBytesRead=0x243d7e8*=0x1a0, lpOverlapped=0x0) returned 1 [0075.712] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.712] WriteFile (in: hFile=0x230, lpBuffer=0x63f408*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x63f408*, lpNumberOfBytesWritten=0x243d7e4*=0x1a0, lpOverlapped=0x0) returned 1 [0075.713] GetProcessHeap () returned 0x630000 [0075.713] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63f408 | out: hHeap=0x630000) returned 1 [0075.713] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.714] WriteFile (in: hFile=0x230, lpBuffer=0x673bb8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673bb8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0075.716] CloseHandle (hObject=0x230) returned 1 [0075.716] GetProcessHeap () returned 0x630000 [0075.716] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0075.716] GetProcessHeap () returned 0x630000 [0075.716] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655418 | out: hHeap=0x630000) returned 1 [0075.716] GetProcessHeap () returned 0x630000 [0075.716] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673538 | out: hHeap=0x630000) returned 1 [0075.716] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\Contacts\\desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Contacts\\desktop.ini") returned="C:\\Users\\FD1HVy\\Contacts\\desktop.ini" [0075.716] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Contacts\\desktop.ini", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\Contacts\\desktop.ini.happythreechoose") returned="C:\\Users\\FD1HVy\\Contacts\\desktop.ini.happythreechoose" [0075.716] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Contacts\\desktop.ini" (normalized: "c:\\users\\fd1hvy\\contacts\\desktop.ini"), lpNewFileName="C:\\Users\\FD1HVy\\Contacts\\desktop.ini.happythreechoose" (normalized: "c:\\users\\fd1hvy\\contacts\\desktop.ini.happythreechoose"), dwFlags=0x1) returned 1 [0075.717] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Contacts\\desktop.ini" | out: pszPath="C:\\Users\\FD1HVy\\Contacts") returned 1 [0075.717] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Contacts" | out: pszPath="C:\\Users\\FD1HVy\\Contacts\\") returned="" [0075.717] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Contacts\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\Contacts\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\Contacts\\Decryption INFO.html" [0075.717] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Contacts\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\contacts\\decryption info.html")) returned 0xffffffff [0075.717] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Contacts\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\contacts\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0075.718] GetProcessHeap () returned 0x630000 [0075.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655418 [0075.718] GetProcessHeap () returned 0x630000 [0075.718] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672a10 [0075.725] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.726] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.726] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.726] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.726] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.726] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.726] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.727] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.727] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.727] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.727] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.727] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.727] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.727] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.727] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.727] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.727] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.727] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.727] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.727] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.728] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.728] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.728] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.728] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.728] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.728] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.728] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.728] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.728] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.728] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.728] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.728] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.728] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.729] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.729] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.729] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.729] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.729] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.729] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.729] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.730] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.730] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.730] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.730] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.730] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.730] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.730] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.730] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.730] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.730] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.730] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.730] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.730] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.730] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.731] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.731] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.731] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.731] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.731] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.731] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.731] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.731] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.731] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.731] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.731] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.731] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.731] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.731] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.731] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.732] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.732] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.732] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.732] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.732] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.732] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.732] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.732] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.732] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.732] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.732] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.732] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.732] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.732] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.732] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.733] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.733] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.733] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.733] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.733] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.733] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.733] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.733] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.733] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.733] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.733] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.744] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.744] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.744] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.744] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.744] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.744] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.744] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.745] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.745] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.745] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.745] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.745] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.745] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.745] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.745] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.745] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.745] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.745] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.745] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.745] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.745] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.746] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.746] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.746] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.746] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.746] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.746] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.746] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.746] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.746] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.746] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.746] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.746] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.746] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.746] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.747] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.747] GetProcessHeap () returned 0x630000 [0075.747] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655418 | out: hHeap=0x630000) returned 1 [0075.747] GetProcessHeap () returned 0x630000 [0075.747] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672a10 | out: hHeap=0x630000) returned 1 [0075.747] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0075.747] GetProcessHeap () returned 0x630000 [0075.747] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6558c8 [0075.747] GetProcessHeap () returned 0x630000 [0075.747] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673428 [0075.754] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.754] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.754] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.754] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.754] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.754] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.754] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.754] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.754] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.754] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.755] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.755] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.755] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.755] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.755] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.755] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.755] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.755] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.755] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.755] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.755] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.755] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.755] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.755] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.756] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.756] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.756] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.756] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.756] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.756] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.756] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.756] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.756] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.756] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.756] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.756] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.756] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.756] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.757] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.757] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.757] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.757] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.757] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.757] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.757] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.757] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.757] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.757] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.757] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.757] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.757] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.757] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.757] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.758] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.758] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.758] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.758] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.758] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.758] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.758] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.758] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.758] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.758] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.758] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.758] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.758] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.758] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.759] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.759] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.759] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.759] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.759] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.759] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.759] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.759] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.759] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.759] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.759] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.760] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.760] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.760] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.760] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.760] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.761] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.761] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.761] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.761] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.761] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.761] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.761] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.761] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.761] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.761] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.761] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.761] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.761] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.761] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.762] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.762] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.762] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.762] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.762] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.762] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.762] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.762] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.762] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.762] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.762] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.762] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.762] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.762] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.763] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.763] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.763] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.763] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.763] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.763] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.763] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.764] GetProcessHeap () returned 0x630000 [0075.764] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6558c8 | out: hHeap=0x630000) returned 1 [0075.764] GetProcessHeap () returned 0x630000 [0075.764] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673428 | out: hHeap=0x630000) returned 1 [0075.764] CloseHandle (hObject=0x230) returned 1 [0075.764] GetProcessHeap () returned 0x630000 [0075.764] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0075.764] FindNextFileW (in: hFindFile=0x6487d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0075.764] FindClose (in: hFindFile=0x6487d0 | out: hFindFile=0x6487d0) returned 1 [0075.765] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\Application Data\\" | out: lpString1="C:\\Users\\FD1HVy\\Application Data\\") returned="C:\\Users\\FD1HVy\\Application Data\\" [0075.801] GetProcessHeap () returned 0x630000 [0075.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65fca0 | out: hHeap=0x630000) returned 1 [0075.801] GetProcessHeap () returned 0x630000 [0075.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0075.801] lstrlenW (lpString="C:\\Users\\FD1HVy\\Application Data\\") returned 33 [0075.801] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Application Data\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Application Data\\*") returned="C:\\Users\\FD1HVy\\Application Data\\*" [0075.801] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Application Data\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0xffffffff [0075.801] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\AppData\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\") returned="C:\\Users\\FD1HVy\\AppData\\" [0075.802] GetProcessHeap () returned 0x630000 [0075.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x648710 | out: hHeap=0x630000) returned 1 [0075.802] GetProcessHeap () returned 0x630000 [0075.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0075.802] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\") returned 24 [0075.802] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\*") returned="C:\\Users\\FD1HVy\\AppData\\*" [0075.802] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3b5a0677, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3b5a0677, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648bd0 [0075.802] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0075.802] FindNextFileW (in: hFindFile=0x648bd0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3b5a0677, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3b5a0677, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.802] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0075.802] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0075.802] FindNextFileW (in: hFindFile=0x648bd0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x485a6467, ftLastAccessTime.dwHighDateTime=0x1d5dbe3, ftLastWriteTime.dwLowDateTime=0x485a6467, ftLastWriteTime.dwHighDateTime=0x1d5dbe3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1 [0075.802] lstrcmpiW (lpString1="Local", lpString2=".") returned 1 [0075.802] lstrcmpiW (lpString1="Local", lpString2="..") returned 1 [0075.802] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\", lpString2="Local" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Local") returned="C:\\Users\\FD1HVy\\AppData\\Local" [0075.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Local", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0075.802] GetProcessHeap () returned 0x630000 [0075.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6) returned 0x65a338 [0075.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Local", cchWideChar=-1, lpMultiByteStr=0x65a338, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Local", lpUsedDefaultChar=0x0) returned 6 [0075.802] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0075.802] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0075.802] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0075.802] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0075.802] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0075.802] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0075.802] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0075.802] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0075.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0075.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0075.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0075.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0075.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0075.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0075.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0075.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0075.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0075.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0075.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0075.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0075.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0075.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0075.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0075.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0075.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0075.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0075.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0075.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0075.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0075.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0075.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0075.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0075.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0075.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0075.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0075.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0075.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0075.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0075.804] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0075.804] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0075.804] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0075.804] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0075.804] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0075.804] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Local", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Local\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\" [0075.804] GetProcessHeap () returned 0x630000 [0075.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a278 [0075.804] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Local\\") returned 30 [0075.804] GetProcessHeap () returned 0x630000 [0075.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3e) returned 0x642238 [0075.804] lstrcpyW (in: lpString1=0x642238, lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Local\\") returned="C:\\Users\\FD1HVy\\AppData\\Local\\" [0075.804] GetProcessHeap () returned 0x630000 [0075.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0075.804] FindNextFileW (in: hFindFile=0x648bd0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34f2b3d6, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xb373310b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb373310b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="LocalLow", cAlternateFileName="")) returned 1 [0075.804] lstrcmpiW (lpString1="LocalLow", lpString2=".") returned 1 [0075.804] lstrcmpiW (lpString1="LocalLow", lpString2="..") returned 1 [0075.804] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\", lpString2="LocalLow" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\LocalLow") returned="C:\\Users\\FD1HVy\\AppData\\LocalLow" [0075.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LocalLow", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0075.804] GetProcessHeap () returned 0x630000 [0075.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9) returned 0x64c9f0 [0075.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="LocalLow", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LocalLow", lpUsedDefaultChar=0x0) returned 9 [0075.804] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="LocalLow", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0075.804] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="LocalLow", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0075.804] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="LocalLow", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0075.804] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="LocalLow", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0075.804] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="LocalLow", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0075.805] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="LocalLow", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0075.805] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="LocalLow", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0075.805] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="LocalLow", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0075.805] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="LocalLow", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0075.805] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="LocalLow", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0075.805] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="LocalLow", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0075.805] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="LocalLow", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0075.805] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="LocalLow", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0075.805] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="LocalLow", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0075.805] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="LocalLow", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0075.805] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="LocalLow", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0075.805] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="LocalLow", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0075.805] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="LocalLow", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0075.805] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="LocalLow", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0075.805] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="LocalLow", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0075.805] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="LocalLow", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0075.805] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="LocalLow", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0075.805] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="LocalLow", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0075.805] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="LocalLow", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0075.805] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="LocalLow", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0075.805] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="LocalLow", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0075.805] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="LocalLow", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0075.805] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="LocalLow", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0075.805] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="LocalLow", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0075.805] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="LocalLow", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0075.805] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="LocalLow", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0075.805] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="LocalLow", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0075.805] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="LocalLow", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0075.805] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="LocalLow", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0075.805] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="LocalLow", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0075.805] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="LocalLow", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0075.805] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="LocalLow", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0075.805] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="LocalLow", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0075.806] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="LocalLow", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0075.806] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="LocalLow", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0075.806] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="LocalLow", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0075.806] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="LocalLow", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0075.806] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="LocalLow", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0075.806] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\LocalLow", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\LocalLow\\") returned="C:\\Users\\FD1HVy\\AppData\\LocalLow\\" [0075.806] GetProcessHeap () returned 0x630000 [0075.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a2f8 [0075.806] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\LocalLow\\") returned 33 [0075.806] GetProcessHeap () returned 0x630000 [0075.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x44) returned 0x65fde0 [0075.806] lstrcpyW (in: lpString1=0x65fde0, lpString2="C:\\Users\\FD1HVy\\AppData\\LocalLow\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\LocalLow\\") returned="C:\\Users\\FD1HVy\\AppData\\LocalLow\\" [0075.806] GetProcessHeap () returned 0x630000 [0075.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0075.806] FindNextFileW (in: hFindFile=0x648bd0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3aa34258, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3aa34258, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1 [0075.806] lstrcmpiW (lpString1="Roaming", lpString2=".") returned 1 [0075.806] lstrcmpiW (lpString1="Roaming", lpString2="..") returned 1 [0075.806] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\", lpString2="Roaming" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming") returned="C:\\Users\\FD1HVy\\AppData\\Roaming" [0075.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Roaming", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0075.806] GetProcessHeap () returned 0x630000 [0075.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a328 [0075.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Roaming", cchWideChar=-1, lpMultiByteStr=0x65a328, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Roaming", lpUsedDefaultChar=0x0) returned 8 [0075.806] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Roaming", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0075.806] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Roaming", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0075.806] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Roaming", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0075.806] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Roaming", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0075.806] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Roaming", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0075.806] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Roaming", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0075.806] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Roaming", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0075.806] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Roaming", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0075.806] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Roaming", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0075.806] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Roaming", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0075.806] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Roaming", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0075.806] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Roaming", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0075.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Roaming", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0075.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Roaming", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0075.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Roaming", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0075.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Roaming", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0075.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Roaming", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0075.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Roaming", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0075.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Roaming", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0075.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Roaming", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0075.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Roaming", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0075.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Roaming", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0075.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Roaming", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0075.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Roaming", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0075.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Roaming", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0075.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Roaming", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0075.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Roaming", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0075.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Roaming", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0075.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Roaming", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0075.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Roaming", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0075.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Roaming", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0075.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Roaming", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0075.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Roaming", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0075.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Roaming", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0075.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Roaming", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0075.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Roaming", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0075.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Roaming", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0075.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Roaming", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0075.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Roaming", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0075.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Roaming", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0075.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Roaming", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0075.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Roaming", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0075.807] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Roaming", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0075.807] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\" [0075.807] GetProcessHeap () returned 0x630000 [0075.807] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a378 [0075.808] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned 32 [0075.808] GetProcessHeap () returned 0x630000 [0075.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x42) returned 0x65fe30 [0075.808] lstrcpyW (in: lpString1=0x65fe30, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\" [0075.808] GetProcessHeap () returned 0x630000 [0075.808] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0075.808] FindNextFileW (in: hFindFile=0x648bd0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3aa34258, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3aa34258, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0 [0075.808] FindClose (in: hFindFile=0x648bd0 | out: hFindFile=0x648bd0) returned 1 [0075.808] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\" [0075.808] GetProcessHeap () returned 0x630000 [0075.808] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65fe30 | out: hHeap=0x630000) returned 1 [0075.808] GetProcessHeap () returned 0x630000 [0075.808] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0075.808] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned 32 [0075.808] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\*" [0075.808] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3aa34258, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3aa34258, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648890 [0075.808] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0075.808] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3aa34258, ftLastAccessTime.dwHighDateTime=0x1d5d816, ftLastWriteTime.dwLowDateTime=0x3aa34258, ftLastWriteTime.dwHighDateTime=0x1d5d816, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.808] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0075.808] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0075.808] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6f2d010, ftCreationTime.dwHighDateTime=0x1d5d321, ftLastAccessTime.dwLowDateTime=0x8fc2380, ftLastAccessTime.dwHighDateTime=0x1d5c7a9, ftLastWriteTime.dwLowDateTime=0x8fc2380, ftLastWriteTime.dwHighDateTime=0x1d5c7a9, nFileSizeHigh=0x0, nFileSizeLow=0xeba9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0BcvL.wav", cAlternateFileName="")) returned 1 [0075.808] lstrcmpiW (lpString1="0BcvL.wav", lpString2=".") returned 1 [0075.808] lstrcmpiW (lpString1="0BcvL.wav", lpString2="..") returned 1 [0075.808] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="0BcvL.wav" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\0BcvL.wav") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\0BcvL.wav" [0075.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="0BcvL.wav", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0075.808] GetProcessHeap () returned 0x630000 [0075.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x64c9f0 [0075.809] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="0BcvL.wav", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0BcvL.wav", lpUsedDefaultChar=0x0) returned 10 [0075.809] lstrlenA (lpString="0BcvL.wav") returned 9 [0075.809] lstrlenA (lpString=".happythreechoose") returned 17 [0075.809] lstrcmpiW (lpString1="0BcvL.wav", lpString2="Decryption INFO.html") returned -1 [0075.809] lstrcmpiW (lpString1="0BcvL.wav", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned -1 [0075.809] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0075.809] lstrcmpiW (lpString1="0BcvL.wav", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0075.809] GetProcessHeap () returned 0x630000 [0075.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0075.809] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\0BcvL.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\0bcvl.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0075.809] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=60329) returned 1 [0075.809] GetProcessHeap () returned 0x630000 [0075.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6559b8 [0075.809] GetProcessHeap () returned 0x630000 [0075.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6736d0 [0075.809] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\0BcvL.wav") returned 41 [0075.809] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.809] GetProcessHeap () returned 0x630000 [0075.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0075.809] GetProcessHeap () returned 0x630000 [0075.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x673bf0 [0075.810] lstrlenA (lpString="rsa_encrypt") returned 11 [0075.810] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x672cb8) returned 1 [0075.810] CryptGenRandom (in: hProv=0x672cb8, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0075.811] CryptReleaseContext (hProv=0x672cb8, dwFlags=0x0) returned 1 [0075.811] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0075.811] GetProcessHeap () returned 0x630000 [0075.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672cb8 [0075.811] lstrlenA (lpString="010001") returned 6 [0075.811] GetProcessHeap () returned 0x630000 [0075.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a318 [0075.811] GetProcessHeap () returned 0x630000 [0075.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6735c0 [0075.811] GetProcessHeap () returned 0x630000 [0075.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e100 [0075.811] GetProcessHeap () returned 0x630000 [0075.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6735c0 | out: hHeap=0x630000) returned 1 [0075.811] GetProcessHeap () returned 0x630000 [0075.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0075.811] GetProcessHeap () returned 0x630000 [0075.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657558 [0075.811] GetProcessHeap () returned 0x630000 [0075.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0075.811] GetProcessHeap () returned 0x630000 [0075.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0075.811] GetProcessHeap () returned 0x630000 [0075.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0075.811] GetProcessHeap () returned 0x630000 [0075.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0075.811] GetProcessHeap () returned 0x630000 [0075.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672d40 [0075.811] GetProcessHeap () returned 0x630000 [0075.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657788 [0075.811] GetProcessHeap () returned 0x630000 [0075.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0075.811] GetProcessHeap () returned 0x630000 [0075.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0075.811] GetProcessHeap () returned 0x630000 [0075.812] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dec0 [0075.812] GetProcessHeap () returned 0x630000 [0075.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672d40 | out: hHeap=0x630000) returned 1 [0075.812] GetProcessHeap () returned 0x630000 [0075.812] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0075.812] GetProcessHeap () returned 0x630000 [0075.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0075.812] GetProcessHeap () returned 0x630000 [0075.812] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0075.812] GetProcessHeap () returned 0x630000 [0075.812] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65d000 [0075.812] GetProcessHeap () returned 0x630000 [0075.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0075.812] GetProcessHeap () returned 0x630000 [0075.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0075.812] GetProcessHeap () returned 0x630000 [0075.812] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0075.812] GetProcessHeap () returned 0x630000 [0075.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0075.812] GetProcessHeap () returned 0x630000 [0075.812] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e730 [0075.812] GetProcessHeap () returned 0x630000 [0075.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65d000 | out: hHeap=0x630000) returned 1 [0075.812] GetProcessHeap () returned 0x630000 [0075.812] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0075.812] GetProcessHeap () returned 0x630000 [0075.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0075.812] GetProcessHeap () returned 0x630000 [0075.812] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.812] GetProcessHeap () returned 0x630000 [0075.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.812] GetProcessHeap () returned 0x630000 [0075.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.813] GetProcessHeap () returned 0x630000 [0075.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.813] GetProcessHeap () returned 0x630000 [0075.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.813] GetProcessHeap () returned 0x630000 [0075.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.813] GetProcessHeap () returned 0x630000 [0075.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0075.813] GetProcessHeap () returned 0x630000 [0075.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0075.813] GetProcessHeap () returned 0x630000 [0075.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0075.813] GetProcessHeap () returned 0x630000 [0075.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0075.813] GetProcessHeap () returned 0x630000 [0075.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.813] GetProcessHeap () returned 0x630000 [0075.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.813] GetProcessHeap () returned 0x630000 [0075.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0075.813] GetProcessHeap () returned 0x630000 [0075.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0075.813] GetProcessHeap () returned 0x630000 [0075.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0075.813] GetProcessHeap () returned 0x630000 [0075.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0075.813] GetProcessHeap () returned 0x630000 [0075.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0075.813] GetProcessHeap () returned 0x630000 [0075.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0075.813] GetProcessHeap () returned 0x630000 [0075.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.813] GetProcessHeap () returned 0x630000 [0075.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.813] GetProcessHeap () returned 0x630000 [0075.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0075.813] GetProcessHeap () returned 0x630000 [0075.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0075.813] GetProcessHeap () returned 0x630000 [0075.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0075.814] GetProcessHeap () returned 0x630000 [0075.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0075.814] GetProcessHeap () returned 0x630000 [0075.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0075.814] GetProcessHeap () returned 0x630000 [0075.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0075.814] GetProcessHeap () returned 0x630000 [0075.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0075.814] GetProcessHeap () returned 0x630000 [0075.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0075.814] GetProcessHeap () returned 0x630000 [0075.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0075.814] GetProcessHeap () returned 0x630000 [0075.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0075.814] GetProcessHeap () returned 0x630000 [0075.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0075.814] GetProcessHeap () returned 0x630000 [0075.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0075.814] GetProcessHeap () returned 0x630000 [0075.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0075.814] GetProcessHeap () returned 0x630000 [0075.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0075.814] GetProcessHeap () returned 0x630000 [0075.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0075.814] GetProcessHeap () returned 0x630000 [0075.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0075.814] GetProcessHeap () returned 0x630000 [0075.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0075.814] GetProcessHeap () returned 0x630000 [0075.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0075.814] GetProcessHeap () returned 0x630000 [0075.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0075.814] GetProcessHeap () returned 0x630000 [0075.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0075.814] GetProcessHeap () returned 0x630000 [0075.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0075.814] GetProcessHeap () returned 0x630000 [0075.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0075.815] GetProcessHeap () returned 0x630000 [0075.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.815] GetProcessHeap () returned 0x630000 [0075.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.815] GetProcessHeap () returned 0x630000 [0075.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0075.815] GetProcessHeap () returned 0x630000 [0075.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0075.815] GetProcessHeap () returned 0x630000 [0075.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0075.815] GetProcessHeap () returned 0x630000 [0075.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0075.815] GetProcessHeap () returned 0x630000 [0075.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0075.815] GetProcessHeap () returned 0x630000 [0075.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0075.815] GetProcessHeap () returned 0x630000 [0075.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0075.815] GetProcessHeap () returned 0x630000 [0075.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0075.815] GetProcessHeap () returned 0x630000 [0075.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0075.815] GetProcessHeap () returned 0x630000 [0075.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0075.815] GetProcessHeap () returned 0x630000 [0075.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0075.815] GetProcessHeap () returned 0x630000 [0075.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0075.815] GetProcessHeap () returned 0x630000 [0075.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0075.815] GetProcessHeap () returned 0x630000 [0075.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0075.815] GetProcessHeap () returned 0x630000 [0075.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0075.815] GetProcessHeap () returned 0x630000 [0075.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0075.815] GetProcessHeap () returned 0x630000 [0075.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0075.815] GetProcessHeap () returned 0x630000 [0075.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0075.815] GetProcessHeap () returned 0x630000 [0075.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0075.816] GetProcessHeap () returned 0x630000 [0075.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0075.816] GetProcessHeap () returned 0x630000 [0075.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0075.816] GetProcessHeap () returned 0x630000 [0075.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0075.816] GetProcessHeap () returned 0x630000 [0075.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.816] GetProcessHeap () returned 0x630000 [0075.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.816] GetProcessHeap () returned 0x630000 [0075.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0075.816] GetProcessHeap () returned 0x630000 [0075.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0075.816] GetProcessHeap () returned 0x630000 [0075.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0075.816] GetProcessHeap () returned 0x630000 [0075.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0075.816] GetProcessHeap () returned 0x630000 [0075.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0075.816] GetProcessHeap () returned 0x630000 [0075.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0075.816] GetProcessHeap () returned 0x630000 [0075.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0075.816] GetProcessHeap () returned 0x630000 [0075.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0075.816] GetProcessHeap () returned 0x630000 [0075.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0075.816] GetProcessHeap () returned 0x630000 [0075.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0075.816] GetProcessHeap () returned 0x630000 [0075.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0075.816] GetProcessHeap () returned 0x630000 [0075.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0075.816] GetProcessHeap () returned 0x630000 [0075.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0075.816] GetProcessHeap () returned 0x630000 [0075.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0075.816] GetProcessHeap () returned 0x630000 [0075.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0075.817] GetProcessHeap () returned 0x630000 [0075.817] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0075.817] GetProcessHeap () returned 0x630000 [0075.817] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0075.817] GetProcessHeap () returned 0x630000 [0075.817] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0075.817] GetProcessHeap () returned 0x630000 [0075.817] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0075.817] GetProcessHeap () returned 0x630000 [0075.817] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0075.817] GetProcessHeap () returned 0x630000 [0075.817] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0075.817] GetProcessHeap () returned 0x630000 [0075.817] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0075.817] GetProcessHeap () returned 0x630000 [0075.817] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0075.817] GetProcessHeap () returned 0x630000 [0075.817] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0075.817] GetProcessHeap () returned 0x630000 [0075.817] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672cb8 | out: hHeap=0x630000) returned 1 [0075.817] WriteFile (in: hFile=0x230, lpBuffer=0x673bf0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673bf0*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0075.980] GetProcessHeap () returned 0x630000 [0075.980] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x673bf0, Size=0x30) returned 0x673bf0 [0075.980] GetProcessHeap () returned 0x630000 [0075.980] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0075.980] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.980] GetProcessHeap () returned 0x630000 [0075.980] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xeba9) returned 0x673c28 [0075.981] ReadFile (in: hFile=0x230, lpBuffer=0x673c28, nNumberOfBytesToRead=0xeba9, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x673c28*, lpNumberOfBytesRead=0x243d7e8*=0xeba9, lpOverlapped=0x0) returned 1 [0075.983] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.983] WriteFile (in: hFile=0x230, lpBuffer=0x673c28*, nNumberOfBytesToWrite=0xeba9, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x673c28*, lpNumberOfBytesWritten=0x243d7e4*=0xeba9, lpOverlapped=0x0) returned 1 [0075.984] GetProcessHeap () returned 0x630000 [0075.984] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673c28 | out: hHeap=0x630000) returned 1 [0075.984] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0075.984] WriteFile (in: hFile=0x230, lpBuffer=0x673bf0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673bf0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0075.985] CloseHandle (hObject=0x230) returned 1 [0075.986] GetProcessHeap () returned 0x630000 [0075.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0075.986] GetProcessHeap () returned 0x630000 [0075.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6559b8 | out: hHeap=0x630000) returned 1 [0075.986] GetProcessHeap () returned 0x630000 [0075.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6736d0 | out: hHeap=0x630000) returned 1 [0075.986] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\0BcvL.wav" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\0BcvL.wav") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\0BcvL.wav" [0075.986] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\0BcvL.wav", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\0BcvL.wav.happythreechoose") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\0BcvL.wav.happythreechoose" [0075.986] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\0BcvL.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\0bcvl.wav"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\0BcvL.wav.happythreechoose" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\0bcvl.wav.happythreechoose"), dwFlags=0x1) returned 1 [0075.987] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\0BcvL.wav" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0075.987] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="" [0075.987] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" [0075.987] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\decryption info.html")) returned 0xffffffff [0075.987] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0075.988] GetProcessHeap () returned 0x630000 [0075.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655580 [0075.988] GetProcessHeap () returned 0x630000 [0075.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6733a0 [0075.995] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.996] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.996] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.996] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.996] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.996] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.996] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.996] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.996] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.997] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.997] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.997] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.997] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.997] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.997] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.997] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.997] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.997] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.997] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.997] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.997] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.997] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.998] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.998] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.998] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.998] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.998] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.998] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.998] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.998] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.998] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.998] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.998] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.998] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.998] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.999] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.999] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.005] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.005] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.006] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.006] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.006] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.006] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.006] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.006] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.006] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.006] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.006] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.006] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.006] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.006] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.006] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.007] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.007] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.007] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.007] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.007] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.007] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.007] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.007] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.007] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.007] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.007] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.007] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.007] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.007] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.008] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.008] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.008] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.008] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.008] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.008] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.008] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.008] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.008] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.008] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.008] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.008] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.009] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.009] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.009] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.009] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.009] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.009] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.009] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.009] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.009] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.009] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.009] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.010] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.010] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.010] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.010] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.010] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.010] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.010] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.010] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.010] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.010] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.010] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.010] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.010] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.011] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.011] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.011] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.011] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.011] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.011] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.011] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.011] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.011] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.011] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.011] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.011] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.012] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.012] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.012] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.012] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.012] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.012] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.012] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.012] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.012] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.012] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.013] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.013] GetProcessHeap () returned 0x630000 [0076.013] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655580 | out: hHeap=0x630000) returned 1 [0076.013] GetProcessHeap () returned 0x630000 [0076.013] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6733a0 | out: hHeap=0x630000) returned 1 [0076.013] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0076.013] GetProcessHeap () returned 0x630000 [0076.013] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655850 [0076.013] GetProcessHeap () returned 0x630000 [0076.013] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672e50 [0076.020] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.020] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.020] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.021] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.021] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.021] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.021] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.021] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.021] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.021] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.021] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.021] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.021] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.021] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.021] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.021] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.022] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.022] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.022] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.022] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.022] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.022] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.022] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.022] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.022] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.022] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.022] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.022] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.023] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.023] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.023] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.023] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.023] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.023] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.023] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.023] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.023] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.023] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.023] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.023] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.023] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.023] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.024] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.024] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.024] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.024] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.024] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.024] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.024] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.024] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.024] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.024] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.024] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.024] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.024] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.025] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.025] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.025] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.025] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.025] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.025] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.025] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.025] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.025] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.025] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.025] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.025] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.025] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.025] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.026] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.026] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.026] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.026] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.026] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.026] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.026] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.026] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.026] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.026] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.026] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.026] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.027] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.027] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.027] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.027] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.027] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.027] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.027] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.027] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.027] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.027] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.027] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.027] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.027] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.027] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.028] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.028] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.028] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.028] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.028] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.028] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.028] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.028] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.028] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.028] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.028] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.028] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.028] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.028] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.029] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.029] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.029] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.029] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.029] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.029] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.029] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.029] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.029] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.030] GetProcessHeap () returned 0x630000 [0076.030] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655850 | out: hHeap=0x630000) returned 1 [0076.030] GetProcessHeap () returned 0x630000 [0076.030] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672e50 | out: hHeap=0x630000) returned 1 [0076.030] CloseHandle (hObject=0x230) returned 1 [0076.030] GetProcessHeap () returned 0x630000 [0076.030] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0076.030] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3110500, ftCreationTime.dwHighDateTime=0x1d5d0b6, ftLastAccessTime.dwLowDateTime=0xae5b7f80, ftLastAccessTime.dwHighDateTime=0x1d5c9a0, ftLastWriteTime.dwLowDateTime=0xae5b7f80, ftLastWriteTime.dwHighDateTime=0x1d5c9a0, nFileSizeHigh=0x0, nFileSizeLow=0xb6f2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0JfOL.wav", cAlternateFileName="")) returned 1 [0076.030] lstrcmpiW (lpString1="0JfOL.wav", lpString2=".") returned 1 [0076.030] lstrcmpiW (lpString1="0JfOL.wav", lpString2="..") returned 1 [0076.098] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="0JfOL.wav" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\0JfOL.wav") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\0JfOL.wav" [0076.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="0JfOL.wav", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0076.098] GetProcessHeap () returned 0x630000 [0076.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x64c9f0 [0076.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="0JfOL.wav", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0JfOL.wav", lpUsedDefaultChar=0x0) returned 10 [0076.098] lstrlenA (lpString="0JfOL.wav") returned 9 [0076.098] lstrlenA (lpString=".happythreechoose") returned 17 [0076.098] lstrcmpiW (lpString1="0JfOL.wav", lpString2="Decryption INFO.html") returned -1 [0076.098] lstrcmpiW (lpString1="0JfOL.wav", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned -1 [0076.098] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0076.098] lstrcmpiW (lpString1="0JfOL.wav", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0076.098] GetProcessHeap () returned 0x630000 [0076.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x652000 [0076.098] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\0JfOL.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\0jfol.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0076.099] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=46834) returned 1 [0076.099] GetProcessHeap () returned 0x630000 [0076.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655aa8 [0076.099] GetProcessHeap () returned 0x630000 [0076.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672988 [0076.099] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\0JfOL.wav") returned 41 [0076.099] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0076.099] GetProcessHeap () returned 0x630000 [0076.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0076.099] GetProcessHeap () returned 0x630000 [0076.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x673c28 [0076.099] lstrlenA (lpString="rsa_encrypt") returned 11 [0076.099] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x673318) returned 1 [0076.099] CryptGenRandom (in: hProv=0x673318, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0076.099] CryptReleaseContext (hProv=0x673318, dwFlags=0x0) returned 1 [0076.100] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0076.100] GetProcessHeap () returned 0x630000 [0076.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672900 [0076.100] lstrlenA (lpString="010001") returned 6 [0076.100] GetProcessHeap () returned 0x630000 [0076.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a378 [0076.100] GetProcessHeap () returned 0x630000 [0076.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672dc8 [0076.100] GetProcessHeap () returned 0x630000 [0076.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e3d0 [0076.100] GetProcessHeap () returned 0x630000 [0076.100] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672dc8 | out: hHeap=0x630000) returned 1 [0076.100] GetProcessHeap () returned 0x630000 [0076.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e6a0 [0076.100] GetProcessHeap () returned 0x630000 [0076.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656950 [0076.100] GetProcessHeap () returned 0x630000 [0076.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3f8 [0076.100] GetProcessHeap () returned 0x630000 [0076.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0076.100] GetProcessHeap () returned 0x630000 [0076.100] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.100] GetProcessHeap () returned 0x630000 [0076.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0076.100] GetProcessHeap () returned 0x630000 [0076.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672cb8 [0076.100] GetProcessHeap () returned 0x630000 [0076.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656c98 [0076.100] GetProcessHeap () returned 0x630000 [0076.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0076.100] GetProcessHeap () returned 0x630000 [0076.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0076.100] GetProcessHeap () returned 0x630000 [0076.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e4f0 [0076.100] GetProcessHeap () returned 0x630000 [0076.100] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672cb8 | out: hHeap=0x630000) returned 1 [0076.100] GetProcessHeap () returned 0x630000 [0076.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0076.101] GetProcessHeap () returned 0x630000 [0076.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0076.101] GetProcessHeap () returned 0x630000 [0076.101] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0076.101] GetProcessHeap () returned 0x630000 [0076.101] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65ce68 [0076.101] GetProcessHeap () returned 0x630000 [0076.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0076.101] GetProcessHeap () returned 0x630000 [0076.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0076.101] GetProcessHeap () returned 0x630000 [0076.101] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0076.101] GetProcessHeap () returned 0x630000 [0076.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0076.101] GetProcessHeap () returned 0x630000 [0076.101] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65df50 [0076.101] GetProcessHeap () returned 0x630000 [0076.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ce68 | out: hHeap=0x630000) returned 1 [0076.101] GetProcessHeap () returned 0x630000 [0076.101] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0076.101] GetProcessHeap () returned 0x630000 [0076.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0076.101] GetProcessHeap () returned 0x630000 [0076.101] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.101] GetProcessHeap () returned 0x630000 [0076.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.101] GetProcessHeap () returned 0x630000 [0076.101] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.101] GetProcessHeap () returned 0x630000 [0076.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.101] GetProcessHeap () returned 0x630000 [0076.101] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0076.101] GetProcessHeap () returned 0x630000 [0076.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0076.101] GetProcessHeap () returned 0x630000 [0076.101] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.101] GetProcessHeap () returned 0x630000 [0076.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.101] GetProcessHeap () returned 0x630000 [0076.101] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.101] GetProcessHeap () returned 0x630000 [0076.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.102] GetProcessHeap () returned 0x630000 [0076.102] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.102] GetProcessHeap () returned 0x630000 [0076.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.102] GetProcessHeap () returned 0x630000 [0076.102] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.102] GetProcessHeap () returned 0x630000 [0076.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.102] GetProcessHeap () returned 0x630000 [0076.102] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.102] GetProcessHeap () returned 0x630000 [0076.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.102] GetProcessHeap () returned 0x630000 [0076.102] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0076.102] GetProcessHeap () returned 0x630000 [0076.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0076.102] GetProcessHeap () returned 0x630000 [0076.102] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0076.102] GetProcessHeap () returned 0x630000 [0076.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0076.102] GetProcessHeap () returned 0x630000 [0076.102] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0076.102] GetProcessHeap () returned 0x630000 [0076.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.102] GetProcessHeap () returned 0x630000 [0076.102] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.102] GetProcessHeap () returned 0x630000 [0076.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.102] GetProcessHeap () returned 0x630000 [0076.102] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.102] GetProcessHeap () returned 0x630000 [0076.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.102] GetProcessHeap () returned 0x630000 [0076.102] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.102] GetProcessHeap () returned 0x630000 [0076.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.102] GetProcessHeap () returned 0x630000 [0076.103] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.103] GetProcessHeap () returned 0x630000 [0076.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.103] GetProcessHeap () returned 0x630000 [0076.103] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.103] GetProcessHeap () returned 0x630000 [0076.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.103] GetProcessHeap () returned 0x630000 [0076.103] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.103] GetProcessHeap () returned 0x630000 [0076.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.103] GetProcessHeap () returned 0x630000 [0076.103] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.103] GetProcessHeap () returned 0x630000 [0076.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.103] GetProcessHeap () returned 0x630000 [0076.103] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0076.103] GetProcessHeap () returned 0x630000 [0076.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0076.103] GetProcessHeap () returned 0x630000 [0076.103] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0076.103] GetProcessHeap () returned 0x630000 [0076.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0076.103] GetProcessHeap () returned 0x630000 [0076.103] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.103] GetProcessHeap () returned 0x630000 [0076.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.103] GetProcessHeap () returned 0x630000 [0076.103] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.103] GetProcessHeap () returned 0x630000 [0076.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.103] GetProcessHeap () returned 0x630000 [0076.103] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.103] GetProcessHeap () returned 0x630000 [0076.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.103] GetProcessHeap () returned 0x630000 [0076.103] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.103] GetProcessHeap () returned 0x630000 [0076.104] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.104] GetProcessHeap () returned 0x630000 [0076.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0076.104] GetProcessHeap () returned 0x630000 [0076.104] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0076.104] GetProcessHeap () returned 0x630000 [0076.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.104] GetProcessHeap () returned 0x630000 [0076.104] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.104] GetProcessHeap () returned 0x630000 [0076.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.104] GetProcessHeap () returned 0x630000 [0076.104] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.104] GetProcessHeap () returned 0x630000 [0076.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.104] GetProcessHeap () returned 0x630000 [0076.104] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.104] GetProcessHeap () returned 0x630000 [0076.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.104] GetProcessHeap () returned 0x630000 [0076.104] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.104] GetProcessHeap () returned 0x630000 [0076.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.104] GetProcessHeap () returned 0x630000 [0076.104] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.104] GetProcessHeap () returned 0x630000 [0076.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.104] GetProcessHeap () returned 0x630000 [0076.104] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.104] GetProcessHeap () returned 0x630000 [0076.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.104] GetProcessHeap () returned 0x630000 [0076.104] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.104] GetProcessHeap () returned 0x630000 [0076.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.104] GetProcessHeap () returned 0x630000 [0076.104] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.104] GetProcessHeap () returned 0x630000 [0076.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.105] GetProcessHeap () returned 0x630000 [0076.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.105] GetProcessHeap () returned 0x630000 [0076.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.105] GetProcessHeap () returned 0x630000 [0076.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.105] GetProcessHeap () returned 0x630000 [0076.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.105] GetProcessHeap () returned 0x630000 [0076.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.105] GetProcessHeap () returned 0x630000 [0076.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0076.105] GetProcessHeap () returned 0x630000 [0076.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.105] GetProcessHeap () returned 0x630000 [0076.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.105] GetProcessHeap () returned 0x630000 [0076.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.105] GetProcessHeap () returned 0x630000 [0076.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0076.105] GetProcessHeap () returned 0x630000 [0076.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.105] GetProcessHeap () returned 0x630000 [0076.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.105] GetProcessHeap () returned 0x630000 [0076.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.105] GetProcessHeap () returned 0x630000 [0076.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0076.105] GetProcessHeap () returned 0x630000 [0076.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0076.105] GetProcessHeap () returned 0x630000 [0076.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0076.105] GetProcessHeap () returned 0x630000 [0076.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0076.105] GetProcessHeap () returned 0x630000 [0076.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0076.105] GetProcessHeap () returned 0x630000 [0076.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0076.105] GetProcessHeap () returned 0x630000 [0076.106] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0076.106] GetProcessHeap () returned 0x630000 [0076.106] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e6a0 | out: hHeap=0x630000) returned 1 [0076.106] GetProcessHeap () returned 0x630000 [0076.106] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0076.106] GetProcessHeap () returned 0x630000 [0076.106] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0076.106] GetProcessHeap () returned 0x630000 [0076.106] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0076.106] GetProcessHeap () returned 0x630000 [0076.106] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.106] GetProcessHeap () returned 0x630000 [0076.106] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672900 | out: hHeap=0x630000) returned 1 [0076.106] WriteFile (in: hFile=0x230, lpBuffer=0x673c28*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673c28*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0076.175] GetProcessHeap () returned 0x630000 [0076.175] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x673c28, Size=0x30) returned 0x673c28 [0076.175] GetProcessHeap () returned 0x630000 [0076.175] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0076.175] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0076.175] GetProcessHeap () returned 0x630000 [0076.175] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb6f2) returned 0x673c60 [0076.175] ReadFile (in: hFile=0x230, lpBuffer=0x673c60, nNumberOfBytesToRead=0xb6f2, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x673c60*, lpNumberOfBytesRead=0x243d7e8*=0xb6f2, lpOverlapped=0x0) returned 1 [0076.176] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0076.176] WriteFile (in: hFile=0x230, lpBuffer=0x673c60*, nNumberOfBytesToWrite=0xb6f2, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x673c60*, lpNumberOfBytesWritten=0x243d7e4*=0xb6f2, lpOverlapped=0x0) returned 1 [0076.244] GetProcessHeap () returned 0x630000 [0076.244] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673c60 | out: hHeap=0x630000) returned 1 [0076.245] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0076.245] WriteFile (in: hFile=0x230, lpBuffer=0x673c28*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673c28*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0076.247] CloseHandle (hObject=0x230) returned 1 [0076.247] GetProcessHeap () returned 0x630000 [0076.247] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x652000 | out: hHeap=0x630000) returned 1 [0076.247] GetProcessHeap () returned 0x630000 [0076.247] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655aa8 | out: hHeap=0x630000) returned 1 [0076.247] GetProcessHeap () returned 0x630000 [0076.247] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672988 | out: hHeap=0x630000) returned 1 [0076.247] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\0JfOL.wav" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\0JfOL.wav") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\0JfOL.wav" [0076.247] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\0JfOL.wav", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\0JfOL.wav.happythreechoose") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\0JfOL.wav.happythreechoose" [0076.247] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\0JfOL.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\0jfol.wav"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\0JfOL.wav.happythreechoose" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\0jfol.wav.happythreechoose"), dwFlags=0x1) returned 1 [0076.248] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\0JfOL.wav" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0076.248] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="" [0076.248] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" [0076.248] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\decryption info.html")) returned 0x20 [0076.248] GetProcessHeap () returned 0x630000 [0076.248] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0076.249] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x647b7040, ftCreationTime.dwHighDateTime=0x1d5d46e, ftLastAccessTime.dwLowDateTime=0x87254340, ftLastAccessTime.dwHighDateTime=0x1d5d4ab, ftLastWriteTime.dwLowDateTime=0x87254340, ftLastWriteTime.dwHighDateTime=0x1d5d4ab, nFileSizeHigh=0x0, nFileSizeLow=0x987c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4 Dt76jy3hp.flv", cAlternateFileName="4DT76J~1.FLV")) returned 1 [0076.249] lstrcmpiW (lpString1="4 Dt76jy3hp.flv", lpString2=".") returned 1 [0076.249] lstrcmpiW (lpString1="4 Dt76jy3hp.flv", lpString2="..") returned 1 [0076.249] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="4 Dt76jy3hp.flv" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\4 Dt76jy3hp.flv") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\4 Dt76jy3hp.flv" [0076.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4 Dt76jy3hp.flv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0076.249] GetProcessHeap () returned 0x630000 [0076.249] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x64ca20 [0076.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4 Dt76jy3hp.flv", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4 Dt76jy3hp.flv", lpUsedDefaultChar=0x0) returned 16 [0076.249] lstrlenA (lpString="4 Dt76jy3hp.flv") returned 15 [0076.249] lstrlenA (lpString=".happythreechoose") returned 17 [0076.249] lstrcmpiW (lpString1="4 Dt76jy3hp.flv", lpString2="Decryption INFO.html") returned -1 [0076.249] lstrcmpiW (lpString1="4 Dt76jy3hp.flv", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned -1 [0076.249] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0076.249] lstrcmpiW (lpString1="4 Dt76jy3hp.flv", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0076.249] GetProcessHeap () returned 0x630000 [0076.249] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0076.249] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\4 Dt76jy3hp.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\4 dt76jy3hp.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0076.250] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=39036) returned 1 [0076.250] GetProcessHeap () returned 0x630000 [0076.250] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655850 [0076.250] GetProcessHeap () returned 0x630000 [0076.250] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672f60 [0076.250] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\4 Dt76jy3hp.flv") returned 47 [0076.250] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0076.250] GetProcessHeap () returned 0x630000 [0076.250] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0076.250] GetProcessHeap () returned 0x630000 [0076.250] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x384) returned 0x673c60 [0076.251] lstrlenA (lpString="rsa_encrypt") returned 11 [0076.251] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x672a10) returned 1 [0076.252] CryptGenRandom (in: hProv=0x672a10, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0076.252] CryptReleaseContext (hProv=0x672a10, dwFlags=0x0) returned 1 [0076.252] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0076.252] GetProcessHeap () returned 0x630000 [0076.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673208 [0076.252] lstrlenA (lpString="010001") returned 6 [0076.252] GetProcessHeap () returned 0x630000 [0076.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a328 [0076.252] GetProcessHeap () returned 0x630000 [0076.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673180 [0076.252] GetProcessHeap () returned 0x630000 [0076.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e7c0 [0076.252] GetProcessHeap () returned 0x630000 [0076.252] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673180 | out: hHeap=0x630000) returned 1 [0076.252] GetProcessHeap () returned 0x630000 [0076.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dfe0 [0076.252] GetProcessHeap () returned 0x630000 [0076.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656b80 [0076.252] GetProcessHeap () returned 0x630000 [0076.252] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0076.254] GetProcessHeap () returned 0x630000 [0076.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0076.254] GetProcessHeap () returned 0x630000 [0076.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.254] GetProcessHeap () returned 0x630000 [0076.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0076.254] GetProcessHeap () returned 0x630000 [0076.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673538 [0076.254] GetProcessHeap () returned 0x630000 [0076.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657788 [0076.254] GetProcessHeap () returned 0x630000 [0076.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.254] GetProcessHeap () returned 0x630000 [0076.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0076.254] GetProcessHeap () returned 0x630000 [0076.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0076.254] GetProcessHeap () returned 0x630000 [0076.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673538 | out: hHeap=0x630000) returned 1 [0076.254] GetProcessHeap () returned 0x630000 [0076.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0076.254] GetProcessHeap () returned 0x630000 [0076.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0076.254] GetProcessHeap () returned 0x630000 [0076.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.254] GetProcessHeap () returned 0x630000 [0076.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65d018 [0076.254] GetProcessHeap () returned 0x630000 [0076.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.255] GetProcessHeap () returned 0x630000 [0076.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.255] GetProcessHeap () returned 0x630000 [0076.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.255] GetProcessHeap () returned 0x630000 [0076.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.255] GetProcessHeap () returned 0x630000 [0076.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e4f0 [0076.255] GetProcessHeap () returned 0x630000 [0076.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65d018 | out: hHeap=0x630000) returned 1 [0076.255] GetProcessHeap () returned 0x630000 [0076.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0076.255] GetProcessHeap () returned 0x630000 [0076.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0076.255] GetProcessHeap () returned 0x630000 [0076.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.255] GetProcessHeap () returned 0x630000 [0076.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.255] GetProcessHeap () returned 0x630000 [0076.255] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0076.255] GetProcessHeap () returned 0x630000 [0076.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0076.256] GetProcessHeap () returned 0x630000 [0076.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.256] GetProcessHeap () returned 0x630000 [0076.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.256] GetProcessHeap () returned 0x630000 [0076.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0076.256] GetProcessHeap () returned 0x630000 [0076.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.256] GetProcessHeap () returned 0x630000 [0076.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.256] GetProcessHeap () returned 0x630000 [0076.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.256] GetProcessHeap () returned 0x630000 [0076.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.256] GetProcessHeap () returned 0x630000 [0076.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.256] GetProcessHeap () returned 0x630000 [0076.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.256] GetProcessHeap () returned 0x630000 [0076.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.256] GetProcessHeap () returned 0x630000 [0076.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.256] GetProcessHeap () returned 0x630000 [0076.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.256] GetProcessHeap () returned 0x630000 [0076.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0076.256] GetProcessHeap () returned 0x630000 [0076.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0076.256] GetProcessHeap () returned 0x630000 [0076.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.256] GetProcessHeap () returned 0x630000 [0076.256] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.256] GetProcessHeap () returned 0x630000 [0076.256] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.256] GetProcessHeap () returned 0x630000 [0076.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.257] GetProcessHeap () returned 0x630000 [0076.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.257] GetProcessHeap () returned 0x630000 [0076.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.257] GetProcessHeap () returned 0x630000 [0076.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.257] GetProcessHeap () returned 0x630000 [0076.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.257] GetProcessHeap () returned 0x630000 [0076.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0076.257] GetProcessHeap () returned 0x630000 [0076.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.257] GetProcessHeap () returned 0x630000 [0076.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.257] GetProcessHeap () returned 0x630000 [0076.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.257] GetProcessHeap () returned 0x630000 [0076.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.257] GetProcessHeap () returned 0x630000 [0076.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.257] GetProcessHeap () returned 0x630000 [0076.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0076.257] GetProcessHeap () returned 0x630000 [0076.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.257] GetProcessHeap () returned 0x630000 [0076.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0076.257] GetProcessHeap () returned 0x630000 [0076.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0076.257] GetProcessHeap () returned 0x630000 [0076.257] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0076.257] GetProcessHeap () returned 0x630000 [0076.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0076.257] GetProcessHeap () returned 0x630000 [0076.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.258] GetProcessHeap () returned 0x630000 [0076.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.258] GetProcessHeap () returned 0x630000 [0076.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0076.258] GetProcessHeap () returned 0x630000 [0076.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0076.258] GetProcessHeap () returned 0x630000 [0076.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.258] GetProcessHeap () returned 0x630000 [0076.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.258] GetProcessHeap () returned 0x630000 [0076.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.258] GetProcessHeap () returned 0x630000 [0076.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.258] GetProcessHeap () returned 0x630000 [0076.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.258] GetProcessHeap () returned 0x630000 [0076.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.258] GetProcessHeap () returned 0x630000 [0076.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.258] GetProcessHeap () returned 0x630000 [0076.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.258] GetProcessHeap () returned 0x630000 [0076.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.258] GetProcessHeap () returned 0x630000 [0076.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.258] GetProcessHeap () returned 0x630000 [0076.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.258] GetProcessHeap () returned 0x630000 [0076.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.258] GetProcessHeap () returned 0x630000 [0076.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0076.258] GetProcessHeap () returned 0x630000 [0076.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0076.258] GetProcessHeap () returned 0x630000 [0076.258] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.258] GetProcessHeap () returned 0x630000 [0076.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.259] GetProcessHeap () returned 0x630000 [0076.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0076.259] GetProcessHeap () returned 0x630000 [0076.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0076.259] GetProcessHeap () returned 0x630000 [0076.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.259] GetProcessHeap () returned 0x630000 [0076.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.259] GetProcessHeap () returned 0x630000 [0076.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.259] GetProcessHeap () returned 0x630000 [0076.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.259] GetProcessHeap () returned 0x630000 [0076.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.259] GetProcessHeap () returned 0x630000 [0076.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.259] GetProcessHeap () returned 0x630000 [0076.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0076.259] GetProcessHeap () returned 0x630000 [0076.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0076.259] GetProcessHeap () returned 0x630000 [0076.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.259] GetProcessHeap () returned 0x630000 [0076.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.259] GetProcessHeap () returned 0x630000 [0076.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.259] GetProcessHeap () returned 0x630000 [0076.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.259] GetProcessHeap () returned 0x630000 [0076.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.259] GetProcessHeap () returned 0x630000 [0076.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.259] GetProcessHeap () returned 0x630000 [0076.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.259] GetProcessHeap () returned 0x630000 [0076.259] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.260] GetProcessHeap () returned 0x630000 [0076.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0076.260] GetProcessHeap () returned 0x630000 [0076.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0076.260] GetProcessHeap () returned 0x630000 [0076.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0076.260] GetProcessHeap () returned 0x630000 [0076.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0076.260] GetProcessHeap () returned 0x630000 [0076.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.260] GetProcessHeap () returned 0x630000 [0076.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.260] GetProcessHeap () returned 0x630000 [0076.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0076.260] GetProcessHeap () returned 0x630000 [0076.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0076.260] GetProcessHeap () returned 0x630000 [0076.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0076.260] GetProcessHeap () returned 0x630000 [0076.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0076.260] GetProcessHeap () returned 0x630000 [0076.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0076.260] GetProcessHeap () returned 0x630000 [0076.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0076.260] GetProcessHeap () returned 0x630000 [0076.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0076.260] GetProcessHeap () returned 0x630000 [0076.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e7c0 | out: hHeap=0x630000) returned 1 [0076.260] GetProcessHeap () returned 0x630000 [0076.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0076.260] GetProcessHeap () returned 0x630000 [0076.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0076.260] GetProcessHeap () returned 0x630000 [0076.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673208 | out: hHeap=0x630000) returned 1 [0076.260] WriteFile (in: hFile=0x230, lpBuffer=0x673c60*, nNumberOfBytesToWrite=0x384, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673c60*, lpNumberOfBytesWritten=0x243d864*=0x384, lpOverlapped=0x0) returned 1 [0076.262] GetProcessHeap () returned 0x630000 [0076.262] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x673c60, Size=0x30) returned 0x673c60 [0076.262] GetProcessHeap () returned 0x630000 [0076.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0076.262] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0076.263] GetProcessHeap () returned 0x630000 [0076.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9880) returned 0x673c98 [0076.263] ReadFile (in: hFile=0x230, lpBuffer=0x673c98, nNumberOfBytesToRead=0x9880, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x673c98*, lpNumberOfBytesRead=0x243d7e8*=0x9880, lpOverlapped=0x0) returned 1 [0076.264] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0076.264] WriteFile (in: hFile=0x230, lpBuffer=0x673c98*, nNumberOfBytesToWrite=0x9880, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x673c98*, lpNumberOfBytesWritten=0x243d7e4*=0x9880, lpOverlapped=0x0) returned 1 [0076.265] GetProcessHeap () returned 0x630000 [0076.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673c98 | out: hHeap=0x630000) returned 1 [0076.265] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0076.265] WriteFile (in: hFile=0x230, lpBuffer=0x673c60*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673c60*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0076.266] CloseHandle (hObject=0x230) returned 1 [0076.266] GetProcessHeap () returned 0x630000 [0076.266] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0076.266] GetProcessHeap () returned 0x630000 [0076.267] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655850 | out: hHeap=0x630000) returned 1 [0076.267] GetProcessHeap () returned 0x630000 [0076.267] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672f60 | out: hHeap=0x630000) returned 1 [0076.267] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\4 Dt76jy3hp.flv" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\4 Dt76jy3hp.flv") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\4 Dt76jy3hp.flv" [0076.267] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\4 Dt76jy3hp.flv", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\4 Dt76jy3hp.flv.happythreechoose") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\4 Dt76jy3hp.flv.happythreechoose" [0076.267] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\4 Dt76jy3hp.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\4 dt76jy3hp.flv"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\4 Dt76jy3hp.flv.happythreechoose" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\4 dt76jy3hp.flv.happythreechoose"), dwFlags=0x1) returned 1 [0076.268] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\4 Dt76jy3hp.flv" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0076.268] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="" [0076.268] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" [0076.268] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\decryption info.html")) returned 0x20 [0076.268] GetProcessHeap () returned 0x630000 [0076.268] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0076.268] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95660090, ftCreationTime.dwHighDateTime=0x1d5d3e1, ftLastAccessTime.dwLowDateTime=0xc8f647a0, ftLastAccessTime.dwHighDateTime=0x1d5cb60, ftLastWriteTime.dwLowDateTime=0xc8f647a0, ftLastWriteTime.dwHighDateTime=0x1d5cb60, nFileSizeHigh=0x0, nFileSizeLow=0xbe9c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="6hvt.png", cAlternateFileName="")) returned 1 [0076.268] lstrcmpiW (lpString1="6hvt.png", lpString2=".") returned 1 [0076.268] lstrcmpiW (lpString1="6hvt.png", lpString2="..") returned 1 [0076.268] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="6hvt.png" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\6hvt.png") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\6hvt.png" [0076.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="6hvt.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0076.268] GetProcessHeap () returned 0x630000 [0076.268] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9) returned 0x64c9f0 [0076.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="6hvt.png", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6hvt.png", lpUsedDefaultChar=0x0) returned 9 [0076.268] lstrlenA (lpString="6hvt.png") returned 8 [0076.268] lstrlenA (lpString=".happythreechoose") returned 17 [0076.268] lstrcmpiW (lpString1="6hvt.png", lpString2="Decryption INFO.html") returned -1 [0076.268] lstrcmpiW (lpString1="6hvt.png", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0076.268] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0076.268] lstrcmpiW (lpString1="6hvt.png", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0076.268] GetProcessHeap () returned 0x630000 [0076.268] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0076.268] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\6hvt.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\6hvt.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0076.269] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=48796) returned 1 [0076.269] GetProcessHeap () returned 0x630000 [0076.269] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655490 [0076.269] GetProcessHeap () returned 0x630000 [0076.269] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6734b0 [0076.269] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\6hvt.png") returned 40 [0076.269] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0076.269] GetProcessHeap () returned 0x630000 [0076.269] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0076.269] GetProcessHeap () returned 0x630000 [0076.269] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x673c98 [0076.269] lstrlenA (lpString="rsa_encrypt") returned 11 [0076.269] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x673648) returned 1 [0076.270] CryptGenRandom (in: hProv=0x673648, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0076.270] CryptReleaseContext (hProv=0x673648, dwFlags=0x0) returned 1 [0076.270] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0076.270] GetProcessHeap () returned 0x630000 [0076.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673758 [0076.270] lstrlenA (lpString="010001") returned 6 [0076.270] GetProcessHeap () returned 0x630000 [0076.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3f8 [0076.270] GetProcessHeap () returned 0x630000 [0076.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673180 [0076.270] GetProcessHeap () returned 0x630000 [0076.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e340 [0076.270] GetProcessHeap () returned 0x630000 [0076.270] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673180 | out: hHeap=0x630000) returned 1 [0076.270] GetProcessHeap () returned 0x630000 [0076.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ebb0 [0076.270] GetProcessHeap () returned 0x630000 [0076.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656fe0 [0076.270] GetProcessHeap () returned 0x630000 [0076.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a398 [0076.270] GetProcessHeap () returned 0x630000 [0076.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0076.270] GetProcessHeap () returned 0x630000 [0076.270] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.270] GetProcessHeap () returned 0x630000 [0076.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0076.270] GetProcessHeap () returned 0x630000 [0076.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673208 [0076.270] GetProcessHeap () returned 0x630000 [0076.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656ec8 [0076.270] GetProcessHeap () returned 0x630000 [0076.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.270] GetProcessHeap () returned 0x630000 [0076.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0076.270] GetProcessHeap () returned 0x630000 [0076.270] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ec40 [0076.270] GetProcessHeap () returned 0x630000 [0076.270] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673208 | out: hHeap=0x630000) returned 1 [0076.271] GetProcessHeap () returned 0x630000 [0076.271] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0076.271] GetProcessHeap () returned 0x630000 [0076.271] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ec40 | out: hHeap=0x630000) returned 1 [0076.271] GetProcessHeap () returned 0x630000 [0076.271] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0076.271] GetProcessHeap () returned 0x630000 [0076.271] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cd60 [0076.271] GetProcessHeap () returned 0x630000 [0076.271] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.271] GetProcessHeap () returned 0x630000 [0076.271] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0076.271] GetProcessHeap () returned 0x630000 [0076.271] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.271] GetProcessHeap () returned 0x630000 [0076.271] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.271] GetProcessHeap () returned 0x630000 [0076.271] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e100 [0076.271] GetProcessHeap () returned 0x630000 [0076.271] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cd60 | out: hHeap=0x630000) returned 1 [0076.271] GetProcessHeap () returned 0x630000 [0076.271] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0076.271] GetProcessHeap () returned 0x630000 [0076.271] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e100 | out: hHeap=0x630000) returned 1 [0076.271] GetProcessHeap () returned 0x630000 [0076.271] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0076.271] GetProcessHeap () returned 0x630000 [0076.271] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.271] GetProcessHeap () returned 0x630000 [0076.271] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.271] GetProcessHeap () returned 0x630000 [0076.271] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.271] GetProcessHeap () returned 0x630000 [0076.271] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.271] GetProcessHeap () returned 0x630000 [0076.271] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.271] GetProcessHeap () returned 0x630000 [0076.271] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.271] GetProcessHeap () returned 0x630000 [0076.271] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.272] GetProcessHeap () returned 0x630000 [0076.272] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.272] GetProcessHeap () returned 0x630000 [0076.272] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.272] GetProcessHeap () returned 0x630000 [0076.272] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.272] GetProcessHeap () returned 0x630000 [0076.272] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.272] GetProcessHeap () returned 0x630000 [0076.272] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0076.272] GetProcessHeap () returned 0x630000 [0076.272] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0076.272] GetProcessHeap () returned 0x630000 [0076.272] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0076.272] GetProcessHeap () returned 0x630000 [0076.272] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0076.272] GetProcessHeap () returned 0x630000 [0076.272] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0076.272] GetProcessHeap () returned 0x630000 [0076.272] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0076.272] GetProcessHeap () returned 0x630000 [0076.272] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.272] GetProcessHeap () returned 0x630000 [0076.272] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.272] GetProcessHeap () returned 0x630000 [0076.272] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.272] GetProcessHeap () returned 0x630000 [0076.272] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.272] GetProcessHeap () returned 0x630000 [0076.272] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0076.272] GetProcessHeap () returned 0x630000 [0076.272] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0076.272] GetProcessHeap () returned 0x630000 [0076.272] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0076.272] GetProcessHeap () returned 0x630000 [0076.272] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0076.272] GetProcessHeap () returned 0x630000 [0076.273] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.273] GetProcessHeap () returned 0x630000 [0076.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.273] GetProcessHeap () returned 0x630000 [0076.273] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0076.273] GetProcessHeap () returned 0x630000 [0076.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0076.273] GetProcessHeap () returned 0x630000 [0076.273] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.273] GetProcessHeap () returned 0x630000 [0076.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.273] GetProcessHeap () returned 0x630000 [0076.273] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0076.273] GetProcessHeap () returned 0x630000 [0076.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0076.273] GetProcessHeap () returned 0x630000 [0076.273] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.273] GetProcessHeap () returned 0x630000 [0076.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.273] GetProcessHeap () returned 0x630000 [0076.273] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.273] GetProcessHeap () returned 0x630000 [0076.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.273] GetProcessHeap () returned 0x630000 [0076.273] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.273] GetProcessHeap () returned 0x630000 [0076.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.273] GetProcessHeap () returned 0x630000 [0076.273] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.273] GetProcessHeap () returned 0x630000 [0076.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.273] GetProcessHeap () returned 0x630000 [0076.273] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.273] GetProcessHeap () returned 0x630000 [0076.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.273] GetProcessHeap () returned 0x630000 [0076.273] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0076.274] GetProcessHeap () returned 0x630000 [0076.274] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0076.274] GetProcessHeap () returned 0x630000 [0076.274] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0076.274] GetProcessHeap () returned 0x630000 [0076.274] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0076.274] GetProcessHeap () returned 0x630000 [0076.274] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.274] GetProcessHeap () returned 0x630000 [0076.274] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.274] GetProcessHeap () returned 0x630000 [0076.274] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0076.274] GetProcessHeap () returned 0x630000 [0076.274] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0076.274] GetProcessHeap () returned 0x630000 [0076.274] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0076.274] GetProcessHeap () returned 0x630000 [0076.274] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0076.274] GetProcessHeap () returned 0x630000 [0076.274] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0076.274] GetProcessHeap () returned 0x630000 [0076.274] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0076.274] GetProcessHeap () returned 0x630000 [0076.274] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.274] GetProcessHeap () returned 0x630000 [0076.274] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.274] GetProcessHeap () returned 0x630000 [0076.274] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.274] GetProcessHeap () returned 0x630000 [0076.274] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.274] GetProcessHeap () returned 0x630000 [0076.274] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.274] GetProcessHeap () returned 0x630000 [0076.274] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.274] GetProcessHeap () returned 0x630000 [0076.274] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.274] GetProcessHeap () returned 0x630000 [0076.275] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.275] GetProcessHeap () returned 0x630000 [0076.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.275] GetProcessHeap () returned 0x630000 [0076.275] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.275] GetProcessHeap () returned 0x630000 [0076.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0076.275] GetProcessHeap () returned 0x630000 [0076.275] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0076.275] GetProcessHeap () returned 0x630000 [0076.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0076.275] GetProcessHeap () returned 0x630000 [0076.275] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0076.275] GetProcessHeap () returned 0x630000 [0076.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.275] GetProcessHeap () returned 0x630000 [0076.275] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.275] GetProcessHeap () returned 0x630000 [0076.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0076.275] GetProcessHeap () returned 0x630000 [0076.275] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.275] GetProcessHeap () returned 0x630000 [0076.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.275] GetProcessHeap () returned 0x630000 [0076.275] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.275] GetProcessHeap () returned 0x630000 [0076.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0076.275] GetProcessHeap () returned 0x630000 [0076.275] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0076.275] GetProcessHeap () returned 0x630000 [0076.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0076.275] GetProcessHeap () returned 0x630000 [0076.275] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.275] GetProcessHeap () returned 0x630000 [0076.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.275] GetProcessHeap () returned 0x630000 [0076.275] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.275] GetProcessHeap () returned 0x630000 [0076.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0076.276] GetProcessHeap () returned 0x630000 [0076.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0076.276] GetProcessHeap () returned 0x630000 [0076.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0076.276] GetProcessHeap () returned 0x630000 [0076.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0076.276] GetProcessHeap () returned 0x630000 [0076.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0076.276] GetProcessHeap () returned 0x630000 [0076.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0076.276] GetProcessHeap () returned 0x630000 [0076.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0076.276] GetProcessHeap () returned 0x630000 [0076.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0076.276] GetProcessHeap () returned 0x630000 [0076.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0076.276] GetProcessHeap () returned 0x630000 [0076.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.276] GetProcessHeap () returned 0x630000 [0076.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673758 | out: hHeap=0x630000) returned 1 [0076.276] WriteFile (in: hFile=0x230, lpBuffer=0x673c98*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673c98*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0076.283] GetProcessHeap () returned 0x630000 [0076.283] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x673c98, Size=0x30) returned 0x673c98 [0076.283] GetProcessHeap () returned 0x630000 [0076.283] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0076.283] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0076.283] GetProcessHeap () returned 0x630000 [0076.283] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xbe9c) returned 0x673cd0 [0076.283] ReadFile (in: hFile=0x230, lpBuffer=0x673cd0, nNumberOfBytesToRead=0xbe9c, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x673cd0*, lpNumberOfBytesRead=0x243d7e8*=0xbe9c, lpOverlapped=0x0) returned 1 [0076.284] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0076.284] WriteFile (in: hFile=0x230, lpBuffer=0x673cd0*, nNumberOfBytesToWrite=0xbe9c, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x673cd0*, lpNumberOfBytesWritten=0x243d7e4*=0xbe9c, lpOverlapped=0x0) returned 1 [0076.286] GetProcessHeap () returned 0x630000 [0076.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673cd0 | out: hHeap=0x630000) returned 1 [0076.287] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0076.287] WriteFile (in: hFile=0x230, lpBuffer=0x673c98*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673c98*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0076.289] CloseHandle (hObject=0x230) returned 1 [0076.289] GetProcessHeap () returned 0x630000 [0076.289] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0076.289] GetProcessHeap () returned 0x630000 [0076.289] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655490 | out: hHeap=0x630000) returned 1 [0076.289] GetProcessHeap () returned 0x630000 [0076.289] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6734b0 | out: hHeap=0x630000) returned 1 [0076.290] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\6hvt.png" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\6hvt.png") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\6hvt.png" [0076.290] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\6hvt.png", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\6hvt.png.happythreechoose") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\6hvt.png.happythreechoose" [0076.290] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\6hvt.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\6hvt.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\6hvt.png.happythreechoose" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\6hvt.png.happythreechoose"), dwFlags=0x1) returned 1 [0076.290] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\6hvt.png" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0076.290] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="" [0076.290] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" [0076.290] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\decryption info.html")) returned 0x20 [0076.290] GetProcessHeap () returned 0x630000 [0076.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0076.290] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4aa62480, ftCreationTime.dwHighDateTime=0x1d5d10d, ftLastAccessTime.dwLowDateTime=0x916d5d00, ftLastAccessTime.dwHighDateTime=0x1d5d740, ftLastWriteTime.dwLowDateTime=0x916d5d00, ftLastWriteTime.dwHighDateTime=0x1d5d740, nFileSizeHigh=0x0, nFileSizeLow=0x131b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7IpE.m4a", cAlternateFileName="")) returned 1 [0076.290] lstrcmpiW (lpString1="7IpE.m4a", lpString2=".") returned 1 [0076.291] lstrcmpiW (lpString1="7IpE.m4a", lpString2="..") returned 1 [0076.291] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="7IpE.m4a" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\7IpE.m4a") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\7IpE.m4a" [0076.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="7IpE.m4a", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0076.291] GetProcessHeap () returned 0x630000 [0076.291] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9) returned 0x64c9f0 [0076.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="7IpE.m4a", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7IpE.m4a", lpUsedDefaultChar=0x0) returned 9 [0076.291] lstrlenA (lpString="7IpE.m4a") returned 8 [0076.291] lstrlenA (lpString=".happythreechoose") returned 17 [0076.291] lstrcmpiW (lpString1="7IpE.m4a", lpString2="Decryption INFO.html") returned -1 [0076.291] lstrcmpiW (lpString1="7IpE.m4a", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0076.291] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0076.291] lstrcmpiW (lpString1="7IpE.m4a", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0076.291] GetProcessHeap () returned 0x630000 [0076.291] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0076.291] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\7IpE.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\7ipe.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0076.291] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=78256) returned 1 [0076.291] GetProcessHeap () returned 0x630000 [0076.291] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6556e8 [0076.291] GetProcessHeap () returned 0x630000 [0076.291] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6734b0 [0076.291] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\7IpE.m4a") returned 40 [0076.291] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0076.291] GetProcessHeap () returned 0x630000 [0076.291] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0076.291] GetProcessHeap () returned 0x630000 [0076.291] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x673cd0 [0076.293] lstrlenA (lpString="rsa_encrypt") returned 11 [0076.293] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x6730f8) returned 1 [0076.293] CryptGenRandom (in: hProv=0x6730f8, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0076.293] CryptReleaseContext (hProv=0x6730f8, dwFlags=0x0) returned 1 [0076.293] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0076.293] GetProcessHeap () returned 0x630000 [0076.293] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673180 [0076.293] lstrlenA (lpString="010001") returned 6 [0076.293] GetProcessHeap () returned 0x630000 [0076.293] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3f8 [0076.294] GetProcessHeap () returned 0x630000 [0076.294] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6736d0 [0076.294] GetProcessHeap () returned 0x630000 [0076.294] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65df50 [0076.294] GetProcessHeap () returned 0x630000 [0076.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6736d0 | out: hHeap=0x630000) returned 1 [0076.294] GetProcessHeap () returned 0x630000 [0076.294] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0076.294] GetProcessHeap () returned 0x630000 [0076.294] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656a68 [0076.294] GetProcessHeap () returned 0x630000 [0076.294] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2a8 [0076.294] GetProcessHeap () returned 0x630000 [0076.294] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0076.294] GetProcessHeap () returned 0x630000 [0076.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.294] GetProcessHeap () returned 0x630000 [0076.294] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0076.294] GetProcessHeap () returned 0x630000 [0076.294] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6733a0 [0076.294] GetProcessHeap () returned 0x630000 [0076.294] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657210 [0076.294] GetProcessHeap () returned 0x630000 [0076.294] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.294] GetProcessHeap () returned 0x630000 [0076.294] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0076.294] GetProcessHeap () returned 0x630000 [0076.294] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e580 [0076.294] GetProcessHeap () returned 0x630000 [0076.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6733a0 | out: hHeap=0x630000) returned 1 [0076.294] GetProcessHeap () returned 0x630000 [0076.294] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0076.294] GetProcessHeap () returned 0x630000 [0076.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0076.294] GetProcessHeap () returned 0x630000 [0076.294] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.294] GetProcessHeap () returned 0x630000 [0076.294] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cec8 [0076.294] GetProcessHeap () returned 0x630000 [0076.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.295] GetProcessHeap () returned 0x630000 [0076.295] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.295] GetProcessHeap () returned 0x630000 [0076.295] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.295] GetProcessHeap () returned 0x630000 [0076.295] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.295] GetProcessHeap () returned 0x630000 [0076.295] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e460 [0076.295] GetProcessHeap () returned 0x630000 [0076.295] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cec8 | out: hHeap=0x630000) returned 1 [0076.295] GetProcessHeap () returned 0x630000 [0076.295] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0076.295] GetProcessHeap () returned 0x630000 [0076.295] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e460 | out: hHeap=0x630000) returned 1 [0076.295] GetProcessHeap () returned 0x630000 [0076.295] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0076.295] GetProcessHeap () returned 0x630000 [0076.295] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0076.295] GetProcessHeap () returned 0x630000 [0076.295] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0076.295] GetProcessHeap () returned 0x630000 [0076.295] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.295] GetProcessHeap () returned 0x630000 [0076.295] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0076.295] GetProcessHeap () returned 0x630000 [0076.295] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0076.295] GetProcessHeap () returned 0x630000 [0076.295] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0076.295] GetProcessHeap () returned 0x630000 [0076.295] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0076.295] GetProcessHeap () returned 0x630000 [0076.295] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0076.295] GetProcessHeap () returned 0x630000 [0076.295] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0076.295] GetProcessHeap () returned 0x630000 [0076.295] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0076.295] GetProcessHeap () returned 0x630000 [0076.295] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0076.295] GetProcessHeap () returned 0x630000 [0076.296] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0076.296] GetProcessHeap () returned 0x630000 [0076.296] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0076.296] GetProcessHeap () returned 0x630000 [0076.296] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0076.296] GetProcessHeap () returned 0x630000 [0076.296] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0076.296] GetProcessHeap () returned 0x630000 [0076.296] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0076.296] GetProcessHeap () returned 0x630000 [0076.296] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0076.296] GetProcessHeap () returned 0x630000 [0076.296] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0076.296] GetProcessHeap () returned 0x630000 [0076.296] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0076.296] GetProcessHeap () returned 0x630000 [0076.296] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0076.296] GetProcessHeap () returned 0x630000 [0076.296] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0076.296] GetProcessHeap () returned 0x630000 [0076.296] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.296] GetProcessHeap () returned 0x630000 [0076.296] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.296] GetProcessHeap () returned 0x630000 [0076.296] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.296] GetProcessHeap () returned 0x630000 [0076.296] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.297] GetProcessHeap () returned 0x630000 [0076.297] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0076.297] GetProcessHeap () returned 0x630000 [0076.297] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0076.297] GetProcessHeap () returned 0x630000 [0076.297] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.297] GetProcessHeap () returned 0x630000 [0076.297] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.297] GetProcessHeap () returned 0x630000 [0076.297] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.297] GetProcessHeap () returned 0x630000 [0076.297] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.297] GetProcessHeap () returned 0x630000 [0076.297] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0076.297] GetProcessHeap () returned 0x630000 [0076.297] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0076.297] GetProcessHeap () returned 0x630000 [0076.297] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0076.297] GetProcessHeap () returned 0x630000 [0076.297] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0076.297] GetProcessHeap () returned 0x630000 [0076.297] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0076.297] GetProcessHeap () returned 0x630000 [0076.297] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0076.297] GetProcessHeap () returned 0x630000 [0076.297] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.297] GetProcessHeap () returned 0x630000 [0076.297] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.297] GetProcessHeap () returned 0x630000 [0076.297] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.297] GetProcessHeap () returned 0x630000 [0076.297] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.297] GetProcessHeap () returned 0x630000 [0076.297] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.297] GetProcessHeap () returned 0x630000 [0076.297] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.298] GetProcessHeap () returned 0x630000 [0076.298] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.298] GetProcessHeap () returned 0x630000 [0076.298] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.298] GetProcessHeap () returned 0x630000 [0076.298] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.298] GetProcessHeap () returned 0x630000 [0076.298] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.298] GetProcessHeap () returned 0x630000 [0076.298] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.298] GetProcessHeap () returned 0x630000 [0076.298] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.298] GetProcessHeap () returned 0x630000 [0076.298] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.298] GetProcessHeap () returned 0x630000 [0076.298] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.298] GetProcessHeap () returned 0x630000 [0076.298] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0076.298] GetProcessHeap () returned 0x630000 [0076.298] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0076.298] GetProcessHeap () returned 0x630000 [0076.298] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.298] GetProcessHeap () returned 0x630000 [0076.298] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.298] GetProcessHeap () returned 0x630000 [0076.298] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.298] GetProcessHeap () returned 0x630000 [0076.298] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.298] GetProcessHeap () returned 0x630000 [0076.298] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0076.298] GetProcessHeap () returned 0x630000 [0076.298] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0076.298] GetProcessHeap () returned 0x630000 [0076.298] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.298] GetProcessHeap () returned 0x630000 [0076.298] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.298] GetProcessHeap () returned 0x630000 [0076.298] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.299] GetProcessHeap () returned 0x630000 [0076.299] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.299] GetProcessHeap () returned 0x630000 [0076.299] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.299] GetProcessHeap () returned 0x630000 [0076.299] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.299] GetProcessHeap () returned 0x630000 [0076.299] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0076.299] GetProcessHeap () returned 0x630000 [0076.299] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.299] GetProcessHeap () returned 0x630000 [0076.299] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a328 [0076.299] GetProcessHeap () returned 0x630000 [0076.299] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a328 | out: hHeap=0x630000) returned 1 [0076.299] GetProcessHeap () returned 0x630000 [0076.299] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.299] GetProcessHeap () returned 0x630000 [0076.299] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.299] GetProcessHeap () returned 0x630000 [0076.299] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0076.299] GetProcessHeap () returned 0x630000 [0076.299] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0076.299] GetProcessHeap () returned 0x630000 [0076.299] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0076.299] GetProcessHeap () returned 0x630000 [0076.299] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0076.299] GetProcessHeap () returned 0x630000 [0076.299] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0076.299] GetProcessHeap () returned 0x630000 [0076.299] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0076.299] GetProcessHeap () returned 0x630000 [0076.299] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.299] GetProcessHeap () returned 0x630000 [0076.299] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.299] GetProcessHeap () returned 0x630000 [0076.299] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.300] GetProcessHeap () returned 0x630000 [0076.300] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.300] GetProcessHeap () returned 0x630000 [0076.300] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0076.300] GetProcessHeap () returned 0x630000 [0076.300] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0076.300] GetProcessHeap () returned 0x630000 [0076.300] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0076.300] GetProcessHeap () returned 0x630000 [0076.300] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0076.300] GetProcessHeap () returned 0x630000 [0076.300] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0076.300] GetProcessHeap () returned 0x630000 [0076.300] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0076.300] GetProcessHeap () returned 0x630000 [0076.300] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0076.300] GetProcessHeap () returned 0x630000 [0076.300] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0076.301] GetProcessHeap () returned 0x630000 [0076.301] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0076.301] GetProcessHeap () returned 0x630000 [0076.301] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.301] GetProcessHeap () returned 0x630000 [0076.301] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673180 | out: hHeap=0x630000) returned 1 [0076.301] WriteFile (in: hFile=0x230, lpBuffer=0x673cd0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673cd0*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0076.319] GetProcessHeap () returned 0x630000 [0076.319] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x673cd0, Size=0x30) returned 0x673cd0 [0076.319] GetProcessHeap () returned 0x630000 [0076.319] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0076.319] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0076.319] GetProcessHeap () returned 0x630000 [0076.319] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x131b0) returned 0x673d08 [0076.320] ReadFile (in: hFile=0x230, lpBuffer=0x673d08, nNumberOfBytesToRead=0x131b0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x673d08*, lpNumberOfBytesRead=0x243d7e8*=0x131b0, lpOverlapped=0x0) returned 1 [0076.321] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0076.321] WriteFile (in: hFile=0x230, lpBuffer=0x673d08*, nNumberOfBytesToWrite=0x131b0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x673d08*, lpNumberOfBytesWritten=0x243d7e4*=0x131b0, lpOverlapped=0x0) returned 1 [0076.323] GetProcessHeap () returned 0x630000 [0076.323] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673d08 | out: hHeap=0x630000) returned 1 [0076.323] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0076.323] WriteFile (in: hFile=0x230, lpBuffer=0x673cd0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673cd0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0076.324] CloseHandle (hObject=0x230) returned 1 [0076.325] GetProcessHeap () returned 0x630000 [0076.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0076.325] GetProcessHeap () returned 0x630000 [0076.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6556e8 | out: hHeap=0x630000) returned 1 [0076.325] GetProcessHeap () returned 0x630000 [0076.325] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6734b0 | out: hHeap=0x630000) returned 1 [0076.325] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\7IpE.m4a" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\7IpE.m4a") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\7IpE.m4a" [0076.325] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\7IpE.m4a", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\7IpE.m4a.happythreechoose") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\7IpE.m4a.happythreechoose" [0076.325] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\7IpE.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\7ipe.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\7IpE.m4a.happythreechoose" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\7ipe.m4a.happythreechoose"), dwFlags=0x1) returned 1 [0076.326] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\7IpE.m4a" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0076.326] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="" [0076.326] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" [0076.326] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\decryption info.html")) returned 0x20 [0076.326] GetProcessHeap () returned 0x630000 [0076.326] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0076.326] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42d40cf2, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x7161656c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7b7983c6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0076.326] lstrcmpiW (lpString1="Adobe", lpString2=".") returned 1 [0076.326] lstrcmpiW (lpString1="Adobe", lpString2="..") returned 1 [0076.326] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="Adobe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe" [0076.326] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Adobe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0076.326] GetProcessHeap () returned 0x630000 [0076.326] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6) returned 0x65a378 [0076.326] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Adobe", cchWideChar=-1, lpMultiByteStr=0x65a378, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Adobe", lpUsedDefaultChar=0x0) returned 6 [0076.326] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Adobe", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0076.326] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Adobe", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0076.326] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Adobe", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0076.326] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Adobe", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0076.326] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Adobe", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0076.326] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Adobe", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0076.326] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Adobe", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0076.326] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Adobe", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0076.326] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Adobe", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0076.326] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Adobe", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0076.326] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Adobe", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0076.326] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Adobe", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0076.326] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Adobe", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0076.326] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Adobe", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0076.326] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Adobe", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0076.326] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Adobe", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0076.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Adobe", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0076.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Adobe", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0076.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Adobe", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0076.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Adobe", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0076.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Adobe", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0076.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Adobe", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0076.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Adobe", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0076.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Adobe", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 1 [0076.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Adobe", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0076.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Adobe", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0076.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Adobe", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 1 [0076.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Adobe", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0076.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Adobe", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0076.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Adobe", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0076.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Adobe", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0076.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Adobe", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 1 [0076.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Adobe", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0076.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Adobe", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0076.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Adobe", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0076.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Adobe", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0076.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Adobe", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0076.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Adobe", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0076.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Adobe", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0076.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Adobe", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0076.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Adobe", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0076.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Adobe", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0076.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Adobe", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0076.327] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\" [0076.327] GetProcessHeap () returned 0x630000 [0076.327] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a328 [0076.327] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\") returned 38 [0076.328] GetProcessHeap () returned 0x630000 [0076.328] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4e) returned 0x65f4e0 [0076.328] lstrcpyW (in: lpString1=0x65f4e0, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Adobe\\" [0076.328] GetProcessHeap () returned 0x630000 [0076.328] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.328] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccd31c00, ftCreationTime.dwHighDateTime=0x1d5c894, ftLastAccessTime.dwLowDateTime=0xf28effb0, ftLastAccessTime.dwHighDateTime=0x1d5caef, ftLastWriteTime.dwLowDateTime=0xf28effb0, ftLastWriteTime.dwHighDateTime=0x1d5caef, nFileSizeHigh=0x0, nFileSizeLow=0x9954, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Aklulg73O5.wav", cAlternateFileName="AKLULG~1.WAV")) returned 1 [0076.328] lstrcmpiW (lpString1="Aklulg73O5.wav", lpString2=".") returned 1 [0076.328] lstrcmpiW (lpString1="Aklulg73O5.wav", lpString2="..") returned 1 [0076.328] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="Aklulg73O5.wav" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Aklulg73O5.wav") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Aklulg73O5.wav" [0076.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Aklulg73O5.wav", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0076.328] GetProcessHeap () returned 0x630000 [0076.328] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0076.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Aklulg73O5.wav", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Aklulg73O5.wav", lpUsedDefaultChar=0x0) returned 15 [0076.328] lstrlenA (lpString="Aklulg73O5.wav") returned 14 [0076.328] lstrlenA (lpString=".happythreechoose") returned 17 [0076.328] lstrcmpiW (lpString1="Aklulg73O5.wav", lpString2="Decryption INFO.html") returned -1 [0076.328] lstrcmpiW (lpString1="Aklulg73O5.wav", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0076.328] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0076.328] lstrcmpiW (lpString1="Aklulg73O5.wav", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0076.328] GetProcessHeap () returned 0x630000 [0076.328] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x652000 [0076.328] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Aklulg73O5.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\aklulg73o5.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0076.328] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=39252) returned 1 [0076.328] GetProcessHeap () returned 0x630000 [0076.328] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6558c8 [0076.328] GetProcessHeap () returned 0x630000 [0076.328] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6735c0 [0076.328] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Aklulg73O5.wav") returned 46 [0076.328] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0076.329] GetProcessHeap () returned 0x630000 [0076.329] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0076.329] GetProcessHeap () returned 0x630000 [0076.329] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38c) returned 0x673d08 [0076.329] lstrlenA (lpString="rsa_encrypt") returned 11 [0076.329] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x673180) returned 1 [0076.329] CryptGenRandom (in: hProv=0x673180, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0076.329] CryptReleaseContext (hProv=0x673180, dwFlags=0x0) returned 1 [0076.329] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0076.329] GetProcessHeap () returned 0x630000 [0076.329] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672dc8 [0076.329] lstrlenA (lpString="010001") returned 6 [0076.329] GetProcessHeap () returned 0x630000 [0076.329] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a298 [0076.329] GetProcessHeap () returned 0x630000 [0076.329] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672e50 [0076.330] GetProcessHeap () returned 0x630000 [0076.330] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e580 [0076.330] GetProcessHeap () returned 0x630000 [0076.330] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672e50 | out: hHeap=0x630000) returned 1 [0076.330] GetProcessHeap () returned 0x630000 [0076.330] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0076.330] GetProcessHeap () returned 0x630000 [0076.330] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657210 [0076.330] GetProcessHeap () returned 0x630000 [0076.330] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0076.330] GetProcessHeap () returned 0x630000 [0076.330] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0076.330] GetProcessHeap () returned 0x630000 [0076.330] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0076.330] GetProcessHeap () returned 0x630000 [0076.330] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0076.330] GetProcessHeap () returned 0x630000 [0076.330] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672988 [0076.330] GetProcessHeap () returned 0x630000 [0076.330] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656950 [0076.330] GetProcessHeap () returned 0x630000 [0076.330] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0076.330] GetProcessHeap () returned 0x630000 [0076.330] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0076.330] GetProcessHeap () returned 0x630000 [0076.330] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0076.330] GetProcessHeap () returned 0x630000 [0076.330] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672988 | out: hHeap=0x630000) returned 1 [0076.330] GetProcessHeap () returned 0x630000 [0076.330] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0076.330] GetProcessHeap () returned 0x630000 [0076.330] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0076.330] GetProcessHeap () returned 0x630000 [0076.330] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0076.330] GetProcessHeap () returned 0x630000 [0076.330] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65d090 [0076.330] GetProcessHeap () returned 0x630000 [0076.330] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0076.330] GetProcessHeap () returned 0x630000 [0076.331] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0076.331] GetProcessHeap () returned 0x630000 [0076.331] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0076.331] GetProcessHeap () returned 0x630000 [0076.331] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0076.331] GetProcessHeap () returned 0x630000 [0076.331] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65de30 [0076.331] GetProcessHeap () returned 0x630000 [0076.331] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65d090 | out: hHeap=0x630000) returned 1 [0076.331] GetProcessHeap () returned 0x630000 [0076.331] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0076.331] GetProcessHeap () returned 0x630000 [0076.331] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0076.331] GetProcessHeap () returned 0x630000 [0076.331] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.331] GetProcessHeap () returned 0x630000 [0076.331] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.331] GetProcessHeap () returned 0x630000 [0076.331] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.331] GetProcessHeap () returned 0x630000 [0076.331] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.331] GetProcessHeap () returned 0x630000 [0076.331] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0076.331] GetProcessHeap () returned 0x630000 [0076.331] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0076.331] GetProcessHeap () returned 0x630000 [0076.331] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.331] GetProcessHeap () returned 0x630000 [0076.331] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.331] GetProcessHeap () returned 0x630000 [0076.331] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0076.331] GetProcessHeap () returned 0x630000 [0076.331] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0076.331] GetProcessHeap () returned 0x630000 [0076.331] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.331] GetProcessHeap () returned 0x630000 [0076.331] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.331] GetProcessHeap () returned 0x630000 [0076.331] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0076.331] GetProcessHeap () returned 0x630000 [0076.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0076.332] GetProcessHeap () returned 0x630000 [0076.332] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0076.332] GetProcessHeap () returned 0x630000 [0076.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0076.332] GetProcessHeap () returned 0x630000 [0076.332] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.332] GetProcessHeap () returned 0x630000 [0076.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.332] GetProcessHeap () returned 0x630000 [0076.332] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0076.332] GetProcessHeap () returned 0x630000 [0076.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0076.332] GetProcessHeap () returned 0x630000 [0076.332] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.332] GetProcessHeap () returned 0x630000 [0076.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.332] GetProcessHeap () returned 0x630000 [0076.332] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.332] GetProcessHeap () returned 0x630000 [0076.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.332] GetProcessHeap () returned 0x630000 [0076.332] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.332] GetProcessHeap () returned 0x630000 [0076.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.332] GetProcessHeap () returned 0x630000 [0076.332] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.332] GetProcessHeap () returned 0x630000 [0076.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.332] GetProcessHeap () returned 0x630000 [0076.332] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.332] GetProcessHeap () returned 0x630000 [0076.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.332] GetProcessHeap () returned 0x630000 [0076.332] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.332] GetProcessHeap () returned 0x630000 [0076.333] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.333] GetProcessHeap () returned 0x630000 [0076.333] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0076.333] GetProcessHeap () returned 0x630000 [0076.333] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0076.333] GetProcessHeap () returned 0x630000 [0076.333] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0076.333] GetProcessHeap () returned 0x630000 [0076.333] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0076.333] GetProcessHeap () returned 0x630000 [0076.333] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.333] GetProcessHeap () returned 0x630000 [0076.333] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.333] GetProcessHeap () returned 0x630000 [0076.333] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0076.333] GetProcessHeap () returned 0x630000 [0076.333] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.333] GetProcessHeap () returned 0x630000 [0076.333] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.333] GetProcessHeap () returned 0x630000 [0076.333] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.333] GetProcessHeap () returned 0x630000 [0076.333] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0076.333] GetProcessHeap () returned 0x630000 [0076.333] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.333] GetProcessHeap () returned 0x630000 [0076.333] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0076.333] GetProcessHeap () returned 0x630000 [0076.333] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.333] GetProcessHeap () returned 0x630000 [0076.333] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.333] GetProcessHeap () returned 0x630000 [0076.333] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.333] GetProcessHeap () returned 0x630000 [0076.333] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0076.333] GetProcessHeap () returned 0x630000 [0076.333] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0076.333] GetProcessHeap () returned 0x630000 [0076.334] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.334] GetProcessHeap () returned 0x630000 [0076.334] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.334] GetProcessHeap () returned 0x630000 [0076.334] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.334] GetProcessHeap () returned 0x630000 [0076.334] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.334] GetProcessHeap () returned 0x630000 [0076.334] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.334] GetProcessHeap () returned 0x630000 [0076.334] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.334] GetProcessHeap () returned 0x630000 [0076.334] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.334] GetProcessHeap () returned 0x630000 [0076.334] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.334] GetProcessHeap () returned 0x630000 [0076.334] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.334] GetProcessHeap () returned 0x630000 [0076.334] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.334] GetProcessHeap () returned 0x630000 [0076.334] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.334] GetProcessHeap () returned 0x630000 [0076.334] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.334] GetProcessHeap () returned 0x630000 [0076.334] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.334] GetProcessHeap () returned 0x630000 [0076.334] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.334] GetProcessHeap () returned 0x630000 [0076.334] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.334] GetProcessHeap () returned 0x630000 [0076.334] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.334] GetProcessHeap () returned 0x630000 [0076.334] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.334] GetProcessHeap () returned 0x630000 [0076.334] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.334] GetProcessHeap () returned 0x630000 [0076.334] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.334] GetProcessHeap () returned 0x630000 [0076.335] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.335] GetProcessHeap () returned 0x630000 [0076.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.335] GetProcessHeap () returned 0x630000 [0076.335] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.335] GetProcessHeap () returned 0x630000 [0076.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.335] GetProcessHeap () returned 0x630000 [0076.335] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.335] GetProcessHeap () returned 0x630000 [0076.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.335] GetProcessHeap () returned 0x630000 [0076.335] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.335] GetProcessHeap () returned 0x630000 [0076.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0076.335] GetProcessHeap () returned 0x630000 [0076.335] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0076.335] GetProcessHeap () returned 0x630000 [0076.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.335] GetProcessHeap () returned 0x630000 [0076.335] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.335] GetProcessHeap () returned 0x630000 [0076.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.335] GetProcessHeap () returned 0x630000 [0076.335] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.335] GetProcessHeap () returned 0x630000 [0076.335] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0076.335] GetProcessHeap () returned 0x630000 [0076.335] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0076.335] GetProcessHeap () returned 0x630000 [0076.335] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0076.335] GetProcessHeap () returned 0x630000 [0076.335] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0076.335] GetProcessHeap () returned 0x630000 [0076.335] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0076.336] GetProcessHeap () returned 0x630000 [0076.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0076.336] GetProcessHeap () returned 0x630000 [0076.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0076.336] GetProcessHeap () returned 0x630000 [0076.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0076.336] GetProcessHeap () returned 0x630000 [0076.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0076.336] GetProcessHeap () returned 0x630000 [0076.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.336] GetProcessHeap () returned 0x630000 [0076.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672dc8 | out: hHeap=0x630000) returned 1 [0076.336] WriteFile (in: hFile=0x230, lpBuffer=0x673d08*, nNumberOfBytesToWrite=0x38c, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673d08*, lpNumberOfBytesWritten=0x243d864*=0x38c, lpOverlapped=0x0) returned 1 [0076.339] GetProcessHeap () returned 0x630000 [0076.339] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x673d08, Size=0x30) returned 0x673d08 [0076.339] GetProcessHeap () returned 0x630000 [0076.339] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0076.339] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0076.339] GetProcessHeap () returned 0x630000 [0076.339] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9960) returned 0x673d40 [0076.339] ReadFile (in: hFile=0x230, lpBuffer=0x673d40, nNumberOfBytesToRead=0x9960, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x673d40*, lpNumberOfBytesRead=0x243d7e8*=0x9960, lpOverlapped=0x0) returned 1 [0076.339] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0076.339] WriteFile (in: hFile=0x230, lpBuffer=0x673d40*, nNumberOfBytesToWrite=0x9960, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x673d40*, lpNumberOfBytesWritten=0x243d7e4*=0x9960, lpOverlapped=0x0) returned 1 [0076.341] GetProcessHeap () returned 0x630000 [0076.341] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673d40 | out: hHeap=0x630000) returned 1 [0076.342] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0076.342] WriteFile (in: hFile=0x230, lpBuffer=0x673d08*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673d08*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0076.343] CloseHandle (hObject=0x230) returned 1 [0076.344] GetProcessHeap () returned 0x630000 [0076.344] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x652000 | out: hHeap=0x630000) returned 1 [0076.344] GetProcessHeap () returned 0x630000 [0076.344] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6558c8 | out: hHeap=0x630000) returned 1 [0076.344] GetProcessHeap () returned 0x630000 [0076.344] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6735c0 | out: hHeap=0x630000) returned 1 [0076.344] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Aklulg73O5.wav" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Aklulg73O5.wav") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Aklulg73O5.wav" [0076.344] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Aklulg73O5.wav", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Aklulg73O5.wav.happythreechoose") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Aklulg73O5.wav.happythreechoose" [0076.344] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Aklulg73O5.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\aklulg73o5.wav"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Aklulg73O5.wav.happythreechoose" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\aklulg73o5.wav.happythreechoose"), dwFlags=0x1) returned 1 [0076.345] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Aklulg73O5.wav" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0076.345] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="" [0076.345] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" [0076.345] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\decryption info.html")) returned 0x20 [0076.345] GetProcessHeap () returned 0x630000 [0076.345] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0076.345] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37032870, ftCreationTime.dwHighDateTime=0x1d5ce5a, ftLastAccessTime.dwLowDateTime=0x89909ab0, ftLastAccessTime.dwHighDateTime=0x1d5c936, ftLastWriteTime.dwLowDateTime=0x89909ab0, ftLastWriteTime.dwHighDateTime=0x1d5c936, nFileSizeHigh=0x0, nFileSizeLow=0x17860, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="b7B5p8AGXa_o.wav", cAlternateFileName="B7B5P8~1.WAV")) returned 1 [0076.345] lstrcmpiW (lpString1="b7B5p8AGXa_o.wav", lpString2=".") returned 1 [0076.345] lstrcmpiW (lpString1="b7B5p8AGXa_o.wav", lpString2="..") returned 1 [0076.345] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="b7B5p8AGXa_o.wav" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\b7B5p8AGXa_o.wav") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\b7B5p8AGXa_o.wav" [0076.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b7B5p8AGXa_o.wav", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0076.345] GetProcessHeap () returned 0x630000 [0076.345] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11) returned 0x645e58 [0076.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b7B5p8AGXa_o.wav", cchWideChar=-1, lpMultiByteStr=0x645e58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b7B5p8AGXa_o.wav", lpUsedDefaultChar=0x0) returned 17 [0076.345] lstrlenA (lpString="b7B5p8AGXa_o.wav") returned 16 [0076.345] lstrlenA (lpString=".happythreechoose") returned 17 [0076.345] lstrcmpiW (lpString1="b7B5p8AGXa_o.wav", lpString2="Decryption INFO.html") returned -1 [0076.345] lstrcmpiW (lpString1="b7B5p8AGXa_o.wav", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0076.345] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0076.345] lstrcmpiW (lpString1="b7B5p8AGXa_o.wav", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0076.345] GetProcessHeap () returned 0x630000 [0076.345] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f10 [0076.345] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\b7B5p8AGXa_o.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\b7b5p8agxa_o.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0076.346] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=96352) returned 1 [0076.346] GetProcessHeap () returned 0x630000 [0076.346] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655580 [0076.346] GetProcessHeap () returned 0x630000 [0076.346] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672dc8 [0076.346] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\b7B5p8AGXa_o.wav") returned 48 [0076.346] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0076.346] GetProcessHeap () returned 0x630000 [0076.346] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0076.346] GetProcessHeap () returned 0x630000 [0076.346] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x673d40 [0076.353] lstrlenA (lpString="rsa_encrypt") returned 11 [0076.353] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x673428) returned 1 [0076.353] CryptGenRandom (in: hProv=0x673428, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0076.353] CryptReleaseContext (hProv=0x673428, dwFlags=0x0) returned 1 [0076.353] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0076.353] GetProcessHeap () returned 0x630000 [0076.353] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672ba8 [0076.353] lstrlenA (lpString="010001") returned 6 [0076.353] GetProcessHeap () returned 0x630000 [0076.353] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a298 [0076.353] GetProcessHeap () returned 0x630000 [0076.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6737e0 [0076.354] GetProcessHeap () returned 0x630000 [0076.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0076.354] GetProcessHeap () returned 0x630000 [0076.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6737e0 | out: hHeap=0x630000) returned 1 [0076.354] GetProcessHeap () returned 0x630000 [0076.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e4f0 [0076.354] GetProcessHeap () returned 0x630000 [0076.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656c98 [0076.354] GetProcessHeap () returned 0x630000 [0076.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0076.354] GetProcessHeap () returned 0x630000 [0076.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0076.354] GetProcessHeap () returned 0x630000 [0076.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0076.354] GetProcessHeap () returned 0x630000 [0076.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0076.354] GetProcessHeap () returned 0x630000 [0076.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672f60 [0076.354] GetProcessHeap () returned 0x630000 [0076.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657440 [0076.354] GetProcessHeap () returned 0x630000 [0076.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0076.354] GetProcessHeap () returned 0x630000 [0076.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0076.354] GetProcessHeap () returned 0x630000 [0076.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e580 [0076.354] GetProcessHeap () returned 0x630000 [0076.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672f60 | out: hHeap=0x630000) returned 1 [0076.354] GetProcessHeap () returned 0x630000 [0076.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0076.354] GetProcessHeap () returned 0x630000 [0076.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0076.354] GetProcessHeap () returned 0x630000 [0076.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0076.354] GetProcessHeap () returned 0x630000 [0076.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0076.354] GetProcessHeap () returned 0x630000 [0076.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.355] GetProcessHeap () returned 0x630000 [0076.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0076.355] GetProcessHeap () returned 0x630000 [0076.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.355] GetProcessHeap () returned 0x630000 [0076.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.355] GetProcessHeap () returned 0x630000 [0076.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65dfe0 [0076.355] GetProcessHeap () returned 0x630000 [0076.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0076.355] GetProcessHeap () returned 0x630000 [0076.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0076.355] GetProcessHeap () returned 0x630000 [0076.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0076.355] GetProcessHeap () returned 0x630000 [0076.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.355] GetProcessHeap () returned 0x630000 [0076.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.355] GetProcessHeap () returned 0x630000 [0076.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0076.355] GetProcessHeap () returned 0x630000 [0076.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0076.355] GetProcessHeap () returned 0x630000 [0076.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0076.355] GetProcessHeap () returned 0x630000 [0076.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0076.355] GetProcessHeap () returned 0x630000 [0076.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0076.355] GetProcessHeap () returned 0x630000 [0076.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.355] GetProcessHeap () returned 0x630000 [0076.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0076.355] GetProcessHeap () returned 0x630000 [0076.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.355] GetProcessHeap () returned 0x630000 [0076.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.355] GetProcessHeap () returned 0x630000 [0076.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.356] GetProcessHeap () returned 0x630000 [0076.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.356] GetProcessHeap () returned 0x630000 [0076.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.356] GetProcessHeap () returned 0x630000 [0076.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.356] GetProcessHeap () returned 0x630000 [0076.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.356] GetProcessHeap () returned 0x630000 [0076.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.356] GetProcessHeap () returned 0x630000 [0076.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.356] GetProcessHeap () returned 0x630000 [0076.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.356] GetProcessHeap () returned 0x630000 [0076.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.356] GetProcessHeap () returned 0x630000 [0076.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.356] GetProcessHeap () returned 0x630000 [0076.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.356] GetProcessHeap () returned 0x630000 [0076.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0076.356] GetProcessHeap () returned 0x630000 [0076.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0076.356] GetProcessHeap () returned 0x630000 [0076.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0076.356] GetProcessHeap () returned 0x630000 [0076.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0076.356] GetProcessHeap () returned 0x630000 [0076.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0076.356] GetProcessHeap () returned 0x630000 [0076.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.356] GetProcessHeap () returned 0x630000 [0076.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.356] GetProcessHeap () returned 0x630000 [0076.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.356] GetProcessHeap () returned 0x630000 [0076.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.356] GetProcessHeap () returned 0x630000 [0076.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.357] GetProcessHeap () returned 0x630000 [0076.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.357] GetProcessHeap () returned 0x630000 [0076.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.357] GetProcessHeap () returned 0x630000 [0076.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.357] GetProcessHeap () returned 0x630000 [0076.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.357] GetProcessHeap () returned 0x630000 [0076.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.357] GetProcessHeap () returned 0x630000 [0076.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.357] GetProcessHeap () returned 0x630000 [0076.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.357] GetProcessHeap () returned 0x630000 [0076.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.357] GetProcessHeap () returned 0x630000 [0076.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0076.357] GetProcessHeap () returned 0x630000 [0076.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.357] GetProcessHeap () returned 0x630000 [0076.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.357] GetProcessHeap () returned 0x630000 [0076.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.357] GetProcessHeap () returned 0x630000 [0076.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.357] GetProcessHeap () returned 0x630000 [0076.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.357] GetProcessHeap () returned 0x630000 [0076.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.357] GetProcessHeap () returned 0x630000 [0076.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.357] GetProcessHeap () returned 0x630000 [0076.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.357] GetProcessHeap () returned 0x630000 [0076.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.357] GetProcessHeap () returned 0x630000 [0076.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.358] GetProcessHeap () returned 0x630000 [0076.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.358] GetProcessHeap () returned 0x630000 [0076.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.358] GetProcessHeap () returned 0x630000 [0076.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.358] GetProcessHeap () returned 0x630000 [0076.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.358] GetProcessHeap () returned 0x630000 [0076.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.358] GetProcessHeap () returned 0x630000 [0076.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0076.358] GetProcessHeap () returned 0x630000 [0076.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.358] GetProcessHeap () returned 0x630000 [0076.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0076.358] GetProcessHeap () returned 0x630000 [0076.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.358] GetProcessHeap () returned 0x630000 [0076.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0076.358] GetProcessHeap () returned 0x630000 [0076.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.358] GetProcessHeap () returned 0x630000 [0076.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0076.358] GetProcessHeap () returned 0x630000 [0076.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.358] GetProcessHeap () returned 0x630000 [0076.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.358] GetProcessHeap () returned 0x630000 [0076.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.359] GetProcessHeap () returned 0x630000 [0076.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0076.359] GetProcessHeap () returned 0x630000 [0076.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0076.359] GetProcessHeap () returned 0x630000 [0076.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.359] GetProcessHeap () returned 0x630000 [0076.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.359] GetProcessHeap () returned 0x630000 [0076.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.359] GetProcessHeap () returned 0x630000 [0076.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.359] GetProcessHeap () returned 0x630000 [0076.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0076.359] GetProcessHeap () returned 0x630000 [0076.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.359] GetProcessHeap () returned 0x630000 [0076.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.359] GetProcessHeap () returned 0x630000 [0076.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.359] GetProcessHeap () returned 0x630000 [0076.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0076.359] GetProcessHeap () returned 0x630000 [0076.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0076.359] GetProcessHeap () returned 0x630000 [0076.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.359] GetProcessHeap () returned 0x630000 [0076.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.359] GetProcessHeap () returned 0x630000 [0076.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.359] GetProcessHeap () returned 0x630000 [0076.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.359] GetProcessHeap () returned 0x630000 [0076.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0076.359] GetProcessHeap () returned 0x630000 [0076.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0076.360] GetProcessHeap () returned 0x630000 [0076.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0076.360] GetProcessHeap () returned 0x630000 [0076.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0076.360] GetProcessHeap () returned 0x630000 [0076.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0076.360] GetProcessHeap () returned 0x630000 [0076.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0076.360] GetProcessHeap () returned 0x630000 [0076.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0076.360] GetProcessHeap () returned 0x630000 [0076.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0076.360] GetProcessHeap () returned 0x630000 [0076.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0076.360] GetProcessHeap () returned 0x630000 [0076.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.360] GetProcessHeap () returned 0x630000 [0076.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672ba8 | out: hHeap=0x630000) returned 1 [0076.360] WriteFile (in: hFile=0x230, lpBuffer=0x673d40*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673d40*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0076.422] GetProcessHeap () returned 0x630000 [0076.422] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x673d40, Size=0x30) returned 0x673d40 [0076.422] GetProcessHeap () returned 0x630000 [0076.422] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0076.422] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0076.422] GetProcessHeap () returned 0x630000 [0076.422] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x17860) returned 0x673d78 [0076.424] ReadFile (in: hFile=0x230, lpBuffer=0x673d78, nNumberOfBytesToRead=0x17860, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x673d78*, lpNumberOfBytesRead=0x243d7e8*=0x17860, lpOverlapped=0x0) returned 1 [0076.425] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0076.425] WriteFile (in: hFile=0x230, lpBuffer=0x673d78*, nNumberOfBytesToWrite=0x17860, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x673d78*, lpNumberOfBytesWritten=0x243d7e4*=0x17860, lpOverlapped=0x0) returned 1 [0076.469] GetProcessHeap () returned 0x630000 [0076.469] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673d78 | out: hHeap=0x630000) returned 1 [0076.469] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0076.469] WriteFile (in: hFile=0x230, lpBuffer=0x673d40*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673d40*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0076.471] CloseHandle (hObject=0x230) returned 1 [0076.471] GetProcessHeap () returned 0x630000 [0076.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f10 | out: hHeap=0x630000) returned 1 [0076.472] GetProcessHeap () returned 0x630000 [0076.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655580 | out: hHeap=0x630000) returned 1 [0076.472] GetProcessHeap () returned 0x630000 [0076.472] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672dc8 | out: hHeap=0x630000) returned 1 [0076.472] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\b7B5p8AGXa_o.wav" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\b7B5p8AGXa_o.wav") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\b7B5p8AGXa_o.wav" [0076.472] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\b7B5p8AGXa_o.wav", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\b7B5p8AGXa_o.wav.happythreechoose") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\b7B5p8AGXa_o.wav.happythreechoose" [0076.472] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\b7B5p8AGXa_o.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\b7b5p8agxa_o.wav"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\b7B5p8AGXa_o.wav.happythreechoose" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\b7b5p8agxa_o.wav.happythreechoose"), dwFlags=0x1) returned 1 [0076.473] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\b7B5p8AGXa_o.wav" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0076.473] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="" [0076.473] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" [0076.473] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\decryption info.html")) returned 0x20 [0076.473] GetProcessHeap () returned 0x630000 [0076.473] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645e58 | out: hHeap=0x630000) returned 1 [0076.473] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2616bc30, ftCreationTime.dwHighDateTime=0x1d5c80a, ftLastAccessTime.dwLowDateTime=0xa95b9950, ftLastAccessTime.dwHighDateTime=0x1d5cb37, ftLastWriteTime.dwLowDateTime=0xa95b9950, ftLastWriteTime.dwHighDateTime=0x1d5cb37, nFileSizeHigh=0x0, nFileSizeLow=0x14bef, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="G7Sm1GdDhkNzSCJ.doc", cAlternateFileName="G7SM1G~1.DOC")) returned 1 [0076.473] lstrcmpiW (lpString1="G7Sm1GdDhkNzSCJ.doc", lpString2=".") returned 1 [0076.473] lstrcmpiW (lpString1="G7Sm1GdDhkNzSCJ.doc", lpString2="..") returned 1 [0076.473] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="G7Sm1GdDhkNzSCJ.doc" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\G7Sm1GdDhkNzSCJ.doc") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\G7Sm1GdDhkNzSCJ.doc" [0076.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="G7Sm1GdDhkNzSCJ.doc", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0076.473] GetProcessHeap () returned 0x630000 [0076.473] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x645e58 [0076.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="G7Sm1GdDhkNzSCJ.doc", cchWideChar=-1, lpMultiByteStr=0x645e58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="G7Sm1GdDhkNzSCJ.doc", lpUsedDefaultChar=0x0) returned 20 [0076.473] lstrlenA (lpString="G7Sm1GdDhkNzSCJ.doc") returned 19 [0076.473] lstrlenA (lpString=".happythreechoose") returned 17 [0076.473] lstrlenA (lpString=".happythreechoose") returned 17 [0076.473] lstrlenA (lpString="G7Sm1GdDhkNzSCJ.doc") returned 19 [0076.473] lstrcmpiA (lpString1="Sm1GdDhkNzSCJ.doc", lpString2=".happythreechoose") returned 1 [0076.473] lstrcmpiW (lpString1="G7Sm1GdDhkNzSCJ.doc", lpString2="Decryption INFO.html") returned 1 [0076.473] lstrcmpiW (lpString1="G7Sm1GdDhkNzSCJ.doc", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0076.473] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0076.473] lstrcmpiW (lpString1="G7Sm1GdDhkNzSCJ.doc", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0076.473] GetProcessHeap () returned 0x630000 [0076.473] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0076.474] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\G7Sm1GdDhkNzSCJ.doc" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\g7sm1gddhknzscj.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0076.474] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=84975) returned 1 [0076.474] GetProcessHeap () returned 0x630000 [0076.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6558c8 [0076.474] GetProcessHeap () returned 0x630000 [0076.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6734b0 [0076.474] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\G7Sm1GdDhkNzSCJ.doc") returned 51 [0076.474] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0076.474] GetProcessHeap () returned 0x630000 [0076.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0076.474] GetProcessHeap () returned 0x630000 [0076.474] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x381) returned 0x673d78 [0076.474] lstrlenA (lpString="rsa_encrypt") returned 11 [0076.474] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x673070) returned 1 [0076.475] CryptGenRandom (in: hProv=0x673070, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0076.475] CryptReleaseContext (hProv=0x673070, dwFlags=0x0) returned 1 [0076.475] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0076.475] GetProcessHeap () returned 0x630000 [0076.475] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673538 [0076.475] lstrlenA (lpString="010001") returned 6 [0076.475] GetProcessHeap () returned 0x630000 [0076.475] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3f8 [0076.475] GetProcessHeap () returned 0x630000 [0076.475] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673070 [0076.475] GetProcessHeap () returned 0x630000 [0076.475] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e190 [0076.475] GetProcessHeap () returned 0x630000 [0076.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673070 | out: hHeap=0x630000) returned 1 [0076.475] GetProcessHeap () returned 0x630000 [0076.475] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0076.475] GetProcessHeap () returned 0x630000 [0076.475] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657440 [0076.475] GetProcessHeap () returned 0x630000 [0076.475] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a378 [0076.475] GetProcessHeap () returned 0x630000 [0076.475] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0076.475] GetProcessHeap () returned 0x630000 [0076.475] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.475] GetProcessHeap () returned 0x630000 [0076.475] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0076.475] GetProcessHeap () returned 0x630000 [0076.475] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6737e0 [0076.475] GetProcessHeap () returned 0x630000 [0076.475] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657328 [0076.475] GetProcessHeap () returned 0x630000 [0076.475] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.475] GetProcessHeap () returned 0x630000 [0076.475] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0076.475] GetProcessHeap () returned 0x630000 [0076.475] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea90 [0076.476] GetProcessHeap () returned 0x630000 [0076.476] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6737e0 | out: hHeap=0x630000) returned 1 [0076.476] GetProcessHeap () returned 0x630000 [0076.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0076.476] GetProcessHeap () returned 0x630000 [0076.476] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea90 | out: hHeap=0x630000) returned 1 [0076.476] GetProcessHeap () returned 0x630000 [0076.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.476] GetProcessHeap () returned 0x630000 [0076.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0076.476] GetProcessHeap () returned 0x630000 [0076.476] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.476] GetProcessHeap () returned 0x630000 [0076.476] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.476] GetProcessHeap () returned 0x630000 [0076.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0076.476] GetProcessHeap () returned 0x630000 [0076.476] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0076.476] GetProcessHeap () returned 0x630000 [0076.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65dfe0 [0076.476] GetProcessHeap () returned 0x630000 [0076.476] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0076.476] GetProcessHeap () returned 0x630000 [0076.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0076.476] GetProcessHeap () returned 0x630000 [0076.476] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0076.476] GetProcessHeap () returned 0x630000 [0076.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.476] GetProcessHeap () returned 0x630000 [0076.476] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.476] GetProcessHeap () returned 0x630000 [0076.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0076.476] GetProcessHeap () returned 0x630000 [0076.476] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0076.476] GetProcessHeap () returned 0x630000 [0076.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.476] GetProcessHeap () returned 0x630000 [0076.476] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.476] GetProcessHeap () returned 0x630000 [0076.476] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.477] GetProcessHeap () returned 0x630000 [0076.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.477] GetProcessHeap () returned 0x630000 [0076.477] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0076.477] GetProcessHeap () returned 0x630000 [0076.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0076.477] GetProcessHeap () returned 0x630000 [0076.477] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0076.477] GetProcessHeap () returned 0x630000 [0076.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0076.477] GetProcessHeap () returned 0x630000 [0076.477] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0076.477] GetProcessHeap () returned 0x630000 [0076.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.477] GetProcessHeap () returned 0x630000 [0076.477] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.477] GetProcessHeap () returned 0x630000 [0076.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.477] GetProcessHeap () returned 0x630000 [0076.477] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.477] GetProcessHeap () returned 0x630000 [0076.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.477] GetProcessHeap () returned 0x630000 [0076.477] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0076.477] GetProcessHeap () returned 0x630000 [0076.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.477] GetProcessHeap () returned 0x630000 [0076.477] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0076.477] GetProcessHeap () returned 0x630000 [0076.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0076.477] GetProcessHeap () returned 0x630000 [0076.477] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0076.477] GetProcessHeap () returned 0x630000 [0076.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0076.477] GetProcessHeap () returned 0x630000 [0076.477] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.477] GetProcessHeap () returned 0x630000 [0076.477] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.478] GetProcessHeap () returned 0x630000 [0076.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0076.478] GetProcessHeap () returned 0x630000 [0076.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0076.478] GetProcessHeap () returned 0x630000 [0076.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.478] GetProcessHeap () returned 0x630000 [0076.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.478] GetProcessHeap () returned 0x630000 [0076.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.478] GetProcessHeap () returned 0x630000 [0076.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.478] GetProcessHeap () returned 0x630000 [0076.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.478] GetProcessHeap () returned 0x630000 [0076.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.478] GetProcessHeap () returned 0x630000 [0076.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.478] GetProcessHeap () returned 0x630000 [0076.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.478] GetProcessHeap () returned 0x630000 [0076.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0076.478] GetProcessHeap () returned 0x630000 [0076.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0076.478] GetProcessHeap () returned 0x630000 [0076.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.478] GetProcessHeap () returned 0x630000 [0076.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.478] GetProcessHeap () returned 0x630000 [0076.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0076.478] GetProcessHeap () returned 0x630000 [0076.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0076.478] GetProcessHeap () returned 0x630000 [0076.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0076.478] GetProcessHeap () returned 0x630000 [0076.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0076.478] GetProcessHeap () returned 0x630000 [0076.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0076.478] GetProcessHeap () returned 0x630000 [0076.478] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0076.479] GetProcessHeap () returned 0x630000 [0076.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.479] GetProcessHeap () returned 0x630000 [0076.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.479] GetProcessHeap () returned 0x630000 [0076.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.479] GetProcessHeap () returned 0x630000 [0076.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.479] GetProcessHeap () returned 0x630000 [0076.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.479] GetProcessHeap () returned 0x630000 [0076.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.479] GetProcessHeap () returned 0x630000 [0076.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0076.479] GetProcessHeap () returned 0x630000 [0076.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0076.479] GetProcessHeap () returned 0x630000 [0076.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0076.479] GetProcessHeap () returned 0x630000 [0076.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0076.479] GetProcessHeap () returned 0x630000 [0076.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.479] GetProcessHeap () returned 0x630000 [0076.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.479] GetProcessHeap () returned 0x630000 [0076.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.479] GetProcessHeap () returned 0x630000 [0076.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.479] GetProcessHeap () returned 0x630000 [0076.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.479] GetProcessHeap () returned 0x630000 [0076.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.479] GetProcessHeap () returned 0x630000 [0076.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0076.479] GetProcessHeap () returned 0x630000 [0076.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0076.479] GetProcessHeap () returned 0x630000 [0076.479] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0076.479] GetProcessHeap () returned 0x630000 [0076.479] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0076.480] GetProcessHeap () returned 0x630000 [0076.480] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.480] GetProcessHeap () returned 0x630000 [0076.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.480] GetProcessHeap () returned 0x630000 [0076.480] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0076.480] GetProcessHeap () returned 0x630000 [0076.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0076.480] GetProcessHeap () returned 0x630000 [0076.480] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0076.480] GetProcessHeap () returned 0x630000 [0076.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0076.480] GetProcessHeap () returned 0x630000 [0076.480] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.480] GetProcessHeap () returned 0x630000 [0076.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.480] GetProcessHeap () returned 0x630000 [0076.480] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0076.480] GetProcessHeap () returned 0x630000 [0076.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0076.480] GetProcessHeap () returned 0x630000 [0076.480] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.480] GetProcessHeap () returned 0x630000 [0076.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.480] GetProcessHeap () returned 0x630000 [0076.480] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0076.480] GetProcessHeap () returned 0x630000 [0076.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0076.480] GetProcessHeap () returned 0x630000 [0076.480] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.480] GetProcessHeap () returned 0x630000 [0076.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.480] GetProcessHeap () returned 0x630000 [0076.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0076.480] GetProcessHeap () returned 0x630000 [0076.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0076.480] GetProcessHeap () returned 0x630000 [0076.480] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0076.480] GetProcessHeap () returned 0x630000 [0076.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0076.481] GetProcessHeap () returned 0x630000 [0076.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0076.481] GetProcessHeap () returned 0x630000 [0076.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0076.481] GetProcessHeap () returned 0x630000 [0076.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0076.481] GetProcessHeap () returned 0x630000 [0076.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0076.481] GetProcessHeap () returned 0x630000 [0076.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0076.481] GetProcessHeap () returned 0x630000 [0076.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.481] GetProcessHeap () returned 0x630000 [0076.481] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673538 | out: hHeap=0x630000) returned 1 [0076.481] WriteFile (in: hFile=0x230, lpBuffer=0x673d78*, nNumberOfBytesToWrite=0x381, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673d78*, lpNumberOfBytesWritten=0x243d864*=0x381, lpOverlapped=0x0) returned 1 [0076.519] GetProcessHeap () returned 0x630000 [0076.519] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x673d78, Size=0x30) returned 0x673d78 [0076.519] GetProcessHeap () returned 0x630000 [0076.519] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0076.519] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0076.519] GetProcessHeap () returned 0x630000 [0076.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14bf0) returned 0x673db0 [0076.519] ReadFile (in: hFile=0x230, lpBuffer=0x673db0, nNumberOfBytesToRead=0x14bf0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x673db0*, lpNumberOfBytesRead=0x243d7e8*=0x14bf0, lpOverlapped=0x0) returned 1 [0076.520] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0076.520] WriteFile (in: hFile=0x230, lpBuffer=0x673db0*, nNumberOfBytesToWrite=0x14bf0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x673db0*, lpNumberOfBytesWritten=0x243d7e4*=0x14bf0, lpOverlapped=0x0) returned 1 [0076.522] GetProcessHeap () returned 0x630000 [0076.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673db0 | out: hHeap=0x630000) returned 1 [0076.523] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0076.523] WriteFile (in: hFile=0x230, lpBuffer=0x673d78*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673d78*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0076.524] CloseHandle (hObject=0x230) returned 1 [0076.525] GetProcessHeap () returned 0x630000 [0076.525] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0076.525] GetProcessHeap () returned 0x630000 [0076.525] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6558c8 | out: hHeap=0x630000) returned 1 [0076.525] GetProcessHeap () returned 0x630000 [0076.525] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6734b0 | out: hHeap=0x630000) returned 1 [0076.525] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\G7Sm1GdDhkNzSCJ.doc" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\G7Sm1GdDhkNzSCJ.doc") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\G7Sm1GdDhkNzSCJ.doc" [0076.525] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\G7Sm1GdDhkNzSCJ.doc", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\G7Sm1GdDhkNzSCJ.doc.happythreechoose") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\G7Sm1GdDhkNzSCJ.doc.happythreechoose" [0076.525] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\G7Sm1GdDhkNzSCJ.doc" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\g7sm1gddhknzscj.doc"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\G7Sm1GdDhkNzSCJ.doc.happythreechoose" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\g7sm1gddhknzscj.doc.happythreechoose"), dwFlags=0x1) returned 1 [0076.526] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\G7Sm1GdDhkNzSCJ.doc" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0076.526] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="" [0076.526] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" [0076.526] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\decryption info.html")) returned 0x20 [0076.526] GetProcessHeap () returned 0x630000 [0076.526] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645e58 | out: hHeap=0x630000) returned 1 [0076.526] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80269a20, ftCreationTime.dwHighDateTime=0x1d5d3c1, ftLastAccessTime.dwLowDateTime=0xd32d5120, ftLastAccessTime.dwHighDateTime=0x1d5d59a, ftLastWriteTime.dwLowDateTime=0xd32d5120, ftLastWriteTime.dwHighDateTime=0x1d5d59a, nFileSizeHigh=0x0, nFileSizeLow=0x155d5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="gtOFFGsHrE.pptx", cAlternateFileName="GTOFFG~1.PPT")) returned 1 [0076.526] lstrcmpiW (lpString1="gtOFFGsHrE.pptx", lpString2=".") returned 1 [0076.526] lstrcmpiW (lpString1="gtOFFGsHrE.pptx", lpString2="..") returned 1 [0076.526] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="gtOFFGsHrE.pptx" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\gtOFFGsHrE.pptx") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\gtOFFGsHrE.pptx" [0076.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gtOFFGsHrE.pptx", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0076.526] GetProcessHeap () returned 0x630000 [0076.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x64c9f0 [0076.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gtOFFGsHrE.pptx", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gtOFFGsHrE.pptx", lpUsedDefaultChar=0x0) returned 16 [0076.526] lstrlenA (lpString="gtOFFGsHrE.pptx") returned 15 [0076.526] lstrlenA (lpString=".happythreechoose") returned 17 [0076.526] lstrcmpiW (lpString1="gtOFFGsHrE.pptx", lpString2="Decryption INFO.html") returned 1 [0076.526] lstrcmpiW (lpString1="gtOFFGsHrE.pptx", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0076.526] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0076.526] lstrcmpiW (lpString1="gtOFFGsHrE.pptx", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0076.526] GetProcessHeap () returned 0x630000 [0076.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0076.526] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\gtOFFGsHrE.pptx" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\gtoffgshre.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0076.527] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=87509) returned 1 [0076.527] GetProcessHeap () returned 0x630000 [0076.527] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655940 [0076.527] GetProcessHeap () returned 0x630000 [0076.527] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6736d0 [0076.527] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\gtOFFGsHrE.pptx") returned 47 [0076.527] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0076.527] GetProcessHeap () returned 0x630000 [0076.527] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0076.527] GetProcessHeap () returned 0x630000 [0076.527] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38b) returned 0x673db0 [0076.528] lstrlenA (lpString="rsa_encrypt") returned 11 [0076.528] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x672ba8) returned 1 [0076.528] CryptGenRandom (in: hProv=0x672ba8, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0076.529] CryptReleaseContext (hProv=0x672ba8, dwFlags=0x0) returned 1 [0076.529] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0076.529] GetProcessHeap () returned 0x630000 [0076.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673208 [0076.529] lstrlenA (lpString="010001") returned 6 [0076.529] GetProcessHeap () returned 0x630000 [0076.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a318 [0076.529] GetProcessHeap () returned 0x630000 [0076.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673318 [0076.529] GetProcessHeap () returned 0x630000 [0076.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e730 [0076.529] GetProcessHeap () returned 0x630000 [0076.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673318 | out: hHeap=0x630000) returned 1 [0076.529] GetProcessHeap () returned 0x630000 [0076.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ebb0 [0076.529] GetProcessHeap () returned 0x630000 [0076.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656950 [0076.529] GetProcessHeap () returned 0x630000 [0076.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0076.529] GetProcessHeap () returned 0x630000 [0076.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0076.529] GetProcessHeap () returned 0x630000 [0076.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.529] GetProcessHeap () returned 0x630000 [0076.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0076.529] GetProcessHeap () returned 0x630000 [0076.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672a10 [0076.529] GetProcessHeap () returned 0x630000 [0076.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657210 [0076.529] GetProcessHeap () returned 0x630000 [0076.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.529] GetProcessHeap () returned 0x630000 [0076.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0076.529] GetProcessHeap () returned 0x630000 [0076.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0076.529] GetProcessHeap () returned 0x630000 [0076.529] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672a10 | out: hHeap=0x630000) returned 1 [0076.529] GetProcessHeap () returned 0x630000 [0076.529] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0076.530] GetProcessHeap () returned 0x630000 [0076.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0076.530] GetProcessHeap () returned 0x630000 [0076.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0076.530] GetProcessHeap () returned 0x630000 [0076.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65d0d8 [0076.530] GetProcessHeap () returned 0x630000 [0076.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.530] GetProcessHeap () returned 0x630000 [0076.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0076.530] GetProcessHeap () returned 0x630000 [0076.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.530] GetProcessHeap () returned 0x630000 [0076.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.530] GetProcessHeap () returned 0x630000 [0076.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e8e0 [0076.530] GetProcessHeap () returned 0x630000 [0076.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65d0d8 | out: hHeap=0x630000) returned 1 [0076.530] GetProcessHeap () returned 0x630000 [0076.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0076.530] GetProcessHeap () returned 0x630000 [0076.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0076.530] GetProcessHeap () returned 0x630000 [0076.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.530] GetProcessHeap () returned 0x630000 [0076.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.530] GetProcessHeap () returned 0x630000 [0076.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.530] GetProcessHeap () returned 0x630000 [0076.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.530] GetProcessHeap () returned 0x630000 [0076.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0076.530] GetProcessHeap () returned 0x630000 [0076.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0076.530] GetProcessHeap () returned 0x630000 [0076.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.530] GetProcessHeap () returned 0x630000 [0076.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.530] GetProcessHeap () returned 0x630000 [0076.530] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.531] GetProcessHeap () returned 0x630000 [0076.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.531] GetProcessHeap () returned 0x630000 [0076.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0076.531] GetProcessHeap () returned 0x630000 [0076.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0076.531] GetProcessHeap () returned 0x630000 [0076.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.531] GetProcessHeap () returned 0x630000 [0076.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.531] GetProcessHeap () returned 0x630000 [0076.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.531] GetProcessHeap () returned 0x630000 [0076.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.531] GetProcessHeap () returned 0x630000 [0076.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.531] GetProcessHeap () returned 0x630000 [0076.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.531] GetProcessHeap () returned 0x630000 [0076.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.531] GetProcessHeap () returned 0x630000 [0076.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.531] GetProcessHeap () returned 0x630000 [0076.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.531] GetProcessHeap () returned 0x630000 [0076.531] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.531] GetProcessHeap () returned 0x630000 [0076.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.532] GetProcessHeap () returned 0x630000 [0076.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.532] GetProcessHeap () returned 0x630000 [0076.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.532] GetProcessHeap () returned 0x630000 [0076.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.532] GetProcessHeap () returned 0x630000 [0076.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0076.532] GetProcessHeap () returned 0x630000 [0076.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0076.532] GetProcessHeap () returned 0x630000 [0076.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.532] GetProcessHeap () returned 0x630000 [0076.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.532] GetProcessHeap () returned 0x630000 [0076.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.532] GetProcessHeap () returned 0x630000 [0076.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.532] GetProcessHeap () returned 0x630000 [0076.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.532] GetProcessHeap () returned 0x630000 [0076.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.532] GetProcessHeap () returned 0x630000 [0076.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0076.532] GetProcessHeap () returned 0x630000 [0076.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0076.532] GetProcessHeap () returned 0x630000 [0076.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0076.532] GetProcessHeap () returned 0x630000 [0076.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0076.532] GetProcessHeap () returned 0x630000 [0076.532] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.532] GetProcessHeap () returned 0x630000 [0076.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.532] GetProcessHeap () returned 0x630000 [0076.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.533] GetProcessHeap () returned 0x630000 [0076.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.533] GetProcessHeap () returned 0x630000 [0076.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.533] GetProcessHeap () returned 0x630000 [0076.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.533] GetProcessHeap () returned 0x630000 [0076.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.533] GetProcessHeap () returned 0x630000 [0076.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.533] GetProcessHeap () returned 0x630000 [0076.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.533] GetProcessHeap () returned 0x630000 [0076.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.533] GetProcessHeap () returned 0x630000 [0076.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.533] GetProcessHeap () returned 0x630000 [0076.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.533] GetProcessHeap () returned 0x630000 [0076.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0076.533] GetProcessHeap () returned 0x630000 [0076.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0076.533] GetProcessHeap () returned 0x630000 [0076.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.533] GetProcessHeap () returned 0x630000 [0076.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.533] GetProcessHeap () returned 0x630000 [0076.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0076.533] GetProcessHeap () returned 0x630000 [0076.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.533] GetProcessHeap () returned 0x630000 [0076.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.533] GetProcessHeap () returned 0x630000 [0076.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.533] GetProcessHeap () returned 0x630000 [0076.533] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0076.533] GetProcessHeap () returned 0x630000 [0076.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0076.533] GetProcessHeap () returned 0x630000 [0076.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0076.534] GetProcessHeap () returned 0x630000 [0076.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.534] GetProcessHeap () returned 0x630000 [0076.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.534] GetProcessHeap () returned 0x630000 [0076.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.534] GetProcessHeap () returned 0x630000 [0076.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0076.534] GetProcessHeap () returned 0x630000 [0076.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0076.534] GetProcessHeap () returned 0x630000 [0076.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0076.534] GetProcessHeap () returned 0x630000 [0076.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0076.534] GetProcessHeap () returned 0x630000 [0076.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0076.534] GetProcessHeap () returned 0x630000 [0076.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0076.534] GetProcessHeap () returned 0x630000 [0076.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.534] GetProcessHeap () returned 0x630000 [0076.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.534] GetProcessHeap () returned 0x630000 [0076.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.534] GetProcessHeap () returned 0x630000 [0076.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.534] GetProcessHeap () returned 0x630000 [0076.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0076.534] GetProcessHeap () returned 0x630000 [0076.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0076.534] GetProcessHeap () returned 0x630000 [0076.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.534] GetProcessHeap () returned 0x630000 [0076.534] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.534] GetProcessHeap () returned 0x630000 [0076.534] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.535] GetProcessHeap () returned 0x630000 [0076.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.535] GetProcessHeap () returned 0x630000 [0076.535] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.535] GetProcessHeap () returned 0x630000 [0076.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.535] GetProcessHeap () returned 0x630000 [0076.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0076.535] GetProcessHeap () returned 0x630000 [0076.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0076.535] GetProcessHeap () returned 0x630000 [0076.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0076.535] GetProcessHeap () returned 0x630000 [0076.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0076.535] GetProcessHeap () returned 0x630000 [0076.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0076.535] GetProcessHeap () returned 0x630000 [0076.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0076.535] GetProcessHeap () returned 0x630000 [0076.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0076.535] GetProcessHeap () returned 0x630000 [0076.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0076.535] GetProcessHeap () returned 0x630000 [0076.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0076.535] GetProcessHeap () returned 0x630000 [0076.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.535] GetProcessHeap () returned 0x630000 [0076.535] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673208 | out: hHeap=0x630000) returned 1 [0076.535] WriteFile (in: hFile=0x230, lpBuffer=0x673db0*, nNumberOfBytesToWrite=0x38b, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673db0*, lpNumberOfBytesWritten=0x243d864*=0x38b, lpOverlapped=0x0) returned 1 [0076.537] GetProcessHeap () returned 0x630000 [0076.537] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x673db0, Size=0x30) returned 0x673db0 [0076.537] GetProcessHeap () returned 0x630000 [0076.537] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0076.537] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0076.537] GetProcessHeap () returned 0x630000 [0076.537] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x155e0) returned 0x673de8 [0076.539] ReadFile (in: hFile=0x230, lpBuffer=0x673de8, nNumberOfBytesToRead=0x155e0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x673de8*, lpNumberOfBytesRead=0x243d7e8*=0x155e0, lpOverlapped=0x0) returned 1 [0076.540] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0076.540] WriteFile (in: hFile=0x230, lpBuffer=0x673de8*, nNumberOfBytesToWrite=0x155e0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x673de8*, lpNumberOfBytesWritten=0x243d7e4*=0x155e0, lpOverlapped=0x0) returned 1 [0076.548] GetProcessHeap () returned 0x630000 [0076.548] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673de8 | out: hHeap=0x630000) returned 1 [0076.548] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0076.548] WriteFile (in: hFile=0x230, lpBuffer=0x673db0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673db0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0076.549] CloseHandle (hObject=0x230) returned 1 [0076.549] GetProcessHeap () returned 0x630000 [0076.550] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0076.550] GetProcessHeap () returned 0x630000 [0076.550] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655940 | out: hHeap=0x630000) returned 1 [0076.550] GetProcessHeap () returned 0x630000 [0076.550] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6736d0 | out: hHeap=0x630000) returned 1 [0076.550] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\gtOFFGsHrE.pptx" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\gtOFFGsHrE.pptx") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\gtOFFGsHrE.pptx" [0076.550] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\gtOFFGsHrE.pptx", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\gtOFFGsHrE.pptx.happythreechoose") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\gtOFFGsHrE.pptx.happythreechoose" [0076.550] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\gtOFFGsHrE.pptx" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\gtoffgshre.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\gtOFFGsHrE.pptx.happythreechoose" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\gtoffgshre.pptx.happythreechoose"), dwFlags=0x1) returned 1 [0076.550] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\gtOFFGsHrE.pptx" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0076.550] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="" [0076.550] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" [0076.551] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\decryption info.html")) returned 0x20 [0076.551] GetProcessHeap () returned 0x630000 [0076.551] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0076.551] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc367880, ftCreationTime.dwHighDateTime=0x1d5d566, ftLastAccessTime.dwLowDateTime=0x5d0c2ab0, ftLastAccessTime.dwHighDateTime=0x1d5d758, ftLastWriteTime.dwLowDateTime=0x5d0c2ab0, ftLastWriteTime.dwHighDateTime=0x1d5d758, nFileSizeHigh=0x0, nFileSizeLow=0x7011, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hyIdUq94ezSk.jpg", cAlternateFileName="HYIDUQ~1.JPG")) returned 1 [0076.551] lstrcmpiW (lpString1="hyIdUq94ezSk.jpg", lpString2=".") returned 1 [0076.551] lstrcmpiW (lpString1="hyIdUq94ezSk.jpg", lpString2="..") returned 1 [0076.551] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="hyIdUq94ezSk.jpg" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\hyIdUq94ezSk.jpg") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\hyIdUq94ezSk.jpg" [0076.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hyIdUq94ezSk.jpg", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0076.551] GetProcessHeap () returned 0x630000 [0076.551] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11) returned 0x645e58 [0076.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hyIdUq94ezSk.jpg", cchWideChar=-1, lpMultiByteStr=0x645e58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hyIdUq94ezSk.jpg", lpUsedDefaultChar=0x0) returned 17 [0076.551] lstrlenA (lpString="hyIdUq94ezSk.jpg") returned 16 [0076.551] lstrlenA (lpString=".happythreechoose") returned 17 [0076.551] lstrcmpiW (lpString1="hyIdUq94ezSk.jpg", lpString2="Decryption INFO.html") returned 1 [0076.551] lstrcmpiW (lpString1="hyIdUq94ezSk.jpg", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0076.551] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0076.551] lstrcmpiW (lpString1="hyIdUq94ezSk.jpg", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0076.551] GetProcessHeap () returned 0x630000 [0076.551] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0076.551] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\hyIdUq94ezSk.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\hyiduq94ezsk.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0076.551] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=28689) returned 1 [0076.551] GetProcessHeap () returned 0x630000 [0076.551] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655850 [0076.551] GetProcessHeap () returned 0x630000 [0076.551] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673290 [0076.551] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\hyIdUq94ezSk.jpg") returned 48 [0076.552] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0076.552] GetProcessHeap () returned 0x630000 [0076.552] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0076.552] GetProcessHeap () returned 0x630000 [0076.552] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x673de8 [0076.552] lstrlenA (lpString="rsa_encrypt") returned 11 [0076.552] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x673180) returned 1 [0076.552] CryptGenRandom (in: hProv=0x673180, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0076.552] CryptReleaseContext (hProv=0x673180, dwFlags=0x0) returned 1 [0076.552] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0076.552] GetProcessHeap () returned 0x630000 [0076.552] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673208 [0076.553] lstrlenA (lpString="010001") returned 6 [0076.553] GetProcessHeap () returned 0x630000 [0076.553] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a298 [0076.553] GetProcessHeap () returned 0x630000 [0076.553] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6735c0 [0076.553] GetProcessHeap () returned 0x630000 [0076.553] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e580 [0076.553] GetProcessHeap () returned 0x630000 [0076.553] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6735c0 | out: hHeap=0x630000) returned 1 [0076.553] GetProcessHeap () returned 0x630000 [0076.553] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e6a0 [0076.553] GetProcessHeap () returned 0x630000 [0076.553] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656ec8 [0076.553] GetProcessHeap () returned 0x630000 [0076.553] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a398 [0076.553] GetProcessHeap () returned 0x630000 [0076.553] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0076.553] GetProcessHeap () returned 0x630000 [0076.553] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.553] GetProcessHeap () returned 0x630000 [0076.553] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0076.553] GetProcessHeap () returned 0x630000 [0076.553] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6733a0 [0076.553] GetProcessHeap () returned 0x630000 [0076.553] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656fe0 [0076.553] GetProcessHeap () returned 0x630000 [0076.553] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.553] GetProcessHeap () returned 0x630000 [0076.553] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0076.553] GetProcessHeap () returned 0x630000 [0076.553] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0076.553] GetProcessHeap () returned 0x630000 [0076.553] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6733a0 | out: hHeap=0x630000) returned 1 [0076.553] GetProcessHeap () returned 0x630000 [0076.553] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0076.553] GetProcessHeap () returned 0x630000 [0076.553] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0076.553] GetProcessHeap () returned 0x630000 [0076.553] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0076.553] GetProcessHeap () returned 0x630000 [0076.554] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0076.554] GetProcessHeap () returned 0x630000 [0076.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.554] GetProcessHeap () returned 0x630000 [0076.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0076.554] GetProcessHeap () returned 0x630000 [0076.554] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.554] GetProcessHeap () returned 0x630000 [0076.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.554] GetProcessHeap () returned 0x630000 [0076.554] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ea00 [0076.554] GetProcessHeap () returned 0x630000 [0076.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0076.554] GetProcessHeap () returned 0x630000 [0076.554] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0076.554] GetProcessHeap () returned 0x630000 [0076.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0076.554] GetProcessHeap () returned 0x630000 [0076.554] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.554] GetProcessHeap () returned 0x630000 [0076.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.554] GetProcessHeap () returned 0x630000 [0076.554] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.554] GetProcessHeap () returned 0x630000 [0076.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.554] GetProcessHeap () returned 0x630000 [0076.554] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.554] GetProcessHeap () returned 0x630000 [0076.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.554] GetProcessHeap () returned 0x630000 [0076.554] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.554] GetProcessHeap () returned 0x630000 [0076.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.554] GetProcessHeap () returned 0x630000 [0076.554] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.554] GetProcessHeap () returned 0x630000 [0076.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.554] GetProcessHeap () returned 0x630000 [0076.554] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0076.555] GetProcessHeap () returned 0x630000 [0076.555] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0076.555] GetProcessHeap () returned 0x630000 [0076.555] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0076.555] GetProcessHeap () returned 0x630000 [0076.555] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.555] GetProcessHeap () returned 0x630000 [0076.555] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.555] GetProcessHeap () returned 0x630000 [0076.555] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.555] GetProcessHeap () returned 0x630000 [0076.555] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0076.555] GetProcessHeap () returned 0x630000 [0076.555] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0076.555] GetProcessHeap () returned 0x630000 [0076.555] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.555] GetProcessHeap () returned 0x630000 [0076.555] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.555] GetProcessHeap () returned 0x630000 [0076.555] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.555] GetProcessHeap () returned 0x630000 [0076.555] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.555] GetProcessHeap () returned 0x630000 [0076.555] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.555] GetProcessHeap () returned 0x630000 [0076.555] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.555] GetProcessHeap () returned 0x630000 [0076.555] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.555] GetProcessHeap () returned 0x630000 [0076.555] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.555] GetProcessHeap () returned 0x630000 [0076.555] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.555] GetProcessHeap () returned 0x630000 [0076.555] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.555] GetProcessHeap () returned 0x630000 [0076.555] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0076.555] GetProcessHeap () returned 0x630000 [0076.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.556] GetProcessHeap () returned 0x630000 [0076.556] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.556] GetProcessHeap () returned 0x630000 [0076.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.556] GetProcessHeap () returned 0x630000 [0076.556] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.556] GetProcessHeap () returned 0x630000 [0076.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.556] GetProcessHeap () returned 0x630000 [0076.556] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.556] GetProcessHeap () returned 0x630000 [0076.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.556] GetProcessHeap () returned 0x630000 [0076.556] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0076.556] GetProcessHeap () returned 0x630000 [0076.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.556] GetProcessHeap () returned 0x630000 [0076.556] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0076.556] GetProcessHeap () returned 0x630000 [0076.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0076.556] GetProcessHeap () returned 0x630000 [0076.556] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0076.556] GetProcessHeap () returned 0x630000 [0076.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.556] GetProcessHeap () returned 0x630000 [0076.556] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.556] GetProcessHeap () returned 0x630000 [0076.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.556] GetProcessHeap () returned 0x630000 [0076.556] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0076.556] GetProcessHeap () returned 0x630000 [0076.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0076.556] GetProcessHeap () returned 0x630000 [0076.556] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.556] GetProcessHeap () returned 0x630000 [0076.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.556] GetProcessHeap () returned 0x630000 [0076.556] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0076.557] GetProcessHeap () returned 0x630000 [0076.557] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0076.557] GetProcessHeap () returned 0x630000 [0076.557] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.557] GetProcessHeap () returned 0x630000 [0076.557] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.557] GetProcessHeap () returned 0x630000 [0076.557] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.557] GetProcessHeap () returned 0x630000 [0076.557] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.557] GetProcessHeap () returned 0x630000 [0076.557] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.557] GetProcessHeap () returned 0x630000 [0076.557] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.557] GetProcessHeap () returned 0x630000 [0076.557] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.557] GetProcessHeap () returned 0x630000 [0076.557] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.557] GetProcessHeap () returned 0x630000 [0076.557] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.557] GetProcessHeap () returned 0x630000 [0076.557] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.557] GetProcessHeap () returned 0x630000 [0076.557] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.557] GetProcessHeap () returned 0x630000 [0076.557] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.557] GetProcessHeap () returned 0x630000 [0076.557] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.557] GetProcessHeap () returned 0x630000 [0076.557] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.557] GetProcessHeap () returned 0x630000 [0076.557] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.557] GetProcessHeap () returned 0x630000 [0076.557] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.557] GetProcessHeap () returned 0x630000 [0076.557] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.557] GetProcessHeap () returned 0x630000 [0076.557] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.557] GetProcessHeap () returned 0x630000 [0076.557] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0076.558] GetProcessHeap () returned 0x630000 [0076.558] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0076.558] GetProcessHeap () returned 0x630000 [0076.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.558] GetProcessHeap () returned 0x630000 [0076.558] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.558] GetProcessHeap () returned 0x630000 [0076.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.558] GetProcessHeap () returned 0x630000 [0076.558] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.558] GetProcessHeap () returned 0x630000 [0076.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0076.558] GetProcessHeap () returned 0x630000 [0076.558] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0076.558] GetProcessHeap () returned 0x630000 [0076.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0076.558] GetProcessHeap () returned 0x630000 [0076.558] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0076.558] GetProcessHeap () returned 0x630000 [0076.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.558] GetProcessHeap () returned 0x630000 [0076.558] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.558] GetProcessHeap () returned 0x630000 [0076.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.558] GetProcessHeap () returned 0x630000 [0076.558] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.558] GetProcessHeap () returned 0x630000 [0076.558] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0076.558] GetProcessHeap () returned 0x630000 [0076.558] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0076.558] GetProcessHeap () returned 0x630000 [0076.558] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0076.558] GetProcessHeap () returned 0x630000 [0076.558] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0076.558] GetProcessHeap () returned 0x630000 [0076.558] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0076.558] GetProcessHeap () returned 0x630000 [0076.558] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e6a0 | out: hHeap=0x630000) returned 1 [0076.559] GetProcessHeap () returned 0x630000 [0076.559] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0076.559] GetProcessHeap () returned 0x630000 [0076.559] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0076.559] GetProcessHeap () returned 0x630000 [0076.559] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0076.559] GetProcessHeap () returned 0x630000 [0076.559] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.559] GetProcessHeap () returned 0x630000 [0076.559] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673208 | out: hHeap=0x630000) returned 1 [0076.559] WriteFile (in: hFile=0x230, lpBuffer=0x673de8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673de8*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0076.560] GetProcessHeap () returned 0x630000 [0076.560] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x673de8, Size=0x30) returned 0x673de8 [0076.560] GetProcessHeap () returned 0x630000 [0076.560] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0076.561] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0076.561] GetProcessHeap () returned 0x630000 [0076.561] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7011) returned 0x673e20 [0076.561] ReadFile (in: hFile=0x230, lpBuffer=0x673e20, nNumberOfBytesToRead=0x7011, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x673e20*, lpNumberOfBytesRead=0x243d7e8*=0x7011, lpOverlapped=0x0) returned 1 [0076.561] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0076.561] WriteFile (in: hFile=0x230, lpBuffer=0x673e20*, nNumberOfBytesToWrite=0x7011, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x673e20*, lpNumberOfBytesWritten=0x243d7e4*=0x7011, lpOverlapped=0x0) returned 1 [0076.633] GetProcessHeap () returned 0x630000 [0076.633] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673e20 | out: hHeap=0x630000) returned 1 [0076.634] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0076.634] WriteFile (in: hFile=0x230, lpBuffer=0x673de8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673de8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0076.635] CloseHandle (hObject=0x230) returned 1 [0076.636] GetProcessHeap () returned 0x630000 [0076.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0076.636] GetProcessHeap () returned 0x630000 [0076.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655850 | out: hHeap=0x630000) returned 1 [0076.636] GetProcessHeap () returned 0x630000 [0076.636] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673290 | out: hHeap=0x630000) returned 1 [0076.636] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\hyIdUq94ezSk.jpg" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\hyIdUq94ezSk.jpg") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\hyIdUq94ezSk.jpg" [0076.636] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\hyIdUq94ezSk.jpg", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\hyIdUq94ezSk.jpg.happythreechoose") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\hyIdUq94ezSk.jpg.happythreechoose" [0076.636] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\hyIdUq94ezSk.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\hyiduq94ezsk.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\hyIdUq94ezSk.jpg.happythreechoose" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\hyiduq94ezsk.jpg.happythreechoose"), dwFlags=0x1) returned 1 [0076.637] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\hyIdUq94ezSk.jpg" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0076.637] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="" [0076.637] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" [0076.637] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\decryption info.html")) returned 0x20 [0076.637] GetProcessHeap () returned 0x630000 [0076.637] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645e58 | out: hHeap=0x630000) returned 1 [0076.637] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8d42b30, ftCreationTime.dwHighDateTime=0x1d5c855, ftLastAccessTime.dwLowDateTime=0x85962550, ftLastAccessTime.dwHighDateTime=0x1d5c856, ftLastWriteTime.dwLowDateTime=0x85962550, ftLastWriteTime.dwHighDateTime=0x1d5c856, nFileSizeHigh=0x0, nFileSizeLow=0x587, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Hyid_Whq.avi", cAlternateFileName="")) returned 1 [0076.637] lstrcmpiW (lpString1="Hyid_Whq.avi", lpString2=".") returned 1 [0076.637] lstrcmpiW (lpString1="Hyid_Whq.avi", lpString2="..") returned 1 [0076.637] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="Hyid_Whq.avi" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Hyid_Whq.avi") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Hyid_Whq.avi" [0076.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Hyid_Whq.avi", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0076.637] GetProcessHeap () returned 0x630000 [0076.637] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd) returned 0x64c9f0 [0076.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Hyid_Whq.avi", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Hyid_Whq.avi", lpUsedDefaultChar=0x0) returned 13 [0076.637] lstrlenA (lpString="Hyid_Whq.avi") returned 12 [0076.637] lstrlenA (lpString=".happythreechoose") returned 17 [0076.637] lstrcmpiW (lpString1="Hyid_Whq.avi", lpString2="Decryption INFO.html") returned 1 [0076.637] lstrcmpiW (lpString1="Hyid_Whq.avi", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0076.637] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0076.637] lstrcmpiW (lpString1="Hyid_Whq.avi", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0076.637] GetProcessHeap () returned 0x630000 [0076.637] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0076.637] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Hyid_Whq.avi" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\hyid_whq.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0076.637] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=1415) returned 1 [0076.637] GetProcessHeap () returned 0x630000 [0076.637] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655aa8 [0076.637] GetProcessHeap () returned 0x630000 [0076.638] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672b20 [0076.638] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Hyid_Whq.avi") returned 44 [0076.638] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0076.638] GetProcessHeap () returned 0x630000 [0076.638] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0076.638] GetProcessHeap () returned 0x630000 [0076.638] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x389) returned 0x673e20 [0076.639] lstrlenA (lpString="rsa_encrypt") returned 11 [0076.639] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x672cb8) returned 1 [0076.639] CryptGenRandom (in: hProv=0x672cb8, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0076.639] CryptReleaseContext (hProv=0x672cb8, dwFlags=0x0) returned 1 [0076.639] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0076.639] GetProcessHeap () returned 0x630000 [0076.639] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673208 [0076.639] lstrlenA (lpString="010001") returned 6 [0076.639] GetProcessHeap () returned 0x630000 [0076.639] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0076.640] GetProcessHeap () returned 0x630000 [0076.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6730f8 [0076.640] GetProcessHeap () returned 0x630000 [0076.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e730 [0076.640] GetProcessHeap () returned 0x630000 [0076.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6730f8 | out: hHeap=0x630000) returned 1 [0076.640] GetProcessHeap () returned 0x630000 [0076.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0076.640] GetProcessHeap () returned 0x630000 [0076.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656950 [0076.640] GetProcessHeap () returned 0x630000 [0076.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0076.640] GetProcessHeap () returned 0x630000 [0076.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0076.640] GetProcessHeap () returned 0x630000 [0076.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0076.640] GetProcessHeap () returned 0x630000 [0076.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0076.640] GetProcessHeap () returned 0x630000 [0076.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6733a0 [0076.640] GetProcessHeap () returned 0x630000 [0076.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656ec8 [0076.640] GetProcessHeap () returned 0x630000 [0076.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.640] GetProcessHeap () returned 0x630000 [0076.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0076.640] GetProcessHeap () returned 0x630000 [0076.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea00 [0076.640] GetProcessHeap () returned 0x630000 [0076.640] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6733a0 | out: hHeap=0x630000) returned 1 [0076.640] GetProcessHeap () returned 0x630000 [0076.640] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0076.641] GetProcessHeap () returned 0x630000 [0076.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0076.641] GetProcessHeap () returned 0x630000 [0076.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.641] GetProcessHeap () returned 0x630000 [0076.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cdd8 [0076.641] GetProcessHeap () returned 0x630000 [0076.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.641] GetProcessHeap () returned 0x630000 [0076.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.641] GetProcessHeap () returned 0x630000 [0076.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.641] GetProcessHeap () returned 0x630000 [0076.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.641] GetProcessHeap () returned 0x630000 [0076.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e610 [0076.641] GetProcessHeap () returned 0x630000 [0076.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cdd8 | out: hHeap=0x630000) returned 1 [0076.641] GetProcessHeap () returned 0x630000 [0076.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0076.641] GetProcessHeap () returned 0x630000 [0076.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0076.641] GetProcessHeap () returned 0x630000 [0076.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.641] GetProcessHeap () returned 0x630000 [0076.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.641] GetProcessHeap () returned 0x630000 [0076.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.641] GetProcessHeap () returned 0x630000 [0076.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.641] GetProcessHeap () returned 0x630000 [0076.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0076.641] GetProcessHeap () returned 0x630000 [0076.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0076.641] GetProcessHeap () returned 0x630000 [0076.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.641] GetProcessHeap () returned 0x630000 [0076.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.641] GetProcessHeap () returned 0x630000 [0076.641] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0076.642] GetProcessHeap () returned 0x630000 [0076.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0076.642] GetProcessHeap () returned 0x630000 [0076.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.642] GetProcessHeap () returned 0x630000 [0076.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.642] GetProcessHeap () returned 0x630000 [0076.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.642] GetProcessHeap () returned 0x630000 [0076.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.642] GetProcessHeap () returned 0x630000 [0076.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.642] GetProcessHeap () returned 0x630000 [0076.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.642] GetProcessHeap () returned 0x630000 [0076.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.642] GetProcessHeap () returned 0x630000 [0076.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.642] GetProcessHeap () returned 0x630000 [0076.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.642] GetProcessHeap () returned 0x630000 [0076.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.642] GetProcessHeap () returned 0x630000 [0076.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.642] GetProcessHeap () returned 0x630000 [0076.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.642] GetProcessHeap () returned 0x630000 [0076.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0076.642] GetProcessHeap () returned 0x630000 [0076.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0076.642] GetProcessHeap () returned 0x630000 [0076.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0076.642] GetProcessHeap () returned 0x630000 [0076.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0076.642] GetProcessHeap () returned 0x630000 [0076.642] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.642] GetProcessHeap () returned 0x630000 [0076.642] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.643] GetProcessHeap () returned 0x630000 [0076.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0076.643] GetProcessHeap () returned 0x630000 [0076.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.643] GetProcessHeap () returned 0x630000 [0076.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.643] GetProcessHeap () returned 0x630000 [0076.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.643] GetProcessHeap () returned 0x630000 [0076.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.643] GetProcessHeap () returned 0x630000 [0076.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.643] GetProcessHeap () returned 0x630000 [0076.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.643] GetProcessHeap () returned 0x630000 [0076.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.643] GetProcessHeap () returned 0x630000 [0076.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.643] GetProcessHeap () returned 0x630000 [0076.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.643] GetProcessHeap () returned 0x630000 [0076.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0076.643] GetProcessHeap () returned 0x630000 [0076.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0076.643] GetProcessHeap () returned 0x630000 [0076.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.643] GetProcessHeap () returned 0x630000 [0076.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.643] GetProcessHeap () returned 0x630000 [0076.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.643] GetProcessHeap () returned 0x630000 [0076.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.643] GetProcessHeap () returned 0x630000 [0076.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.643] GetProcessHeap () returned 0x630000 [0076.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.643] GetProcessHeap () returned 0x630000 [0076.643] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.643] GetProcessHeap () returned 0x630000 [0076.643] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.644] GetProcessHeap () returned 0x630000 [0076.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.644] GetProcessHeap () returned 0x630000 [0076.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.644] GetProcessHeap () returned 0x630000 [0076.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.644] GetProcessHeap () returned 0x630000 [0076.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.644] GetProcessHeap () returned 0x630000 [0076.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.644] GetProcessHeap () returned 0x630000 [0076.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.644] GetProcessHeap () returned 0x630000 [0076.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.644] GetProcessHeap () returned 0x630000 [0076.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.644] GetProcessHeap () returned 0x630000 [0076.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.644] GetProcessHeap () returned 0x630000 [0076.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.644] GetProcessHeap () returned 0x630000 [0076.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.644] GetProcessHeap () returned 0x630000 [0076.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.644] GetProcessHeap () returned 0x630000 [0076.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.644] GetProcessHeap () returned 0x630000 [0076.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.644] GetProcessHeap () returned 0x630000 [0076.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.644] GetProcessHeap () returned 0x630000 [0076.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.644] GetProcessHeap () returned 0x630000 [0076.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.644] GetProcessHeap () returned 0x630000 [0076.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.644] GetProcessHeap () returned 0x630000 [0076.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0076.644] GetProcessHeap () returned 0x630000 [0076.644] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0076.645] GetProcessHeap () returned 0x630000 [0076.645] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.645] GetProcessHeap () returned 0x630000 [0076.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.645] GetProcessHeap () returned 0x630000 [0076.645] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.645] GetProcessHeap () returned 0x630000 [0076.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.645] GetProcessHeap () returned 0x630000 [0076.645] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.645] GetProcessHeap () returned 0x630000 [0076.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.645] GetProcessHeap () returned 0x630000 [0076.645] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.645] GetProcessHeap () returned 0x630000 [0076.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.645] GetProcessHeap () returned 0x630000 [0076.645] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.645] GetProcessHeap () returned 0x630000 [0076.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.645] GetProcessHeap () returned 0x630000 [0076.645] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.645] GetProcessHeap () returned 0x630000 [0076.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.645] GetProcessHeap () returned 0x630000 [0076.645] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.645] GetProcessHeap () returned 0x630000 [0076.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.645] GetProcessHeap () returned 0x630000 [0076.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0076.645] GetProcessHeap () returned 0x630000 [0076.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0076.645] GetProcessHeap () returned 0x630000 [0076.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0076.645] GetProcessHeap () returned 0x630000 [0076.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0076.645] GetProcessHeap () returned 0x630000 [0076.645] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0076.646] GetProcessHeap () returned 0x630000 [0076.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0076.646] GetProcessHeap () returned 0x630000 [0076.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0076.646] GetProcessHeap () returned 0x630000 [0076.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0076.646] GetProcessHeap () returned 0x630000 [0076.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0076.646] GetProcessHeap () returned 0x630000 [0076.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0076.646] GetProcessHeap () returned 0x630000 [0076.646] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673208 | out: hHeap=0x630000) returned 1 [0076.646] WriteFile (in: hFile=0x230, lpBuffer=0x673e20*, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673e20*, lpNumberOfBytesWritten=0x243d864*=0x389, lpOverlapped=0x0) returned 1 [0076.648] GetProcessHeap () returned 0x630000 [0076.648] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x673e20, Size=0x30) returned 0x673e20 [0076.648] GetProcessHeap () returned 0x630000 [0076.648] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0076.648] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0076.648] GetProcessHeap () returned 0x630000 [0076.648] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x590) returned 0x673e58 [0076.648] ReadFile (in: hFile=0x230, lpBuffer=0x673e58, nNumberOfBytesToRead=0x590, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x673e58*, lpNumberOfBytesRead=0x243d7e8*=0x590, lpOverlapped=0x0) returned 1 [0076.648] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0076.648] WriteFile (in: hFile=0x230, lpBuffer=0x673e58*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x673e58*, lpNumberOfBytesWritten=0x243d7e4*=0x590, lpOverlapped=0x0) returned 1 [0076.649] GetProcessHeap () returned 0x630000 [0076.649] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673e58 | out: hHeap=0x630000) returned 1 [0076.649] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0076.649] WriteFile (in: hFile=0x230, lpBuffer=0x673e20*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673e20*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0076.650] CloseHandle (hObject=0x230) returned 1 [0076.650] GetProcessHeap () returned 0x630000 [0076.650] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0076.650] GetProcessHeap () returned 0x630000 [0076.650] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655aa8 | out: hHeap=0x630000) returned 1 [0076.650] GetProcessHeap () returned 0x630000 [0076.650] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672b20 | out: hHeap=0x630000) returned 1 [0076.650] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Hyid_Whq.avi" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Hyid_Whq.avi") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Hyid_Whq.avi" [0076.650] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Hyid_Whq.avi", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Hyid_Whq.avi.happythreechoose") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Hyid_Whq.avi.happythreechoose" [0076.651] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Hyid_Whq.avi" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\hyid_whq.avi"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Hyid_Whq.avi.happythreechoose" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\hyid_whq.avi.happythreechoose"), dwFlags=0x1) returned 1 [0076.651] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Hyid_Whq.avi" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0076.651] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="" [0076.651] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" [0076.651] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\decryption info.html")) returned 0x20 [0076.651] GetProcessHeap () returned 0x630000 [0076.651] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0076.651] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf10f5f50, ftCreationTime.dwHighDateTime=0x1d5d318, ftLastAccessTime.dwLowDateTime=0xd9a15630, ftLastAccessTime.dwHighDateTime=0x1d5c7cd, ftLastWriteTime.dwLowDateTime=0xd9a15630, ftLastWriteTime.dwHighDateTime=0x1d5c7cd, nFileSizeHigh=0x0, nFileSizeLow=0x1055d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="iTkqfu_KGpReiA8L9cTQ.bmp", cAlternateFileName="ITKQFU~1.BMP")) returned 1 [0076.651] lstrcmpiW (lpString1="iTkqfu_KGpReiA8L9cTQ.bmp", lpString2=".") returned 1 [0076.651] lstrcmpiW (lpString1="iTkqfu_KGpReiA8L9cTQ.bmp", lpString2="..") returned 1 [0076.652] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="iTkqfu_KGpReiA8L9cTQ.bmp" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\iTkqfu_KGpReiA8L9cTQ.bmp") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\iTkqfu_KGpReiA8L9cTQ.bmp" [0076.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iTkqfu_KGpReiA8L9cTQ.bmp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0076.652] GetProcessHeap () returned 0x630000 [0076.652] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x19) returned 0x651f88 [0076.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="iTkqfu_KGpReiA8L9cTQ.bmp", cchWideChar=-1, lpMultiByteStr=0x651f88, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="iTkqfu_KGpReiA8L9cTQ.bmp", lpUsedDefaultChar=0x0) returned 25 [0076.652] lstrlenA (lpString="iTkqfu_KGpReiA8L9cTQ.bmp") returned 24 [0076.652] lstrlenA (lpString=".happythreechoose") returned 17 [0076.652] lstrlenA (lpString=".happythreechoose") returned 17 [0076.652] lstrlenA (lpString="iTkqfu_KGpReiA8L9cTQ.bmp") returned 24 [0076.652] lstrcmpiA (lpString1="KGpReiA8L9cTQ.bmp", lpString2=".happythreechoose") returned 1 [0076.652] lstrcmpiW (lpString1="iTkqfu_KGpReiA8L9cTQ.bmp", lpString2="Decryption INFO.html") returned 1 [0076.652] lstrcmpiW (lpString1="iTkqfu_KGpReiA8L9cTQ.bmp", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0076.652] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0076.652] lstrcmpiW (lpString1="iTkqfu_KGpReiA8L9cTQ.bmp", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0076.652] GetProcessHeap () returned 0x630000 [0076.652] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0076.652] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\iTkqfu_KGpReiA8L9cTQ.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\itkqfu_kgpreia8l9ctq.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0076.652] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=66909) returned 1 [0076.652] GetProcessHeap () returned 0x630000 [0076.652] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655aa8 [0076.652] GetProcessHeap () returned 0x630000 [0076.652] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672cb8 [0076.652] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\iTkqfu_KGpReiA8L9cTQ.bmp") returned 56 [0076.652] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0076.652] GetProcessHeap () returned 0x630000 [0076.652] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0076.652] GetProcessHeap () returned 0x630000 [0076.652] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x383) returned 0x673e58 [0076.653] lstrlenA (lpString="rsa_encrypt") returned 11 [0076.653] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x672900) returned 1 [0076.653] CryptGenRandom (in: hProv=0x672900, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0076.653] CryptReleaseContext (hProv=0x672900, dwFlags=0x0) returned 1 [0076.653] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0076.653] GetProcessHeap () returned 0x630000 [0076.653] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672c30 [0076.653] lstrlenA (lpString="010001") returned 6 [0076.653] GetProcessHeap () returned 0x630000 [0076.653] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0076.653] GetProcessHeap () returned 0x630000 [0076.653] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6730f8 [0076.653] GetProcessHeap () returned 0x630000 [0076.653] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e4f0 [0076.653] GetProcessHeap () returned 0x630000 [0076.653] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6730f8 | out: hHeap=0x630000) returned 1 [0076.653] GetProcessHeap () returned 0x630000 [0076.653] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e3d0 [0076.654] GetProcessHeap () returned 0x630000 [0076.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657440 [0076.654] GetProcessHeap () returned 0x630000 [0076.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a298 [0076.654] GetProcessHeap () returned 0x630000 [0076.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0076.654] GetProcessHeap () returned 0x630000 [0076.654] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.654] GetProcessHeap () returned 0x630000 [0076.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0076.654] GetProcessHeap () returned 0x630000 [0076.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6735c0 [0076.654] GetProcessHeap () returned 0x630000 [0076.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656950 [0076.654] GetProcessHeap () returned 0x630000 [0076.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.654] GetProcessHeap () returned 0x630000 [0076.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0076.654] GetProcessHeap () returned 0x630000 [0076.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dfe0 [0076.654] GetProcessHeap () returned 0x630000 [0076.654] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6735c0 | out: hHeap=0x630000) returned 1 [0076.654] GetProcessHeap () returned 0x630000 [0076.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0076.654] GetProcessHeap () returned 0x630000 [0076.654] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0076.654] GetProcessHeap () returned 0x630000 [0076.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.654] GetProcessHeap () returned 0x630000 [0076.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0076.654] GetProcessHeap () returned 0x630000 [0076.654] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.654] GetProcessHeap () returned 0x630000 [0076.654] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.654] GetProcessHeap () returned 0x630000 [0076.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0076.654] GetProcessHeap () returned 0x630000 [0076.654] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0076.654] GetProcessHeap () returned 0x630000 [0076.654] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e070 [0076.654] GetProcessHeap () returned 0x630000 [0076.655] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0076.655] GetProcessHeap () returned 0x630000 [0076.655] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0076.655] GetProcessHeap () returned 0x630000 [0076.655] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0076.655] GetProcessHeap () returned 0x630000 [0076.655] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.655] GetProcessHeap () returned 0x630000 [0076.655] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.655] GetProcessHeap () returned 0x630000 [0076.655] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.655] GetProcessHeap () returned 0x630000 [0076.655] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.655] GetProcessHeap () returned 0x630000 [0076.655] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.655] GetProcessHeap () returned 0x630000 [0076.655] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.655] GetProcessHeap () returned 0x630000 [0076.655] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.655] GetProcessHeap () returned 0x630000 [0076.655] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.655] GetProcessHeap () returned 0x630000 [0076.655] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.655] GetProcessHeap () returned 0x630000 [0076.655] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.655] GetProcessHeap () returned 0x630000 [0076.655] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.655] GetProcessHeap () returned 0x630000 [0076.655] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.655] GetProcessHeap () returned 0x630000 [0076.655] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0076.655] GetProcessHeap () returned 0x630000 [0076.655] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0076.655] GetProcessHeap () returned 0x630000 [0076.655] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0076.655] GetProcessHeap () returned 0x630000 [0076.656] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0076.656] GetProcessHeap () returned 0x630000 [0076.656] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.656] GetProcessHeap () returned 0x630000 [0076.656] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.656] GetProcessHeap () returned 0x630000 [0076.656] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.656] GetProcessHeap () returned 0x630000 [0076.656] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.656] GetProcessHeap () returned 0x630000 [0076.656] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.656] GetProcessHeap () returned 0x630000 [0076.656] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.656] GetProcessHeap () returned 0x630000 [0076.656] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.656] GetProcessHeap () returned 0x630000 [0076.656] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.656] GetProcessHeap () returned 0x630000 [0076.656] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.656] GetProcessHeap () returned 0x630000 [0076.656] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.656] GetProcessHeap () returned 0x630000 [0076.656] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.656] GetProcessHeap () returned 0x630000 [0076.656] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.656] GetProcessHeap () returned 0x630000 [0076.656] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.656] GetProcessHeap () returned 0x630000 [0076.656] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.656] GetProcessHeap () returned 0x630000 [0076.656] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.656] GetProcessHeap () returned 0x630000 [0076.656] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.656] GetProcessHeap () returned 0x630000 [0076.656] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.656] GetProcessHeap () returned 0x630000 [0076.656] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.656] GetProcessHeap () returned 0x630000 [0076.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.657] GetProcessHeap () returned 0x630000 [0076.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.657] GetProcessHeap () returned 0x630000 [0076.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.657] GetProcessHeap () returned 0x630000 [0076.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.657] GetProcessHeap () returned 0x630000 [0076.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.657] GetProcessHeap () returned 0x630000 [0076.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.657] GetProcessHeap () returned 0x630000 [0076.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.657] GetProcessHeap () returned 0x630000 [0076.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.657] GetProcessHeap () returned 0x630000 [0076.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.657] GetProcessHeap () returned 0x630000 [0076.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.657] GetProcessHeap () returned 0x630000 [0076.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.657] GetProcessHeap () returned 0x630000 [0076.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.657] GetProcessHeap () returned 0x630000 [0076.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.657] GetProcessHeap () returned 0x630000 [0076.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.657] GetProcessHeap () returned 0x630000 [0076.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0076.657] GetProcessHeap () returned 0x630000 [0076.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.657] GetProcessHeap () returned 0x630000 [0076.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.657] GetProcessHeap () returned 0x630000 [0076.657] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.657] GetProcessHeap () returned 0x630000 [0076.657] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0076.657] GetProcessHeap () returned 0x630000 [0076.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.658] GetProcessHeap () returned 0x630000 [0076.658] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.658] GetProcessHeap () returned 0x630000 [0076.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.658] GetProcessHeap () returned 0x630000 [0076.658] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0076.658] GetProcessHeap () returned 0x630000 [0076.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0076.658] GetProcessHeap () returned 0x630000 [0076.658] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.658] GetProcessHeap () returned 0x630000 [0076.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.658] GetProcessHeap () returned 0x630000 [0076.658] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.658] GetProcessHeap () returned 0x630000 [0076.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.658] GetProcessHeap () returned 0x630000 [0076.658] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.658] GetProcessHeap () returned 0x630000 [0076.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.658] GetProcessHeap () returned 0x630000 [0076.658] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.658] GetProcessHeap () returned 0x630000 [0076.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.658] GetProcessHeap () returned 0x630000 [0076.658] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0076.658] GetProcessHeap () returned 0x630000 [0076.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0076.658] GetProcessHeap () returned 0x630000 [0076.658] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.658] GetProcessHeap () returned 0x630000 [0076.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.658] GetProcessHeap () returned 0x630000 [0076.658] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.658] GetProcessHeap () returned 0x630000 [0076.658] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.658] GetProcessHeap () returned 0x630000 [0076.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.659] GetProcessHeap () returned 0x630000 [0076.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.659] GetProcessHeap () returned 0x630000 [0076.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.659] GetProcessHeap () returned 0x630000 [0076.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.659] GetProcessHeap () returned 0x630000 [0076.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0076.659] GetProcessHeap () returned 0x630000 [0076.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0076.659] GetProcessHeap () returned 0x630000 [0076.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.659] GetProcessHeap () returned 0x630000 [0076.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.659] GetProcessHeap () returned 0x630000 [0076.659] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.659] GetProcessHeap () returned 0x630000 [0076.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.659] GetProcessHeap () returned 0x630000 [0076.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0076.659] GetProcessHeap () returned 0x630000 [0076.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0076.659] GetProcessHeap () returned 0x630000 [0076.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0076.659] GetProcessHeap () returned 0x630000 [0076.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0076.659] GetProcessHeap () returned 0x630000 [0076.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0076.659] GetProcessHeap () returned 0x630000 [0076.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0076.659] GetProcessHeap () returned 0x630000 [0076.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0076.659] GetProcessHeap () returned 0x630000 [0076.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0076.659] GetProcessHeap () returned 0x630000 [0076.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0076.659] GetProcessHeap () returned 0x630000 [0076.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0076.660] GetProcessHeap () returned 0x630000 [0076.660] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672c30 | out: hHeap=0x630000) returned 1 [0076.660] WriteFile (in: hFile=0x230, lpBuffer=0x673e58*, nNumberOfBytesToWrite=0x383, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673e58*, lpNumberOfBytesWritten=0x243d864*=0x383, lpOverlapped=0x0) returned 1 [0076.661] GetProcessHeap () returned 0x630000 [0076.661] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x673e58, Size=0x30) returned 0x673e58 [0076.661] GetProcessHeap () returned 0x630000 [0076.661] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0076.662] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0076.662] GetProcessHeap () returned 0x630000 [0076.662] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10560) returned 0x673e90 [0076.663] ReadFile (in: hFile=0x230, lpBuffer=0x673e90, nNumberOfBytesToRead=0x10560, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x673e90*, lpNumberOfBytesRead=0x243d7e8*=0x10560, lpOverlapped=0x0) returned 1 [0076.664] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0076.664] WriteFile (in: hFile=0x230, lpBuffer=0x673e90*, nNumberOfBytesToWrite=0x10560, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x673e90*, lpNumberOfBytesWritten=0x243d7e4*=0x10560, lpOverlapped=0x0) returned 1 [0076.665] GetProcessHeap () returned 0x630000 [0076.665] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673e90 | out: hHeap=0x630000) returned 1 [0076.666] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0076.666] WriteFile (in: hFile=0x230, lpBuffer=0x673e58*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673e58*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0076.667] CloseHandle (hObject=0x230) returned 1 [0076.668] GetProcessHeap () returned 0x630000 [0076.668] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0076.668] GetProcessHeap () returned 0x630000 [0076.668] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655aa8 | out: hHeap=0x630000) returned 1 [0076.668] GetProcessHeap () returned 0x630000 [0076.668] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672cb8 | out: hHeap=0x630000) returned 1 [0076.668] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\iTkqfu_KGpReiA8L9cTQ.bmp" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\iTkqfu_KGpReiA8L9cTQ.bmp") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\iTkqfu_KGpReiA8L9cTQ.bmp" [0076.668] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\iTkqfu_KGpReiA8L9cTQ.bmp", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\iTkqfu_KGpReiA8L9cTQ.bmp.happythreechoose") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\iTkqfu_KGpReiA8L9cTQ.bmp.happythreechoose" [0076.668] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\iTkqfu_KGpReiA8L9cTQ.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\itkqfu_kgpreia8l9ctq.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\iTkqfu_KGpReiA8L9cTQ.bmp.happythreechoose" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\itkqfu_kgpreia8l9ctq.bmp.happythreechoose"), dwFlags=0x1) returned 1 [0076.668] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\iTkqfu_KGpReiA8L9cTQ.bmp" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0076.668] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="" [0076.668] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" [0076.668] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\decryption info.html")) returned 0x20 [0076.669] GetProcessHeap () returned 0x630000 [0076.669] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0076.669] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc831ab30, ftCreationTime.dwHighDateTime=0x1d5d7ad, ftLastAccessTime.dwLowDateTime=0xb51d49d0, ftLastAccessTime.dwHighDateTime=0x1d5d034, ftLastWriteTime.dwLowDateTime=0xb51d49d0, ftLastWriteTime.dwHighDateTime=0x1d5d034, nFileSizeHigh=0x0, nFileSizeLow=0x155ca, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="KbLHq.m4a", cAlternateFileName="")) returned 1 [0076.669] lstrcmpiW (lpString1="KbLHq.m4a", lpString2=".") returned 1 [0076.669] lstrcmpiW (lpString1="KbLHq.m4a", lpString2="..") returned 1 [0076.669] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="KbLHq.m4a" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\KbLHq.m4a") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\KbLHq.m4a" [0076.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="KbLHq.m4a", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0076.669] GetProcessHeap () returned 0x630000 [0076.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x64c9f0 [0076.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="KbLHq.m4a", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KbLHq.m4a", lpUsedDefaultChar=0x0) returned 10 [0076.669] lstrlenA (lpString="KbLHq.m4a") returned 9 [0076.669] lstrlenA (lpString=".happythreechoose") returned 17 [0076.669] lstrcmpiW (lpString1="KbLHq.m4a", lpString2="Decryption INFO.html") returned 1 [0076.669] lstrcmpiW (lpString1="KbLHq.m4a", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0076.669] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0076.669] lstrcmpiW (lpString1="KbLHq.m4a", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0076.669] GetProcessHeap () returned 0x630000 [0076.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651ec0 [0076.669] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\KbLHq.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\kblhq.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0076.669] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=87498) returned 1 [0076.669] GetProcessHeap () returned 0x630000 [0076.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655aa8 [0076.669] GetProcessHeap () returned 0x630000 [0076.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673758 [0076.669] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\KbLHq.m4a") returned 41 [0076.669] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0076.669] GetProcessHeap () returned 0x630000 [0076.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0076.670] GetProcessHeap () returned 0x630000 [0076.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x386) returned 0x673e90 [0076.671] lstrlenA (lpString="rsa_encrypt") returned 11 [0076.671] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x672dc8) returned 1 [0076.671] CryptGenRandom (in: hProv=0x672dc8, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0076.671] CryptReleaseContext (hProv=0x672dc8, dwFlags=0x0) returned 1 [0076.671] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0076.671] GetProcessHeap () returned 0x630000 [0076.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6736d0 [0076.672] lstrlenA (lpString="010001") returned 6 [0076.672] GetProcessHeap () returned 0x630000 [0076.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0076.672] GetProcessHeap () returned 0x630000 [0076.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672d40 [0076.672] GetProcessHeap () returned 0x630000 [0076.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0076.672] GetProcessHeap () returned 0x630000 [0076.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672d40 | out: hHeap=0x630000) returned 1 [0076.672] GetProcessHeap () returned 0x630000 [0076.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e970 [0076.672] GetProcessHeap () returned 0x630000 [0076.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657328 [0076.672] GetProcessHeap () returned 0x630000 [0076.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a348 [0076.672] GetProcessHeap () returned 0x630000 [0076.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0076.672] GetProcessHeap () returned 0x630000 [0076.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0076.672] GetProcessHeap () returned 0x630000 [0076.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0076.672] GetProcessHeap () returned 0x630000 [0076.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673290 [0076.672] GetProcessHeap () returned 0x630000 [0076.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x6570f8 [0076.672] GetProcessHeap () returned 0x630000 [0076.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.672] GetProcessHeap () returned 0x630000 [0076.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0076.672] GetProcessHeap () returned 0x630000 [0076.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e8e0 [0076.672] GetProcessHeap () returned 0x630000 [0076.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673290 | out: hHeap=0x630000) returned 1 [0076.672] GetProcessHeap () returned 0x630000 [0076.672] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0076.672] GetProcessHeap () returned 0x630000 [0076.672] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0076.672] GetProcessHeap () returned 0x630000 [0076.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0076.673] GetProcessHeap () returned 0x630000 [0076.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cf28 [0076.673] GetProcessHeap () returned 0x630000 [0076.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.673] GetProcessHeap () returned 0x630000 [0076.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.673] GetProcessHeap () returned 0x630000 [0076.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.673] GetProcessHeap () returned 0x630000 [0076.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.673] GetProcessHeap () returned 0x630000 [0076.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e610 [0076.673] GetProcessHeap () returned 0x630000 [0076.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cf28 | out: hHeap=0x630000) returned 1 [0076.673] GetProcessHeap () returned 0x630000 [0076.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0076.673] GetProcessHeap () returned 0x630000 [0076.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0076.673] GetProcessHeap () returned 0x630000 [0076.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.673] GetProcessHeap () returned 0x630000 [0076.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.673] GetProcessHeap () returned 0x630000 [0076.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.673] GetProcessHeap () returned 0x630000 [0076.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.673] GetProcessHeap () returned 0x630000 [0076.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.673] GetProcessHeap () returned 0x630000 [0076.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.673] GetProcessHeap () returned 0x630000 [0076.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0076.673] GetProcessHeap () returned 0x630000 [0076.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.673] GetProcessHeap () returned 0x630000 [0076.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.673] GetProcessHeap () returned 0x630000 [0076.673] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.673] GetProcessHeap () returned 0x630000 [0076.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.674] GetProcessHeap () returned 0x630000 [0076.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.674] GetProcessHeap () returned 0x630000 [0076.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0076.674] GetProcessHeap () returned 0x630000 [0076.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.674] GetProcessHeap () returned 0x630000 [0076.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0076.674] GetProcessHeap () returned 0x630000 [0076.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0076.674] GetProcessHeap () returned 0x630000 [0076.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0076.674] GetProcessHeap () returned 0x630000 [0076.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0076.674] GetProcessHeap () returned 0x630000 [0076.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.674] GetProcessHeap () returned 0x630000 [0076.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.674] GetProcessHeap () returned 0x630000 [0076.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0076.674] GetProcessHeap () returned 0x630000 [0076.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0076.674] GetProcessHeap () returned 0x630000 [0076.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.674] GetProcessHeap () returned 0x630000 [0076.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.674] GetProcessHeap () returned 0x630000 [0076.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.674] GetProcessHeap () returned 0x630000 [0076.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.674] GetProcessHeap () returned 0x630000 [0076.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.674] GetProcessHeap () returned 0x630000 [0076.674] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.674] GetProcessHeap () returned 0x630000 [0076.674] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.674] GetProcessHeap () returned 0x630000 [0076.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.675] GetProcessHeap () returned 0x630000 [0076.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.675] GetProcessHeap () returned 0x630000 [0076.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.675] GetProcessHeap () returned 0x630000 [0076.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.675] GetProcessHeap () returned 0x630000 [0076.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.675] GetProcessHeap () returned 0x630000 [0076.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0076.675] GetProcessHeap () returned 0x630000 [0076.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0076.675] GetProcessHeap () returned 0x630000 [0076.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.675] GetProcessHeap () returned 0x630000 [0076.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.675] GetProcessHeap () returned 0x630000 [0076.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0076.675] GetProcessHeap () returned 0x630000 [0076.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0076.675] GetProcessHeap () returned 0x630000 [0076.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.675] GetProcessHeap () returned 0x630000 [0076.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.675] GetProcessHeap () returned 0x630000 [0076.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.675] GetProcessHeap () returned 0x630000 [0076.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.675] GetProcessHeap () returned 0x630000 [0076.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.675] GetProcessHeap () returned 0x630000 [0076.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.675] GetProcessHeap () returned 0x630000 [0076.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0076.675] GetProcessHeap () returned 0x630000 [0076.675] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0076.675] GetProcessHeap () returned 0x630000 [0076.675] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.676] GetProcessHeap () returned 0x630000 [0076.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.676] GetProcessHeap () returned 0x630000 [0076.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.676] GetProcessHeap () returned 0x630000 [0076.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.676] GetProcessHeap () returned 0x630000 [0076.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.676] GetProcessHeap () returned 0x630000 [0076.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.676] GetProcessHeap () returned 0x630000 [0076.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.676] GetProcessHeap () returned 0x630000 [0076.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.676] GetProcessHeap () returned 0x630000 [0076.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0076.676] GetProcessHeap () returned 0x630000 [0076.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0076.676] GetProcessHeap () returned 0x630000 [0076.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0076.676] GetProcessHeap () returned 0x630000 [0076.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0076.676] GetProcessHeap () returned 0x630000 [0076.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.676] GetProcessHeap () returned 0x630000 [0076.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.676] GetProcessHeap () returned 0x630000 [0076.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0076.676] GetProcessHeap () returned 0x630000 [0076.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0076.676] GetProcessHeap () returned 0x630000 [0076.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0076.676] GetProcessHeap () returned 0x630000 [0076.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0076.676] GetProcessHeap () returned 0x630000 [0076.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a378 [0076.676] GetProcessHeap () returned 0x630000 [0076.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.676] GetProcessHeap () returned 0x630000 [0076.676] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0076.677] GetProcessHeap () returned 0x630000 [0076.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0076.677] GetProcessHeap () returned 0x630000 [0076.677] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.677] GetProcessHeap () returned 0x630000 [0076.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.677] GetProcessHeap () returned 0x630000 [0076.677] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0076.677] GetProcessHeap () returned 0x630000 [0076.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0076.677] GetProcessHeap () returned 0x630000 [0076.677] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.677] GetProcessHeap () returned 0x630000 [0076.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.677] GetProcessHeap () returned 0x630000 [0076.677] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0076.677] GetProcessHeap () returned 0x630000 [0076.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0076.677] GetProcessHeap () returned 0x630000 [0076.677] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.677] GetProcessHeap () returned 0x630000 [0076.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.677] GetProcessHeap () returned 0x630000 [0076.677] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.677] GetProcessHeap () returned 0x630000 [0076.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.677] GetProcessHeap () returned 0x630000 [0076.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0076.677] GetProcessHeap () returned 0x630000 [0076.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0076.677] GetProcessHeap () returned 0x630000 [0076.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0076.677] GetProcessHeap () returned 0x630000 [0076.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0076.677] GetProcessHeap () returned 0x630000 [0076.677] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0076.677] GetProcessHeap () returned 0x630000 [0076.678] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0076.678] GetProcessHeap () returned 0x630000 [0076.678] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0076.678] GetProcessHeap () returned 0x630000 [0076.678] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0076.678] GetProcessHeap () returned 0x630000 [0076.678] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0076.678] GetProcessHeap () returned 0x630000 [0076.678] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.678] GetProcessHeap () returned 0x630000 [0076.678] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6736d0 | out: hHeap=0x630000) returned 1 [0076.678] WriteFile (in: hFile=0x230, lpBuffer=0x673e90*, nNumberOfBytesToWrite=0x386, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673e90*, lpNumberOfBytesWritten=0x243d864*=0x386, lpOverlapped=0x0) returned 1 [0076.679] GetProcessHeap () returned 0x630000 [0076.679] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x673e90, Size=0x30) returned 0x673e90 [0076.679] GetProcessHeap () returned 0x630000 [0076.679] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0076.679] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0076.679] GetProcessHeap () returned 0x630000 [0076.679] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x155d0) returned 0x673ec8 [0076.681] ReadFile (in: hFile=0x230, lpBuffer=0x673ec8, nNumberOfBytesToRead=0x155d0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x673ec8*, lpNumberOfBytesRead=0x243d7e8*=0x155d0, lpOverlapped=0x0) returned 1 [0076.682] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0076.682] WriteFile (in: hFile=0x230, lpBuffer=0x673ec8*, nNumberOfBytesToWrite=0x155d0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x673ec8*, lpNumberOfBytesWritten=0x243d7e4*=0x155d0, lpOverlapped=0x0) returned 1 [0076.684] GetProcessHeap () returned 0x630000 [0076.684] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673ec8 | out: hHeap=0x630000) returned 1 [0076.684] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0076.684] WriteFile (in: hFile=0x230, lpBuffer=0x673e90*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673e90*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0076.684] CloseHandle (hObject=0x230) returned 1 [0076.685] GetProcessHeap () returned 0x630000 [0076.685] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651ec0 | out: hHeap=0x630000) returned 1 [0076.685] GetProcessHeap () returned 0x630000 [0076.685] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655aa8 | out: hHeap=0x630000) returned 1 [0076.685] GetProcessHeap () returned 0x630000 [0076.685] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673758 | out: hHeap=0x630000) returned 1 [0076.685] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\KbLHq.m4a" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\KbLHq.m4a") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\KbLHq.m4a" [0076.685] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\KbLHq.m4a", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\KbLHq.m4a.happythreechoose") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\KbLHq.m4a.happythreechoose" [0076.685] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\KbLHq.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\kblhq.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\KbLHq.m4a.happythreechoose" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\kblhq.m4a.happythreechoose"), dwFlags=0x1) returned 1 [0076.686] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\KbLHq.m4a" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0076.686] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="" [0076.686] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" [0076.686] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\decryption info.html")) returned 0x20 [0076.686] GetProcessHeap () returned 0x630000 [0076.686] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0076.686] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cb32320, ftCreationTime.dwHighDateTime=0x1d5cad9, ftLastAccessTime.dwLowDateTime=0x20124770, ftLastAccessTime.dwHighDateTime=0x1d5cb87, ftLastWriteTime.dwLowDateTime=0x20124770, ftLastWriteTime.dwHighDateTime=0x1d5cb87, nFileSizeHigh=0x0, nFileSizeLow=0x17d3d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ksX6_DYBC.ots", cAlternateFileName="KSX6_D~1.OTS")) returned 1 [0076.686] lstrcmpiW (lpString1="ksX6_DYBC.ots", lpString2=".") returned 1 [0076.686] lstrcmpiW (lpString1="ksX6_DYBC.ots", lpString2="..") returned 1 [0076.686] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="ksX6_DYBC.ots" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\ksX6_DYBC.ots") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\ksX6_DYBC.ots" [0076.686] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksX6_DYBC.ots", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0076.686] GetProcessHeap () returned 0x630000 [0076.686] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x64c9f0 [0076.686] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ksX6_DYBC.ots", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ksX6_DYBC.ots", lpUsedDefaultChar=0x0) returned 14 [0076.686] lstrlenA (lpString="ksX6_DYBC.ots") returned 13 [0076.686] lstrlenA (lpString=".happythreechoose") returned 17 [0076.686] lstrcmpiW (lpString1="ksX6_DYBC.ots", lpString2="Decryption INFO.html") returned 1 [0076.687] lstrcmpiW (lpString1="ksX6_DYBC.ots", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0076.687] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0076.687] lstrcmpiW (lpString1="ksX6_DYBC.ots", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0076.687] GetProcessHeap () returned 0x630000 [0076.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0076.687] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ksX6_DYBC.ots" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ksx6_dybc.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0076.687] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=97597) returned 1 [0076.687] GetProcessHeap () returned 0x630000 [0076.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6559b8 [0076.687] GetProcessHeap () returned 0x630000 [0076.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673290 [0076.687] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\ksX6_DYBC.ots") returned 45 [0076.687] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0076.687] GetProcessHeap () returned 0x630000 [0076.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0076.687] GetProcessHeap () returned 0x630000 [0076.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x673ec8 [0076.687] lstrlenA (lpString="rsa_encrypt") returned 11 [0076.687] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x672a98) returned 1 [0076.688] CryptGenRandom (in: hProv=0x672a98, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0076.688] CryptReleaseContext (hProv=0x672a98, dwFlags=0x0) returned 1 [0076.688] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0076.688] GetProcessHeap () returned 0x630000 [0076.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673318 [0076.688] lstrlenA (lpString="010001") returned 6 [0076.688] GetProcessHeap () returned 0x630000 [0076.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a378 [0076.688] GetProcessHeap () returned 0x630000 [0076.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6736d0 [0076.688] GetProcessHeap () returned 0x630000 [0076.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0076.688] GetProcessHeap () returned 0x630000 [0076.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6736d0 | out: hHeap=0x630000) returned 1 [0076.688] GetProcessHeap () returned 0x630000 [0076.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e4f0 [0076.688] GetProcessHeap () returned 0x630000 [0076.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656ec8 [0076.688] GetProcessHeap () returned 0x630000 [0076.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a318 [0076.688] GetProcessHeap () returned 0x630000 [0076.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0076.688] GetProcessHeap () returned 0x630000 [0076.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.689] GetProcessHeap () returned 0x630000 [0076.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0076.689] GetProcessHeap () returned 0x630000 [0076.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672cb8 [0076.689] GetProcessHeap () returned 0x630000 [0076.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657440 [0076.689] GetProcessHeap () returned 0x630000 [0076.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0076.689] GetProcessHeap () returned 0x630000 [0076.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0076.689] GetProcessHeap () returned 0x630000 [0076.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e3d0 [0076.689] GetProcessHeap () returned 0x630000 [0076.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672cb8 | out: hHeap=0x630000) returned 1 [0076.689] GetProcessHeap () returned 0x630000 [0076.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0076.689] GetProcessHeap () returned 0x630000 [0076.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0076.689] GetProcessHeap () returned 0x630000 [0076.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.689] GetProcessHeap () returned 0x630000 [0076.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cf28 [0076.689] GetProcessHeap () returned 0x630000 [0076.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.689] GetProcessHeap () returned 0x630000 [0076.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.689] GetProcessHeap () returned 0x630000 [0076.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.689] GetProcessHeap () returned 0x630000 [0076.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.689] GetProcessHeap () returned 0x630000 [0076.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e610 [0076.689] GetProcessHeap () returned 0x630000 [0076.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cf28 | out: hHeap=0x630000) returned 1 [0076.689] GetProcessHeap () returned 0x630000 [0076.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0076.689] GetProcessHeap () returned 0x630000 [0076.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0076.689] GetProcessHeap () returned 0x630000 [0076.689] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0076.689] GetProcessHeap () returned 0x630000 [0076.690] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0076.690] GetProcessHeap () returned 0x630000 [0076.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.690] GetProcessHeap () returned 0x630000 [0076.690] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.690] GetProcessHeap () returned 0x630000 [0076.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.690] GetProcessHeap () returned 0x630000 [0076.690] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.690] GetProcessHeap () returned 0x630000 [0076.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0076.690] GetProcessHeap () returned 0x630000 [0076.690] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0076.690] GetProcessHeap () returned 0x630000 [0076.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.690] GetProcessHeap () returned 0x630000 [0076.690] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.690] GetProcessHeap () returned 0x630000 [0076.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.690] GetProcessHeap () returned 0x630000 [0076.690] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.690] GetProcessHeap () returned 0x630000 [0076.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.690] GetProcessHeap () returned 0x630000 [0076.690] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.690] GetProcessHeap () returned 0x630000 [0076.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.690] GetProcessHeap () returned 0x630000 [0076.690] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.690] GetProcessHeap () returned 0x630000 [0076.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.690] GetProcessHeap () returned 0x630000 [0076.690] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.690] GetProcessHeap () returned 0x630000 [0076.690] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.690] GetProcessHeap () returned 0x630000 [0076.690] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.690] GetProcessHeap () returned 0x630000 [0076.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.691] GetProcessHeap () returned 0x630000 [0076.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.691] GetProcessHeap () returned 0x630000 [0076.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0076.691] GetProcessHeap () returned 0x630000 [0076.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0076.691] GetProcessHeap () returned 0x630000 [0076.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.691] GetProcessHeap () returned 0x630000 [0076.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.691] GetProcessHeap () returned 0x630000 [0076.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.691] GetProcessHeap () returned 0x630000 [0076.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.691] GetProcessHeap () returned 0x630000 [0076.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.691] GetProcessHeap () returned 0x630000 [0076.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.691] GetProcessHeap () returned 0x630000 [0076.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0076.691] GetProcessHeap () returned 0x630000 [0076.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0076.691] GetProcessHeap () returned 0x630000 [0076.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0076.691] GetProcessHeap () returned 0x630000 [0076.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0076.691] GetProcessHeap () returned 0x630000 [0076.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.691] GetProcessHeap () returned 0x630000 [0076.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.691] GetProcessHeap () returned 0x630000 [0076.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.691] GetProcessHeap () returned 0x630000 [0076.691] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.691] GetProcessHeap () returned 0x630000 [0076.691] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.691] GetProcessHeap () returned 0x630000 [0076.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.692] GetProcessHeap () returned 0x630000 [0076.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.692] GetProcessHeap () returned 0x630000 [0076.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.692] GetProcessHeap () returned 0x630000 [0076.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.692] GetProcessHeap () returned 0x630000 [0076.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.692] GetProcessHeap () returned 0x630000 [0076.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.692] GetProcessHeap () returned 0x630000 [0076.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.692] GetProcessHeap () returned 0x630000 [0076.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0076.692] GetProcessHeap () returned 0x630000 [0076.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0076.692] GetProcessHeap () returned 0x630000 [0076.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.692] GetProcessHeap () returned 0x630000 [0076.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.692] GetProcessHeap () returned 0x630000 [0076.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0076.692] GetProcessHeap () returned 0x630000 [0076.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.692] GetProcessHeap () returned 0x630000 [0076.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.692] GetProcessHeap () returned 0x630000 [0076.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.692] GetProcessHeap () returned 0x630000 [0076.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0076.692] GetProcessHeap () returned 0x630000 [0076.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0076.692] GetProcessHeap () returned 0x630000 [0076.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0076.692] GetProcessHeap () returned 0x630000 [0076.692] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.692] GetProcessHeap () returned 0x630000 [0076.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.693] GetProcessHeap () returned 0x630000 [0076.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.693] GetProcessHeap () returned 0x630000 [0076.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0076.693] GetProcessHeap () returned 0x630000 [0076.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0076.693] GetProcessHeap () returned 0x630000 [0076.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0076.693] GetProcessHeap () returned 0x630000 [0076.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0076.693] GetProcessHeap () returned 0x630000 [0076.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0076.693] GetProcessHeap () returned 0x630000 [0076.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0076.693] GetProcessHeap () returned 0x630000 [0076.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.693] GetProcessHeap () returned 0x630000 [0076.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.693] GetProcessHeap () returned 0x630000 [0076.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.693] GetProcessHeap () returned 0x630000 [0076.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.693] GetProcessHeap () returned 0x630000 [0076.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0076.693] GetProcessHeap () returned 0x630000 [0076.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0076.693] GetProcessHeap () returned 0x630000 [0076.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.693] GetProcessHeap () returned 0x630000 [0076.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.693] GetProcessHeap () returned 0x630000 [0076.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.693] GetProcessHeap () returned 0x630000 [0076.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.693] GetProcessHeap () returned 0x630000 [0076.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.693] GetProcessHeap () returned 0x630000 [0076.693] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.693] GetProcessHeap () returned 0x630000 [0076.694] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.694] GetProcessHeap () returned 0x630000 [0076.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.694] GetProcessHeap () returned 0x630000 [0076.694] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0076.694] GetProcessHeap () returned 0x630000 [0076.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0076.694] GetProcessHeap () returned 0x630000 [0076.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0076.694] GetProcessHeap () returned 0x630000 [0076.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0076.694] GetProcessHeap () returned 0x630000 [0076.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0076.694] GetProcessHeap () returned 0x630000 [0076.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0076.694] GetProcessHeap () returned 0x630000 [0076.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0076.694] GetProcessHeap () returned 0x630000 [0076.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0076.694] GetProcessHeap () returned 0x630000 [0076.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0076.694] GetProcessHeap () returned 0x630000 [0076.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0076.694] GetProcessHeap () returned 0x630000 [0076.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0076.694] GetProcessHeap () returned 0x630000 [0076.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a378 | out: hHeap=0x630000) returned 1 [0076.694] GetProcessHeap () returned 0x630000 [0076.694] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673318 | out: hHeap=0x630000) returned 1 [0076.694] WriteFile (in: hFile=0x230, lpBuffer=0x673ec8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673ec8*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0076.769] GetProcessHeap () returned 0x630000 [0076.769] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x673ec8, Size=0x30) returned 0x673ec8 [0076.769] GetProcessHeap () returned 0x630000 [0076.769] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0076.769] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0076.769] GetProcessHeap () returned 0x630000 [0076.769] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x17d3d) returned 0x673f00 [0076.769] ReadFile (in: hFile=0x230, lpBuffer=0x673f00, nNumberOfBytesToRead=0x17d3d, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x673f00*, lpNumberOfBytesRead=0x243d7e8*=0x17d3d, lpOverlapped=0x0) returned 1 [0076.770] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0076.770] WriteFile (in: hFile=0x230, lpBuffer=0x673f00*, nNumberOfBytesToWrite=0x17d3d, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x673f00*, lpNumberOfBytesWritten=0x243d7e4*=0x17d3d, lpOverlapped=0x0) returned 1 [0076.772] GetProcessHeap () returned 0x630000 [0076.772] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673f00 | out: hHeap=0x630000) returned 1 [0076.772] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0076.772] WriteFile (in: hFile=0x230, lpBuffer=0x673ec8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673ec8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0076.773] CloseHandle (hObject=0x230) returned 1 [0076.773] GetProcessHeap () returned 0x630000 [0076.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0076.773] GetProcessHeap () returned 0x630000 [0076.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6559b8 | out: hHeap=0x630000) returned 1 [0076.773] GetProcessHeap () returned 0x630000 [0076.773] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673290 | out: hHeap=0x630000) returned 1 [0076.773] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\ksX6_DYBC.ots" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\ksX6_DYBC.ots") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\ksX6_DYBC.ots" [0076.773] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\ksX6_DYBC.ots", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\ksX6_DYBC.ots.happythreechoose") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\ksX6_DYBC.ots.happythreechoose" [0076.773] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ksX6_DYBC.ots" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ksx6_dybc.ots"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\ksX6_DYBC.ots.happythreechoose" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\ksx6_dybc.ots.happythreechoose"), dwFlags=0x1) returned 1 [0076.774] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\ksX6_DYBC.ots" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0076.774] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="" [0076.774] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" [0076.774] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\decryption info.html")) returned 0x20 [0076.774] GetProcessHeap () returned 0x630000 [0076.774] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0076.774] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe53cdcf0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xd35c70fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe53cf090, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Macromedia", cAlternateFileName="MACROM~1")) returned 1 [0076.774] lstrcmpiW (lpString1="Macromedia", lpString2=".") returned 1 [0076.774] lstrcmpiW (lpString1="Macromedia", lpString2="..") returned 1 [0076.774] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="Macromedia" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia" [0076.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Macromedia", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0076.774] GetProcessHeap () returned 0x630000 [0076.774] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb) returned 0x64ca20 [0076.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Macromedia", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Macromedia", lpUsedDefaultChar=0x0) returned 11 [0076.774] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Macromedia", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0076.775] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Macromedia", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0076.775] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Macromedia", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0076.775] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Macromedia", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0076.775] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Macromedia", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0076.775] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Macromedia", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0076.775] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Macromedia", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0076.775] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Macromedia", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0076.775] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Macromedia", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0076.775] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Macromedia", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0076.775] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Macromedia", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0076.775] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Macromedia", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0076.775] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Macromedia", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0076.775] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Macromedia", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0076.775] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Macromedia", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0076.775] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Macromedia", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0076.775] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Macromedia", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0076.775] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Macromedia", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0076.775] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Macromedia", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0076.775] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Macromedia", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0076.775] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Macromedia", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0076.775] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Macromedia", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0076.775] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Macromedia", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0076.775] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Macromedia", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0076.775] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Macromedia", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0076.775] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Macromedia", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0076.775] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Macromedia", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0076.775] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Macromedia", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0076.775] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Macromedia", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0076.775] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Macromedia", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0076.775] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Macromedia", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0076.775] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Macromedia", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0076.775] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Macromedia", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0076.775] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Macromedia", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0076.775] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Macromedia", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0076.776] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Macromedia", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0076.776] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Macromedia", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0076.776] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Macromedia", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0076.776] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Macromedia", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0076.776] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Macromedia", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0076.776] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Macromedia", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0076.776] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Macromedia", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0076.776] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Macromedia", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0076.776] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\" [0076.776] GetProcessHeap () returned 0x630000 [0076.776] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a378 [0076.776] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\") returned 43 [0076.776] GetProcessHeap () returned 0x630000 [0076.776] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x58) returned 0x653e10 [0076.776] lstrcpyW (in: lpString1=0x653e10, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Macromedia\\" [0076.776] GetProcessHeap () returned 0x630000 [0076.776] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0076.776] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xee6ea6d8, ftLastAccessTime.dwHighDateTime=0x1d47c36, ftLastWriteTime.dwLowDateTime=0xee6ea6d8, ftLastWriteTime.dwHighDateTime=0x1d47c36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0076.776] lstrcmpiW (lpString1="Microsoft", lpString2=".") returned 1 [0076.776] lstrcmpiW (lpString1="Microsoft", lpString2="..") returned 1 [0076.776] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="Microsoft" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft" [0076.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Microsoft", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0076.776] GetProcessHeap () returned 0x630000 [0076.776] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x64c9f0 [0076.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Microsoft", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft", lpUsedDefaultChar=0x0) returned 10 [0076.776] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0076.776] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 2 [0076.776] GetProcessHeap () returned 0x630000 [0076.776] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0076.776] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d187760, ftCreationTime.dwHighDateTime=0x1d5cbf3, ftLastAccessTime.dwLowDateTime=0xb9c280d0, ftLastAccessTime.dwHighDateTime=0x1d5cd74, ftLastWriteTime.dwLowDateTime=0xb9c280d0, ftLastWriteTime.dwHighDateTime=0x1d5cd74, nFileSizeHigh=0x0, nFileSizeLow=0xc1eb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MnsHUqpMqJG.flv", cAlternateFileName="MNSHUQ~1.FLV")) returned 1 [0076.776] lstrcmpiW (lpString1="MnsHUqpMqJG.flv", lpString2=".") returned 1 [0076.776] lstrcmpiW (lpString1="MnsHUqpMqJG.flv", lpString2="..") returned 1 [0076.776] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="MnsHUqpMqJG.flv" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\MnsHUqpMqJG.flv") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\MnsHUqpMqJG.flv" [0076.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MnsHUqpMqJG.flv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0076.776] GetProcessHeap () returned 0x630000 [0076.776] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x64c9f0 [0076.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="MnsHUqpMqJG.flv", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MnsHUqpMqJG.flv", lpUsedDefaultChar=0x0) returned 16 [0076.777] lstrlenA (lpString="MnsHUqpMqJG.flv") returned 15 [0076.777] lstrlenA (lpString=".happythreechoose") returned 17 [0076.777] lstrcmpiW (lpString1="MnsHUqpMqJG.flv", lpString2="Decryption INFO.html") returned 1 [0076.777] lstrcmpiW (lpString1="MnsHUqpMqJG.flv", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0076.777] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0076.777] lstrcmpiW (lpString1="MnsHUqpMqJG.flv", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0076.777] GetProcessHeap () returned 0x630000 [0076.777] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651ec0 [0076.777] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\MnsHUqpMqJG.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mnshuqpmqjg.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0076.777] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=49643) returned 1 [0076.777] GetProcessHeap () returned 0x630000 [0076.777] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655850 [0076.777] GetProcessHeap () returned 0x630000 [0076.777] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672cb8 [0076.777] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\MnsHUqpMqJG.flv") returned 47 [0076.777] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0076.777] GetProcessHeap () returned 0x630000 [0076.777] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0076.777] GetProcessHeap () returned 0x630000 [0076.777] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x385) returned 0x673f00 [0076.777] lstrlenA (lpString="rsa_encrypt") returned 11 [0076.777] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x6736d0) returned 1 [0076.778] CryptGenRandom (in: hProv=0x6736d0, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0076.778] CryptReleaseContext (hProv=0x6736d0, dwFlags=0x0) returned 1 [0076.778] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0076.778] GetProcessHeap () returned 0x630000 [0076.778] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6733a0 [0076.778] lstrlenA (lpString="010001") returned 6 [0076.778] GetProcessHeap () returned 0x630000 [0076.778] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3f8 [0076.778] GetProcessHeap () returned 0x630000 [0076.778] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6730f8 [0076.778] GetProcessHeap () returned 0x630000 [0076.778] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e850 [0076.778] GetProcessHeap () returned 0x630000 [0076.778] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6730f8 | out: hHeap=0x630000) returned 1 [0076.778] GetProcessHeap () returned 0x630000 [0076.778] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e460 [0076.778] GetProcessHeap () returned 0x630000 [0076.778] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657328 [0076.778] GetProcessHeap () returned 0x630000 [0076.778] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0076.778] GetProcessHeap () returned 0x630000 [0076.778] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0076.778] GetProcessHeap () returned 0x630000 [0076.778] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0076.779] GetProcessHeap () returned 0x630000 [0076.779] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0076.779] GetProcessHeap () returned 0x630000 [0076.779] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673758 [0076.779] GetProcessHeap () returned 0x630000 [0076.779] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656c98 [0076.779] GetProcessHeap () returned 0x630000 [0076.779] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0076.779] GetProcessHeap () returned 0x630000 [0076.779] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0076.779] GetProcessHeap () returned 0x630000 [0076.779] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e4f0 [0076.779] GetProcessHeap () returned 0x630000 [0076.779] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673758 | out: hHeap=0x630000) returned 1 [0076.779] GetProcessHeap () returned 0x630000 [0076.779] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0076.779] GetProcessHeap () returned 0x630000 [0076.779] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0076.779] GetProcessHeap () returned 0x630000 [0076.779] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.779] GetProcessHeap () returned 0x630000 [0076.779] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cfd0 [0076.779] GetProcessHeap () returned 0x630000 [0076.779] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0076.779] GetProcessHeap () returned 0x630000 [0076.779] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.779] GetProcessHeap () returned 0x630000 [0076.779] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.779] GetProcessHeap () returned 0x630000 [0076.779] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.779] GetProcessHeap () returned 0x630000 [0076.779] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65dda0 [0076.779] GetProcessHeap () returned 0x630000 [0076.779] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cfd0 | out: hHeap=0x630000) returned 1 [0076.779] GetProcessHeap () returned 0x630000 [0076.779] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0076.779] GetProcessHeap () returned 0x630000 [0076.779] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0076.779] GetProcessHeap () returned 0x630000 [0076.779] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.779] GetProcessHeap () returned 0x630000 [0076.780] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.780] GetProcessHeap () returned 0x630000 [0076.780] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.780] GetProcessHeap () returned 0x630000 [0076.780] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.780] GetProcessHeap () returned 0x630000 [0076.780] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0076.780] GetProcessHeap () returned 0x630000 [0076.780] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0076.780] GetProcessHeap () returned 0x630000 [0076.780] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.780] GetProcessHeap () returned 0x630000 [0076.780] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.780] GetProcessHeap () returned 0x630000 [0076.780] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.780] GetProcessHeap () returned 0x630000 [0076.780] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.780] GetProcessHeap () returned 0x630000 [0076.780] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.780] GetProcessHeap () returned 0x630000 [0076.780] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.780] GetProcessHeap () returned 0x630000 [0076.780] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.780] GetProcessHeap () returned 0x630000 [0076.780] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.780] GetProcessHeap () returned 0x630000 [0076.780] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.780] GetProcessHeap () returned 0x630000 [0076.780] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.780] GetProcessHeap () returned 0x630000 [0076.780] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.780] GetProcessHeap () returned 0x630000 [0076.780] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.780] GetProcessHeap () returned 0x630000 [0076.780] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.780] GetProcessHeap () returned 0x630000 [0076.781] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.781] GetProcessHeap () returned 0x630000 [0076.781] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.781] GetProcessHeap () returned 0x630000 [0076.781] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.781] GetProcessHeap () returned 0x630000 [0076.781] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0076.781] GetProcessHeap () returned 0x630000 [0076.781] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0076.781] GetProcessHeap () returned 0x630000 [0076.781] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.781] GetProcessHeap () returned 0x630000 [0076.781] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.781] GetProcessHeap () returned 0x630000 [0076.781] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.781] GetProcessHeap () returned 0x630000 [0076.781] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.781] GetProcessHeap () returned 0x630000 [0076.781] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0076.781] GetProcessHeap () returned 0x630000 [0076.781] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0076.781] GetProcessHeap () returned 0x630000 [0076.781] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.781] GetProcessHeap () returned 0x630000 [0076.781] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.781] GetProcessHeap () returned 0x630000 [0076.781] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0076.781] GetProcessHeap () returned 0x630000 [0076.781] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0076.781] GetProcessHeap () returned 0x630000 [0076.781] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.781] GetProcessHeap () returned 0x630000 [0076.781] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.781] GetProcessHeap () returned 0x630000 [0076.781] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.781] GetProcessHeap () returned 0x630000 [0076.781] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.781] GetProcessHeap () returned 0x630000 [0076.782] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.782] GetProcessHeap () returned 0x630000 [0076.782] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.782] GetProcessHeap () returned 0x630000 [0076.782] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0076.782] GetProcessHeap () returned 0x630000 [0076.782] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0076.782] GetProcessHeap () returned 0x630000 [0076.782] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0076.782] GetProcessHeap () returned 0x630000 [0076.782] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0076.782] GetProcessHeap () returned 0x630000 [0076.782] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0076.782] GetProcessHeap () returned 0x630000 [0076.782] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0076.782] GetProcessHeap () returned 0x630000 [0076.782] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.782] GetProcessHeap () returned 0x630000 [0076.782] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.782] GetProcessHeap () returned 0x630000 [0076.782] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.782] GetProcessHeap () returned 0x630000 [0076.782] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.782] GetProcessHeap () returned 0x630000 [0076.782] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.782] GetProcessHeap () returned 0x630000 [0076.782] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.782] GetProcessHeap () returned 0x630000 [0076.782] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0076.782] GetProcessHeap () returned 0x630000 [0076.782] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0076.782] GetProcessHeap () returned 0x630000 [0076.782] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.782] GetProcessHeap () returned 0x630000 [0076.782] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.782] GetProcessHeap () returned 0x630000 [0076.782] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.782] GetProcessHeap () returned 0x630000 [0076.782] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.783] GetProcessHeap () returned 0x630000 [0076.783] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0076.783] GetProcessHeap () returned 0x630000 [0076.783] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0076.783] GetProcessHeap () returned 0x630000 [0076.783] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0076.783] GetProcessHeap () returned 0x630000 [0076.783] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0076.783] GetProcessHeap () returned 0x630000 [0076.783] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.783] GetProcessHeap () returned 0x630000 [0076.783] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.783] GetProcessHeap () returned 0x630000 [0076.783] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.783] GetProcessHeap () returned 0x630000 [0076.783] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.783] GetProcessHeap () returned 0x630000 [0076.783] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.783] GetProcessHeap () returned 0x630000 [0076.783] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.783] GetProcessHeap () returned 0x630000 [0076.783] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0076.783] GetProcessHeap () returned 0x630000 [0076.783] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0076.783] GetProcessHeap () returned 0x630000 [0076.783] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a318 [0076.783] GetProcessHeap () returned 0x630000 [0076.783] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0076.783] GetProcessHeap () returned 0x630000 [0076.783] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.783] GetProcessHeap () returned 0x630000 [0076.783] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.783] GetProcessHeap () returned 0x630000 [0076.783] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.783] GetProcessHeap () returned 0x630000 [0076.783] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.783] GetProcessHeap () returned 0x630000 [0076.783] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.783] GetProcessHeap () returned 0x630000 [0076.784] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.784] GetProcessHeap () returned 0x630000 [0076.784] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.784] GetProcessHeap () returned 0x630000 [0076.784] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.784] GetProcessHeap () returned 0x630000 [0076.784] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0076.784] GetProcessHeap () returned 0x630000 [0076.784] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.784] GetProcessHeap () returned 0x630000 [0076.784] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0076.784] GetProcessHeap () returned 0x630000 [0076.784] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0076.784] GetProcessHeap () returned 0x630000 [0076.784] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0076.784] GetProcessHeap () returned 0x630000 [0076.784] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0076.784] GetProcessHeap () returned 0x630000 [0076.784] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0076.784] GetProcessHeap () returned 0x630000 [0076.784] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e460 | out: hHeap=0x630000) returned 1 [0076.784] GetProcessHeap () returned 0x630000 [0076.784] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0076.784] GetProcessHeap () returned 0x630000 [0076.784] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0076.784] GetProcessHeap () returned 0x630000 [0076.784] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0076.784] GetProcessHeap () returned 0x630000 [0076.784] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.784] GetProcessHeap () returned 0x630000 [0076.784] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6733a0 | out: hHeap=0x630000) returned 1 [0076.784] WriteFile (in: hFile=0x230, lpBuffer=0x673f00*, nNumberOfBytesToWrite=0x385, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673f00*, lpNumberOfBytesWritten=0x243d864*=0x385, lpOverlapped=0x0) returned 1 [0076.786] GetProcessHeap () returned 0x630000 [0076.786] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x673f00, Size=0x30) returned 0x673f00 [0076.786] GetProcessHeap () returned 0x630000 [0076.786] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0076.786] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0076.786] GetProcessHeap () returned 0x630000 [0076.786] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc1f0) returned 0x673f38 [0076.786] ReadFile (in: hFile=0x230, lpBuffer=0x673f38, nNumberOfBytesToRead=0xc1f0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x673f38*, lpNumberOfBytesRead=0x243d7e8*=0xc1f0, lpOverlapped=0x0) returned 1 [0076.787] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0076.787] WriteFile (in: hFile=0x230, lpBuffer=0x673f38*, nNumberOfBytesToWrite=0xc1f0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x673f38*, lpNumberOfBytesWritten=0x243d7e4*=0xc1f0, lpOverlapped=0x0) returned 1 [0076.792] GetProcessHeap () returned 0x630000 [0076.792] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673f38 | out: hHeap=0x630000) returned 1 [0076.794] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0076.794] WriteFile (in: hFile=0x230, lpBuffer=0x673f00*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673f00*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0076.795] CloseHandle (hObject=0x230) returned 1 [0076.795] GetProcessHeap () returned 0x630000 [0076.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651ec0 | out: hHeap=0x630000) returned 1 [0076.795] GetProcessHeap () returned 0x630000 [0076.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655850 | out: hHeap=0x630000) returned 1 [0076.795] GetProcessHeap () returned 0x630000 [0076.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672cb8 | out: hHeap=0x630000) returned 1 [0076.795] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\MnsHUqpMqJG.flv" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\MnsHUqpMqJG.flv") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\MnsHUqpMqJG.flv" [0076.795] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\MnsHUqpMqJG.flv", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\MnsHUqpMqJG.flv.happythreechoose") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\MnsHUqpMqJG.flv.happythreechoose" [0076.795] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\MnsHUqpMqJG.flv" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mnshuqpmqjg.flv"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\MnsHUqpMqJG.flv.happythreechoose" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mnshuqpmqjg.flv.happythreechoose"), dwFlags=0x1) returned 1 [0076.796] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\MnsHUqpMqJG.flv" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0076.796] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="" [0076.796] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" [0076.796] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\decryption info.html")) returned 0x20 [0076.797] GetProcessHeap () returned 0x630000 [0076.797] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0076.797] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd8b64ce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfd8b64ce, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0076.797] lstrcmpiW (lpString1="Mozilla", lpString2=".") returned 1 [0076.797] lstrcmpiW (lpString1="Mozilla", lpString2="..") returned 1 [0076.797] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="Mozilla" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla" [0076.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Mozilla", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0076.797] GetProcessHeap () returned 0x630000 [0076.797] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a398 [0076.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Mozilla", cchWideChar=-1, lpMultiByteStr=0x65a398, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mozilla", lpUsedDefaultChar=0x0) returned 8 [0076.797] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Mozilla", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0076.797] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Mozilla", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0076.797] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Mozilla", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0076.797] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Mozilla", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0076.797] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Mozilla", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0076.797] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Mozilla", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0076.797] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Mozilla", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0076.797] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Mozilla", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0076.797] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Mozilla", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0076.797] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Mozilla", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0076.797] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Mozilla", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0076.797] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Mozilla", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0076.797] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Mozilla", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0076.797] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Mozilla", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0076.797] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Mozilla", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0076.797] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Mozilla", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0076.797] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Mozilla", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0076.797] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Mozilla", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0076.797] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Mozilla", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0076.797] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Mozilla", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0076.797] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Mozilla", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0076.797] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Mozilla", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0076.797] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Mozilla", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0076.798] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Mozilla", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0076.798] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Mozilla", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0076.798] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Mozilla", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0076.798] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Mozilla", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0076.798] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Mozilla", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0076.798] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Mozilla", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0076.798] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Mozilla", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0076.798] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Mozilla", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0076.798] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Mozilla", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0076.798] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Mozilla", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0076.798] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Mozilla", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0076.798] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Mozilla", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0076.798] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Mozilla", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0076.798] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Mozilla", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0076.798] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Mozilla", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0076.798] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Mozilla", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0076.798] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Mozilla", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0076.798] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Mozilla", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0076.798] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Mozilla", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0076.798] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Mozilla", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0076.798] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\" [0076.798] GetProcessHeap () returned 0x630000 [0076.798] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a318 [0076.798] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\") returned 40 [0076.798] GetProcessHeap () returned 0x630000 [0076.798] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x52) returned 0x653990 [0076.798] lstrcpyW (in: lpString1=0x653990, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\" [0076.798] GetProcessHeap () returned 0x630000 [0076.798] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.798] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcbdad20, ftCreationTime.dwHighDateTime=0x1d5cb57, ftLastAccessTime.dwLowDateTime=0x547625f0, ftLastAccessTime.dwHighDateTime=0x1d5d05e, ftLastWriteTime.dwLowDateTime=0x547625f0, ftLastWriteTime.dwHighDateTime=0x1d5d05e, nFileSizeHigh=0x0, nFileSizeLow=0x131e5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mwi1UbX2tp 5v_.doc", cAlternateFileName="MWI1UB~1.DOC")) returned 1 [0076.798] lstrcmpiW (lpString1="Mwi1UbX2tp 5v_.doc", lpString2=".") returned 1 [0076.798] lstrcmpiW (lpString1="Mwi1UbX2tp 5v_.doc", lpString2="..") returned 1 [0076.798] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="Mwi1UbX2tp 5v_.doc" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mwi1UbX2tp 5v_.doc") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mwi1UbX2tp 5v_.doc" [0076.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Mwi1UbX2tp 5v_.doc", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0076.798] GetProcessHeap () returned 0x630000 [0076.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x13) returned 0x645f58 [0076.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Mwi1UbX2tp 5v_.doc", cchWideChar=-1, lpMultiByteStr=0x645f58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mwi1UbX2tp 5v_.doc", lpUsedDefaultChar=0x0) returned 19 [0076.799] lstrlenA (lpString="Mwi1UbX2tp 5v_.doc") returned 18 [0076.799] lstrlenA (lpString=".happythreechoose") returned 17 [0076.799] lstrlenA (lpString=".happythreechoose") returned 17 [0076.799] lstrlenA (lpString="Mwi1UbX2tp 5v_.doc") returned 18 [0076.799] lstrcmpiA (lpString1="wi1UbX2tp 5v_.doc", lpString2=".happythreechoose") returned 1 [0076.799] lstrcmpiW (lpString1="Mwi1UbX2tp 5v_.doc", lpString2="Decryption INFO.html") returned 1 [0076.799] lstrcmpiW (lpString1="Mwi1UbX2tp 5v_.doc", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0076.799] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0076.799] lstrcmpiW (lpString1="Mwi1UbX2tp 5v_.doc", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0076.799] GetProcessHeap () returned 0x630000 [0076.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0076.799] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mwi1UbX2tp 5v_.doc" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mwi1ubx2tp 5v_.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0076.799] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=78309) returned 1 [0076.799] GetProcessHeap () returned 0x630000 [0076.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655b20 [0076.799] GetProcessHeap () returned 0x630000 [0076.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6734b0 [0076.799] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mwi1UbX2tp 5v_.doc") returned 50 [0076.799] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0076.799] GetProcessHeap () returned 0x630000 [0076.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0076.799] GetProcessHeap () returned 0x630000 [0076.799] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x673f38 [0076.800] lstrlenA (lpString="rsa_encrypt") returned 11 [0076.800] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x672900) returned 1 [0076.801] CryptGenRandom (in: hProv=0x672900, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0076.801] CryptReleaseContext (hProv=0x672900, dwFlags=0x0) returned 1 [0076.801] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0076.801] GetProcessHeap () returned 0x630000 [0076.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673538 [0076.801] lstrlenA (lpString="010001") returned 6 [0076.801] GetProcessHeap () returned 0x630000 [0076.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a398 [0076.801] GetProcessHeap () returned 0x630000 [0076.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6736d0 [0076.801] GetProcessHeap () returned 0x630000 [0076.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e970 [0076.801] GetProcessHeap () returned 0x630000 [0076.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6736d0 | out: hHeap=0x630000) returned 1 [0076.801] GetProcessHeap () returned 0x630000 [0076.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e7c0 [0076.801] GetProcessHeap () returned 0x630000 [0076.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656c98 [0076.801] GetProcessHeap () returned 0x630000 [0076.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a298 [0076.801] GetProcessHeap () returned 0x630000 [0076.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0076.802] GetProcessHeap () returned 0x630000 [0076.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.802] GetProcessHeap () returned 0x630000 [0076.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0076.802] GetProcessHeap () returned 0x630000 [0076.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673180 [0076.802] GetProcessHeap () returned 0x630000 [0076.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657210 [0076.802] GetProcessHeap () returned 0x630000 [0076.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0076.802] GetProcessHeap () returned 0x630000 [0076.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0076.802] GetProcessHeap () returned 0x630000 [0076.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ec40 [0076.802] GetProcessHeap () returned 0x630000 [0076.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673180 | out: hHeap=0x630000) returned 1 [0076.802] GetProcessHeap () returned 0x630000 [0076.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0076.802] GetProcessHeap () returned 0x630000 [0076.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ec40 | out: hHeap=0x630000) returned 1 [0076.802] GetProcessHeap () returned 0x630000 [0076.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.802] GetProcessHeap () returned 0x630000 [0076.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0076.802] GetProcessHeap () returned 0x630000 [0076.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0076.802] GetProcessHeap () returned 0x630000 [0076.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.802] GetProcessHeap () returned 0x630000 [0076.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.802] GetProcessHeap () returned 0x630000 [0076.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.802] GetProcessHeap () returned 0x630000 [0076.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e610 [0076.802] GetProcessHeap () returned 0x630000 [0076.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0076.802] GetProcessHeap () returned 0x630000 [0076.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0076.802] GetProcessHeap () returned 0x630000 [0076.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0076.802] GetProcessHeap () returned 0x630000 [0076.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0076.803] GetProcessHeap () returned 0x630000 [0076.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0076.803] GetProcessHeap () returned 0x630000 [0076.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0076.803] GetProcessHeap () returned 0x630000 [0076.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0076.803] GetProcessHeap () returned 0x630000 [0076.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0076.803] GetProcessHeap () returned 0x630000 [0076.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0076.803] GetProcessHeap () returned 0x630000 [0076.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0076.803] GetProcessHeap () returned 0x630000 [0076.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.803] GetProcessHeap () returned 0x630000 [0076.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.803] GetProcessHeap () returned 0x630000 [0076.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.803] GetProcessHeap () returned 0x630000 [0076.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.803] GetProcessHeap () returned 0x630000 [0076.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.803] GetProcessHeap () returned 0x630000 [0076.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.803] GetProcessHeap () returned 0x630000 [0076.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.803] GetProcessHeap () returned 0x630000 [0076.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.803] GetProcessHeap () returned 0x630000 [0076.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.803] GetProcessHeap () returned 0x630000 [0076.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0076.803] GetProcessHeap () returned 0x630000 [0076.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0076.803] GetProcessHeap () returned 0x630000 [0076.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.803] GetProcessHeap () returned 0x630000 [0076.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.804] GetProcessHeap () returned 0x630000 [0076.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0076.804] GetProcessHeap () returned 0x630000 [0076.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0076.804] GetProcessHeap () returned 0x630000 [0076.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.804] GetProcessHeap () returned 0x630000 [0076.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.804] GetProcessHeap () returned 0x630000 [0076.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.804] GetProcessHeap () returned 0x630000 [0076.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.804] GetProcessHeap () returned 0x630000 [0076.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.804] GetProcessHeap () returned 0x630000 [0076.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.804] GetProcessHeap () returned 0x630000 [0076.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0076.804] GetProcessHeap () returned 0x630000 [0076.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0076.804] GetProcessHeap () returned 0x630000 [0076.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.804] GetProcessHeap () returned 0x630000 [0076.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.804] GetProcessHeap () returned 0x630000 [0076.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0076.804] GetProcessHeap () returned 0x630000 [0076.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0076.804] GetProcessHeap () returned 0x630000 [0076.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0076.804] GetProcessHeap () returned 0x630000 [0076.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0076.804] GetProcessHeap () returned 0x630000 [0076.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.804] GetProcessHeap () returned 0x630000 [0076.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.804] GetProcessHeap () returned 0x630000 [0076.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0076.804] GetProcessHeap () returned 0x630000 [0076.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0076.805] GetProcessHeap () returned 0x630000 [0076.805] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0076.805] GetProcessHeap () returned 0x630000 [0076.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0076.805] GetProcessHeap () returned 0x630000 [0076.805] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0076.805] GetProcessHeap () returned 0x630000 [0076.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0076.805] GetProcessHeap () returned 0x630000 [0076.805] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0076.805] GetProcessHeap () returned 0x630000 [0076.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0076.805] GetProcessHeap () returned 0x630000 [0076.805] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.805] GetProcessHeap () returned 0x630000 [0076.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.805] GetProcessHeap () returned 0x630000 [0076.805] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.805] GetProcessHeap () returned 0x630000 [0076.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.805] GetProcessHeap () returned 0x630000 [0076.805] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.805] GetProcessHeap () returned 0x630000 [0076.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.805] GetProcessHeap () returned 0x630000 [0076.805] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.805] GetProcessHeap () returned 0x630000 [0076.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.805] GetProcessHeap () returned 0x630000 [0076.805] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.805] GetProcessHeap () returned 0x630000 [0076.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.805] GetProcessHeap () returned 0x630000 [0076.805] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.805] GetProcessHeap () returned 0x630000 [0076.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.805] GetProcessHeap () returned 0x630000 [0076.805] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0076.805] GetProcessHeap () returned 0x630000 [0076.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0076.806] GetProcessHeap () returned 0x630000 [0076.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0076.806] GetProcessHeap () returned 0x630000 [0076.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0076.806] GetProcessHeap () returned 0x630000 [0076.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0076.806] GetProcessHeap () returned 0x630000 [0076.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0076.806] GetProcessHeap () returned 0x630000 [0076.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.806] GetProcessHeap () returned 0x630000 [0076.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.806] GetProcessHeap () returned 0x630000 [0076.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.806] GetProcessHeap () returned 0x630000 [0076.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.806] GetProcessHeap () returned 0x630000 [0076.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0076.806] GetProcessHeap () returned 0x630000 [0076.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0076.806] GetProcessHeap () returned 0x630000 [0076.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0076.806] GetProcessHeap () returned 0x630000 [0076.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0076.806] GetProcessHeap () returned 0x630000 [0076.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0076.806] GetProcessHeap () returned 0x630000 [0076.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0076.806] GetProcessHeap () returned 0x630000 [0076.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0076.806] GetProcessHeap () returned 0x630000 [0076.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0076.806] GetProcessHeap () returned 0x630000 [0076.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0076.806] GetProcessHeap () returned 0x630000 [0076.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0076.806] GetProcessHeap () returned 0x630000 [0076.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0076.807] GetProcessHeap () returned 0x630000 [0076.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0076.807] GetProcessHeap () returned 0x630000 [0076.807] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0076.807] GetProcessHeap () returned 0x630000 [0076.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0076.807] GetProcessHeap () returned 0x630000 [0076.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0076.807] GetProcessHeap () returned 0x630000 [0076.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0076.807] GetProcessHeap () returned 0x630000 [0076.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0076.807] GetProcessHeap () returned 0x630000 [0076.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0076.807] GetProcessHeap () returned 0x630000 [0076.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0076.807] GetProcessHeap () returned 0x630000 [0076.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e7c0 | out: hHeap=0x630000) returned 1 [0076.807] GetProcessHeap () returned 0x630000 [0076.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0076.807] GetProcessHeap () returned 0x630000 [0076.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0076.807] GetProcessHeap () returned 0x630000 [0076.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0076.807] GetProcessHeap () returned 0x630000 [0076.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0076.807] GetProcessHeap () returned 0x630000 [0076.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673538 | out: hHeap=0x630000) returned 1 [0076.807] WriteFile (in: hFile=0x230, lpBuffer=0x673f38*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673f38*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0077.095] GetProcessHeap () returned 0x630000 [0077.095] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x673f38, Size=0x30) returned 0x673f38 [0077.095] GetProcessHeap () returned 0x630000 [0077.095] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0077.095] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0077.095] GetProcessHeap () returned 0x630000 [0077.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x131e5) returned 0x673f70 [0077.097] ReadFile (in: hFile=0x230, lpBuffer=0x673f70, nNumberOfBytesToRead=0x131e5, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x673f70*, lpNumberOfBytesRead=0x243d7e8*=0x131e5, lpOverlapped=0x0) returned 1 [0077.098] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0077.098] WriteFile (in: hFile=0x230, lpBuffer=0x673f70*, nNumberOfBytesToWrite=0x131e5, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x673f70*, lpNumberOfBytesWritten=0x243d7e4*=0x131e5, lpOverlapped=0x0) returned 1 [0077.100] GetProcessHeap () returned 0x630000 [0077.100] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673f70 | out: hHeap=0x630000) returned 1 [0077.101] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0077.101] WriteFile (in: hFile=0x230, lpBuffer=0x673f38*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673f38*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0077.102] CloseHandle (hObject=0x230) returned 1 [0077.103] GetProcessHeap () returned 0x630000 [0077.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0077.103] GetProcessHeap () returned 0x630000 [0077.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655b20 | out: hHeap=0x630000) returned 1 [0077.103] GetProcessHeap () returned 0x630000 [0077.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6734b0 | out: hHeap=0x630000) returned 1 [0077.103] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mwi1UbX2tp 5v_.doc" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mwi1UbX2tp 5v_.doc") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mwi1UbX2tp 5v_.doc" [0077.103] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mwi1UbX2tp 5v_.doc", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mwi1UbX2tp 5v_.doc.happythreechoose") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mwi1UbX2tp 5v_.doc.happythreechoose" [0077.103] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mwi1UbX2tp 5v_.doc" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mwi1ubx2tp 5v_.doc"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mwi1UbX2tp 5v_.doc.happythreechoose" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mwi1ubx2tp 5v_.doc.happythreechoose"), dwFlags=0x1) returned 1 [0077.104] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mwi1UbX2tp 5v_.doc" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0077.104] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="" [0077.104] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" [0077.104] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\decryption info.html")) returned 0x20 [0077.104] GetProcessHeap () returned 0x630000 [0077.104] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645f58 | out: hHeap=0x630000) returned 1 [0077.104] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74645d70, ftCreationTime.dwHighDateTime=0x1d5d714, ftLastAccessTime.dwLowDateTime=0xf4bc3cf0, ftLastAccessTime.dwHighDateTime=0x1d5cb10, ftLastWriteTime.dwLowDateTime=0xf4bc3cf0, ftLastWriteTime.dwHighDateTime=0x1d5cb10, nFileSizeHigh=0x0, nFileSizeLow=0x12aec, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="mYC78rQTQNZN.jpg", cAlternateFileName="MYC78R~1.JPG")) returned 1 [0077.104] lstrcmpiW (lpString1="mYC78rQTQNZN.jpg", lpString2=".") returned 1 [0077.104] lstrcmpiW (lpString1="mYC78rQTQNZN.jpg", lpString2="..") returned 1 [0077.104] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="mYC78rQTQNZN.jpg" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\mYC78rQTQNZN.jpg") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\mYC78rQTQNZN.jpg" [0077.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mYC78rQTQNZN.jpg", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0077.104] GetProcessHeap () returned 0x630000 [0077.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11) returned 0x645ed8 [0077.104] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="mYC78rQTQNZN.jpg", cchWideChar=-1, lpMultiByteStr=0x645ed8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mYC78rQTQNZN.jpg", lpUsedDefaultChar=0x0) returned 17 [0077.104] lstrlenA (lpString="mYC78rQTQNZN.jpg") returned 16 [0077.104] lstrlenA (lpString=".happythreechoose") returned 17 [0077.104] lstrcmpiW (lpString1="mYC78rQTQNZN.jpg", lpString2="Decryption INFO.html") returned 1 [0077.104] lstrcmpiW (lpString1="mYC78rQTQNZN.jpg", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0077.104] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0077.104] lstrcmpiW (lpString1="mYC78rQTQNZN.jpg", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0077.104] GetProcessHeap () returned 0x630000 [0077.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651ec0 [0077.104] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\mYC78rQTQNZN.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\myc78rqtqnzn.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0077.104] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=76524) returned 1 [0077.104] GetProcessHeap () returned 0x630000 [0077.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655aa8 [0077.105] GetProcessHeap () returned 0x630000 [0077.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672a98 [0077.105] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\mYC78rQTQNZN.jpg") returned 48 [0077.105] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0077.105] GetProcessHeap () returned 0x630000 [0077.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0077.105] GetProcessHeap () returned 0x630000 [0077.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x673f70 [0077.106] lstrlenA (lpString="rsa_encrypt") returned 11 [0077.106] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x6737e0) returned 1 [0077.107] CryptGenRandom (in: hProv=0x6737e0, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0077.107] CryptReleaseContext (hProv=0x6737e0, dwFlags=0x0) returned 1 [0077.107] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0077.107] GetProcessHeap () returned 0x630000 [0077.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673070 [0077.107] lstrlenA (lpString="010001") returned 6 [0077.107] GetProcessHeap () returned 0x630000 [0077.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a398 [0077.107] GetProcessHeap () returned 0x630000 [0077.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672b20 [0077.107] GetProcessHeap () returned 0x630000 [0077.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e610 [0077.107] GetProcessHeap () returned 0x630000 [0077.107] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672b20 | out: hHeap=0x630000) returned 1 [0077.107] GetProcessHeap () returned 0x630000 [0077.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e730 [0077.107] GetProcessHeap () returned 0x630000 [0077.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657440 [0077.107] GetProcessHeap () returned 0x630000 [0077.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0077.107] GetProcessHeap () returned 0x630000 [0077.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0077.107] GetProcessHeap () returned 0x630000 [0077.107] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0077.107] GetProcessHeap () returned 0x630000 [0077.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0077.107] GetProcessHeap () returned 0x630000 [0077.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673180 [0077.107] GetProcessHeap () returned 0x630000 [0077.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656c98 [0077.107] GetProcessHeap () returned 0x630000 [0077.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.107] GetProcessHeap () returned 0x630000 [0077.107] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0077.107] GetProcessHeap () returned 0x630000 [0077.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65eb20 [0077.108] GetProcessHeap () returned 0x630000 [0077.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673180 | out: hHeap=0x630000) returned 1 [0077.108] GetProcessHeap () returned 0x630000 [0077.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0077.108] GetProcessHeap () returned 0x630000 [0077.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0077.108] GetProcessHeap () returned 0x630000 [0077.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.108] GetProcessHeap () returned 0x630000 [0077.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0077.108] GetProcessHeap () returned 0x630000 [0077.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.108] GetProcessHeap () returned 0x630000 [0077.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.108] GetProcessHeap () returned 0x630000 [0077.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.108] GetProcessHeap () returned 0x630000 [0077.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.108] GetProcessHeap () returned 0x630000 [0077.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ec40 [0077.108] GetProcessHeap () returned 0x630000 [0077.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0077.108] GetProcessHeap () returned 0x630000 [0077.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0077.108] GetProcessHeap () returned 0x630000 [0077.108] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ec40 | out: hHeap=0x630000) returned 1 [0077.108] GetProcessHeap () returned 0x630000 [0077.108] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.108] GetProcessHeap () returned 0x630000 [0077.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.109] GetProcessHeap () returned 0x630000 [0077.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.109] GetProcessHeap () returned 0x630000 [0077.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.109] GetProcessHeap () returned 0x630000 [0077.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.109] GetProcessHeap () returned 0x630000 [0077.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.109] GetProcessHeap () returned 0x630000 [0077.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.109] GetProcessHeap () returned 0x630000 [0077.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.109] GetProcessHeap () returned 0x630000 [0077.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.109] GetProcessHeap () returned 0x630000 [0077.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.109] GetProcessHeap () returned 0x630000 [0077.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.109] GetProcessHeap () returned 0x630000 [0077.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.109] GetProcessHeap () returned 0x630000 [0077.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.109] GetProcessHeap () returned 0x630000 [0077.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.109] GetProcessHeap () returned 0x630000 [0077.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.109] GetProcessHeap () returned 0x630000 [0077.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.109] GetProcessHeap () returned 0x630000 [0077.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.109] GetProcessHeap () returned 0x630000 [0077.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.109] GetProcessHeap () returned 0x630000 [0077.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.109] GetProcessHeap () returned 0x630000 [0077.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.109] GetProcessHeap () returned 0x630000 [0077.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.110] GetProcessHeap () returned 0x630000 [0077.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.110] GetProcessHeap () returned 0x630000 [0077.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.110] GetProcessHeap () returned 0x630000 [0077.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.110] GetProcessHeap () returned 0x630000 [0077.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.110] GetProcessHeap () returned 0x630000 [0077.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.110] GetProcessHeap () returned 0x630000 [0077.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.110] GetProcessHeap () returned 0x630000 [0077.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.110] GetProcessHeap () returned 0x630000 [0077.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.110] GetProcessHeap () returned 0x630000 [0077.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.110] GetProcessHeap () returned 0x630000 [0077.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.110] GetProcessHeap () returned 0x630000 [0077.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.110] GetProcessHeap () returned 0x630000 [0077.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.110] GetProcessHeap () returned 0x630000 [0077.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.110] GetProcessHeap () returned 0x630000 [0077.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.110] GetProcessHeap () returned 0x630000 [0077.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.110] GetProcessHeap () returned 0x630000 [0077.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.110] GetProcessHeap () returned 0x630000 [0077.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.110] GetProcessHeap () returned 0x630000 [0077.110] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.110] GetProcessHeap () returned 0x630000 [0077.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.111] GetProcessHeap () returned 0x630000 [0077.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.111] GetProcessHeap () returned 0x630000 [0077.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.111] GetProcessHeap () returned 0x630000 [0077.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.111] GetProcessHeap () returned 0x630000 [0077.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.111] GetProcessHeap () returned 0x630000 [0077.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.111] GetProcessHeap () returned 0x630000 [0077.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.111] GetProcessHeap () returned 0x630000 [0077.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.111] GetProcessHeap () returned 0x630000 [0077.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.111] GetProcessHeap () returned 0x630000 [0077.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.111] GetProcessHeap () returned 0x630000 [0077.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.111] GetProcessHeap () returned 0x630000 [0077.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.111] GetProcessHeap () returned 0x630000 [0077.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.111] GetProcessHeap () returned 0x630000 [0077.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.111] GetProcessHeap () returned 0x630000 [0077.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.111] GetProcessHeap () returned 0x630000 [0077.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.111] GetProcessHeap () returned 0x630000 [0077.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.111] GetProcessHeap () returned 0x630000 [0077.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.111] GetProcessHeap () returned 0x630000 [0077.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.111] GetProcessHeap () returned 0x630000 [0077.111] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.111] GetProcessHeap () returned 0x630000 [0077.111] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.112] GetProcessHeap () returned 0x630000 [0077.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.112] GetProcessHeap () returned 0x630000 [0077.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.112] GetProcessHeap () returned 0x630000 [0077.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.112] GetProcessHeap () returned 0x630000 [0077.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.112] GetProcessHeap () returned 0x630000 [0077.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.112] GetProcessHeap () returned 0x630000 [0077.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.112] GetProcessHeap () returned 0x630000 [0077.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.112] GetProcessHeap () returned 0x630000 [0077.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.112] GetProcessHeap () returned 0x630000 [0077.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.112] GetProcessHeap () returned 0x630000 [0077.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.112] GetProcessHeap () returned 0x630000 [0077.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0077.112] GetProcessHeap () returned 0x630000 [0077.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0077.112] GetProcessHeap () returned 0x630000 [0077.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.112] GetProcessHeap () returned 0x630000 [0077.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.112] GetProcessHeap () returned 0x630000 [0077.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.112] GetProcessHeap () returned 0x630000 [0077.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.112] GetProcessHeap () returned 0x630000 [0077.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.112] GetProcessHeap () returned 0x630000 [0077.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.112] GetProcessHeap () returned 0x630000 [0077.112] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.112] GetProcessHeap () returned 0x630000 [0077.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.112] GetProcessHeap () returned 0x630000 [0077.113] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.113] GetProcessHeap () returned 0x630000 [0077.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.113] GetProcessHeap () returned 0x630000 [0077.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0077.113] GetProcessHeap () returned 0x630000 [0077.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0077.113] GetProcessHeap () returned 0x630000 [0077.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0077.113] GetProcessHeap () returned 0x630000 [0077.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0077.113] GetProcessHeap () returned 0x630000 [0077.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0077.113] GetProcessHeap () returned 0x630000 [0077.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0077.113] GetProcessHeap () returned 0x630000 [0077.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0077.113] GetProcessHeap () returned 0x630000 [0077.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0077.113] GetProcessHeap () returned 0x630000 [0077.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0077.113] GetProcessHeap () returned 0x630000 [0077.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.113] GetProcessHeap () returned 0x630000 [0077.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673070 | out: hHeap=0x630000) returned 1 [0077.113] WriteFile (in: hFile=0x230, lpBuffer=0x673f70*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673f70*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0077.118] GetProcessHeap () returned 0x630000 [0077.118] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x673f70, Size=0x30) returned 0x673f70 [0077.118] GetProcessHeap () returned 0x630000 [0077.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0077.118] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0077.118] GetProcessHeap () returned 0x630000 [0077.118] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12aec) returned 0x673fa8 [0077.119] ReadFile (in: hFile=0x230, lpBuffer=0x673fa8, nNumberOfBytesToRead=0x12aec, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x673fa8*, lpNumberOfBytesRead=0x243d7e8*=0x12aec, lpOverlapped=0x0) returned 1 [0077.120] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0077.120] WriteFile (in: hFile=0x230, lpBuffer=0x673fa8*, nNumberOfBytesToWrite=0x12aec, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x673fa8*, lpNumberOfBytesWritten=0x243d7e4*=0x12aec, lpOverlapped=0x0) returned 1 [0077.122] GetProcessHeap () returned 0x630000 [0077.122] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673fa8 | out: hHeap=0x630000) returned 1 [0077.122] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0077.122] WriteFile (in: hFile=0x230, lpBuffer=0x673f70*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673f70*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0077.125] CloseHandle (hObject=0x230) returned 1 [0077.125] GetProcessHeap () returned 0x630000 [0077.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651ec0 | out: hHeap=0x630000) returned 1 [0077.125] GetProcessHeap () returned 0x630000 [0077.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655aa8 | out: hHeap=0x630000) returned 1 [0077.125] GetProcessHeap () returned 0x630000 [0077.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672a98 | out: hHeap=0x630000) returned 1 [0077.125] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\mYC78rQTQNZN.jpg" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\mYC78rQTQNZN.jpg") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\mYC78rQTQNZN.jpg" [0077.125] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\mYC78rQTQNZN.jpg", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\mYC78rQTQNZN.jpg.happythreechoose") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\mYC78rQTQNZN.jpg.happythreechoose" [0077.125] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\mYC78rQTQNZN.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\myc78rqtqnzn.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\mYC78rQTQNZN.jpg.happythreechoose" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\myc78rqtqnzn.jpg.happythreechoose"), dwFlags=0x1) returned 1 [0077.126] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\mYC78rQTQNZN.jpg" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0077.126] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="" [0077.126] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" [0077.126] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\decryption info.html")) returned 0x20 [0077.126] GetProcessHeap () returned 0x630000 [0077.126] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645ed8 | out: hHeap=0x630000) returned 1 [0077.126] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20c26960, ftCreationTime.dwHighDateTime=0x1d5cfc0, ftLastAccessTime.dwLowDateTime=0xae2ef2c0, ftLastAccessTime.dwHighDateTime=0x1d5cd39, ftLastWriteTime.dwLowDateTime=0xae2ef2c0, ftLastWriteTime.dwHighDateTime=0x1d5cd39, nFileSizeHigh=0x0, nFileSizeLow=0x8f4d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="n8UpnAipkCi.png", cAlternateFileName="N8UPNA~1.PNG")) returned 1 [0077.126] lstrcmpiW (lpString1="n8UpnAipkCi.png", lpString2=".") returned 1 [0077.126] lstrcmpiW (lpString1="n8UpnAipkCi.png", lpString2="..") returned 1 [0077.126] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="n8UpnAipkCi.png" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\n8UpnAipkCi.png") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\n8UpnAipkCi.png" [0077.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="n8UpnAipkCi.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0077.126] GetProcessHeap () returned 0x630000 [0077.126] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x64c9f0 [0077.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="n8UpnAipkCi.png", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="n8UpnAipkCi.png", lpUsedDefaultChar=0x0) returned 16 [0077.126] lstrlenA (lpString="n8UpnAipkCi.png") returned 15 [0077.126] lstrlenA (lpString=".happythreechoose") returned 17 [0077.126] lstrcmpiW (lpString1="n8UpnAipkCi.png", lpString2="Decryption INFO.html") returned 1 [0077.127] lstrcmpiW (lpString1="n8UpnAipkCi.png", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0077.127] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0077.127] lstrcmpiW (lpString1="n8UpnAipkCi.png", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0077.127] GetProcessHeap () returned 0x630000 [0077.127] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0077.127] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\n8UpnAipkCi.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\n8upnaipkci.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0077.127] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=36685) returned 1 [0077.127] GetProcessHeap () returned 0x630000 [0077.127] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655850 [0077.127] GetProcessHeap () returned 0x630000 [0077.127] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672f60 [0077.127] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\n8UpnAipkCi.png") returned 47 [0077.127] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0077.127] GetProcessHeap () returned 0x630000 [0077.127] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0077.127] GetProcessHeap () returned 0x630000 [0077.127] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x383) returned 0x673fa8 [0077.127] lstrlenA (lpString="rsa_encrypt") returned 11 [0077.127] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x673538) returned 1 [0077.128] CryptGenRandom (in: hProv=0x673538, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0077.128] CryptReleaseContext (hProv=0x673538, dwFlags=0x0) returned 1 [0077.128] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0077.128] GetProcessHeap () returned 0x630000 [0077.128] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672fe8 [0077.128] lstrlenA (lpString="010001") returned 6 [0077.128] GetProcessHeap () returned 0x630000 [0077.128] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a298 [0077.128] GetProcessHeap () returned 0x630000 [0077.128] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672b20 [0077.128] GetProcessHeap () returned 0x630000 [0077.128] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e580 [0077.128] GetProcessHeap () returned 0x630000 [0077.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672b20 | out: hHeap=0x630000) returned 1 [0077.128] GetProcessHeap () returned 0x630000 [0077.128] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e850 [0077.128] GetProcessHeap () returned 0x630000 [0077.128] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657328 [0077.128] GetProcessHeap () returned 0x630000 [0077.128] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a398 [0077.128] GetProcessHeap () returned 0x630000 [0077.128] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0077.128] GetProcessHeap () returned 0x630000 [0077.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.128] GetProcessHeap () returned 0x630000 [0077.128] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0077.128] GetProcessHeap () returned 0x630000 [0077.128] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672b20 [0077.128] GetProcessHeap () returned 0x630000 [0077.128] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x6570f8 [0077.128] GetProcessHeap () returned 0x630000 [0077.129] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.129] GetProcessHeap () returned 0x630000 [0077.129] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0077.129] GetProcessHeap () returned 0x630000 [0077.129] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea00 [0077.129] GetProcessHeap () returned 0x630000 [0077.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672b20 | out: hHeap=0x630000) returned 1 [0077.129] GetProcessHeap () returned 0x630000 [0077.129] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0077.129] GetProcessHeap () returned 0x630000 [0077.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0077.129] GetProcessHeap () returned 0x630000 [0077.129] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.129] GetProcessHeap () returned 0x630000 [0077.129] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cf58 [0077.129] GetProcessHeap () returned 0x630000 [0077.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.129] GetProcessHeap () returned 0x630000 [0077.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.129] GetProcessHeap () returned 0x630000 [0077.129] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.129] GetProcessHeap () returned 0x630000 [0077.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.129] GetProcessHeap () returned 0x630000 [0077.129] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65dec0 [0077.129] GetProcessHeap () returned 0x630000 [0077.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cf58 | out: hHeap=0x630000) returned 1 [0077.129] GetProcessHeap () returned 0x630000 [0077.129] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0077.129] GetProcessHeap () returned 0x630000 [0077.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0077.129] GetProcessHeap () returned 0x630000 [0077.129] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.129] GetProcessHeap () returned 0x630000 [0077.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.129] GetProcessHeap () returned 0x630000 [0077.129] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.129] GetProcessHeap () returned 0x630000 [0077.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.129] GetProcessHeap () returned 0x630000 [0077.129] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.129] GetProcessHeap () returned 0x630000 [0077.130] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.130] GetProcessHeap () returned 0x630000 [0077.130] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.130] GetProcessHeap () returned 0x630000 [0077.130] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.130] GetProcessHeap () returned 0x630000 [0077.130] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0077.130] GetProcessHeap () returned 0x630000 [0077.130] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0077.130] GetProcessHeap () returned 0x630000 [0077.130] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.130] GetProcessHeap () returned 0x630000 [0077.130] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.130] GetProcessHeap () returned 0x630000 [0077.130] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0077.130] GetProcessHeap () returned 0x630000 [0077.130] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0077.130] GetProcessHeap () returned 0x630000 [0077.130] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.130] GetProcessHeap () returned 0x630000 [0077.130] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.130] GetProcessHeap () returned 0x630000 [0077.130] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.130] GetProcessHeap () returned 0x630000 [0077.130] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.130] GetProcessHeap () returned 0x630000 [0077.130] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.130] GetProcessHeap () returned 0x630000 [0077.130] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.130] GetProcessHeap () returned 0x630000 [0077.130] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0077.130] GetProcessHeap () returned 0x630000 [0077.130] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0077.130] GetProcessHeap () returned 0x630000 [0077.130] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.130] GetProcessHeap () returned 0x630000 [0077.130] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.130] GetProcessHeap () returned 0x630000 [0077.130] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.131] GetProcessHeap () returned 0x630000 [0077.131] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.131] GetProcessHeap () returned 0x630000 [0077.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.131] GetProcessHeap () returned 0x630000 [0077.131] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.131] GetProcessHeap () returned 0x630000 [0077.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.131] GetProcessHeap () returned 0x630000 [0077.131] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.131] GetProcessHeap () returned 0x630000 [0077.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.131] GetProcessHeap () returned 0x630000 [0077.131] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.131] GetProcessHeap () returned 0x630000 [0077.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0077.131] GetProcessHeap () returned 0x630000 [0077.131] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0077.131] GetProcessHeap () returned 0x630000 [0077.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.131] GetProcessHeap () returned 0x630000 [0077.131] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.131] GetProcessHeap () returned 0x630000 [0077.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.131] GetProcessHeap () returned 0x630000 [0077.131] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.131] GetProcessHeap () returned 0x630000 [0077.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.131] GetProcessHeap () returned 0x630000 [0077.131] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.131] GetProcessHeap () returned 0x630000 [0077.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.131] GetProcessHeap () returned 0x630000 [0077.131] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.131] GetProcessHeap () returned 0x630000 [0077.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0077.131] GetProcessHeap () returned 0x630000 [0077.131] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0077.131] GetProcessHeap () returned 0x630000 [0077.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.132] GetProcessHeap () returned 0x630000 [0077.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.132] GetProcessHeap () returned 0x630000 [0077.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.132] GetProcessHeap () returned 0x630000 [0077.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.132] GetProcessHeap () returned 0x630000 [0077.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.132] GetProcessHeap () returned 0x630000 [0077.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.132] GetProcessHeap () returned 0x630000 [0077.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.132] GetProcessHeap () returned 0x630000 [0077.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.132] GetProcessHeap () returned 0x630000 [0077.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.132] GetProcessHeap () returned 0x630000 [0077.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.132] GetProcessHeap () returned 0x630000 [0077.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.132] GetProcessHeap () returned 0x630000 [0077.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.132] GetProcessHeap () returned 0x630000 [0077.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.132] GetProcessHeap () returned 0x630000 [0077.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.132] GetProcessHeap () returned 0x630000 [0077.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.132] GetProcessHeap () returned 0x630000 [0077.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.132] GetProcessHeap () returned 0x630000 [0077.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.132] GetProcessHeap () returned 0x630000 [0077.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.132] GetProcessHeap () returned 0x630000 [0077.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.132] GetProcessHeap () returned 0x630000 [0077.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.132] GetProcessHeap () returned 0x630000 [0077.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.133] GetProcessHeap () returned 0x630000 [0077.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.133] GetProcessHeap () returned 0x630000 [0077.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.133] GetProcessHeap () returned 0x630000 [0077.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.133] GetProcessHeap () returned 0x630000 [0077.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.133] GetProcessHeap () returned 0x630000 [0077.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.133] GetProcessHeap () returned 0x630000 [0077.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0077.133] GetProcessHeap () returned 0x630000 [0077.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0077.133] GetProcessHeap () returned 0x630000 [0077.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.133] GetProcessHeap () returned 0x630000 [0077.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.133] GetProcessHeap () returned 0x630000 [0077.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.133] GetProcessHeap () returned 0x630000 [0077.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.133] GetProcessHeap () returned 0x630000 [0077.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.133] GetProcessHeap () returned 0x630000 [0077.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.133] GetProcessHeap () returned 0x630000 [0077.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.133] GetProcessHeap () returned 0x630000 [0077.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.133] GetProcessHeap () returned 0x630000 [0077.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.133] GetProcessHeap () returned 0x630000 [0077.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.133] GetProcessHeap () returned 0x630000 [0077.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0077.133] GetProcessHeap () returned 0x630000 [0077.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0077.133] GetProcessHeap () returned 0x630000 [0077.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0077.134] GetProcessHeap () returned 0x630000 [0077.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0077.134] GetProcessHeap () returned 0x630000 [0077.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0077.134] GetProcessHeap () returned 0x630000 [0077.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0077.134] GetProcessHeap () returned 0x630000 [0077.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0077.134] GetProcessHeap () returned 0x630000 [0077.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0077.134] GetProcessHeap () returned 0x630000 [0077.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0077.134] GetProcessHeap () returned 0x630000 [0077.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.134] GetProcessHeap () returned 0x630000 [0077.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672fe8 | out: hHeap=0x630000) returned 1 [0077.134] WriteFile (in: hFile=0x230, lpBuffer=0x673fa8*, nNumberOfBytesToWrite=0x383, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673fa8*, lpNumberOfBytesWritten=0x243d864*=0x383, lpOverlapped=0x0) returned 1 [0077.143] GetProcessHeap () returned 0x630000 [0077.143] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x673fa8, Size=0x30) returned 0x673fa8 [0077.143] GetProcessHeap () returned 0x630000 [0077.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0077.143] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0077.143] GetProcessHeap () returned 0x630000 [0077.143] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8f50) returned 0x673fe0 [0077.143] ReadFile (in: hFile=0x230, lpBuffer=0x673fe0, nNumberOfBytesToRead=0x8f50, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x673fe0*, lpNumberOfBytesRead=0x243d7e8*=0x8f50, lpOverlapped=0x0) returned 1 [0077.143] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0077.143] WriteFile (in: hFile=0x230, lpBuffer=0x673fe0*, nNumberOfBytesToWrite=0x8f50, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x673fe0*, lpNumberOfBytesWritten=0x243d7e4*=0x8f50, lpOverlapped=0x0) returned 1 [0077.144] GetProcessHeap () returned 0x630000 [0077.144] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673fe0 | out: hHeap=0x630000) returned 1 [0077.145] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0077.145] WriteFile (in: hFile=0x230, lpBuffer=0x673fa8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673fa8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0077.150] CloseHandle (hObject=0x230) returned 1 [0077.151] GetProcessHeap () returned 0x630000 [0077.151] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0077.151] GetProcessHeap () returned 0x630000 [0077.151] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655850 | out: hHeap=0x630000) returned 1 [0077.151] GetProcessHeap () returned 0x630000 [0077.151] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672f60 | out: hHeap=0x630000) returned 1 [0077.151] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\n8UpnAipkCi.png" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\n8UpnAipkCi.png") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\n8UpnAipkCi.png" [0077.151] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\n8UpnAipkCi.png", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\n8UpnAipkCi.png.happythreechoose") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\n8UpnAipkCi.png.happythreechoose" [0077.151] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\n8UpnAipkCi.png" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\n8upnaipkci.png"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\n8UpnAipkCi.png.happythreechoose" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\n8upnaipkci.png.happythreechoose"), dwFlags=0x1) returned 1 [0077.152] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\n8UpnAipkCi.png" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0077.152] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="" [0077.152] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" [0077.152] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\decryption info.html")) returned 0x20 [0077.152] GetProcessHeap () returned 0x630000 [0077.152] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0077.152] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2752ee30, ftCreationTime.dwHighDateTime=0x1d5d51a, ftLastAccessTime.dwLowDateTime=0x363cd2b0, ftLastAccessTime.dwHighDateTime=0x1d5d422, ftLastWriteTime.dwLowDateTime=0x363cd2b0, ftLastWriteTime.dwHighDateTime=0x1d5d422, nFileSizeHigh=0x0, nFileSizeLow=0x4c82, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NRi0jdyX6cadVvi.jpg", cAlternateFileName="NRI0JD~1.JPG")) returned 1 [0077.152] lstrcmpiW (lpString1="NRi0jdyX6cadVvi.jpg", lpString2=".") returned 1 [0077.152] lstrcmpiW (lpString1="NRi0jdyX6cadVvi.jpg", lpString2="..") returned 1 [0077.152] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="NRi0jdyX6cadVvi.jpg" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\NRi0jdyX6cadVvi.jpg") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\NRi0jdyX6cadVvi.jpg" [0077.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NRi0jdyX6cadVvi.jpg", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0077.152] GetProcessHeap () returned 0x630000 [0077.152] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x645ff8 [0077.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NRi0jdyX6cadVvi.jpg", cchWideChar=-1, lpMultiByteStr=0x645ff8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NRi0jdyX6cadVvi.jpg", lpUsedDefaultChar=0x0) returned 20 [0077.152] lstrlenA (lpString="NRi0jdyX6cadVvi.jpg") returned 19 [0077.153] lstrlenA (lpString=".happythreechoose") returned 17 [0077.153] lstrlenA (lpString=".happythreechoose") returned 17 [0077.153] lstrlenA (lpString="NRi0jdyX6cadVvi.jpg") returned 19 [0077.153] lstrcmpiA (lpString1="i0jdyX6cadVvi.jpg", lpString2=".happythreechoose") returned 1 [0077.153] lstrcmpiW (lpString1="NRi0jdyX6cadVvi.jpg", lpString2="Decryption INFO.html") returned 1 [0077.153] lstrcmpiW (lpString1="NRi0jdyX6cadVvi.jpg", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0077.153] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0077.153] lstrcmpiW (lpString1="NRi0jdyX6cadVvi.jpg", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0077.153] GetProcessHeap () returned 0x630000 [0077.153] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0077.153] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\NRi0jdyX6cadVvi.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\nri0jdyx6cadvvi.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0077.153] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=19586) returned 1 [0077.154] GetProcessHeap () returned 0x630000 [0077.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655760 [0077.154] GetProcessHeap () returned 0x630000 [0077.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6735c0 [0077.154] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\NRi0jdyX6cadVvi.jpg") returned 51 [0077.154] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0077.154] GetProcessHeap () returned 0x630000 [0077.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0077.154] GetProcessHeap () returned 0x630000 [0077.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38e) returned 0x673fe0 [0077.243] lstrlenA (lpString="rsa_encrypt") returned 11 [0077.244] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x673290) returned 1 [0077.244] CryptGenRandom (in: hProv=0x673290, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0077.244] CryptReleaseContext (hProv=0x673290, dwFlags=0x0) returned 1 [0077.244] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0077.244] GetProcessHeap () returned 0x630000 [0077.244] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6734b0 [0077.244] lstrlenA (lpString="010001") returned 6 [0077.244] GetProcessHeap () returned 0x630000 [0077.244] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a398 [0077.244] GetProcessHeap () returned 0x630000 [0077.244] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673180 [0077.244] GetProcessHeap () returned 0x630000 [0077.244] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e850 [0077.244] GetProcessHeap () returned 0x630000 [0077.244] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673180 | out: hHeap=0x630000) returned 1 [0077.244] GetProcessHeap () returned 0x630000 [0077.245] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65df50 [0077.245] GetProcessHeap () returned 0x630000 [0077.245] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x6570f8 [0077.245] GetProcessHeap () returned 0x630000 [0077.245] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0077.245] GetProcessHeap () returned 0x630000 [0077.245] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0077.245] GetProcessHeap () returned 0x630000 [0077.245] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.245] GetProcessHeap () returned 0x630000 [0077.245] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0077.245] GetProcessHeap () returned 0x630000 [0077.245] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673318 [0077.245] GetProcessHeap () returned 0x630000 [0077.245] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656c98 [0077.245] GetProcessHeap () returned 0x630000 [0077.245] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.245] GetProcessHeap () returned 0x630000 [0077.245] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0077.245] GetProcessHeap () returned 0x630000 [0077.245] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dfe0 [0077.245] GetProcessHeap () returned 0x630000 [0077.245] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673318 | out: hHeap=0x630000) returned 1 [0077.245] GetProcessHeap () returned 0x630000 [0077.245] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0077.245] GetProcessHeap () returned 0x630000 [0077.245] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0077.245] GetProcessHeap () returned 0x630000 [0077.245] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.245] GetProcessHeap () returned 0x630000 [0077.245] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0077.245] GetProcessHeap () returned 0x630000 [0077.245] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.245] GetProcessHeap () returned 0x630000 [0077.245] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.245] GetProcessHeap () returned 0x630000 [0077.245] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.245] GetProcessHeap () returned 0x630000 [0077.245] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.245] GetProcessHeap () returned 0x630000 [0077.245] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e8e0 [0077.245] GetProcessHeap () returned 0x630000 [0077.246] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0077.246] GetProcessHeap () returned 0x630000 [0077.246] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0077.246] GetProcessHeap () returned 0x630000 [0077.246] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0077.246] GetProcessHeap () returned 0x630000 [0077.246] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.246] GetProcessHeap () returned 0x630000 [0077.246] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.246] GetProcessHeap () returned 0x630000 [0077.246] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.246] GetProcessHeap () returned 0x630000 [0077.246] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.246] GetProcessHeap () returned 0x630000 [0077.246] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.246] GetProcessHeap () returned 0x630000 [0077.246] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.246] GetProcessHeap () returned 0x630000 [0077.246] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0077.246] GetProcessHeap () returned 0x630000 [0077.246] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0077.246] GetProcessHeap () returned 0x630000 [0077.246] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.246] GetProcessHeap () returned 0x630000 [0077.246] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.246] GetProcessHeap () returned 0x630000 [0077.246] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.246] GetProcessHeap () returned 0x630000 [0077.246] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.246] GetProcessHeap () returned 0x630000 [0077.246] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.246] GetProcessHeap () returned 0x630000 [0077.246] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.246] GetProcessHeap () returned 0x630000 [0077.246] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.246] GetProcessHeap () returned 0x630000 [0077.246] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.246] GetProcessHeap () returned 0x630000 [0077.247] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.247] GetProcessHeap () returned 0x630000 [0077.247] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.247] GetProcessHeap () returned 0x630000 [0077.247] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.247] GetProcessHeap () returned 0x630000 [0077.247] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.247] GetProcessHeap () returned 0x630000 [0077.247] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0077.247] GetProcessHeap () returned 0x630000 [0077.247] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0077.247] GetProcessHeap () returned 0x630000 [0077.247] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.247] GetProcessHeap () returned 0x630000 [0077.247] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.247] GetProcessHeap () returned 0x630000 [0077.247] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.247] GetProcessHeap () returned 0x630000 [0077.247] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.247] GetProcessHeap () returned 0x630000 [0077.247] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.247] GetProcessHeap () returned 0x630000 [0077.247] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.247] GetProcessHeap () returned 0x630000 [0077.247] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0077.247] GetProcessHeap () returned 0x630000 [0077.247] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0077.247] GetProcessHeap () returned 0x630000 [0077.247] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.247] GetProcessHeap () returned 0x630000 [0077.247] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.247] GetProcessHeap () returned 0x630000 [0077.247] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.247] GetProcessHeap () returned 0x630000 [0077.247] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.247] GetProcessHeap () returned 0x630000 [0077.247] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0077.247] GetProcessHeap () returned 0x630000 [0077.248] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0077.248] GetProcessHeap () returned 0x630000 [0077.248] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0077.248] GetProcessHeap () returned 0x630000 [0077.248] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0077.248] GetProcessHeap () returned 0x630000 [0077.248] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.248] GetProcessHeap () returned 0x630000 [0077.248] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.248] GetProcessHeap () returned 0x630000 [0077.248] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.248] GetProcessHeap () returned 0x630000 [0077.248] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.248] GetProcessHeap () returned 0x630000 [0077.248] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.248] GetProcessHeap () returned 0x630000 [0077.248] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.248] GetProcessHeap () returned 0x630000 [0077.248] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.248] GetProcessHeap () returned 0x630000 [0077.248] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.248] GetProcessHeap () returned 0x630000 [0077.248] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.248] GetProcessHeap () returned 0x630000 [0077.248] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.248] GetProcessHeap () returned 0x630000 [0077.248] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.248] GetProcessHeap () returned 0x630000 [0077.248] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.248] GetProcessHeap () returned 0x630000 [0077.248] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.248] GetProcessHeap () returned 0x630000 [0077.248] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.248] GetProcessHeap () returned 0x630000 [0077.248] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.248] GetProcessHeap () returned 0x630000 [0077.248] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.248] GetProcessHeap () returned 0x630000 [0077.249] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0077.249] GetProcessHeap () returned 0x630000 [0077.249] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0077.249] GetProcessHeap () returned 0x630000 [0077.249] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.249] GetProcessHeap () returned 0x630000 [0077.249] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.249] GetProcessHeap () returned 0x630000 [0077.249] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.249] GetProcessHeap () returned 0x630000 [0077.249] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.249] GetProcessHeap () returned 0x630000 [0077.249] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.249] GetProcessHeap () returned 0x630000 [0077.249] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.249] GetProcessHeap () returned 0x630000 [0077.249] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.249] GetProcessHeap () returned 0x630000 [0077.250] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.250] GetProcessHeap () returned 0x630000 [0077.250] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.250] GetProcessHeap () returned 0x630000 [0077.250] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.250] GetProcessHeap () returned 0x630000 [0077.250] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.250] GetProcessHeap () returned 0x630000 [0077.250] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.250] GetProcessHeap () returned 0x630000 [0077.250] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0077.250] GetProcessHeap () returned 0x630000 [0077.250] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0077.250] GetProcessHeap () returned 0x630000 [0077.250] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.250] GetProcessHeap () returned 0x630000 [0077.250] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.250] GetProcessHeap () returned 0x630000 [0077.250] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.250] GetProcessHeap () returned 0x630000 [0077.250] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.250] GetProcessHeap () returned 0x630000 [0077.250] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.250] GetProcessHeap () returned 0x630000 [0077.250] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.250] GetProcessHeap () returned 0x630000 [0077.250] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.250] GetProcessHeap () returned 0x630000 [0077.250] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.250] GetProcessHeap () returned 0x630000 [0077.250] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.250] GetProcessHeap () returned 0x630000 [0077.250] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.251] GetProcessHeap () returned 0x630000 [0077.251] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.251] GetProcessHeap () returned 0x630000 [0077.251] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.251] GetProcessHeap () returned 0x630000 [0077.251] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0077.251] GetProcessHeap () returned 0x630000 [0077.251] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0077.251] GetProcessHeap () returned 0x630000 [0077.251] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0077.251] GetProcessHeap () returned 0x630000 [0077.251] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0077.251] GetProcessHeap () returned 0x630000 [0077.251] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0077.251] GetProcessHeap () returned 0x630000 [0077.251] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0077.251] GetProcessHeap () returned 0x630000 [0077.251] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0077.251] GetProcessHeap () returned 0x630000 [0077.251] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0077.251] GetProcessHeap () returned 0x630000 [0077.251] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0077.251] GetProcessHeap () returned 0x630000 [0077.251] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.251] GetProcessHeap () returned 0x630000 [0077.251] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6734b0 | out: hHeap=0x630000) returned 1 [0077.251] WriteFile (in: hFile=0x230, lpBuffer=0x673fe0*, nNumberOfBytesToWrite=0x38e, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673fe0*, lpNumberOfBytesWritten=0x243d864*=0x38e, lpOverlapped=0x0) returned 1 [0077.254] GetProcessHeap () returned 0x630000 [0077.254] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x673fe0, Size=0x30) returned 0x673fe0 [0077.254] GetProcessHeap () returned 0x630000 [0077.254] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0077.254] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0077.254] GetProcessHeap () returned 0x630000 [0077.254] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4c90) returned 0x674018 [0077.254] ReadFile (in: hFile=0x230, lpBuffer=0x674018, nNumberOfBytesToRead=0x4c90, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x674018*, lpNumberOfBytesRead=0x243d7e8*=0x4c90, lpOverlapped=0x0) returned 1 [0077.254] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0077.255] WriteFile (in: hFile=0x230, lpBuffer=0x674018*, nNumberOfBytesToWrite=0x4c90, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x674018*, lpNumberOfBytesWritten=0x243d7e4*=0x4c90, lpOverlapped=0x0) returned 1 [0077.255] GetProcessHeap () returned 0x630000 [0077.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x674018 | out: hHeap=0x630000) returned 1 [0077.255] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0077.256] WriteFile (in: hFile=0x230, lpBuffer=0x673fe0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x673fe0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0077.257] CloseHandle (hObject=0x230) returned 1 [0077.257] GetProcessHeap () returned 0x630000 [0077.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0077.257] GetProcessHeap () returned 0x630000 [0077.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655760 | out: hHeap=0x630000) returned 1 [0077.257] GetProcessHeap () returned 0x630000 [0077.257] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6735c0 | out: hHeap=0x630000) returned 1 [0077.257] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\NRi0jdyX6cadVvi.jpg" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\NRi0jdyX6cadVvi.jpg") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\NRi0jdyX6cadVvi.jpg" [0077.257] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\NRi0jdyX6cadVvi.jpg", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\NRi0jdyX6cadVvi.jpg.happythreechoose") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\NRi0jdyX6cadVvi.jpg.happythreechoose" [0077.257] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\NRi0jdyX6cadVvi.jpg" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\nri0jdyx6cadvvi.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\NRi0jdyX6cadVvi.jpg.happythreechoose" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\nri0jdyx6cadvvi.jpg.happythreechoose"), dwFlags=0x1) returned 1 [0077.258] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\NRi0jdyX6cadVvi.jpg" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0077.258] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="" [0077.258] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" [0077.258] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\decryption info.html")) returned 0x20 [0077.258] GetProcessHeap () returned 0x630000 [0077.258] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645ff8 | out: hHeap=0x630000) returned 1 [0077.258] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ba5afc0, ftCreationTime.dwHighDateTime=0x1d5cff9, ftLastAccessTime.dwLowDateTime=0xa7dcdbf0, ftLastAccessTime.dwHighDateTime=0x1d5cc10, ftLastWriteTime.dwLowDateTime=0xa7dcdbf0, ftLastWriteTime.dwHighDateTime=0x1d5cc10, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="O0NtX6Uir_XTxoE.mp3", cAlternateFileName="O0NTX6~1.MP3")) returned 1 [0077.258] lstrcmpiW (lpString1="O0NtX6Uir_XTxoE.mp3", lpString2=".") returned 1 [0077.258] lstrcmpiW (lpString1="O0NtX6Uir_XTxoE.mp3", lpString2="..") returned 1 [0077.258] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="O0NtX6Uir_XTxoE.mp3" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\O0NtX6Uir_XTxoE.mp3") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\O0NtX6Uir_XTxoE.mp3" [0077.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="O0NtX6Uir_XTxoE.mp3", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0077.258] GetProcessHeap () returned 0x630000 [0077.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x645d38 [0077.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="O0NtX6Uir_XTxoE.mp3", cchWideChar=-1, lpMultiByteStr=0x645d38, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="O0NtX6Uir_XTxoE.mp3", lpUsedDefaultChar=0x0) returned 20 [0077.259] lstrlenA (lpString="O0NtX6Uir_XTxoE.mp3") returned 19 [0077.259] lstrlenA (lpString=".happythreechoose") returned 17 [0077.259] lstrlenA (lpString=".happythreechoose") returned 17 [0077.259] lstrlenA (lpString="O0NtX6Uir_XTxoE.mp3") returned 19 [0077.259] lstrcmpiA (lpString1="NtX6Uir_XTxoE.mp3", lpString2=".happythreechoose") returned 1 [0077.259] lstrcmpiW (lpString1="O0NtX6Uir_XTxoE.mp3", lpString2="Decryption INFO.html") returned 1 [0077.259] lstrcmpiW (lpString1="O0NtX6Uir_XTxoE.mp3", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0077.259] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0077.259] lstrcmpiW (lpString1="O0NtX6Uir_XTxoE.mp3", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0077.259] GetProcessHeap () returned 0x630000 [0077.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0077.259] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\O0NtX6Uir_XTxoE.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\o0ntx6uir_xtxoe.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0077.259] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=3683) returned 1 [0077.259] GetProcessHeap () returned 0x630000 [0077.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655490 [0077.259] GetProcessHeap () returned 0x630000 [0077.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6736d0 [0077.259] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\O0NtX6Uir_XTxoE.mp3") returned 51 [0077.259] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0077.259] GetProcessHeap () returned 0x630000 [0077.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0077.259] GetProcessHeap () returned 0x630000 [0077.259] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38d) returned 0x674018 [0077.259] lstrlenA (lpString="rsa_encrypt") returned 11 [0077.259] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x673208) returned 1 [0077.260] CryptGenRandom (in: hProv=0x673208, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0077.260] CryptReleaseContext (hProv=0x673208, dwFlags=0x0) returned 1 [0077.260] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0077.260] GetProcessHeap () returned 0x630000 [0077.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673648 [0077.260] lstrlenA (lpString="010001") returned 6 [0077.260] GetProcessHeap () returned 0x630000 [0077.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0077.260] GetProcessHeap () returned 0x630000 [0077.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672c30 [0077.260] GetProcessHeap () returned 0x630000 [0077.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65eb20 [0077.260] GetProcessHeap () returned 0x630000 [0077.260] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672c30 | out: hHeap=0x630000) returned 1 [0077.260] GetProcessHeap () returned 0x630000 [0077.260] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea00 [0077.260] GetProcessHeap () returned 0x630000 [0077.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656fe0 [0077.261] GetProcessHeap () returned 0x630000 [0077.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0077.261] GetProcessHeap () returned 0x630000 [0077.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0077.261] GetProcessHeap () returned 0x630000 [0077.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.261] GetProcessHeap () returned 0x630000 [0077.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0077.261] GetProcessHeap () returned 0x630000 [0077.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673208 [0077.261] GetProcessHeap () returned 0x630000 [0077.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657670 [0077.261] GetProcessHeap () returned 0x630000 [0077.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.261] GetProcessHeap () returned 0x630000 [0077.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0077.261] GetProcessHeap () returned 0x630000 [0077.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e610 [0077.261] GetProcessHeap () returned 0x630000 [0077.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673208 | out: hHeap=0x630000) returned 1 [0077.261] GetProcessHeap () returned 0x630000 [0077.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0077.261] GetProcessHeap () returned 0x630000 [0077.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0077.261] GetProcessHeap () returned 0x630000 [0077.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.261] GetProcessHeap () returned 0x630000 [0077.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0077.261] GetProcessHeap () returned 0x630000 [0077.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.261] GetProcessHeap () returned 0x630000 [0077.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.261] GetProcessHeap () returned 0x630000 [0077.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.261] GetProcessHeap () returned 0x630000 [0077.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.261] GetProcessHeap () returned 0x630000 [0077.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e850 [0077.261] GetProcessHeap () returned 0x630000 [0077.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0077.262] GetProcessHeap () returned 0x630000 [0077.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0077.262] GetProcessHeap () returned 0x630000 [0077.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0077.262] GetProcessHeap () returned 0x630000 [0077.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.262] GetProcessHeap () returned 0x630000 [0077.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.262] GetProcessHeap () returned 0x630000 [0077.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.262] GetProcessHeap () returned 0x630000 [0077.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.262] GetProcessHeap () returned 0x630000 [0077.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.262] GetProcessHeap () returned 0x630000 [0077.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.262] GetProcessHeap () returned 0x630000 [0077.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.262] GetProcessHeap () returned 0x630000 [0077.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.262] GetProcessHeap () returned 0x630000 [0077.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.262] GetProcessHeap () returned 0x630000 [0077.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.262] GetProcessHeap () returned 0x630000 [0077.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.262] GetProcessHeap () returned 0x630000 [0077.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.262] GetProcessHeap () returned 0x630000 [0077.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.262] GetProcessHeap () returned 0x630000 [0077.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.262] GetProcessHeap () returned 0x630000 [0077.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.262] GetProcessHeap () returned 0x630000 [0077.262] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.262] GetProcessHeap () returned 0x630000 [0077.262] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.263] GetProcessHeap () returned 0x630000 [0077.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.263] GetProcessHeap () returned 0x630000 [0077.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.263] GetProcessHeap () returned 0x630000 [0077.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.263] GetProcessHeap () returned 0x630000 [0077.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0077.263] GetProcessHeap () returned 0x630000 [0077.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0077.263] GetProcessHeap () returned 0x630000 [0077.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.263] GetProcessHeap () returned 0x630000 [0077.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.263] GetProcessHeap () returned 0x630000 [0077.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.263] GetProcessHeap () returned 0x630000 [0077.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.263] GetProcessHeap () returned 0x630000 [0077.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.263] GetProcessHeap () returned 0x630000 [0077.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.263] GetProcessHeap () returned 0x630000 [0077.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.263] GetProcessHeap () returned 0x630000 [0077.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.263] GetProcessHeap () returned 0x630000 [0077.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.263] GetProcessHeap () returned 0x630000 [0077.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.263] GetProcessHeap () returned 0x630000 [0077.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.263] GetProcessHeap () returned 0x630000 [0077.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.263] GetProcessHeap () returned 0x630000 [0077.263] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.263] GetProcessHeap () returned 0x630000 [0077.263] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.264] GetProcessHeap () returned 0x630000 [0077.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.264] GetProcessHeap () returned 0x630000 [0077.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.264] GetProcessHeap () returned 0x630000 [0077.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.264] GetProcessHeap () returned 0x630000 [0077.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.264] GetProcessHeap () returned 0x630000 [0077.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.264] GetProcessHeap () returned 0x630000 [0077.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.264] GetProcessHeap () returned 0x630000 [0077.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.264] GetProcessHeap () returned 0x630000 [0077.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.264] GetProcessHeap () returned 0x630000 [0077.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.264] GetProcessHeap () returned 0x630000 [0077.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.264] GetProcessHeap () returned 0x630000 [0077.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0077.264] GetProcessHeap () returned 0x630000 [0077.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0077.264] GetProcessHeap () returned 0x630000 [0077.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0077.264] GetProcessHeap () returned 0x630000 [0077.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0077.264] GetProcessHeap () returned 0x630000 [0077.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.264] GetProcessHeap () returned 0x630000 [0077.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.264] GetProcessHeap () returned 0x630000 [0077.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.264] GetProcessHeap () returned 0x630000 [0077.264] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.264] GetProcessHeap () returned 0x630000 [0077.264] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.264] GetProcessHeap () returned 0x630000 [0077.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.265] GetProcessHeap () returned 0x630000 [0077.265] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.265] GetProcessHeap () returned 0x630000 [0077.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.265] GetProcessHeap () returned 0x630000 [0077.265] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.265] GetProcessHeap () returned 0x630000 [0077.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.265] GetProcessHeap () returned 0x630000 [0077.265] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.265] GetProcessHeap () returned 0x630000 [0077.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.265] GetProcessHeap () returned 0x630000 [0077.265] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.265] GetProcessHeap () returned 0x630000 [0077.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.265] GetProcessHeap () returned 0x630000 [0077.265] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.265] GetProcessHeap () returned 0x630000 [0077.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.265] GetProcessHeap () returned 0x630000 [0077.265] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.265] GetProcessHeap () returned 0x630000 [0077.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.265] GetProcessHeap () returned 0x630000 [0077.265] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.265] GetProcessHeap () returned 0x630000 [0077.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.265] GetProcessHeap () returned 0x630000 [0077.265] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.265] GetProcessHeap () returned 0x630000 [0077.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.265] GetProcessHeap () returned 0x630000 [0077.265] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.265] GetProcessHeap () returned 0x630000 [0077.265] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.265] GetProcessHeap () returned 0x630000 [0077.266] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.266] GetProcessHeap () returned 0x630000 [0077.266] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.266] GetProcessHeap () returned 0x630000 [0077.266] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.266] GetProcessHeap () returned 0x630000 [0077.266] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.266] GetProcessHeap () returned 0x630000 [0077.266] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.266] GetProcessHeap () returned 0x630000 [0077.266] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.266] GetProcessHeap () returned 0x630000 [0077.266] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.266] GetProcessHeap () returned 0x630000 [0077.266] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.266] GetProcessHeap () returned 0x630000 [0077.266] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0077.266] GetProcessHeap () returned 0x630000 [0077.266] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0077.266] GetProcessHeap () returned 0x630000 [0077.266] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0077.266] GetProcessHeap () returned 0x630000 [0077.266] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0077.266] GetProcessHeap () returned 0x630000 [0077.266] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0077.266] GetProcessHeap () returned 0x630000 [0077.266] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0077.266] GetProcessHeap () returned 0x630000 [0077.266] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0077.266] GetProcessHeap () returned 0x630000 [0077.266] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0077.266] GetProcessHeap () returned 0x630000 [0077.266] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0077.266] GetProcessHeap () returned 0x630000 [0077.266] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.266] GetProcessHeap () returned 0x630000 [0077.266] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673648 | out: hHeap=0x630000) returned 1 [0077.266] WriteFile (in: hFile=0x230, lpBuffer=0x674018*, nNumberOfBytesToWrite=0x38d, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x674018*, lpNumberOfBytesWritten=0x243d864*=0x38d, lpOverlapped=0x0) returned 1 [0077.269] GetProcessHeap () returned 0x630000 [0077.269] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x674018, Size=0x30) returned 0x674018 [0077.269] GetProcessHeap () returned 0x630000 [0077.269] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0077.269] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0077.269] GetProcessHeap () returned 0x630000 [0077.269] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe70) returned 0x674050 [0077.269] ReadFile (in: hFile=0x230, lpBuffer=0x674050, nNumberOfBytesToRead=0xe70, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x674050*, lpNumberOfBytesRead=0x243d7e8*=0xe70, lpOverlapped=0x0) returned 1 [0077.269] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0077.269] WriteFile (in: hFile=0x230, lpBuffer=0x674050*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x674050*, lpNumberOfBytesWritten=0x243d7e4*=0xe70, lpOverlapped=0x0) returned 1 [0077.270] GetProcessHeap () returned 0x630000 [0077.270] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x674050 | out: hHeap=0x630000) returned 1 [0077.270] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0077.270] WriteFile (in: hFile=0x230, lpBuffer=0x674018*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x674018*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0077.271] CloseHandle (hObject=0x230) returned 1 [0077.272] GetProcessHeap () returned 0x630000 [0077.272] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0077.272] GetProcessHeap () returned 0x630000 [0077.272] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655490 | out: hHeap=0x630000) returned 1 [0077.272] GetProcessHeap () returned 0x630000 [0077.272] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6736d0 | out: hHeap=0x630000) returned 1 [0077.272] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\O0NtX6Uir_XTxoE.mp3" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\O0NtX6Uir_XTxoE.mp3") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\O0NtX6Uir_XTxoE.mp3" [0077.272] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\O0NtX6Uir_XTxoE.mp3", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\O0NtX6Uir_XTxoE.mp3.happythreechoose") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\O0NtX6Uir_XTxoE.mp3.happythreechoose" [0077.272] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\O0NtX6Uir_XTxoE.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\o0ntx6uir_xtxoe.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\O0NtX6Uir_XTxoE.mp3.happythreechoose" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\o0ntx6uir_xtxoe.mp3.happythreechoose"), dwFlags=0x1) returned 1 [0077.273] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\O0NtX6Uir_XTxoE.mp3" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0077.273] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="" [0077.273] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" [0077.273] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\decryption info.html")) returned 0x20 [0077.273] GetProcessHeap () returned 0x630000 [0077.273] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645d38 | out: hHeap=0x630000) returned 1 [0077.273] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440772f0, ftCreationTime.dwHighDateTime=0x1d5cac3, ftLastAccessTime.dwLowDateTime=0xb911ea0, ftLastAccessTime.dwHighDateTime=0x1d5d480, ftLastWriteTime.dwLowDateTime=0xb911ea0, ftLastWriteTime.dwHighDateTime=0x1d5d480, nFileSizeHigh=0x0, nFileSizeLow=0x9432, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Obd8mz.bmp", cAlternateFileName="")) returned 1 [0077.273] lstrcmpiW (lpString1="Obd8mz.bmp", lpString2=".") returned 1 [0077.273] lstrcmpiW (lpString1="Obd8mz.bmp", lpString2="..") returned 1 [0077.273] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="Obd8mz.bmp" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Obd8mz.bmp") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Obd8mz.bmp" [0077.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Obd8mz.bmp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0077.273] GetProcessHeap () returned 0x630000 [0077.273] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb) returned 0x64c9f0 [0077.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Obd8mz.bmp", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Obd8mz.bmp", lpUsedDefaultChar=0x0) returned 11 [0077.273] lstrlenA (lpString="Obd8mz.bmp") returned 10 [0077.273] lstrlenA (lpString=".happythreechoose") returned 17 [0077.273] lstrcmpiW (lpString1="Obd8mz.bmp", lpString2="Decryption INFO.html") returned 1 [0077.273] lstrcmpiW (lpString1="Obd8mz.bmp", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0077.273] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0077.273] lstrcmpiW (lpString1="Obd8mz.bmp", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0077.273] GetProcessHeap () returned 0x630000 [0077.273] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0077.273] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Obd8mz.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\obd8mz.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0077.274] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=37938) returned 1 [0077.274] GetProcessHeap () returned 0x630000 [0077.274] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655850 [0077.274] GetProcessHeap () returned 0x630000 [0077.274] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672c30 [0077.274] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Obd8mz.bmp") returned 42 [0077.274] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0077.274] GetProcessHeap () returned 0x630000 [0077.274] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0077.274] GetProcessHeap () returned 0x630000 [0077.274] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38e) returned 0x674050 [0077.274] lstrlenA (lpString="rsa_encrypt") returned 11 [0077.274] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x6730f8) returned 1 [0077.275] CryptGenRandom (in: hProv=0x6730f8, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0077.275] CryptReleaseContext (hProv=0x6730f8, dwFlags=0x0) returned 1 [0077.275] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0077.275] GetProcessHeap () returned 0x630000 [0077.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6736d0 [0077.275] lstrlenA (lpString="010001") returned 6 [0077.275] GetProcessHeap () returned 0x630000 [0077.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3f8 [0077.275] GetProcessHeap () returned 0x630000 [0077.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6733a0 [0077.275] GetProcessHeap () returned 0x630000 [0077.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ebb0 [0077.275] GetProcessHeap () returned 0x630000 [0077.275] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6733a0 | out: hHeap=0x630000) returned 1 [0077.275] GetProcessHeap () returned 0x630000 [0077.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e970 [0077.275] GetProcessHeap () returned 0x630000 [0077.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657328 [0077.275] GetProcessHeap () returned 0x630000 [0077.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2b8 [0077.275] GetProcessHeap () returned 0x630000 [0077.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0077.275] GetProcessHeap () returned 0x630000 [0077.275] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0077.275] GetProcessHeap () returned 0x630000 [0077.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0077.275] GetProcessHeap () returned 0x630000 [0077.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672a98 [0077.275] GetProcessHeap () returned 0x630000 [0077.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657440 [0077.275] GetProcessHeap () returned 0x630000 [0077.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.275] GetProcessHeap () returned 0x630000 [0077.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0077.275] GetProcessHeap () returned 0x630000 [0077.275] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e460 [0077.276] GetProcessHeap () returned 0x630000 [0077.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672a98 | out: hHeap=0x630000) returned 1 [0077.276] GetProcessHeap () returned 0x630000 [0077.276] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0077.276] GetProcessHeap () returned 0x630000 [0077.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e460 | out: hHeap=0x630000) returned 1 [0077.276] GetProcessHeap () returned 0x630000 [0077.276] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.276] GetProcessHeap () returned 0x630000 [0077.276] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cfe8 [0077.276] GetProcessHeap () returned 0x630000 [0077.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.276] GetProcessHeap () returned 0x630000 [0077.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.276] GetProcessHeap () returned 0x630000 [0077.276] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.276] GetProcessHeap () returned 0x630000 [0077.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.276] GetProcessHeap () returned 0x630000 [0077.276] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ec40 [0077.276] GetProcessHeap () returned 0x630000 [0077.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cfe8 | out: hHeap=0x630000) returned 1 [0077.276] GetProcessHeap () returned 0x630000 [0077.276] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0077.276] GetProcessHeap () returned 0x630000 [0077.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ec40 | out: hHeap=0x630000) returned 1 [0077.276] GetProcessHeap () returned 0x630000 [0077.276] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.276] GetProcessHeap () returned 0x630000 [0077.276] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.276] GetProcessHeap () returned 0x630000 [0077.276] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.277] GetProcessHeap () returned 0x630000 [0077.277] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.277] GetProcessHeap () returned 0x630000 [0077.277] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.277] GetProcessHeap () returned 0x630000 [0077.277] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.277] GetProcessHeap () returned 0x630000 [0077.277] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.277] GetProcessHeap () returned 0x630000 [0077.277] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.277] GetProcessHeap () returned 0x630000 [0077.277] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.277] GetProcessHeap () returned 0x630000 [0077.277] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.277] GetProcessHeap () returned 0x630000 [0077.277] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.277] GetProcessHeap () returned 0x630000 [0077.277] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.277] GetProcessHeap () returned 0x630000 [0077.277] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.277] GetProcessHeap () returned 0x630000 [0077.277] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.277] GetProcessHeap () returned 0x630000 [0077.277] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.277] GetProcessHeap () returned 0x630000 [0077.277] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.277] GetProcessHeap () returned 0x630000 [0077.277] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.277] GetProcessHeap () returned 0x630000 [0077.277] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.277] GetProcessHeap () returned 0x630000 [0077.277] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.278] GetProcessHeap () returned 0x630000 [0077.278] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.278] GetProcessHeap () returned 0x630000 [0077.278] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.278] GetProcessHeap () returned 0x630000 [0077.278] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.278] GetProcessHeap () returned 0x630000 [0077.278] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.278] GetProcessHeap () returned 0x630000 [0077.278] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.278] GetProcessHeap () returned 0x630000 [0077.278] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.278] GetProcessHeap () returned 0x630000 [0077.278] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.278] GetProcessHeap () returned 0x630000 [0077.278] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.278] GetProcessHeap () returned 0x630000 [0077.278] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.278] GetProcessHeap () returned 0x630000 [0077.278] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.278] GetProcessHeap () returned 0x630000 [0077.278] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.278] GetProcessHeap () returned 0x630000 [0077.278] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.278] GetProcessHeap () returned 0x630000 [0077.278] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.278] GetProcessHeap () returned 0x630000 [0077.278] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.278] GetProcessHeap () returned 0x630000 [0077.278] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.278] GetProcessHeap () returned 0x630000 [0077.278] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.278] GetProcessHeap () returned 0x630000 [0077.278] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.278] GetProcessHeap () returned 0x630000 [0077.278] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.278] GetProcessHeap () returned 0x630000 [0077.278] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.279] GetProcessHeap () returned 0x630000 [0077.279] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.279] GetProcessHeap () returned 0x630000 [0077.279] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.279] GetProcessHeap () returned 0x630000 [0077.279] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.279] GetProcessHeap () returned 0x630000 [0077.279] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.279] GetProcessHeap () returned 0x630000 [0077.279] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0077.279] GetProcessHeap () returned 0x630000 [0077.279] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0077.279] GetProcessHeap () returned 0x630000 [0077.279] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.279] GetProcessHeap () returned 0x630000 [0077.279] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.279] GetProcessHeap () returned 0x630000 [0077.279] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.279] GetProcessHeap () returned 0x630000 [0077.279] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.279] GetProcessHeap () returned 0x630000 [0077.279] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.279] GetProcessHeap () returned 0x630000 [0077.279] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.279] GetProcessHeap () returned 0x630000 [0077.279] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.279] GetProcessHeap () returned 0x630000 [0077.279] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.279] GetProcessHeap () returned 0x630000 [0077.279] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.279] GetProcessHeap () returned 0x630000 [0077.279] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.279] GetProcessHeap () returned 0x630000 [0077.279] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.279] GetProcessHeap () returned 0x630000 [0077.279] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.279] GetProcessHeap () returned 0x630000 [0077.279] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.279] GetProcessHeap () returned 0x630000 [0077.280] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.280] GetProcessHeap () returned 0x630000 [0077.280] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.280] GetProcessHeap () returned 0x630000 [0077.280] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.280] GetProcessHeap () returned 0x630000 [0077.280] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.280] GetProcessHeap () returned 0x630000 [0077.280] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.280] GetProcessHeap () returned 0x630000 [0077.280] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.280] GetProcessHeap () returned 0x630000 [0077.280] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.280] GetProcessHeap () returned 0x630000 [0077.280] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.280] GetProcessHeap () returned 0x630000 [0077.280] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.280] GetProcessHeap () returned 0x630000 [0077.280] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.280] GetProcessHeap () returned 0x630000 [0077.280] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.280] GetProcessHeap () returned 0x630000 [0077.280] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.280] GetProcessHeap () returned 0x630000 [0077.280] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.280] GetProcessHeap () returned 0x630000 [0077.280] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.281] GetProcessHeap () returned 0x630000 [0077.281] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.281] GetProcessHeap () returned 0x630000 [0077.281] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.281] GetProcessHeap () returned 0x630000 [0077.281] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.281] GetProcessHeap () returned 0x630000 [0077.281] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.281] GetProcessHeap () returned 0x630000 [0077.281] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.281] GetProcessHeap () returned 0x630000 [0077.281] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.281] GetProcessHeap () returned 0x630000 [0077.281] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.281] GetProcessHeap () returned 0x630000 [0077.281] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.281] GetProcessHeap () returned 0x630000 [0077.281] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.281] GetProcessHeap () returned 0x630000 [0077.281] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0077.281] GetProcessHeap () returned 0x630000 [0077.281] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0077.281] GetProcessHeap () returned 0x630000 [0077.281] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0077.281] GetProcessHeap () returned 0x630000 [0077.281] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0077.281] GetProcessHeap () returned 0x630000 [0077.281] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0077.281] GetProcessHeap () returned 0x630000 [0077.281] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0077.281] GetProcessHeap () returned 0x630000 [0077.281] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0077.281] GetProcessHeap () returned 0x630000 [0077.281] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0077.281] GetProcessHeap () returned 0x630000 [0077.281] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0077.281] GetProcessHeap () returned 0x630000 [0077.281] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0077.282] GetProcessHeap () returned 0x630000 [0077.282] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0077.282] GetProcessHeap () returned 0x630000 [0077.282] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.282] GetProcessHeap () returned 0x630000 [0077.282] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6736d0 | out: hHeap=0x630000) returned 1 [0077.282] WriteFile (in: hFile=0x230, lpBuffer=0x674050*, nNumberOfBytesToWrite=0x38e, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x674050*, lpNumberOfBytesWritten=0x243d864*=0x38e, lpOverlapped=0x0) returned 1 [0077.283] GetProcessHeap () returned 0x630000 [0077.283] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x674050, Size=0x30) returned 0x674050 [0077.284] GetProcessHeap () returned 0x630000 [0077.284] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0077.284] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0077.284] GetProcessHeap () returned 0x630000 [0077.284] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9440) returned 0x674088 [0077.284] ReadFile (in: hFile=0x230, lpBuffer=0x674088, nNumberOfBytesToRead=0x9440, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x674088*, lpNumberOfBytesRead=0x243d7e8*=0x9440, lpOverlapped=0x0) returned 1 [0077.285] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0077.285] WriteFile (in: hFile=0x230, lpBuffer=0x674088*, nNumberOfBytesToWrite=0x9440, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x674088*, lpNumberOfBytesWritten=0x243d7e4*=0x9440, lpOverlapped=0x0) returned 1 [0077.286] GetProcessHeap () returned 0x630000 [0077.286] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x674088 | out: hHeap=0x630000) returned 1 [0077.286] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0077.286] WriteFile (in: hFile=0x230, lpBuffer=0x674050*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x674050*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0077.287] CloseHandle (hObject=0x230) returned 1 [0077.287] GetProcessHeap () returned 0x630000 [0077.287] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0077.287] GetProcessHeap () returned 0x630000 [0077.287] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655850 | out: hHeap=0x630000) returned 1 [0077.287] GetProcessHeap () returned 0x630000 [0077.287] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672c30 | out: hHeap=0x630000) returned 1 [0077.287] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Obd8mz.bmp" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Obd8mz.bmp") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Obd8mz.bmp" [0077.287] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Obd8mz.bmp", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Obd8mz.bmp.happythreechoose") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Obd8mz.bmp.happythreechoose" [0077.287] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Obd8mz.bmp" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\obd8mz.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Obd8mz.bmp.happythreechoose" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\obd8mz.bmp.happythreechoose"), dwFlags=0x1) returned 1 [0077.288] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Obd8mz.bmp" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0077.288] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="" [0077.288] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" [0077.288] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\decryption info.html")) returned 0x20 [0077.288] GetProcessHeap () returned 0x630000 [0077.288] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0077.288] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4716b960, ftCreationTime.dwHighDateTime=0x1d5ca00, ftLastAccessTime.dwLowDateTime=0x5bdf1110, ftLastAccessTime.dwHighDateTime=0x1d5cf70, ftLastWriteTime.dwLowDateTime=0x5bdf1110, ftLastWriteTime.dwHighDateTime=0x1d5cf70, nFileSizeHigh=0x0, nFileSizeLow=0x14575, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rBdQWeznM6qhns.wav", cAlternateFileName="RBDQWE~1.WAV")) returned 1 [0077.288] lstrcmpiW (lpString1="rBdQWeznM6qhns.wav", lpString2=".") returned 1 [0077.288] lstrcmpiW (lpString1="rBdQWeznM6qhns.wav", lpString2="..") returned 1 [0077.288] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="rBdQWeznM6qhns.wav" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\rBdQWeznM6qhns.wav") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\rBdQWeznM6qhns.wav" [0077.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rBdQWeznM6qhns.wav", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0077.288] GetProcessHeap () returned 0x630000 [0077.288] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x13) returned 0x645d18 [0077.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rBdQWeznM6qhns.wav", cchWideChar=-1, lpMultiByteStr=0x645d18, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rBdQWeznM6qhns.wav", lpUsedDefaultChar=0x0) returned 19 [0077.288] lstrlenA (lpString="rBdQWeznM6qhns.wav") returned 18 [0077.288] lstrlenA (lpString=".happythreechoose") returned 17 [0077.288] lstrlenA (lpString=".happythreechoose") returned 17 [0077.288] lstrlenA (lpString="rBdQWeznM6qhns.wav") returned 18 [0077.288] lstrcmpiA (lpString1="BdQWeznM6qhns.wav", lpString2=".happythreechoose") returned 1 [0077.288] lstrcmpiW (lpString1="rBdQWeznM6qhns.wav", lpString2="Decryption INFO.html") returned 1 [0077.289] lstrcmpiW (lpString1="rBdQWeznM6qhns.wav", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0077.289] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0077.289] lstrcmpiW (lpString1="rBdQWeznM6qhns.wav", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0077.289] GetProcessHeap () returned 0x630000 [0077.289] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0077.289] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\rBdQWeznM6qhns.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\rbdqweznm6qhns.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0077.289] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=83317) returned 1 [0077.289] GetProcessHeap () returned 0x630000 [0077.289] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655508 [0077.289] GetProcessHeap () returned 0x630000 [0077.289] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673180 [0077.289] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\rBdQWeznM6qhns.wav") returned 50 [0077.289] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0077.289] GetProcessHeap () returned 0x630000 [0077.289] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0077.289] GetProcessHeap () returned 0x630000 [0077.289] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38b) returned 0x674088 [0077.289] lstrlenA (lpString="rsa_encrypt") returned 11 [0077.289] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x672ba8) returned 1 [0077.290] CryptGenRandom (in: hProv=0x672ba8, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0077.290] CryptReleaseContext (hProv=0x672ba8, dwFlags=0x0) returned 1 [0077.290] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0077.290] GetProcessHeap () returned 0x630000 [0077.290] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673208 [0077.290] lstrlenA (lpString="010001") returned 6 [0077.290] GetProcessHeap () returned 0x630000 [0077.290] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a298 [0077.290] GetProcessHeap () returned 0x630000 [0077.290] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673290 [0077.290] GetProcessHeap () returned 0x630000 [0077.290] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e730 [0077.290] GetProcessHeap () returned 0x630000 [0077.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673290 | out: hHeap=0x630000) returned 1 [0077.290] GetProcessHeap () returned 0x630000 [0077.290] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e970 [0077.290] GetProcessHeap () returned 0x630000 [0077.290] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657788 [0077.290] GetProcessHeap () returned 0x630000 [0077.290] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2a8 [0077.290] GetProcessHeap () returned 0x630000 [0077.290] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0077.290] GetProcessHeap () returned 0x630000 [0077.290] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.290] GetProcessHeap () returned 0x630000 [0077.290] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0077.290] GetProcessHeap () returned 0x630000 [0077.290] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672cb8 [0077.290] GetProcessHeap () returned 0x630000 [0077.290] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657328 [0077.291] GetProcessHeap () returned 0x630000 [0077.291] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.291] GetProcessHeap () returned 0x630000 [0077.291] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0077.291] GetProcessHeap () returned 0x630000 [0077.291] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e190 [0077.291] GetProcessHeap () returned 0x630000 [0077.291] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672cb8 | out: hHeap=0x630000) returned 1 [0077.291] GetProcessHeap () returned 0x630000 [0077.291] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0077.291] GetProcessHeap () returned 0x630000 [0077.291] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0077.291] GetProcessHeap () returned 0x630000 [0077.291] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0077.291] GetProcessHeap () returned 0x630000 [0077.291] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0077.291] GetProcessHeap () returned 0x630000 [0077.291] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.291] GetProcessHeap () returned 0x630000 [0077.291] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0077.291] GetProcessHeap () returned 0x630000 [0077.291] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.291] GetProcessHeap () returned 0x630000 [0077.291] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.291] GetProcessHeap () returned 0x630000 [0077.291] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e7c0 [0077.291] GetProcessHeap () returned 0x630000 [0077.291] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0077.291] GetProcessHeap () returned 0x630000 [0077.291] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0077.291] GetProcessHeap () returned 0x630000 [0077.291] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e7c0 | out: hHeap=0x630000) returned 1 [0077.291] GetProcessHeap () returned 0x630000 [0077.291] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.291] GetProcessHeap () returned 0x630000 [0077.291] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.291] GetProcessHeap () returned 0x630000 [0077.291] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.291] GetProcessHeap () returned 0x630000 [0077.291] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.291] GetProcessHeap () returned 0x630000 [0077.292] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.292] GetProcessHeap () returned 0x630000 [0077.292] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.292] GetProcessHeap () returned 0x630000 [0077.292] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.292] GetProcessHeap () returned 0x630000 [0077.292] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.292] GetProcessHeap () returned 0x630000 [0077.292] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.292] GetProcessHeap () returned 0x630000 [0077.292] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.292] GetProcessHeap () returned 0x630000 [0077.292] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.292] GetProcessHeap () returned 0x630000 [0077.292] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.292] GetProcessHeap () returned 0x630000 [0077.292] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.292] GetProcessHeap () returned 0x630000 [0077.292] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.292] GetProcessHeap () returned 0x630000 [0077.292] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.292] GetProcessHeap () returned 0x630000 [0077.292] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.292] GetProcessHeap () returned 0x630000 [0077.292] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.292] GetProcessHeap () returned 0x630000 [0077.292] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.292] GetProcessHeap () returned 0x630000 [0077.292] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.292] GetProcessHeap () returned 0x630000 [0077.292] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.292] GetProcessHeap () returned 0x630000 [0077.292] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.292] GetProcessHeap () returned 0x630000 [0077.292] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.292] GetProcessHeap () returned 0x630000 [0077.292] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.293] GetProcessHeap () returned 0x630000 [0077.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.293] GetProcessHeap () returned 0x630000 [0077.293] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.293] GetProcessHeap () returned 0x630000 [0077.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.293] GetProcessHeap () returned 0x630000 [0077.293] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.293] GetProcessHeap () returned 0x630000 [0077.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.293] GetProcessHeap () returned 0x630000 [0077.293] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.293] GetProcessHeap () returned 0x630000 [0077.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.293] GetProcessHeap () returned 0x630000 [0077.293] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.293] GetProcessHeap () returned 0x630000 [0077.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.293] GetProcessHeap () returned 0x630000 [0077.293] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.293] GetProcessHeap () returned 0x630000 [0077.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.293] GetProcessHeap () returned 0x630000 [0077.293] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.293] GetProcessHeap () returned 0x630000 [0077.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.293] GetProcessHeap () returned 0x630000 [0077.293] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.293] GetProcessHeap () returned 0x630000 [0077.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.293] GetProcessHeap () returned 0x630000 [0077.293] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.293] GetProcessHeap () returned 0x630000 [0077.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.293] GetProcessHeap () returned 0x630000 [0077.293] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.293] GetProcessHeap () returned 0x630000 [0077.293] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.293] GetProcessHeap () returned 0x630000 [0077.294] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.294] GetProcessHeap () returned 0x630000 [0077.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.294] GetProcessHeap () returned 0x630000 [0077.294] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.294] GetProcessHeap () returned 0x630000 [0077.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.294] GetProcessHeap () returned 0x630000 [0077.294] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.294] GetProcessHeap () returned 0x630000 [0077.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.294] GetProcessHeap () returned 0x630000 [0077.294] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.294] GetProcessHeap () returned 0x630000 [0077.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.294] GetProcessHeap () returned 0x630000 [0077.294] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.294] GetProcessHeap () returned 0x630000 [0077.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.294] GetProcessHeap () returned 0x630000 [0077.294] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.294] GetProcessHeap () returned 0x630000 [0077.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.294] GetProcessHeap () returned 0x630000 [0077.294] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.294] GetProcessHeap () returned 0x630000 [0077.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.294] GetProcessHeap () returned 0x630000 [0077.294] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.294] GetProcessHeap () returned 0x630000 [0077.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.294] GetProcessHeap () returned 0x630000 [0077.294] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.294] GetProcessHeap () returned 0x630000 [0077.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.294] GetProcessHeap () returned 0x630000 [0077.294] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.294] GetProcessHeap () returned 0x630000 [0077.294] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.295] GetProcessHeap () returned 0x630000 [0077.295] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.295] GetProcessHeap () returned 0x630000 [0077.295] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.295] GetProcessHeap () returned 0x630000 [0077.295] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.295] GetProcessHeap () returned 0x630000 [0077.295] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.295] GetProcessHeap () returned 0x630000 [0077.295] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.295] GetProcessHeap () returned 0x630000 [0077.295] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.295] GetProcessHeap () returned 0x630000 [0077.295] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0077.295] GetProcessHeap () returned 0x630000 [0077.295] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0077.295] GetProcessHeap () returned 0x630000 [0077.295] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.295] GetProcessHeap () returned 0x630000 [0077.295] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.295] GetProcessHeap () returned 0x630000 [0077.295] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.295] GetProcessHeap () returned 0x630000 [0077.295] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.295] GetProcessHeap () returned 0x630000 [0077.295] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.295] GetProcessHeap () returned 0x630000 [0077.295] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.295] GetProcessHeap () returned 0x630000 [0077.295] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.295] GetProcessHeap () returned 0x630000 [0077.295] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.295] GetProcessHeap () returned 0x630000 [0077.295] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.295] GetProcessHeap () returned 0x630000 [0077.295] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.295] GetProcessHeap () returned 0x630000 [0077.295] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.296] GetProcessHeap () returned 0x630000 [0077.296] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.296] GetProcessHeap () returned 0x630000 [0077.296] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0077.296] GetProcessHeap () returned 0x630000 [0077.296] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0077.296] GetProcessHeap () returned 0x630000 [0077.296] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0077.296] GetProcessHeap () returned 0x630000 [0077.296] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0077.296] GetProcessHeap () returned 0x630000 [0077.296] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0077.296] GetProcessHeap () returned 0x630000 [0077.296] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0077.296] GetProcessHeap () returned 0x630000 [0077.296] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0077.296] GetProcessHeap () returned 0x630000 [0077.296] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0077.296] GetProcessHeap () returned 0x630000 [0077.296] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0077.296] GetProcessHeap () returned 0x630000 [0077.296] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.296] GetProcessHeap () returned 0x630000 [0077.296] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673208 | out: hHeap=0x630000) returned 1 [0077.296] WriteFile (in: hFile=0x230, lpBuffer=0x674088*, nNumberOfBytesToWrite=0x38b, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x674088*, lpNumberOfBytesWritten=0x243d864*=0x38b, lpOverlapped=0x0) returned 1 [0077.298] GetProcessHeap () returned 0x630000 [0077.298] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x674088, Size=0x30) returned 0x674088 [0077.298] GetProcessHeap () returned 0x630000 [0077.298] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0077.298] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0077.298] GetProcessHeap () returned 0x630000 [0077.299] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14580) returned 0x6740c0 [0077.299] ReadFile (in: hFile=0x230, lpBuffer=0x6740c0, nNumberOfBytesToRead=0x14580, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x6740c0*, lpNumberOfBytesRead=0x243d7e8*=0x14580, lpOverlapped=0x0) returned 1 [0077.300] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0077.300] WriteFile (in: hFile=0x230, lpBuffer=0x6740c0*, nNumberOfBytesToWrite=0x14580, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x6740c0*, lpNumberOfBytesWritten=0x243d7e4*=0x14580, lpOverlapped=0x0) returned 1 [0077.302] GetProcessHeap () returned 0x630000 [0077.302] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6740c0 | out: hHeap=0x630000) returned 1 [0077.303] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0077.303] WriteFile (in: hFile=0x230, lpBuffer=0x674088*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x674088*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0077.304] CloseHandle (hObject=0x230) returned 1 [0077.305] GetProcessHeap () returned 0x630000 [0077.305] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0077.305] GetProcessHeap () returned 0x630000 [0077.305] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655508 | out: hHeap=0x630000) returned 1 [0077.305] GetProcessHeap () returned 0x630000 [0077.305] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673180 | out: hHeap=0x630000) returned 1 [0077.305] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\rBdQWeznM6qhns.wav" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\rBdQWeznM6qhns.wav") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\rBdQWeznM6qhns.wav" [0077.305] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\rBdQWeznM6qhns.wav", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\rBdQWeznM6qhns.wav.happythreechoose") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\rBdQWeznM6qhns.wav.happythreechoose" [0077.305] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\rBdQWeznM6qhns.wav" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\rbdqweznm6qhns.wav"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\rBdQWeznM6qhns.wav.happythreechoose" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\rbdqweznm6qhns.wav.happythreechoose"), dwFlags=0x1) returned 1 [0077.305] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\rBdQWeznM6qhns.wav" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0077.305] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="" [0077.305] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" [0077.305] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\decryption info.html")) returned 0x20 [0077.306] GetProcessHeap () returned 0x630000 [0077.306] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645d18 | out: hHeap=0x630000) returned 1 [0077.306] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Skype", cAlternateFileName="")) returned 1 [0077.306] lstrcmpiW (lpString1="Skype", lpString2=".") returned 1 [0077.306] lstrcmpiW (lpString1="Skype", lpString2="..") returned 1 [0077.306] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="Skype" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype" [0077.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Skype", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0077.306] GetProcessHeap () returned 0x630000 [0077.306] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6) returned 0x65a298 [0077.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Skype", cchWideChar=-1, lpMultiByteStr=0x65a298, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Skype", lpUsedDefaultChar=0x0) returned 6 [0077.306] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Skype", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0077.306] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Skype", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0077.306] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Skype", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0077.306] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Skype", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0077.306] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Skype", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0077.306] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Skype", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0077.306] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Skype", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0077.306] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Skype", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0077.306] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Skype", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0077.306] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Skype", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0077.306] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Skype", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0077.306] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Skype", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0077.306] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Skype", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0077.306] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Skype", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0077.306] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Skype", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0077.306] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Skype", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0077.306] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Skype", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0077.306] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Skype", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0077.306] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Skype", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0077.306] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Skype", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0077.306] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Skype", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0077.307] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Skype", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0077.307] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Skype", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0077.307] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Skype", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0077.307] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Skype", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0077.307] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Skype", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0077.307] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Skype", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0077.307] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Skype", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0077.307] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Skype", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0077.307] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Skype", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0077.307] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Skype", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0077.307] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Skype", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0077.307] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Skype", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0077.307] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Skype", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0077.307] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Skype", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0077.307] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Skype", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0077.307] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Skype", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0077.307] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Skype", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0077.307] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Skype", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0077.307] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Skype", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0077.307] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Skype", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0077.307] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Skype", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0077.307] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Skype", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0077.307] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\" [0077.307] GetProcessHeap () returned 0x630000 [0077.307] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a258 [0077.307] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\") returned 38 [0077.307] GetProcessHeap () returned 0x630000 [0077.307] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4e) returned 0x65f1c8 [0077.307] lstrcpyW (in: lpString1=0x65f1c8, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\" [0077.307] GetProcessHeap () returned 0x630000 [0077.307] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.307] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 1 [0077.307] lstrcmpiW (lpString1="Sun", lpString2=".") returned 1 [0077.307] lstrcmpiW (lpString1="Sun", lpString2="..") returned 1 [0077.307] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="Sun" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun" [0077.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Sun", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0077.308] GetProcessHeap () returned 0x630000 [0077.308] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4) returned 0x65a338 [0077.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Sun", cchWideChar=-1, lpMultiByteStr=0x65a338, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sun", lpUsedDefaultChar=0x0) returned 4 [0077.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Sun", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0077.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Sun", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0077.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Sun", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0077.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Sun", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0077.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Sun", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0077.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Sun", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0077.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Sun", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0077.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Sun", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0077.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Sun", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0077.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Sun", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0077.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Sun", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0077.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Sun", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0077.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Sun", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0077.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Sun", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0077.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Sun", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0077.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Sun", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0077.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Sun", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0077.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Sun", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0077.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Sun", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0077.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Sun", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0077.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Sun", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0077.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Sun", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0077.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Sun", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0077.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Sun", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0077.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Sun", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 3 [0077.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Sun", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0077.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Sun", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0077.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Sun", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0077.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Sun", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0077.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Sun", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0077.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Sun", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0077.308] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Sun", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0077.309] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Sun", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0077.309] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Sun", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0077.309] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Sun", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0077.309] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Sun", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0077.309] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Sun", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0077.309] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Sun", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0077.309] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Sun", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0077.309] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Sun", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0077.309] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Sun", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0077.309] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Sun", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0077.309] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Sun", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0077.309] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\" [0077.309] GetProcessHeap () returned 0x630000 [0077.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a298 [0077.309] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\") returned 36 [0077.309] GetProcessHeap () returned 0x630000 [0077.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4a) returned 0x65f380 [0077.309] lstrcpyW (in: lpString1=0x65f380, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\" [0077.309] GetProcessHeap () returned 0x630000 [0077.309] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.309] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78fefdc0, ftCreationTime.dwHighDateTime=0x1d5cd5c, ftLastAccessTime.dwLowDateTime=0x4dba7510, ftLastAccessTime.dwHighDateTime=0x1d5ca99, ftLastWriteTime.dwLowDateTime=0x4dba7510, ftLastWriteTime.dwHighDateTime=0x1d5ca99, nFileSizeHigh=0x0, nFileSizeLow=0x125ea, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TT7l6Pxrz.swf", cAlternateFileName="TT7L6P~1.SWF")) returned 1 [0077.309] lstrcmpiW (lpString1="TT7l6Pxrz.swf", lpString2=".") returned 1 [0077.309] lstrcmpiW (lpString1="TT7l6Pxrz.swf", lpString2="..") returned 1 [0077.309] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="TT7l6Pxrz.swf" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\TT7l6Pxrz.swf") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\TT7l6Pxrz.swf" [0077.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TT7l6Pxrz.swf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0077.309] GetProcessHeap () returned 0x630000 [0077.309] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x64c9f0 [0077.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="TT7l6Pxrz.swf", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TT7l6Pxrz.swf", lpUsedDefaultChar=0x0) returned 14 [0077.309] lstrlenA (lpString="TT7l6Pxrz.swf") returned 13 [0077.309] lstrlenA (lpString=".happythreechoose") returned 17 [0077.309] lstrcmpiW (lpString1="TT7l6Pxrz.swf", lpString2="Decryption INFO.html") returned 1 [0077.309] lstrcmpiW (lpString1="TT7l6Pxrz.swf", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0077.309] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0077.309] lstrcmpiW (lpString1="TT7l6Pxrz.swf", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0077.309] GetProcessHeap () returned 0x630000 [0077.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0077.310] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\TT7l6Pxrz.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\tt7l6pxrz.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0077.310] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=75242) returned 1 [0077.310] GetProcessHeap () returned 0x630000 [0077.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655490 [0077.310] GetProcessHeap () returned 0x630000 [0077.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672f60 [0077.310] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\TT7l6Pxrz.swf") returned 45 [0077.310] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0077.310] GetProcessHeap () returned 0x630000 [0077.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0077.310] GetProcessHeap () returned 0x630000 [0077.310] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x6740c0 [0077.311] lstrlenA (lpString="rsa_encrypt") returned 11 [0077.311] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x672fe8) returned 1 [0077.312] CryptGenRandom (in: hProv=0x672fe8, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0077.312] CryptReleaseContext (hProv=0x672fe8, dwFlags=0x0) returned 1 [0077.312] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0077.312] GetProcessHeap () returned 0x630000 [0077.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673290 [0077.312] lstrlenA (lpString="010001") returned 6 [0077.312] GetProcessHeap () returned 0x630000 [0077.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0077.312] GetProcessHeap () returned 0x630000 [0077.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672b20 [0077.312] GetProcessHeap () returned 0x630000 [0077.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e610 [0077.312] GetProcessHeap () returned 0x630000 [0077.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672b20 | out: hHeap=0x630000) returned 1 [0077.312] GetProcessHeap () returned 0x630000 [0077.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e2b0 [0077.312] GetProcessHeap () returned 0x630000 [0077.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656950 [0077.312] GetProcessHeap () returned 0x630000 [0077.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3f8 [0077.312] GetProcessHeap () returned 0x630000 [0077.312] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0077.312] GetProcessHeap () returned 0x630000 [0077.312] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.312] GetProcessHeap () returned 0x630000 [0077.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0077.313] GetProcessHeap () returned 0x630000 [0077.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672c30 [0077.313] GetProcessHeap () returned 0x630000 [0077.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656c98 [0077.313] GetProcessHeap () returned 0x630000 [0077.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.313] GetProcessHeap () returned 0x630000 [0077.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0077.313] GetProcessHeap () returned 0x630000 [0077.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dec0 [0077.313] GetProcessHeap () returned 0x630000 [0077.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672c30 | out: hHeap=0x630000) returned 1 [0077.313] GetProcessHeap () returned 0x630000 [0077.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0077.313] GetProcessHeap () returned 0x630000 [0077.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0077.313] GetProcessHeap () returned 0x630000 [0077.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.313] GetProcessHeap () returned 0x630000 [0077.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65d0f0 [0077.313] GetProcessHeap () returned 0x630000 [0077.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.313] GetProcessHeap () returned 0x630000 [0077.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.313] GetProcessHeap () returned 0x630000 [0077.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.313] GetProcessHeap () returned 0x630000 [0077.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.313] GetProcessHeap () returned 0x630000 [0077.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65ea00 [0077.313] GetProcessHeap () returned 0x630000 [0077.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65d0f0 | out: hHeap=0x630000) returned 1 [0077.313] GetProcessHeap () returned 0x630000 [0077.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0077.313] GetProcessHeap () returned 0x630000 [0077.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0077.313] GetProcessHeap () returned 0x630000 [0077.313] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.313] GetProcessHeap () returned 0x630000 [0077.313] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.314] GetProcessHeap () returned 0x630000 [0077.314] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.314] GetProcessHeap () returned 0x630000 [0077.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.314] GetProcessHeap () returned 0x630000 [0077.314] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.314] GetProcessHeap () returned 0x630000 [0077.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.314] GetProcessHeap () returned 0x630000 [0077.314] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0077.314] GetProcessHeap () returned 0x630000 [0077.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0077.314] GetProcessHeap () returned 0x630000 [0077.314] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.314] GetProcessHeap () returned 0x630000 [0077.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.314] GetProcessHeap () returned 0x630000 [0077.314] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.314] GetProcessHeap () returned 0x630000 [0077.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.314] GetProcessHeap () returned 0x630000 [0077.314] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.314] GetProcessHeap () returned 0x630000 [0077.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.314] GetProcessHeap () returned 0x630000 [0077.314] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.314] GetProcessHeap () returned 0x630000 [0077.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.314] GetProcessHeap () returned 0x630000 [0077.314] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.314] GetProcessHeap () returned 0x630000 [0077.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.314] GetProcessHeap () returned 0x630000 [0077.314] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0077.314] GetProcessHeap () returned 0x630000 [0077.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0077.314] GetProcessHeap () returned 0x630000 [0077.314] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.314] GetProcessHeap () returned 0x630000 [0077.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.315] GetProcessHeap () returned 0x630000 [0077.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0077.315] GetProcessHeap () returned 0x630000 [0077.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0077.315] GetProcessHeap () returned 0x630000 [0077.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.315] GetProcessHeap () returned 0x630000 [0077.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.315] GetProcessHeap () returned 0x630000 [0077.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.315] GetProcessHeap () returned 0x630000 [0077.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.315] GetProcessHeap () returned 0x630000 [0077.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.315] GetProcessHeap () returned 0x630000 [0077.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.315] GetProcessHeap () returned 0x630000 [0077.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.315] GetProcessHeap () returned 0x630000 [0077.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.315] GetProcessHeap () returned 0x630000 [0077.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.315] GetProcessHeap () returned 0x630000 [0077.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.315] GetProcessHeap () returned 0x630000 [0077.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.315] GetProcessHeap () returned 0x630000 [0077.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.315] GetProcessHeap () returned 0x630000 [0077.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.315] GetProcessHeap () returned 0x630000 [0077.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.315] GetProcessHeap () returned 0x630000 [0077.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.315] GetProcessHeap () returned 0x630000 [0077.315] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.315] GetProcessHeap () returned 0x630000 [0077.315] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.316] GetProcessHeap () returned 0x630000 [0077.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.316] GetProcessHeap () returned 0x630000 [0077.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.316] GetProcessHeap () returned 0x630000 [0077.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.316] GetProcessHeap () returned 0x630000 [0077.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.316] GetProcessHeap () returned 0x630000 [0077.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.316] GetProcessHeap () returned 0x630000 [0077.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.316] GetProcessHeap () returned 0x630000 [0077.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.316] GetProcessHeap () returned 0x630000 [0077.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.316] GetProcessHeap () returned 0x630000 [0077.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.316] GetProcessHeap () returned 0x630000 [0077.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.316] GetProcessHeap () returned 0x630000 [0077.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.316] GetProcessHeap () returned 0x630000 [0077.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.316] GetProcessHeap () returned 0x630000 [0077.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.316] GetProcessHeap () returned 0x630000 [0077.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.316] GetProcessHeap () returned 0x630000 [0077.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.316] GetProcessHeap () returned 0x630000 [0077.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.316] GetProcessHeap () returned 0x630000 [0077.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.316] GetProcessHeap () returned 0x630000 [0077.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.316] GetProcessHeap () returned 0x630000 [0077.316] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.316] GetProcessHeap () returned 0x630000 [0077.316] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.316] GetProcessHeap () returned 0x630000 [0077.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.317] GetProcessHeap () returned 0x630000 [0077.317] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.317] GetProcessHeap () returned 0x630000 [0077.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.317] GetProcessHeap () returned 0x630000 [0077.317] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.317] GetProcessHeap () returned 0x630000 [0077.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.317] GetProcessHeap () returned 0x630000 [0077.317] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.317] GetProcessHeap () returned 0x630000 [0077.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.317] GetProcessHeap () returned 0x630000 [0077.317] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.317] GetProcessHeap () returned 0x630000 [0077.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.317] GetProcessHeap () returned 0x630000 [0077.317] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.317] GetProcessHeap () returned 0x630000 [0077.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.317] GetProcessHeap () returned 0x630000 [0077.317] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0077.317] GetProcessHeap () returned 0x630000 [0077.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0077.317] GetProcessHeap () returned 0x630000 [0077.317] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.317] GetProcessHeap () returned 0x630000 [0077.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.317] GetProcessHeap () returned 0x630000 [0077.317] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.317] GetProcessHeap () returned 0x630000 [0077.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.317] GetProcessHeap () returned 0x630000 [0077.317] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.317] GetProcessHeap () returned 0x630000 [0077.317] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.317] GetProcessHeap () returned 0x630000 [0077.317] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.318] GetProcessHeap () returned 0x630000 [0077.318] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.318] GetProcessHeap () returned 0x630000 [0077.318] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0077.318] GetProcessHeap () returned 0x630000 [0077.318] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0077.318] GetProcessHeap () returned 0x630000 [0077.318] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0077.318] GetProcessHeap () returned 0x630000 [0077.318] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0077.318] GetProcessHeap () returned 0x630000 [0077.318] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0077.318] GetProcessHeap () returned 0x630000 [0077.318] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e2b0 | out: hHeap=0x630000) returned 1 [0077.318] GetProcessHeap () returned 0x630000 [0077.318] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0077.318] GetProcessHeap () returned 0x630000 [0077.318] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0077.318] GetProcessHeap () returned 0x630000 [0077.318] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0077.318] GetProcessHeap () returned 0x630000 [0077.318] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.318] GetProcessHeap () returned 0x630000 [0077.318] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673290 | out: hHeap=0x630000) returned 1 [0077.318] WriteFile (in: hFile=0x230, lpBuffer=0x6740c0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6740c0*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0077.320] GetProcessHeap () returned 0x630000 [0077.320] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6740c0, Size=0x30) returned 0x6740c0 [0077.320] GetProcessHeap () returned 0x630000 [0077.320] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0077.320] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0077.320] GetProcessHeap () returned 0x630000 [0077.320] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x125ea) returned 0x6740f8 [0077.326] ReadFile (in: hFile=0x230, lpBuffer=0x6740f8, nNumberOfBytesToRead=0x125ea, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x6740f8*, lpNumberOfBytesRead=0x243d7e8*=0x125ea, lpOverlapped=0x0) returned 1 [0077.328] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0077.328] WriteFile (in: hFile=0x230, lpBuffer=0x6740f8*, nNumberOfBytesToWrite=0x125ea, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x6740f8*, lpNumberOfBytesWritten=0x243d7e4*=0x125ea, lpOverlapped=0x0) returned 1 [0077.330] GetProcessHeap () returned 0x630000 [0077.330] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6740f8 | out: hHeap=0x630000) returned 1 [0077.330] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0077.330] WriteFile (in: hFile=0x230, lpBuffer=0x6740c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6740c0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0077.331] CloseHandle (hObject=0x230) returned 1 [0077.332] GetProcessHeap () returned 0x630000 [0077.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0077.332] GetProcessHeap () returned 0x630000 [0077.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655490 | out: hHeap=0x630000) returned 1 [0077.332] GetProcessHeap () returned 0x630000 [0077.332] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672f60 | out: hHeap=0x630000) returned 1 [0077.332] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\TT7l6Pxrz.swf" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\TT7l6Pxrz.swf") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\TT7l6Pxrz.swf" [0077.332] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\TT7l6Pxrz.swf", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\TT7l6Pxrz.swf.happythreechoose") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\TT7l6Pxrz.swf.happythreechoose" [0077.332] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\TT7l6Pxrz.swf" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\tt7l6pxrz.swf"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\TT7l6Pxrz.swf.happythreechoose" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\tt7l6pxrz.swf.happythreechoose"), dwFlags=0x1) returned 1 [0077.332] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\TT7l6Pxrz.swf" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0077.332] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="" [0077.332] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" [0077.332] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\decryption info.html")) returned 0x20 [0077.333] GetProcessHeap () returned 0x630000 [0077.333] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0077.333] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf9c2bd0, ftCreationTime.dwHighDateTime=0x1d5d4e3, ftLastAccessTime.dwLowDateTime=0x3ac15850, ftLastAccessTime.dwHighDateTime=0x1d5cf5f, ftLastWriteTime.dwLowDateTime=0x3ac15850, ftLastWriteTime.dwHighDateTime=0x1d5cf5f, nFileSizeHigh=0x0, nFileSizeLow=0x2cbe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VKXNYx1YHbsL.m4a", cAlternateFileName="VKXNYX~1.M4A")) returned 1 [0077.333] lstrcmpiW (lpString1="VKXNYx1YHbsL.m4a", lpString2=".") returned 1 [0077.333] lstrcmpiW (lpString1="VKXNYx1YHbsL.m4a", lpString2="..") returned 1 [0077.333] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="VKXNYx1YHbsL.m4a" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\VKXNYx1YHbsL.m4a") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\VKXNYx1YHbsL.m4a" [0077.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VKXNYx1YHbsL.m4a", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0077.333] GetProcessHeap () returned 0x630000 [0077.333] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11) returned 0x645eb8 [0077.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VKXNYx1YHbsL.m4a", cchWideChar=-1, lpMultiByteStr=0x645eb8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VKXNYx1YHbsL.m4a", lpUsedDefaultChar=0x0) returned 17 [0077.333] lstrlenA (lpString="VKXNYx1YHbsL.m4a") returned 16 [0077.333] lstrlenA (lpString=".happythreechoose") returned 17 [0077.333] lstrcmpiW (lpString1="VKXNYx1YHbsL.m4a", lpString2="Decryption INFO.html") returned 1 [0077.333] lstrcmpiW (lpString1="VKXNYx1YHbsL.m4a", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0077.333] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0077.333] lstrcmpiW (lpString1="VKXNYx1YHbsL.m4a", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0077.333] GetProcessHeap () returned 0x630000 [0077.333] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651fd8 [0077.333] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\VKXNYx1YHbsL.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\vkxnyx1yhbsl.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0077.333] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=11454) returned 1 [0077.333] GetProcessHeap () returned 0x630000 [0077.333] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655580 [0077.333] GetProcessHeap () returned 0x630000 [0077.333] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6734b0 [0077.333] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\VKXNYx1YHbsL.m4a") returned 48 [0077.333] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0077.333] GetProcessHeap () returned 0x630000 [0077.333] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0077.334] GetProcessHeap () returned 0x630000 [0077.334] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x6740f8 [0077.334] lstrlenA (lpString="rsa_encrypt") returned 11 [0077.334] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x673070) returned 1 [0077.334] CryptGenRandom (in: hProv=0x673070, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0077.334] CryptReleaseContext (hProv=0x673070, dwFlags=0x0) returned 1 [0077.334] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0077.334] GetProcessHeap () returned 0x630000 [0077.334] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672900 [0077.334] lstrlenA (lpString="010001") returned 6 [0077.334] GetProcessHeap () returned 0x630000 [0077.334] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3f8 [0077.334] GetProcessHeap () returned 0x630000 [0077.334] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6733a0 [0077.334] GetProcessHeap () returned 0x630000 [0077.334] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0077.335] GetProcessHeap () returned 0x630000 [0077.335] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6733a0 | out: hHeap=0x630000) returned 1 [0077.335] GetProcessHeap () returned 0x630000 [0077.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dec0 [0077.335] GetProcessHeap () returned 0x630000 [0077.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657670 [0077.335] GetProcessHeap () returned 0x630000 [0077.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2a8 [0077.335] GetProcessHeap () returned 0x630000 [0077.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0077.335] GetProcessHeap () returned 0x630000 [0077.335] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.335] GetProcessHeap () returned 0x630000 [0077.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0077.335] GetProcessHeap () returned 0x630000 [0077.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672d40 [0077.335] GetProcessHeap () returned 0x630000 [0077.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656db0 [0077.335] GetProcessHeap () returned 0x630000 [0077.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.335] GetProcessHeap () returned 0x630000 [0077.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0077.335] GetProcessHeap () returned 0x630000 [0077.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0077.335] GetProcessHeap () returned 0x630000 [0077.335] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672d40 | out: hHeap=0x630000) returned 1 [0077.335] GetProcessHeap () returned 0x630000 [0077.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0077.335] GetProcessHeap () returned 0x630000 [0077.335] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0077.335] GetProcessHeap () returned 0x630000 [0077.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.335] GetProcessHeap () returned 0x630000 [0077.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0077.335] GetProcessHeap () returned 0x630000 [0077.335] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.335] GetProcessHeap () returned 0x630000 [0077.335] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.335] GetProcessHeap () returned 0x630000 [0077.335] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.335] GetProcessHeap () returned 0x630000 [0077.335] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.336] GetProcessHeap () returned 0x630000 [0077.336] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e190 [0077.336] GetProcessHeap () returned 0x630000 [0077.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0077.336] GetProcessHeap () returned 0x630000 [0077.336] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0077.336] GetProcessHeap () returned 0x630000 [0077.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0077.336] GetProcessHeap () returned 0x630000 [0077.336] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.336] GetProcessHeap () returned 0x630000 [0077.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.336] GetProcessHeap () returned 0x630000 [0077.336] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.336] GetProcessHeap () returned 0x630000 [0077.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.336] GetProcessHeap () returned 0x630000 [0077.336] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.336] GetProcessHeap () returned 0x630000 [0077.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.336] GetProcessHeap () returned 0x630000 [0077.336] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0077.336] GetProcessHeap () returned 0x630000 [0077.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0077.336] GetProcessHeap () returned 0x630000 [0077.336] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.336] GetProcessHeap () returned 0x630000 [0077.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.336] GetProcessHeap () returned 0x630000 [0077.336] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0077.336] GetProcessHeap () returned 0x630000 [0077.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0077.336] GetProcessHeap () returned 0x630000 [0077.336] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.336] GetProcessHeap () returned 0x630000 [0077.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.336] GetProcessHeap () returned 0x630000 [0077.336] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0077.336] GetProcessHeap () returned 0x630000 [0077.336] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0077.337] GetProcessHeap () returned 0x630000 [0077.337] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0077.337] GetProcessHeap () returned 0x630000 [0077.337] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0077.337] GetProcessHeap () returned 0x630000 [0077.337] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.337] GetProcessHeap () returned 0x630000 [0077.337] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.337] GetProcessHeap () returned 0x630000 [0077.337] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.337] GetProcessHeap () returned 0x630000 [0077.337] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.337] GetProcessHeap () returned 0x630000 [0077.337] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.337] GetProcessHeap () returned 0x630000 [0077.337] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.337] GetProcessHeap () returned 0x630000 [0077.337] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.337] GetProcessHeap () returned 0x630000 [0077.337] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.337] GetProcessHeap () returned 0x630000 [0077.337] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.337] GetProcessHeap () returned 0x630000 [0077.337] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.337] GetProcessHeap () returned 0x630000 [0077.337] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.337] GetProcessHeap () returned 0x630000 [0077.337] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.337] GetProcessHeap () returned 0x630000 [0077.337] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.337] GetProcessHeap () returned 0x630000 [0077.337] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.337] GetProcessHeap () returned 0x630000 [0077.337] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.337] GetProcessHeap () returned 0x630000 [0077.337] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.337] GetProcessHeap () returned 0x630000 [0077.337] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.337] GetProcessHeap () returned 0x630000 [0077.338] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.338] GetProcessHeap () returned 0x630000 [0077.338] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.338] GetProcessHeap () returned 0x630000 [0077.338] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.338] GetProcessHeap () returned 0x630000 [0077.338] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.338] GetProcessHeap () returned 0x630000 [0077.338] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.338] GetProcessHeap () returned 0x630000 [0077.338] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0077.338] GetProcessHeap () returned 0x630000 [0077.338] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0077.338] GetProcessHeap () returned 0x630000 [0077.338] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.338] GetProcessHeap () returned 0x630000 [0077.338] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.338] GetProcessHeap () returned 0x630000 [0077.338] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.338] GetProcessHeap () returned 0x630000 [0077.338] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.338] GetProcessHeap () returned 0x630000 [0077.338] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.338] GetProcessHeap () returned 0x630000 [0077.338] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.338] GetProcessHeap () returned 0x630000 [0077.338] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.338] GetProcessHeap () returned 0x630000 [0077.338] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.338] GetProcessHeap () returned 0x630000 [0077.338] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.338] GetProcessHeap () returned 0x630000 [0077.338] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.338] GetProcessHeap () returned 0x630000 [0077.338] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.338] GetProcessHeap () returned 0x630000 [0077.338] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.338] GetProcessHeap () returned 0x630000 [0077.338] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0077.338] GetProcessHeap () returned 0x630000 [0077.339] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0077.339] GetProcessHeap () returned 0x630000 [0077.339] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0077.339] GetProcessHeap () returned 0x630000 [0077.339] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0077.339] GetProcessHeap () returned 0x630000 [0077.339] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.339] GetProcessHeap () returned 0x630000 [0077.339] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.339] GetProcessHeap () returned 0x630000 [0077.339] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.339] GetProcessHeap () returned 0x630000 [0077.339] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.339] GetProcessHeap () returned 0x630000 [0077.339] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.339] GetProcessHeap () returned 0x630000 [0077.339] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.339] GetProcessHeap () returned 0x630000 [0077.339] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.339] GetProcessHeap () returned 0x630000 [0077.339] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.339] GetProcessHeap () returned 0x630000 [0077.339] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.339] GetProcessHeap () returned 0x630000 [0077.339] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.339] GetProcessHeap () returned 0x630000 [0077.339] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.339] GetProcessHeap () returned 0x630000 [0077.339] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.339] GetProcessHeap () returned 0x630000 [0077.339] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.339] GetProcessHeap () returned 0x630000 [0077.339] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.339] GetProcessHeap () returned 0x630000 [0077.339] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.339] GetProcessHeap () returned 0x630000 [0077.339] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.339] GetProcessHeap () returned 0x630000 [0077.339] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.339] GetProcessHeap () returned 0x630000 [0077.340] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.340] GetProcessHeap () returned 0x630000 [0077.340] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.340] GetProcessHeap () returned 0x630000 [0077.340] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.340] GetProcessHeap () returned 0x630000 [0077.340] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.340] GetProcessHeap () returned 0x630000 [0077.340] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.340] GetProcessHeap () returned 0x630000 [0077.340] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.340] GetProcessHeap () returned 0x630000 [0077.340] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.340] GetProcessHeap () returned 0x630000 [0077.340] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0077.340] GetProcessHeap () returned 0x630000 [0077.340] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0077.340] GetProcessHeap () returned 0x630000 [0077.340] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0077.340] GetProcessHeap () returned 0x630000 [0077.340] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0077.340] GetProcessHeap () returned 0x630000 [0077.340] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0077.340] GetProcessHeap () returned 0x630000 [0077.340] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0077.340] GetProcessHeap () returned 0x630000 [0077.340] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0077.340] GetProcessHeap () returned 0x630000 [0077.340] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0077.340] GetProcessHeap () returned 0x630000 [0077.340] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0077.340] GetProcessHeap () returned 0x630000 [0077.340] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.340] GetProcessHeap () returned 0x630000 [0077.340] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672900 | out: hHeap=0x630000) returned 1 [0077.340] WriteFile (in: hFile=0x230, lpBuffer=0x6740f8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6740f8*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0077.346] GetProcessHeap () returned 0x630000 [0077.346] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6740f8, Size=0x30) returned 0x6740f8 [0077.346] GetProcessHeap () returned 0x630000 [0077.346] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0077.346] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0077.346] GetProcessHeap () returned 0x630000 [0077.346] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2cbe) returned 0x674130 [0077.346] ReadFile (in: hFile=0x230, lpBuffer=0x674130, nNumberOfBytesToRead=0x2cbe, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x674130*, lpNumberOfBytesRead=0x243d7e8*=0x2cbe, lpOverlapped=0x0) returned 1 [0077.347] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0077.347] WriteFile (in: hFile=0x230, lpBuffer=0x674130*, nNumberOfBytesToWrite=0x2cbe, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x674130*, lpNumberOfBytesWritten=0x243d7e4*=0x2cbe, lpOverlapped=0x0) returned 1 [0077.349] GetProcessHeap () returned 0x630000 [0077.349] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x674130 | out: hHeap=0x630000) returned 1 [0077.349] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0077.349] WriteFile (in: hFile=0x230, lpBuffer=0x6740f8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6740f8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0077.350] CloseHandle (hObject=0x230) returned 1 [0077.350] GetProcessHeap () returned 0x630000 [0077.350] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651fd8 | out: hHeap=0x630000) returned 1 [0077.350] GetProcessHeap () returned 0x630000 [0077.350] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655580 | out: hHeap=0x630000) returned 1 [0077.350] GetProcessHeap () returned 0x630000 [0077.350] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6734b0 | out: hHeap=0x630000) returned 1 [0077.350] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\VKXNYx1YHbsL.m4a" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\VKXNYx1YHbsL.m4a") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\VKXNYx1YHbsL.m4a" [0077.351] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\VKXNYx1YHbsL.m4a", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\VKXNYx1YHbsL.m4a.happythreechoose") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\VKXNYx1YHbsL.m4a.happythreechoose" [0077.351] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\VKXNYx1YHbsL.m4a" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\vkxnyx1yhbsl.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\VKXNYx1YHbsL.m4a.happythreechoose" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\vkxnyx1yhbsl.m4a.happythreechoose"), dwFlags=0x1) returned 1 [0077.351] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\VKXNYx1YHbsL.m4a" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0077.351] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="" [0077.351] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" [0077.351] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\decryption info.html")) returned 0x20 [0077.351] GetProcessHeap () returned 0x630000 [0077.351] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645eb8 | out: hHeap=0x630000) returned 1 [0077.351] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x635fbf0, ftCreationTime.dwHighDateTime=0x1d5cb49, ftLastAccessTime.dwLowDateTime=0x40954650, ftLastAccessTime.dwHighDateTime=0x1d5d1b8, ftLastWriteTime.dwLowDateTime=0x40954650, ftLastWriteTime.dwHighDateTime=0x1d5d1b8, nFileSizeHigh=0x0, nFileSizeLow=0x4785, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Vql_srbW0R7Sorr0D.mp3", cAlternateFileName="VQL_SR~1.MP3")) returned 1 [0077.352] lstrcmpiW (lpString1="Vql_srbW0R7Sorr0D.mp3", lpString2=".") returned 1 [0077.352] lstrcmpiW (lpString1="Vql_srbW0R7Sorr0D.mp3", lpString2="..") returned 1 [0077.352] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="Vql_srbW0R7Sorr0D.mp3" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Vql_srbW0R7Sorr0D.mp3") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Vql_srbW0R7Sorr0D.mp3" [0077.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Vql_srbW0R7Sorr0D.mp3", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0077.352] GetProcessHeap () returned 0x630000 [0077.352] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x645e58 [0077.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Vql_srbW0R7Sorr0D.mp3", cchWideChar=-1, lpMultiByteStr=0x645e58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Vql_srbW0R7Sorr0D.mp3", lpUsedDefaultChar=0x0) returned 22 [0077.352] lstrlenA (lpString="Vql_srbW0R7Sorr0D.mp3") returned 21 [0077.352] lstrlenA (lpString=".happythreechoose") returned 17 [0077.352] lstrlenA (lpString=".happythreechoose") returned 17 [0077.352] lstrlenA (lpString="Vql_srbW0R7Sorr0D.mp3") returned 21 [0077.352] lstrcmpiA (lpString1="srbW0R7Sorr0D.mp3", lpString2=".happythreechoose") returned 1 [0077.352] lstrcmpiW (lpString1="Vql_srbW0R7Sorr0D.mp3", lpString2="Decryption INFO.html") returned 1 [0077.352] lstrcmpiW (lpString1="Vql_srbW0R7Sorr0D.mp3", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0077.352] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0077.352] lstrcmpiW (lpString1="Vql_srbW0R7Sorr0D.mp3", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0077.352] GetProcessHeap () returned 0x630000 [0077.352] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f10 [0077.352] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Vql_srbW0R7Sorr0D.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\vql_srbw0r7sorr0d.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0077.352] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=18309) returned 1 [0077.352] GetProcessHeap () returned 0x630000 [0077.352] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655508 [0077.352] GetProcessHeap () returned 0x630000 [0077.352] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673180 [0077.352] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Vql_srbW0R7Sorr0D.mp3") returned 53 [0077.352] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0077.352] GetProcessHeap () returned 0x630000 [0077.352] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0077.353] GetProcessHeap () returned 0x630000 [0077.353] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38b) returned 0x674130 [0077.353] lstrlenA (lpString="rsa_encrypt") returned 11 [0077.353] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x6736d0) returned 1 [0077.353] CryptGenRandom (in: hProv=0x6736d0, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0077.353] CryptReleaseContext (hProv=0x6736d0, dwFlags=0x0) returned 1 [0077.353] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0077.353] GetProcessHeap () returned 0x630000 [0077.353] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672fe8 [0077.353] lstrlenA (lpString="010001") returned 6 [0077.353] GetProcessHeap () returned 0x630000 [0077.353] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a348 [0077.353] GetProcessHeap () returned 0x630000 [0077.353] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673208 [0077.353] GetProcessHeap () returned 0x630000 [0077.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65eb20 [0077.354] GetProcessHeap () returned 0x630000 [0077.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673208 | out: hHeap=0x630000) returned 1 [0077.354] GetProcessHeap () returned 0x630000 [0077.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65df50 [0077.354] GetProcessHeap () returned 0x630000 [0077.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656950 [0077.354] GetProcessHeap () returned 0x630000 [0077.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a398 [0077.354] GetProcessHeap () returned 0x630000 [0077.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0077.354] GetProcessHeap () returned 0x630000 [0077.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.354] GetProcessHeap () returned 0x630000 [0077.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0077.354] GetProcessHeap () returned 0x630000 [0077.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673538 [0077.354] GetProcessHeap () returned 0x630000 [0077.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657328 [0077.354] GetProcessHeap () returned 0x630000 [0077.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.354] GetProcessHeap () returned 0x630000 [0077.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0077.354] GetProcessHeap () returned 0x630000 [0077.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dec0 [0077.354] GetProcessHeap () returned 0x630000 [0077.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673538 | out: hHeap=0x630000) returned 1 [0077.354] GetProcessHeap () returned 0x630000 [0077.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0077.354] GetProcessHeap () returned 0x630000 [0077.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0077.354] GetProcessHeap () returned 0x630000 [0077.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.354] GetProcessHeap () returned 0x630000 [0077.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0077.354] GetProcessHeap () returned 0x630000 [0077.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.354] GetProcessHeap () returned 0x630000 [0077.354] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.354] GetProcessHeap () returned 0x630000 [0077.354] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.354] GetProcessHeap () returned 0x630000 [0077.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.355] GetProcessHeap () returned 0x630000 [0077.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e970 [0077.355] GetProcessHeap () returned 0x630000 [0077.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0077.355] GetProcessHeap () returned 0x630000 [0077.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0077.355] GetProcessHeap () returned 0x630000 [0077.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0077.355] GetProcessHeap () returned 0x630000 [0077.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.355] GetProcessHeap () returned 0x630000 [0077.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.355] GetProcessHeap () returned 0x630000 [0077.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.355] GetProcessHeap () returned 0x630000 [0077.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.355] GetProcessHeap () returned 0x630000 [0077.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.355] GetProcessHeap () returned 0x630000 [0077.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.355] GetProcessHeap () returned 0x630000 [0077.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0077.355] GetProcessHeap () returned 0x630000 [0077.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0077.355] GetProcessHeap () returned 0x630000 [0077.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.355] GetProcessHeap () returned 0x630000 [0077.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.355] GetProcessHeap () returned 0x630000 [0077.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.355] GetProcessHeap () returned 0x630000 [0077.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.355] GetProcessHeap () returned 0x630000 [0077.355] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.355] GetProcessHeap () returned 0x630000 [0077.355] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.356] GetProcessHeap () returned 0x630000 [0077.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.356] GetProcessHeap () returned 0x630000 [0077.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.356] GetProcessHeap () returned 0x630000 [0077.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.356] GetProcessHeap () returned 0x630000 [0077.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.356] GetProcessHeap () returned 0x630000 [0077.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.356] GetProcessHeap () returned 0x630000 [0077.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.356] GetProcessHeap () returned 0x630000 [0077.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.356] GetProcessHeap () returned 0x630000 [0077.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.356] GetProcessHeap () returned 0x630000 [0077.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.356] GetProcessHeap () returned 0x630000 [0077.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.356] GetProcessHeap () returned 0x630000 [0077.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.356] GetProcessHeap () returned 0x630000 [0077.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.356] GetProcessHeap () returned 0x630000 [0077.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.356] GetProcessHeap () returned 0x630000 [0077.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.356] GetProcessHeap () returned 0x630000 [0077.356] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.356] GetProcessHeap () returned 0x630000 [0077.356] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.357] GetProcessHeap () returned 0x630000 [0077.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.357] GetProcessHeap () returned 0x630000 [0077.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.357] GetProcessHeap () returned 0x630000 [0077.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0077.357] GetProcessHeap () returned 0x630000 [0077.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0077.357] GetProcessHeap () returned 0x630000 [0077.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0077.357] GetProcessHeap () returned 0x630000 [0077.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0077.357] GetProcessHeap () returned 0x630000 [0077.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.357] GetProcessHeap () returned 0x630000 [0077.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.357] GetProcessHeap () returned 0x630000 [0077.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.357] GetProcessHeap () returned 0x630000 [0077.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.357] GetProcessHeap () returned 0x630000 [0077.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.357] GetProcessHeap () returned 0x630000 [0077.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.357] GetProcessHeap () returned 0x630000 [0077.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.357] GetProcessHeap () returned 0x630000 [0077.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.357] GetProcessHeap () returned 0x630000 [0077.357] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.357] GetProcessHeap () returned 0x630000 [0077.357] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.358] GetProcessHeap () returned 0x630000 [0077.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.358] GetProcessHeap () returned 0x630000 [0077.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.358] GetProcessHeap () returned 0x630000 [0077.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.358] GetProcessHeap () returned 0x630000 [0077.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.358] GetProcessHeap () returned 0x630000 [0077.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.358] GetProcessHeap () returned 0x630000 [0077.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.358] GetProcessHeap () returned 0x630000 [0077.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.358] GetProcessHeap () returned 0x630000 [0077.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.358] GetProcessHeap () returned 0x630000 [0077.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.358] GetProcessHeap () returned 0x630000 [0077.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.358] GetProcessHeap () returned 0x630000 [0077.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.358] GetProcessHeap () returned 0x630000 [0077.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.358] GetProcessHeap () returned 0x630000 [0077.358] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.358] GetProcessHeap () returned 0x630000 [0077.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.359] GetProcessHeap () returned 0x630000 [0077.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.359] GetProcessHeap () returned 0x630000 [0077.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.359] GetProcessHeap () returned 0x630000 [0077.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.359] GetProcessHeap () returned 0x630000 [0077.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.359] GetProcessHeap () returned 0x630000 [0077.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.359] GetProcessHeap () returned 0x630000 [0077.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.359] GetProcessHeap () returned 0x630000 [0077.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.359] GetProcessHeap () returned 0x630000 [0077.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.359] GetProcessHeap () returned 0x630000 [0077.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.359] GetProcessHeap () returned 0x630000 [0077.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.359] GetProcessHeap () returned 0x630000 [0077.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.359] GetProcessHeap () returned 0x630000 [0077.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.359] GetProcessHeap () returned 0x630000 [0077.359] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.360] GetProcessHeap () returned 0x630000 [0077.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.360] GetProcessHeap () returned 0x630000 [0077.360] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a398 [0077.360] GetProcessHeap () returned 0x630000 [0077.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.360] GetProcessHeap () returned 0x630000 [0077.360] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.360] GetProcessHeap () returned 0x630000 [0077.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.360] GetProcessHeap () returned 0x630000 [0077.360] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0077.360] GetProcessHeap () returned 0x630000 [0077.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0077.360] GetProcessHeap () returned 0x630000 [0077.360] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.360] GetProcessHeap () returned 0x630000 [0077.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.360] GetProcessHeap () returned 0x630000 [0077.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0077.360] GetProcessHeap () returned 0x630000 [0077.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0077.360] GetProcessHeap () returned 0x630000 [0077.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0077.360] GetProcessHeap () returned 0x630000 [0077.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0077.360] GetProcessHeap () returned 0x630000 [0077.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0077.360] GetProcessHeap () returned 0x630000 [0077.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0077.360] GetProcessHeap () returned 0x630000 [0077.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0077.360] GetProcessHeap () returned 0x630000 [0077.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0077.360] GetProcessHeap () returned 0x630000 [0077.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0077.360] GetProcessHeap () returned 0x630000 [0077.360] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.361] GetProcessHeap () returned 0x630000 [0077.361] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672fe8 | out: hHeap=0x630000) returned 1 [0077.361] WriteFile (in: hFile=0x230, lpBuffer=0x674130*, nNumberOfBytesToWrite=0x38b, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x674130*, lpNumberOfBytesWritten=0x243d864*=0x38b, lpOverlapped=0x0) returned 1 [0077.363] GetProcessHeap () returned 0x630000 [0077.363] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x674130, Size=0x30) returned 0x674130 [0077.363] GetProcessHeap () returned 0x630000 [0077.363] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0077.364] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0077.364] GetProcessHeap () returned 0x630000 [0077.364] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4790) returned 0x674168 [0077.364] ReadFile (in: hFile=0x230, lpBuffer=0x674168, nNumberOfBytesToRead=0x4790, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x674168*, lpNumberOfBytesRead=0x243d7e8*=0x4790, lpOverlapped=0x0) returned 1 [0077.364] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0077.364] WriteFile (in: hFile=0x230, lpBuffer=0x674168*, nNumberOfBytesToWrite=0x4790, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x674168*, lpNumberOfBytesWritten=0x243d7e4*=0x4790, lpOverlapped=0x0) returned 1 [0077.365] GetProcessHeap () returned 0x630000 [0077.365] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x674168 | out: hHeap=0x630000) returned 1 [0077.365] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0077.365] WriteFile (in: hFile=0x230, lpBuffer=0x674130*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x674130*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0077.366] CloseHandle (hObject=0x230) returned 1 [0077.367] GetProcessHeap () returned 0x630000 [0077.367] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f10 | out: hHeap=0x630000) returned 1 [0077.367] GetProcessHeap () returned 0x630000 [0077.367] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655508 | out: hHeap=0x630000) returned 1 [0077.367] GetProcessHeap () returned 0x630000 [0077.367] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673180 | out: hHeap=0x630000) returned 1 [0077.367] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Vql_srbW0R7Sorr0D.mp3" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Vql_srbW0R7Sorr0D.mp3") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Vql_srbW0R7Sorr0D.mp3" [0077.367] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Vql_srbW0R7Sorr0D.mp3", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Vql_srbW0R7Sorr0D.mp3.happythreechoose") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Vql_srbW0R7Sorr0D.mp3.happythreechoose" [0077.367] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Vql_srbW0R7Sorr0D.mp3" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\vql_srbw0r7sorr0d.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Vql_srbW0R7Sorr0D.mp3.happythreechoose" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\vql_srbw0r7sorr0d.mp3.happythreechoose"), dwFlags=0x1) returned 1 [0077.368] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Vql_srbW0R7Sorr0D.mp3" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming") returned 1 [0077.368] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\") returned="" [0077.368] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" [0077.368] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\decryption info.html")) returned 0x20 [0077.368] GetProcessHeap () returned 0x630000 [0077.368] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645e58 | out: hHeap=0x630000) returned 1 [0077.368] FindNextFileW (in: hFindFile=0x648890, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x635fbf0, ftCreationTime.dwHighDateTime=0x1d5cb49, ftLastAccessTime.dwLowDateTime=0x40954650, ftLastAccessTime.dwHighDateTime=0x1d5d1b8, ftLastWriteTime.dwLowDateTime=0x40954650, ftLastWriteTime.dwHighDateTime=0x1d5d1b8, nFileSizeHigh=0x0, nFileSizeLow=0x4785, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Vql_srbW0R7Sorr0D.mp3", cAlternateFileName="VQL_SR~1.MP3")) returned 0 [0077.368] FindClose (in: hFindFile=0x648890 | out: hFindFile=0x648890) returned 1 [0077.368] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\" [0077.368] GetProcessHeap () returned 0x630000 [0077.368] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65f380 | out: hHeap=0x630000) returned 1 [0077.368] GetProcessHeap () returned 0x630000 [0077.368] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.368] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\") returned 36 [0077.368] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\*" [0077.368] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648a10 [0077.368] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0077.368] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.369] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0077.369] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0077.369] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0077.369] lstrcmpiW (lpString1="Java", lpString2=".") returned 1 [0077.369] lstrcmpiW (lpString1="Java", lpString2="..") returned 1 [0077.369] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\", lpString2="Java" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java" [0077.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Java", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0077.369] GetProcessHeap () returned 0x630000 [0077.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5) returned 0x65a268 [0077.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Java", cchWideChar=-1, lpMultiByteStr=0x65a268, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Java", lpUsedDefaultChar=0x0) returned 5 [0077.369] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Java", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0077.369] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Java", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0077.369] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Java", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0077.369] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Java", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0077.369] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Java", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0077.369] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Java", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0077.369] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Java", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0077.369] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Java", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0077.369] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Java", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0077.369] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Java", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0077.369] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Java", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0077.369] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Java", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0077.369] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Java", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0077.369] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Java", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0077.369] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Java", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0077.369] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Java", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0077.369] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Java", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0077.369] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Java", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0077.369] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Java", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0077.369] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Java", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0077.369] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Java", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0077.369] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Java", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0077.369] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Java", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0077.369] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Java", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0077.370] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Java", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0077.370] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Java", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0077.370] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Java", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0077.370] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Java", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0077.370] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Java", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0077.370] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Java", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0077.370] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Java", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0077.370] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Java", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0077.370] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Java", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0077.370] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Java", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0077.370] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Java", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0077.370] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Java", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0077.370] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Java", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0077.370] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Java", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0077.370] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Java", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0077.370] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Java", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0077.370] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Java", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0077.370] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Java", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0077.370] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Java", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0077.370] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\" [0077.370] GetProcessHeap () returned 0x630000 [0077.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a2b8 [0077.370] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\") returned 41 [0077.370] GetProcessHeap () returned 0x630000 [0077.370] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x54) returned 0x654050 [0077.370] lstrcpyW (in: lpString1=0x654050, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\" [0077.370] GetProcessHeap () returned 0x630000 [0077.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0077.370] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 0 [0077.370] FindClose (in: hFindFile=0x648a10 | out: hFindFile=0x648a10) returned 1 [0077.370] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\" [0077.370] GetProcessHeap () returned 0x630000 [0077.370] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x654050 | out: hHeap=0x630000) returned 1 [0077.370] GetProcessHeap () returned 0x630000 [0077.371] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0077.371] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\") returned 41 [0077.371] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\*" [0077.371] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648a90 [0077.371] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0077.371] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.371] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0077.371] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0077.371] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1 [0077.371] lstrcmpiW (lpString1="Deployment", lpString2=".") returned 1 [0077.371] lstrcmpiW (lpString1="Deployment", lpString2="..") returned 1 [0077.371] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\", lpString2="Deployment" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\Deployment") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\Deployment" [0077.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Deployment", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0077.371] GetProcessHeap () returned 0x630000 [0077.371] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb) returned 0x64ca20 [0077.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Deployment", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Deployment", lpUsedDefaultChar=0x0) returned 11 [0077.371] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Deployment", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0077.371] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Deployment", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0077.371] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Deployment", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0077.371] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Deployment", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0077.371] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Deployment", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0077.371] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Deployment", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0077.371] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Deployment", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0077.371] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Deployment", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0077.371] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Deployment", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0077.371] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Deployment", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0077.371] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Deployment", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0077.371] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Deployment", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0077.371] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Deployment", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0077.371] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Deployment", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0077.372] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Deployment", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0077.372] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Deployment", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0077.372] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Deployment", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0077.372] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Deployment", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0077.372] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Deployment", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0077.372] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Deployment", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0077.372] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Deployment", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0077.372] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Deployment", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0077.372] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Deployment", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0077.372] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Deployment", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0077.372] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Deployment", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0077.372] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Deployment", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0077.372] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Deployment", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0077.372] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Deployment", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0077.372] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Deployment", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0077.372] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Deployment", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0077.372] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Deployment", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0077.372] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Deployment", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0077.372] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Deployment", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0077.372] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Deployment", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0077.372] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Deployment", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0077.372] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Deployment", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0077.372] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Deployment", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0077.372] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Deployment", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0077.372] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Deployment", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0077.372] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Deployment", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0077.372] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Deployment", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0077.372] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Deployment", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0077.372] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Deployment", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0077.372] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\Deployment", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\Deployment\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\Deployment\\" [0077.372] GetProcessHeap () returned 0x630000 [0077.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a338 [0077.372] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\Deployment\\") returned 52 [0077.372] GetProcessHeap () returned 0x630000 [0077.372] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6a) returned 0x655490 [0077.372] lstrcpyW (in: lpString1=0x655490, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\Deployment\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\Deployment\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\Deployment\\" [0077.373] GetProcessHeap () returned 0x630000 [0077.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0077.373] FindNextFileW (in: hFindFile=0x648a90, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 0 [0077.373] FindClose (in: hFindFile=0x648a90 | out: hFindFile=0x648a90) returned 1 [0077.373] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\Deployment\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\Deployment\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\Deployment\\" [0077.373] GetProcessHeap () returned 0x630000 [0077.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655490 | out: hHeap=0x630000) returned 1 [0077.373] GetProcessHeap () returned 0x630000 [0077.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.373] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\Deployment\\") returned 52 [0077.373] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\Deployment\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\Deployment\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\Deployment\\*" [0077.373] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Sun\\Java\\Deployment\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648a10 [0077.373] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0077.373] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.373] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0077.373] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0077.373] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad2cc5cd, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad2cc5cd, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad2cc5cd, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0077.373] FindClose (in: hFindFile=0x648a10 | out: hFindFile=0x648a10) returned 1 [0077.373] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\" [0077.373] GetProcessHeap () returned 0x630000 [0077.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65f1c8 | out: hHeap=0x630000) returned 1 [0077.373] GetProcessHeap () returned 0x630000 [0077.373] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0077.373] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\") returned 38 [0077.373] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\*" [0077.373] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648a10 [0077.374] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0077.374] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.374] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0077.374] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0077.374] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RootTools", cAlternateFileName="ROOTTO~1")) returned 1 [0077.374] lstrcmpiW (lpString1="RootTools", lpString2=".") returned 1 [0077.374] lstrcmpiW (lpString1="RootTools", lpString2="..") returned 1 [0077.374] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\", lpString2="RootTools" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools" [0077.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RootTools", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0077.374] GetProcessHeap () returned 0x630000 [0077.374] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x64ca20 [0077.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RootTools", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RootTools", lpUsedDefaultChar=0x0) returned 10 [0077.374] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="RootTools", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0077.374] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="RootTools", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0077.374] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="RootTools", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0077.374] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="RootTools", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0077.375] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="RootTools", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0077.375] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="RootTools", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0077.375] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="RootTools", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0077.375] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="RootTools", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0077.375] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="RootTools", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0077.375] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="RootTools", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0077.375] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="RootTools", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0077.375] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="RootTools", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0077.375] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="RootTools", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0077.375] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="RootTools", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0077.375] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="RootTools", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0077.375] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="RootTools", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0077.375] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="RootTools", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0077.375] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="RootTools", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0077.375] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="RootTools", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0077.375] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="RootTools", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0077.375] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="RootTools", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0077.375] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="RootTools", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0077.375] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="RootTools", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0077.375] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="RootTools", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0077.375] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="RootTools", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0077.375] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="RootTools", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0077.375] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="RootTools", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0077.375] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="RootTools", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0077.375] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="RootTools", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0077.375] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="RootTools", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0077.375] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="RootTools", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0077.375] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="RootTools", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0077.375] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="RootTools", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0077.375] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="RootTools", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0077.375] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="RootTools", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0077.375] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="RootTools", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0077.375] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="RootTools", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0077.375] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="RootTools", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0077.375] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="RootTools", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0077.376] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="RootTools", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0077.376] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="RootTools", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0077.376] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="RootTools", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0077.376] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="RootTools", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0077.376] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\" [0077.376] GetProcessHeap () returned 0x630000 [0077.376] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a348 [0077.376] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\") returned 48 [0077.376] GetProcessHeap () returned 0x630000 [0077.376] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x62) returned 0x6548e0 [0077.376] lstrcpyW (in: lpString1=0x6548e0, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\" [0077.376] GetProcessHeap () returned 0x630000 [0077.376] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0077.376] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RootTools", cAlternateFileName="ROOTTO~1")) returned 0 [0077.376] FindClose (in: hFindFile=0x648a10 | out: hFindFile=0x648a10) returned 1 [0077.376] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\" [0077.376] GetProcessHeap () returned 0x630000 [0077.376] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6548e0 | out: hHeap=0x630000) returned 1 [0077.376] GetProcessHeap () returned 0x630000 [0077.376] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.376] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\") returned 48 [0077.376] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\*" [0077.376] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648710 [0077.376] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0077.376] FindNextFileW (in: hFindFile=0x648710, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.376] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0077.377] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0077.377] FindNextFileW (in: hFindFile=0x648710, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="roottools.conf", cAlternateFileName="ROOTTO~1.CON")) returned 1 [0077.377] lstrcmpiW (lpString1="roottools.conf", lpString2=".") returned 1 [0077.377] lstrcmpiW (lpString1="roottools.conf", lpString2="..") returned 1 [0077.377] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\", lpString2="roottools.conf" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf" [0077.377] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="roottools.conf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0077.377] GetProcessHeap () returned 0x630000 [0077.377] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0077.377] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="roottools.conf", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="roottools.conf", lpUsedDefaultChar=0x0) returned 15 [0077.377] lstrlenA (lpString="roottools.conf") returned 14 [0077.377] lstrlenA (lpString=".happythreechoose") returned 17 [0077.377] lstrcmpiW (lpString1="roottools.conf", lpString2="Decryption INFO.html") returned 1 [0077.377] lstrcmpiW (lpString1="roottools.conf", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0077.377] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0077.377] lstrcmpiW (lpString1="roottools.conf", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0077.377] GetProcessHeap () returned 0x630000 [0077.377] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0077.377] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\skype\\roottools\\roottools.conf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0077.377] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=76) returned 1 [0077.377] GetProcessHeap () returned 0x630000 [0077.377] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6559b8 [0077.377] GetProcessHeap () returned 0x630000 [0077.377] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672a98 [0077.377] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf") returned 62 [0077.377] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0077.378] GetProcessHeap () returned 0x630000 [0077.378] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0077.378] GetProcessHeap () returned 0x630000 [0077.378] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x384) returned 0x674168 [0077.378] lstrlenA (lpString="rsa_encrypt") returned 11 [0077.378] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x672ed8) returned 1 [0077.378] CryptGenRandom (in: hProv=0x672ed8, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0077.378] CryptReleaseContext (hProv=0x672ed8, dwFlags=0x0) returned 1 [0077.378] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0077.378] GetProcessHeap () returned 0x630000 [0077.378] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673648 [0077.378] lstrlenA (lpString="010001") returned 6 [0077.378] GetProcessHeap () returned 0x630000 [0077.378] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a398 [0077.378] GetProcessHeap () returned 0x630000 [0077.379] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672ed8 [0077.379] GetProcessHeap () returned 0x630000 [0077.379] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ebb0 [0077.379] GetProcessHeap () returned 0x630000 [0077.379] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672ed8 | out: hHeap=0x630000) returned 1 [0077.379] GetProcessHeap () returned 0x630000 [0077.379] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e460 [0077.379] GetProcessHeap () returned 0x630000 [0077.379] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657328 [0077.379] GetProcessHeap () returned 0x630000 [0077.379] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a338 [0077.379] GetProcessHeap () returned 0x630000 [0077.379] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0077.379] GetProcessHeap () returned 0x630000 [0077.379] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.379] GetProcessHeap () returned 0x630000 [0077.379] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0077.379] GetProcessHeap () returned 0x630000 [0077.379] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672e50 [0077.379] GetProcessHeap () returned 0x630000 [0077.379] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657558 [0077.379] GetProcessHeap () returned 0x630000 [0077.379] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.379] GetProcessHeap () returned 0x630000 [0077.379] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0077.379] GetProcessHeap () returned 0x630000 [0077.379] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0077.379] GetProcessHeap () returned 0x630000 [0077.379] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672e50 | out: hHeap=0x630000) returned 1 [0077.379] GetProcessHeap () returned 0x630000 [0077.379] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0077.379] GetProcessHeap () returned 0x630000 [0077.379] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0077.379] GetProcessHeap () returned 0x630000 [0077.379] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.379] GetProcessHeap () returned 0x630000 [0077.379] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cf88 [0077.379] GetProcessHeap () returned 0x630000 [0077.379] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.379] GetProcessHeap () returned 0x630000 [0077.379] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.380] GetProcessHeap () returned 0x630000 [0077.380] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.380] GetProcessHeap () returned 0x630000 [0077.380] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.380] GetProcessHeap () returned 0x630000 [0077.380] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e340 [0077.380] GetProcessHeap () returned 0x630000 [0077.380] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cf88 | out: hHeap=0x630000) returned 1 [0077.380] GetProcessHeap () returned 0x630000 [0077.380] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0077.380] GetProcessHeap () returned 0x630000 [0077.380] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0077.380] GetProcessHeap () returned 0x630000 [0077.380] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.380] GetProcessHeap () returned 0x630000 [0077.380] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.380] GetProcessHeap () returned 0x630000 [0077.380] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.380] GetProcessHeap () returned 0x630000 [0077.380] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.380] GetProcessHeap () returned 0x630000 [0077.380] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.380] GetProcessHeap () returned 0x630000 [0077.380] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.380] GetProcessHeap () returned 0x630000 [0077.380] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.380] GetProcessHeap () returned 0x630000 [0077.380] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.380] GetProcessHeap () returned 0x630000 [0077.380] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.380] GetProcessHeap () returned 0x630000 [0077.380] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.380] GetProcessHeap () returned 0x630000 [0077.380] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.380] GetProcessHeap () returned 0x630000 [0077.380] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.380] GetProcessHeap () returned 0x630000 [0077.380] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.380] GetProcessHeap () returned 0x630000 [0077.380] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.380] GetProcessHeap () returned 0x630000 [0077.381] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.381] GetProcessHeap () returned 0x630000 [0077.381] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.381] GetProcessHeap () returned 0x630000 [0077.381] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.381] GetProcessHeap () returned 0x630000 [0077.381] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.381] GetProcessHeap () returned 0x630000 [0077.381] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.381] GetProcessHeap () returned 0x630000 [0077.381] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.381] GetProcessHeap () returned 0x630000 [0077.381] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0077.381] GetProcessHeap () returned 0x630000 [0077.381] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0077.381] GetProcessHeap () returned 0x630000 [0077.381] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.381] GetProcessHeap () returned 0x630000 [0077.381] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.381] GetProcessHeap () returned 0x630000 [0077.381] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.381] GetProcessHeap () returned 0x630000 [0077.381] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.381] GetProcessHeap () returned 0x630000 [0077.381] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0077.381] GetProcessHeap () returned 0x630000 [0077.381] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0077.381] GetProcessHeap () returned 0x630000 [0077.381] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.381] GetProcessHeap () returned 0x630000 [0077.381] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.381] GetProcessHeap () returned 0x630000 [0077.381] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.381] GetProcessHeap () returned 0x630000 [0077.381] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.381] GetProcessHeap () returned 0x630000 [0077.381] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.381] GetProcessHeap () returned 0x630000 [0077.381] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.382] GetProcessHeap () returned 0x630000 [0077.382] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.382] GetProcessHeap () returned 0x630000 [0077.382] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.382] GetProcessHeap () returned 0x630000 [0077.382] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.382] GetProcessHeap () returned 0x630000 [0077.382] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.382] GetProcessHeap () returned 0x630000 [0077.382] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.382] GetProcessHeap () returned 0x630000 [0077.382] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.382] GetProcessHeap () returned 0x630000 [0077.382] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.382] GetProcessHeap () returned 0x630000 [0077.382] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.382] GetProcessHeap () returned 0x630000 [0077.382] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.382] GetProcessHeap () returned 0x630000 [0077.382] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.382] GetProcessHeap () returned 0x630000 [0077.382] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.382] GetProcessHeap () returned 0x630000 [0077.382] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.382] GetProcessHeap () returned 0x630000 [0077.382] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.382] GetProcessHeap () returned 0x630000 [0077.382] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.382] GetProcessHeap () returned 0x630000 [0077.382] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.382] GetProcessHeap () returned 0x630000 [0077.382] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.382] GetProcessHeap () returned 0x630000 [0077.382] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.382] GetProcessHeap () returned 0x630000 [0077.382] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.382] GetProcessHeap () returned 0x630000 [0077.382] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0077.382] GetProcessHeap () returned 0x630000 [0077.383] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0077.383] GetProcessHeap () returned 0x630000 [0077.383] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.383] GetProcessHeap () returned 0x630000 [0077.383] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.383] GetProcessHeap () returned 0x630000 [0077.383] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.383] GetProcessHeap () returned 0x630000 [0077.383] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.383] GetProcessHeap () returned 0x630000 [0077.383] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.383] GetProcessHeap () returned 0x630000 [0077.383] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.383] GetProcessHeap () returned 0x630000 [0077.383] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.383] GetProcessHeap () returned 0x630000 [0077.383] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.383] GetProcessHeap () returned 0x630000 [0077.383] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.383] GetProcessHeap () returned 0x630000 [0077.383] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.383] GetProcessHeap () returned 0x630000 [0077.383] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.383] GetProcessHeap () returned 0x630000 [0077.383] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.383] GetProcessHeap () returned 0x630000 [0077.383] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0077.383] GetProcessHeap () returned 0x630000 [0077.383] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0077.383] GetProcessHeap () returned 0x630000 [0077.383] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.383] GetProcessHeap () returned 0x630000 [0077.383] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.383] GetProcessHeap () returned 0x630000 [0077.383] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.383] GetProcessHeap () returned 0x630000 [0077.383] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.383] GetProcessHeap () returned 0x630000 [0077.383] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.383] GetProcessHeap () returned 0x630000 [0077.384] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.384] GetProcessHeap () returned 0x630000 [0077.384] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0077.384] GetProcessHeap () returned 0x630000 [0077.384] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0077.384] GetProcessHeap () returned 0x630000 [0077.384] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.384] GetProcessHeap () returned 0x630000 [0077.384] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.384] GetProcessHeap () returned 0x630000 [0077.384] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a338 [0077.384] GetProcessHeap () returned 0x630000 [0077.384] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a338 | out: hHeap=0x630000) returned 1 [0077.384] GetProcessHeap () returned 0x630000 [0077.384] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0077.384] GetProcessHeap () returned 0x630000 [0077.384] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0077.384] GetProcessHeap () returned 0x630000 [0077.384] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0077.384] GetProcessHeap () returned 0x630000 [0077.384] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0077.384] GetProcessHeap () returned 0x630000 [0077.384] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0077.384] GetProcessHeap () returned 0x630000 [0077.384] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0077.384] GetProcessHeap () returned 0x630000 [0077.384] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0077.384] GetProcessHeap () returned 0x630000 [0077.384] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e460 | out: hHeap=0x630000) returned 1 [0077.384] GetProcessHeap () returned 0x630000 [0077.384] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0077.384] GetProcessHeap () returned 0x630000 [0077.384] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0077.384] GetProcessHeap () returned 0x630000 [0077.384] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0077.384] GetProcessHeap () returned 0x630000 [0077.384] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.384] GetProcessHeap () returned 0x630000 [0077.385] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673648 | out: hHeap=0x630000) returned 1 [0077.385] WriteFile (in: hFile=0x230, lpBuffer=0x674168*, nNumberOfBytesToWrite=0x384, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x674168*, lpNumberOfBytesWritten=0x243d864*=0x384, lpOverlapped=0x0) returned 1 [0077.388] GetProcessHeap () returned 0x630000 [0077.388] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x674168, Size=0x30) returned 0x674168 [0077.388] GetProcessHeap () returned 0x630000 [0077.388] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0077.388] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0077.388] GetProcessHeap () returned 0x630000 [0077.388] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x50) returned 0x65ee00 [0077.388] ReadFile (in: hFile=0x230, lpBuffer=0x65ee00, nNumberOfBytesToRead=0x50, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x65ee00*, lpNumberOfBytesRead=0x243d7e8*=0x50, lpOverlapped=0x0) returned 1 [0077.388] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0077.388] WriteFile (in: hFile=0x230, lpBuffer=0x65ee00*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x65ee00*, lpNumberOfBytesWritten=0x243d7e4*=0x50, lpOverlapped=0x0) returned 1 [0077.389] GetProcessHeap () returned 0x630000 [0077.389] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ee00 | out: hHeap=0x630000) returned 1 [0077.389] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0077.389] WriteFile (in: hFile=0x230, lpBuffer=0x674168*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x674168*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0077.390] CloseHandle (hObject=0x230) returned 1 [0077.392] GetProcessHeap () returned 0x630000 [0077.392] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0077.392] GetProcessHeap () returned 0x630000 [0077.392] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6559b8 | out: hHeap=0x630000) returned 1 [0077.393] GetProcessHeap () returned 0x630000 [0077.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672a98 | out: hHeap=0x630000) returned 1 [0077.393] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf" [0077.393] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf.happythreechoose") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf.happythreechoose" [0077.393] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\skype\\roottools\\roottools.conf"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf.happythreechoose" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\skype\\roottools\\roottools.conf.happythreechoose"), dwFlags=0x1) returned 1 [0077.393] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\roottools.conf" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools") returned 1 [0077.393] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\") returned="" [0077.393] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\Decryption INFO.html" [0077.393] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\skype\\roottools\\decryption info.html")) returned 0xffffffff [0077.394] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Skype\\RootTools\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\skype\\roottools\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0077.394] GetProcessHeap () returned 0x630000 [0077.394] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6556e8 [0077.394] GetProcessHeap () returned 0x630000 [0077.394] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6734b0 [0077.401] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.402] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.402] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.402] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.402] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.402] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.402] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.402] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.402] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.403] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.403] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.403] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.403] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.403] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.403] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.403] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.403] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.403] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.403] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.403] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.403] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.404] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.404] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.404] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.404] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.404] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.404] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.404] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.404] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.404] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.404] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.404] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.404] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.405] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.405] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.405] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.405] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.406] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.407] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.407] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.407] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.407] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.407] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.407] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.407] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.407] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.407] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.408] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.408] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.408] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.408] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.408] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.408] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.408] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.408] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.408] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.408] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.408] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.408] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.408] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.409] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.409] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.409] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.409] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.409] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.409] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.409] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.409] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.409] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.409] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.409] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.409] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.409] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.410] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.410] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.410] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.410] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.410] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.410] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.410] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.410] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.410] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.410] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.410] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.410] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.410] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.410] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.411] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.411] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.411] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.411] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.411] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.411] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.411] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.411] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.411] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.411] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.411] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.411] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.411] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.412] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.412] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.412] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.412] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.412] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.412] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.412] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.412] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.412] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.412] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.412] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.412] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.412] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.413] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.413] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.413] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.413] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.413] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.413] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.413] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.413] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.413] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.413] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.413] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.413] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.413] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.413] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.414] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.414] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.414] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.414] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.414] GetProcessHeap () returned 0x630000 [0077.414] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6556e8 | out: hHeap=0x630000) returned 1 [0077.414] GetProcessHeap () returned 0x630000 [0077.414] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6734b0 | out: hHeap=0x630000) returned 1 [0077.414] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0077.414] GetProcessHeap () returned 0x630000 [0077.414] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655508 [0077.414] GetProcessHeap () returned 0x630000 [0077.414] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673180 [0077.421] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.421] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.421] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.422] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.422] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.422] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.422] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.422] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.422] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.422] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.422] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.422] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.422] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.422] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.422] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.423] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.423] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.423] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.423] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.423] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.423] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.423] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.423] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.423] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.423] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.423] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.423] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.423] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.424] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.424] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.424] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.424] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.424] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.424] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.424] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.424] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.424] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.424] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.424] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.424] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.424] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.424] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.425] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.425] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.425] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.425] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.425] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.425] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.425] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.425] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.425] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.425] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.425] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.425] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.425] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.425] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.426] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.426] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.426] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.426] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.426] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.426] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.426] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.426] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.426] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.426] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.426] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.426] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.426] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.427] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.427] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.427] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.427] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.427] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.427] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.427] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.427] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.427] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.427] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.427] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.428] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.428] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.428] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.428] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.428] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.428] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.428] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.428] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.428] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.428] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.428] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.428] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.428] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.429] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.429] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.429] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.429] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.429] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.429] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.429] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.502] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.502] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.502] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.502] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.502] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.502] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.502] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.502] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.503] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.503] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.503] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.503] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.503] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.503] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.503] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.503] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.503] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.503] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.505] GetProcessHeap () returned 0x630000 [0077.505] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655508 | out: hHeap=0x630000) returned 1 [0077.505] GetProcessHeap () returned 0x630000 [0077.505] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673180 | out: hHeap=0x630000) returned 1 [0077.506] CloseHandle (hObject=0x230) returned 1 [0077.506] GetProcessHeap () returned 0x630000 [0077.506] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0077.506] FindNextFileW (in: hFindFile=0x648710, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c77649, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd5c77649, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd5c77649, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="roottools.conf", cAlternateFileName="ROOTTO~1.CON")) returned 0 [0077.506] FindClose (in: hFindFile=0x648710 | out: hFindFile=0x648710) returned 1 [0077.506] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\" [0077.506] GetProcessHeap () returned 0x630000 [0077.506] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x653990 | out: hHeap=0x630000) returned 1 [0077.506] GetProcessHeap () returned 0x630000 [0077.506] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a318 | out: hHeap=0x630000) returned 1 [0077.506] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\") returned 40 [0077.506] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\*" [0077.506] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd8b64ce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfd8b64ce, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648ad0 [0077.507] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0077.507] FindNextFileW (in: hFindFile=0x648ad0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd8b64ce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfd8b64ce, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.507] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0077.507] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0077.507] FindNextFileW (in: hFindFile=0x648ad0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8b64ce, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd8b64ce, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfd8b64ce, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Extensions", cAlternateFileName="EXTENS~1")) returned 1 [0077.507] lstrcmpiW (lpString1="Extensions", lpString2=".") returned 1 [0077.507] lstrcmpiW (lpString1="Extensions", lpString2="..") returned 1 [0077.507] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\", lpString2="Extensions" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Extensions") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Extensions" [0077.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Extensions", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0077.507] GetProcessHeap () returned 0x630000 [0077.507] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb) returned 0x64c9f0 [0077.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Extensions", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Extensions", lpUsedDefaultChar=0x0) returned 11 [0077.507] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Extensions", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0077.507] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Extensions", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0077.507] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Extensions", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0077.507] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Extensions", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0077.507] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Extensions", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0077.507] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Extensions", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0077.507] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Extensions", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0077.507] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Extensions", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0077.507] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Extensions", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0077.507] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Extensions", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0077.507] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Extensions", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0077.507] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Extensions", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0077.507] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Extensions", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0077.507] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Extensions", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0077.507] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Extensions", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0077.507] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Extensions", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0077.507] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Extensions", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0077.508] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Extensions", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0077.508] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Extensions", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0077.508] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Extensions", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0077.508] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Extensions", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0077.508] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Extensions", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0077.508] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Extensions", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0077.508] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Extensions", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0077.508] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Extensions", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0077.508] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Extensions", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0077.508] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Extensions", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0077.508] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Extensions", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0077.508] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Extensions", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0077.508] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Extensions", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0077.508] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Extensions", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0077.508] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Extensions", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0077.508] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Extensions", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0077.508] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Extensions", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0077.508] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Extensions", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0077.508] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Extensions", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0077.508] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Extensions", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0077.508] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Extensions", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0077.508] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Extensions", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0077.508] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Extensions", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0077.508] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Extensions", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0077.508] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Extensions", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0077.508] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Extensions", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0077.508] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Extensions", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Extensions\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Extensions\\" [0077.508] GetProcessHeap () returned 0x630000 [0077.508] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a338 [0077.508] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Extensions\\") returned 51 [0077.508] GetProcessHeap () returned 0x630000 [0077.508] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x68) returned 0x654d40 [0077.509] lstrcpyW (in: lpString1=0x654d40, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Extensions\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Extensions\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Extensions\\" [0077.509] GetProcessHeap () returned 0x630000 [0077.509] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0077.509] FindNextFileW (in: hFindFile=0x648ad0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Firefox", cAlternateFileName="")) returned 1 [0077.509] lstrcmpiW (lpString1="Firefox", lpString2=".") returned 1 [0077.509] lstrcmpiW (lpString1="Firefox", lpString2="..") returned 1 [0077.509] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\", lpString2="Firefox" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox" [0077.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Firefox", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0077.509] GetProcessHeap () returned 0x630000 [0077.509] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a298 [0077.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Firefox", cchWideChar=-1, lpMultiByteStr=0x65a298, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Firefox", lpUsedDefaultChar=0x0) returned 8 [0077.509] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Firefox", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0077.509] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Firefox", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0077.509] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Firefox", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0077.509] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Firefox", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0077.509] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Firefox", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0077.509] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Firefox", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0077.509] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Firefox", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0077.509] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Firefox", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0077.509] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Firefox", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0077.509] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Firefox", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0077.509] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Firefox", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0077.509] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Firefox", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0077.509] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Firefox", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0077.509] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Firefox", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0077.509] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Firefox", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0077.509] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Firefox", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0077.509] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Firefox", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0077.509] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Firefox", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0077.509] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Firefox", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0077.509] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Firefox", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0077.510] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Firefox", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0077.510] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Firefox", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0077.510] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Firefox", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0077.510] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Firefox", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0077.510] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Firefox", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0077.510] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Firefox", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0077.510] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Firefox", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0077.510] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Firefox", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0077.510] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Firefox", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0077.510] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Firefox", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0077.510] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Firefox", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0077.510] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Firefox", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0077.510] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Firefox", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0077.510] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Firefox", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0077.510] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Firefox", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0077.510] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Firefox", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0077.510] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Firefox", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0077.510] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Firefox", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0077.510] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Firefox", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0077.510] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Firefox", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0077.510] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Firefox", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0077.510] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Firefox", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0077.510] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Firefox", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0077.510] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\" [0077.510] GetProcessHeap () returned 0x630000 [0077.510] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a398 [0077.510] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\") returned 48 [0077.510] GetProcessHeap () returned 0x630000 [0077.510] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x62) returned 0x654db0 [0077.510] lstrcpyW (in: lpString1=0x654db0, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\" [0077.510] GetProcessHeap () returned 0x630000 [0077.510] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.510] FindNextFileW (in: hFindFile=0x648ad0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Firefox", cAlternateFileName="")) returned 0 [0077.511] FindClose (in: hFindFile=0x648ad0 | out: hFindFile=0x648ad0) returned 1 [0077.511] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\" [0077.511] GetProcessHeap () returned 0x630000 [0077.511] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x654db0 | out: hHeap=0x630000) returned 1 [0077.511] GetProcessHeap () returned 0x630000 [0077.511] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a398 | out: hHeap=0x630000) returned 1 [0077.511] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\") returned 48 [0077.511] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\*" [0077.511] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648710 [0077.512] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0077.512] FindNextFileW (in: hFindFile=0x648710, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.512] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0077.512] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0077.512] FindNextFileW (in: hFindFile=0x648710, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfafe15e1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Crash Reports", cAlternateFileName="CRASHR~1")) returned 1 [0077.512] lstrcmpiW (lpString1="Crash Reports", lpString2=".") returned 1 [0077.512] lstrcmpiW (lpString1="Crash Reports", lpString2="..") returned 1 [0077.512] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="Crash Reports" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports" [0077.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Crash Reports", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0077.512] GetProcessHeap () returned 0x630000 [0077.512] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x64ca20 [0077.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Crash Reports", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Crash Reports", lpUsedDefaultChar=0x0) returned 14 [0077.512] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Crash Reports", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0077.512] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Crash Reports", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0077.512] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Crash Reports", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0077.512] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Crash Reports", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0077.512] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Crash Reports", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0077.512] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Crash Reports", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0077.512] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Crash Reports", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0077.512] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Crash Reports", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0077.512] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Crash Reports", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0077.512] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Crash Reports", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0077.512] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Crash Reports", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0077.512] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Crash Reports", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0077.512] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Crash Reports", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0077.512] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Crash Reports", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0077.512] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Crash Reports", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0077.512] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Crash Reports", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0077.512] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Crash Reports", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0077.512] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Crash Reports", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0077.513] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Crash Reports", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0077.513] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Crash Reports", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0077.513] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Crash Reports", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0077.513] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Crash Reports", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0077.513] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Crash Reports", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0077.513] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Crash Reports", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0077.513] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Crash Reports", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0077.513] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Crash Reports", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0077.513] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Crash Reports", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0077.513] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Crash Reports", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0077.513] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Crash Reports", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0077.513] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Crash Reports", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0077.513] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Crash Reports", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0077.513] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Crash Reports", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0077.513] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Crash Reports", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0077.513] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Crash Reports", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0077.513] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Crash Reports", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0077.513] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Crash Reports", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0077.513] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Crash Reports", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0077.513] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Crash Reports", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0077.513] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Crash Reports", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0077.513] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Crash Reports", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0077.513] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Crash Reports", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0077.513] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Crash Reports", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0077.513] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Crash Reports", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0077.513] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\" [0077.513] GetProcessHeap () returned 0x630000 [0077.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a398 [0077.513] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\") returned 62 [0077.513] GetProcessHeap () returned 0x630000 [0077.513] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7e) returned 0x672cb8 [0077.513] lstrcpyW (in: lpString1=0x672cb8, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\" [0077.514] GetProcessHeap () returned 0x630000 [0077.514] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0077.514] FindNextFileW (in: hFindFile=0x648710, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfafe15e1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfafe15e1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfafe15e1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pending Pings", cAlternateFileName="PENDIN~1")) returned 1 [0077.514] lstrcmpiW (lpString1="Pending Pings", lpString2=".") returned 1 [0077.514] lstrcmpiW (lpString1="Pending Pings", lpString2="..") returned 1 [0077.514] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="Pending Pings" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Pending Pings") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Pending Pings" [0077.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Pending Pings", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0077.514] GetProcessHeap () returned 0x630000 [0077.514] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x64c9f0 [0077.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Pending Pings", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pending Pings", lpUsedDefaultChar=0x0) returned 14 [0077.514] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pending Pings", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0077.514] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pending Pings", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0077.514] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pending Pings", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0077.514] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pending Pings", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0077.514] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pending Pings", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0077.514] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pending Pings", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0077.514] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pending Pings", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0077.514] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pending Pings", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0077.514] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pending Pings", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0077.514] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pending Pings", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0077.514] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pending Pings", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0077.514] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pending Pings", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0077.514] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pending Pings", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0077.514] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pending Pings", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0077.514] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pending Pings", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0077.514] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pending Pings", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0077.514] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pending Pings", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0077.514] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pending Pings", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0077.514] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pending Pings", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0077.514] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pending Pings", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0077.515] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pending Pings", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0077.515] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pending Pings", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0077.515] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pending Pings", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0077.515] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pending Pings", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0077.515] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pending Pings", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0077.515] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pending Pings", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0077.515] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pending Pings", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0077.515] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pending Pings", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0077.515] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pending Pings", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0077.515] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pending Pings", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0077.515] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pending Pings", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0077.515] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pending Pings", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0077.515] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pending Pings", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0077.515] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pending Pings", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0077.515] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pending Pings", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0077.515] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pending Pings", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0077.516] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pending Pings", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0077.516] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pending Pings", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0077.516] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pending Pings", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0077.516] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pending Pings", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0077.516] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pending Pings", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0077.516] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pending Pings", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0077.516] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pending Pings", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0077.516] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Pending Pings", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Pending Pings\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Pending Pings\\" [0077.516] GetProcessHeap () returned 0x630000 [0077.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a318 [0077.516] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Pending Pings\\") returned 62 [0077.516] GetProcessHeap () returned 0x630000 [0077.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7e) returned 0x673648 [0077.516] lstrcpyW (in: lpString1=0x673648, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Pending Pings\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Pending Pings\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Pending Pings\\" [0077.516] GetProcessHeap () returned 0x630000 [0077.516] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0077.516] FindNextFileW (in: hFindFile=0x648710, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1 [0077.516] lstrcmpiW (lpString1="Profiles", lpString2=".") returned 1 [0077.516] lstrcmpiW (lpString1="Profiles", lpString2="..") returned 1 [0077.516] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="Profiles" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" [0077.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Profiles", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0077.516] GetProcessHeap () returned 0x630000 [0077.516] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9) returned 0x64ca20 [0077.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Profiles", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Profiles", lpUsedDefaultChar=0x0) returned 9 [0077.516] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Profiles", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0077.516] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Profiles", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0077.516] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Profiles", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0077.516] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Profiles", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0077.516] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Profiles", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0077.516] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Profiles", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0077.516] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Profiles", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0077.516] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Profiles", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0077.516] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Profiles", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0077.516] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Profiles", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0077.516] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Profiles", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0077.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Profiles", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0077.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Profiles", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0077.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Profiles", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0077.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Profiles", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0077.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Profiles", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0077.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Profiles", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0077.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Profiles", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0077.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Profiles", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0077.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Profiles", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0077.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Profiles", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0077.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Profiles", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0077.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Profiles", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0077.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Profiles", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0077.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Profiles", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0077.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Profiles", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0077.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Profiles", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0077.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Profiles", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0077.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Profiles", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0077.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Profiles", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0077.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Profiles", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0077.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Profiles", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0077.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Profiles", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0077.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Profiles", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0077.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Profiles", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0077.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Profiles", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0077.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Profiles", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0077.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Profiles", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0077.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Profiles", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0077.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Profiles", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0077.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Profiles", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0077.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Profiles", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0077.517] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Profiles", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0077.517] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\" [0077.517] GetProcessHeap () returned 0x630000 [0077.517] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a348 [0077.518] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned 57 [0077.518] GetProcessHeap () returned 0x630000 [0077.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x74) returned 0x63f290 [0077.518] lstrcpyW (in: lpString1=0x63f290, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\" [0077.518] GetProcessHeap () returned 0x630000 [0077.518] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0077.518] FindNextFileW (in: hFindFile=0x648710, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x7a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="profiles.ini", cAlternateFileName="")) returned 1 [0077.518] lstrcmpiW (lpString1="profiles.ini", lpString2=".") returned 1 [0077.518] lstrcmpiW (lpString1="profiles.ini", lpString2="..") returned 1 [0077.518] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="profiles.ini" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" [0077.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="profiles.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0077.518] GetProcessHeap () returned 0x630000 [0077.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd) returned 0x64ca20 [0077.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="profiles.ini", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="profiles.ini", lpUsedDefaultChar=0x0) returned 13 [0077.518] lstrlenA (lpString="profiles.ini") returned 12 [0077.518] lstrlenA (lpString=".happythreechoose") returned 17 [0077.518] lstrcmpiW (lpString1="profiles.ini", lpString2="Decryption INFO.html") returned 1 [0077.518] lstrcmpiW (lpString1="profiles.ini", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0077.518] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0077.518] lstrcmpiW (lpString1="profiles.ini", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0077.518] GetProcessHeap () returned 0x630000 [0077.518] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0077.518] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0077.519] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=122) returned 1 [0077.519] GetProcessHeap () returned 0x630000 [0077.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6558c8 [0077.519] GetProcessHeap () returned 0x630000 [0077.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673208 [0077.519] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini") returned 60 [0077.519] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0077.519] GetProcessHeap () returned 0x630000 [0077.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0077.519] GetProcessHeap () returned 0x630000 [0077.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x386) returned 0x6741a0 [0077.519] lstrlenA (lpString="rsa_encrypt") returned 11 [0077.519] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x6735c0) returned 1 [0077.520] CryptGenRandom (in: hProv=0x6735c0, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0077.520] CryptReleaseContext (hProv=0x6735c0, dwFlags=0x0) returned 1 [0077.520] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0077.520] GetProcessHeap () returned 0x630000 [0077.520] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672c30 [0077.520] lstrlenA (lpString="010001") returned 6 [0077.520] GetProcessHeap () returned 0x630000 [0077.520] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3f8 [0077.520] GetProcessHeap () returned 0x630000 [0077.520] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6734b0 [0077.520] GetProcessHeap () returned 0x630000 [0077.520] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e460 [0077.520] GetProcessHeap () returned 0x630000 [0077.520] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6734b0 | out: hHeap=0x630000) returned 1 [0077.520] GetProcessHeap () returned 0x630000 [0077.520] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e4f0 [0077.520] GetProcessHeap () returned 0x630000 [0077.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656fe0 [0077.521] GetProcessHeap () returned 0x630000 [0077.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3a8 [0077.521] GetProcessHeap () returned 0x630000 [0077.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0077.521] GetProcessHeap () returned 0x630000 [0077.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.521] GetProcessHeap () returned 0x630000 [0077.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0077.521] GetProcessHeap () returned 0x630000 [0077.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672a98 [0077.521] GetProcessHeap () returned 0x630000 [0077.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656950 [0077.521] GetProcessHeap () returned 0x630000 [0077.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.521] GetProcessHeap () returned 0x630000 [0077.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0077.521] GetProcessHeap () returned 0x630000 [0077.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65df50 [0077.521] GetProcessHeap () returned 0x630000 [0077.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672a98 | out: hHeap=0x630000) returned 1 [0077.521] GetProcessHeap () returned 0x630000 [0077.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0077.521] GetProcessHeap () returned 0x630000 [0077.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0077.521] GetProcessHeap () returned 0x630000 [0077.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.521] GetProcessHeap () returned 0x630000 [0077.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65ceb0 [0077.521] GetProcessHeap () returned 0x630000 [0077.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.521] GetProcessHeap () returned 0x630000 [0077.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.521] GetProcessHeap () returned 0x630000 [0077.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.521] GetProcessHeap () returned 0x630000 [0077.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.521] GetProcessHeap () returned 0x630000 [0077.521] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e850 [0077.521] GetProcessHeap () returned 0x630000 [0077.521] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ceb0 | out: hHeap=0x630000) returned 1 [0077.521] GetProcessHeap () returned 0x630000 [0077.522] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0077.522] GetProcessHeap () returned 0x630000 [0077.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0077.522] GetProcessHeap () returned 0x630000 [0077.522] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.522] GetProcessHeap () returned 0x630000 [0077.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.522] GetProcessHeap () returned 0x630000 [0077.522] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.522] GetProcessHeap () returned 0x630000 [0077.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.522] GetProcessHeap () returned 0x630000 [0077.522] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.522] GetProcessHeap () returned 0x630000 [0077.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.522] GetProcessHeap () returned 0x630000 [0077.522] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.522] GetProcessHeap () returned 0x630000 [0077.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.522] GetProcessHeap () returned 0x630000 [0077.522] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.522] GetProcessHeap () returned 0x630000 [0077.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.522] GetProcessHeap () returned 0x630000 [0077.522] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.522] GetProcessHeap () returned 0x630000 [0077.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.522] GetProcessHeap () returned 0x630000 [0077.522] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0077.522] GetProcessHeap () returned 0x630000 [0077.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0077.522] GetProcessHeap () returned 0x630000 [0077.522] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.522] GetProcessHeap () returned 0x630000 [0077.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.522] GetProcessHeap () returned 0x630000 [0077.522] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.522] GetProcessHeap () returned 0x630000 [0077.522] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.523] GetProcessHeap () returned 0x630000 [0077.523] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.523] GetProcessHeap () returned 0x630000 [0077.523] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.523] GetProcessHeap () returned 0x630000 [0077.523] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.523] GetProcessHeap () returned 0x630000 [0077.523] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.523] GetProcessHeap () returned 0x630000 [0077.523] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.523] GetProcessHeap () returned 0x630000 [0077.523] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.523] GetProcessHeap () returned 0x630000 [0077.523] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.523] GetProcessHeap () returned 0x630000 [0077.523] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.523] GetProcessHeap () returned 0x630000 [0077.523] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.523] GetProcessHeap () returned 0x630000 [0077.523] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.523] GetProcessHeap () returned 0x630000 [0077.523] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.523] GetProcessHeap () returned 0x630000 [0077.523] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.523] GetProcessHeap () returned 0x630000 [0077.523] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.523] GetProcessHeap () returned 0x630000 [0077.523] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.523] GetProcessHeap () returned 0x630000 [0077.523] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.523] GetProcessHeap () returned 0x630000 [0077.523] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.523] GetProcessHeap () returned 0x630000 [0077.523] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.523] GetProcessHeap () returned 0x630000 [0077.523] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.523] GetProcessHeap () returned 0x630000 [0077.523] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.523] GetProcessHeap () returned 0x630000 [0077.524] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.524] GetProcessHeap () returned 0x630000 [0077.524] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0077.524] GetProcessHeap () returned 0x630000 [0077.524] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0077.524] GetProcessHeap () returned 0x630000 [0077.524] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0077.524] GetProcessHeap () returned 0x630000 [0077.524] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0077.524] GetProcessHeap () returned 0x630000 [0077.524] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.524] GetProcessHeap () returned 0x630000 [0077.524] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.524] GetProcessHeap () returned 0x630000 [0077.524] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.524] GetProcessHeap () returned 0x630000 [0077.524] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.524] GetProcessHeap () returned 0x630000 [0077.524] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.524] GetProcessHeap () returned 0x630000 [0077.524] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.524] GetProcessHeap () returned 0x630000 [0077.524] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.524] GetProcessHeap () returned 0x630000 [0077.524] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.524] GetProcessHeap () returned 0x630000 [0077.524] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.524] GetProcessHeap () returned 0x630000 [0077.524] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.524] GetProcessHeap () returned 0x630000 [0077.524] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.524] GetProcessHeap () returned 0x630000 [0077.524] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.524] GetProcessHeap () returned 0x630000 [0077.524] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.524] GetProcessHeap () returned 0x630000 [0077.524] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.524] GetProcessHeap () returned 0x630000 [0077.524] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.524] GetProcessHeap () returned 0x630000 [0077.525] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.525] GetProcessHeap () returned 0x630000 [0077.525] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.525] GetProcessHeap () returned 0x630000 [0077.525] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.525] GetProcessHeap () returned 0x630000 [0077.525] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.525] GetProcessHeap () returned 0x630000 [0077.525] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.525] GetProcessHeap () returned 0x630000 [0077.525] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.525] GetProcessHeap () returned 0x630000 [0077.525] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.525] GetProcessHeap () returned 0x630000 [0077.525] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.525] GetProcessHeap () returned 0x630000 [0077.525] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.525] GetProcessHeap () returned 0x630000 [0077.525] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.525] GetProcessHeap () returned 0x630000 [0077.525] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.525] GetProcessHeap () returned 0x630000 [0077.525] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.525] GetProcessHeap () returned 0x630000 [0077.525] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.525] GetProcessHeap () returned 0x630000 [0077.525] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.525] GetProcessHeap () returned 0x630000 [0077.525] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.525] GetProcessHeap () returned 0x630000 [0077.525] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.525] GetProcessHeap () returned 0x630000 [0077.525] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.525] GetProcessHeap () returned 0x630000 [0077.525] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.525] GetProcessHeap () returned 0x630000 [0077.525] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.525] GetProcessHeap () returned 0x630000 [0077.525] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.525] GetProcessHeap () returned 0x630000 [0077.526] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.526] GetProcessHeap () returned 0x630000 [0077.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.526] GetProcessHeap () returned 0x630000 [0077.526] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.526] GetProcessHeap () returned 0x630000 [0077.526] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.526] GetProcessHeap () returned 0x630000 [0077.526] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.526] GetProcessHeap () returned 0x630000 [0077.526] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0077.526] GetProcessHeap () returned 0x630000 [0077.526] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0077.526] GetProcessHeap () returned 0x630000 [0077.526] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0077.526] GetProcessHeap () returned 0x630000 [0077.526] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0077.526] GetProcessHeap () returned 0x630000 [0077.526] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0077.526] GetProcessHeap () returned 0x630000 [0077.526] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0077.526] GetProcessHeap () returned 0x630000 [0077.526] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0077.526] GetProcessHeap () returned 0x630000 [0077.526] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e460 | out: hHeap=0x630000) returned 1 [0077.526] GetProcessHeap () returned 0x630000 [0077.526] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0077.526] GetProcessHeap () returned 0x630000 [0077.526] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.526] GetProcessHeap () returned 0x630000 [0077.526] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672c30 | out: hHeap=0x630000) returned 1 [0077.526] WriteFile (in: hFile=0x230, lpBuffer=0x6741a0*, nNumberOfBytesToWrite=0x386, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6741a0*, lpNumberOfBytesWritten=0x243d864*=0x386, lpOverlapped=0x0) returned 1 [0077.530] GetProcessHeap () returned 0x630000 [0077.530] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6741a0, Size=0x30) returned 0x6741a0 [0077.530] GetProcessHeap () returned 0x630000 [0077.530] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0077.530] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0077.531] GetProcessHeap () returned 0x630000 [0077.531] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x80) returned 0x672c30 [0077.531] ReadFile (in: hFile=0x230, lpBuffer=0x672c30, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x672c30*, lpNumberOfBytesRead=0x243d7e8*=0x80, lpOverlapped=0x0) returned 1 [0077.531] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0077.531] WriteFile (in: hFile=0x230, lpBuffer=0x672c30*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x672c30*, lpNumberOfBytesWritten=0x243d7e4*=0x80, lpOverlapped=0x0) returned 1 [0077.532] GetProcessHeap () returned 0x630000 [0077.532] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672c30 | out: hHeap=0x630000) returned 1 [0077.532] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0077.532] WriteFile (in: hFile=0x230, lpBuffer=0x6741a0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6741a0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0077.533] CloseHandle (hObject=0x230) returned 1 [0077.533] GetProcessHeap () returned 0x630000 [0077.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0077.533] GetProcessHeap () returned 0x630000 [0077.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6558c8 | out: hHeap=0x630000) returned 1 [0077.533] GetProcessHeap () returned 0x630000 [0077.533] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673208 | out: hHeap=0x630000) returned 1 [0077.533] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" [0077.533] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini.happythreechoose") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini.happythreechoose" [0077.533] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles.ini"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini.happythreechoose" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles.ini.happythreechoose"), dwFlags=0x1) returned 1 [0077.535] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox") returned 1 [0077.535] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\") returned="" [0077.535] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Decryption INFO.html" [0077.535] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\decryption info.html")) returned 0xffffffff [0077.535] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0077.536] GetProcessHeap () returned 0x630000 [0077.536] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655490 [0077.536] GetProcessHeap () returned 0x630000 [0077.536] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672a10 [0077.543] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.543] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.544] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.544] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.544] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.544] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.544] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.544] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.544] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.544] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.544] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.544] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.544] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.545] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.545] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.545] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.545] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.545] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.545] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.545] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.545] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.545] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.545] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.545] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.545] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.545] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.546] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.546] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.546] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.546] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.546] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.546] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.546] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.546] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.546] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.546] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.546] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.547] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.547] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.547] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.547] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.547] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.547] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.548] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.548] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.548] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.548] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.548] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.548] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.548] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.548] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.548] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.548] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.548] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.548] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.548] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.549] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.549] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.549] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.549] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.549] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.549] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.549] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.549] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.549] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.549] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.549] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.549] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.549] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.549] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.550] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.550] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.550] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.550] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.550] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.550] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.550] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.550] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.550] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.550] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.550] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.550] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.550] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.551] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.551] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.551] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.551] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.551] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.551] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.551] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.551] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.551] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.551] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.551] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.551] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.551] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.551] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.552] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.552] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.552] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.552] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.552] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.552] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.552] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.552] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.552] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.552] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.552] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.552] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.552] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.553] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.553] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.553] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.553] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.553] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.553] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.553] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.553] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.553] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.553] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.553] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.553] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.553] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.553] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.554] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.554] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.554] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.554] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.554] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.554] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.554] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.554] GetProcessHeap () returned 0x630000 [0077.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655490 | out: hHeap=0x630000) returned 1 [0077.554] GetProcessHeap () returned 0x630000 [0077.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672a10 | out: hHeap=0x630000) returned 1 [0077.554] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0077.554] GetProcessHeap () returned 0x630000 [0077.554] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6556e8 [0077.554] GetProcessHeap () returned 0x630000 [0077.554] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672b20 [0077.561] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.561] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.561] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.562] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.562] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.562] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.616] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.616] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.616] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.616] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.616] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.616] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.616] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.616] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.616] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.616] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.616] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.617] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.617] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.617] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.617] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.617] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.617] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.617] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.617] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.617] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.617] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.617] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.617] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.617] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.617] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.618] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.618] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.618] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.618] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.618] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.618] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.618] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.618] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.618] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.618] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.618] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.618] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.618] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.619] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.619] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.619] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.619] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.619] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.619] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.619] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.619] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.619] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.619] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.619] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.619] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.619] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.619] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.620] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.620] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.620] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.620] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.620] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.620] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.620] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.620] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.620] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.620] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.620] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.620] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.620] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.621] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.621] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.621] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.621] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.621] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.621] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.621] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.621] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.621] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.621] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.622] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.622] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.622] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.622] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.622] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.622] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.622] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.622] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.622] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.622] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.622] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.622] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.623] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.623] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.623] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.679] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.681] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.681] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.681] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.681] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.682] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.682] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.682] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.682] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.682] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.682] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.682] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.683] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.683] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.683] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.683] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.683] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.683] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.683] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.683] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.683] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.683] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.684] GetProcessHeap () returned 0x630000 [0077.684] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6556e8 | out: hHeap=0x630000) returned 1 [0077.684] GetProcessHeap () returned 0x630000 [0077.684] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672b20 | out: hHeap=0x630000) returned 1 [0077.684] CloseHandle (hObject=0x230) returned 1 [0077.685] GetProcessHeap () returned 0x630000 [0077.685] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0077.685] FindNextFileW (in: hFindFile=0x648710, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x7a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="profiles.ini", cAlternateFileName="")) returned 0 [0077.685] FindClose (in: hFindFile=0x648710 | out: hFindFile=0x648710) returned 1 [0077.685] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\" [0077.685] GetProcessHeap () returned 0x630000 [0077.685] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x63f290 | out: hHeap=0x630000) returned 1 [0077.685] GetProcessHeap () returned 0x630000 [0077.685] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.685] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned 57 [0077.685] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*" [0077.685] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6487d0 [0077.686] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0077.686] FindNextFileW (in: hFindFile=0x6487d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.686] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0077.686] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0077.686] FindNextFileW (in: hFindFile=0x6487d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x6236fa1e, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0x6236fa1e, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="w7cr0hor.default", cAlternateFileName="W7CR0H~1.DEF")) returned 1 [0077.686] lstrcmpiW (lpString1="w7cr0hor.default", lpString2=".") returned 1 [0077.686] lstrcmpiW (lpString1="w7cr0hor.default", lpString2="..") returned 1 [0077.686] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\", lpString2="w7cr0hor.default" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default" [0077.686] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="w7cr0hor.default", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0077.686] GetProcessHeap () returned 0x630000 [0077.687] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11) returned 0x645e58 [0077.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="w7cr0hor.default", cchWideChar=-1, lpMultiByteStr=0x645e58, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="w7cr0hor.default", lpUsedDefaultChar=0x0) returned 17 [0077.687] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="w7cr0hor.default", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0077.687] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="w7cr0hor.default", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0077.687] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="w7cr0hor.default", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0077.687] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="w7cr0hor.default", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0077.687] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="w7cr0hor.default", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0077.687] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="w7cr0hor.default", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0077.687] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="w7cr0hor.default", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0077.687] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="w7cr0hor.default", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0077.687] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="w7cr0hor.default", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0077.687] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="w7cr0hor.default", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0077.687] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="w7cr0hor.default", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0077.687] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="w7cr0hor.default", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0077.687] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="w7cr0hor.default", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0077.687] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="w7cr0hor.default", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0077.687] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="w7cr0hor.default", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0077.687] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="w7cr0hor.default", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0077.687] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="w7cr0hor.default", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0077.687] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="w7cr0hor.default", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0077.687] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="w7cr0hor.default", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0077.687] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="w7cr0hor.default", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0077.687] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="w7cr0hor.default", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0077.687] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="w7cr0hor.default", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0077.688] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="w7cr0hor.default", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0077.688] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="w7cr0hor.default", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0077.688] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="w7cr0hor.default", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 3 [0077.688] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="w7cr0hor.default", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 3 [0077.688] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="w7cr0hor.default", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0077.688] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="w7cr0hor.default", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0077.688] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="w7cr0hor.default", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 3 [0077.688] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="w7cr0hor.default", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 3 [0077.688] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="w7cr0hor.default", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 3 [0077.688] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="w7cr0hor.default", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0077.688] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="w7cr0hor.default", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0077.688] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="w7cr0hor.default", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0077.688] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="w7cr0hor.default", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0077.688] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="w7cr0hor.default", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0077.688] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="w7cr0hor.default", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0077.688] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="w7cr0hor.default", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0077.688] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="w7cr0hor.default", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0077.688] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="w7cr0hor.default", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0077.688] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="w7cr0hor.default", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0077.688] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="w7cr0hor.default", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0077.688] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="w7cr0hor.default", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0077.688] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" [0077.688] GetProcessHeap () returned 0x630000 [0077.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a3b8 [0077.688] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned 74 [0077.688] GetProcessHeap () returned 0x630000 [0077.688] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x96) returned 0x640fb0 [0077.688] lstrcpyW (in: lpString1=0x640fb0, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" [0077.688] GetProcessHeap () returned 0x630000 [0077.688] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645e58 | out: hHeap=0x630000) returned 1 [0077.688] FindNextFileW (in: hFindFile=0x6487d0, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x6236fa1e, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0x6236fa1e, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="w7cr0hor.default", cAlternateFileName="W7CR0H~1.DEF")) returned 0 [0077.689] FindClose (in: hFindFile=0x6487d0 | out: hFindFile=0x6487d0) returned 1 [0077.689] lstrcpyW (in: lpString1=0x243df84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\" [0077.689] GetProcessHeap () returned 0x630000 [0077.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x640fb0 | out: hHeap=0x630000) returned 1 [0077.689] GetProcessHeap () returned 0x630000 [0077.689] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.689] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned 74 [0077.689] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\*") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\*" [0077.689] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\*", lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x6236fa1e, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0x6236fa1e, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x648a10 [0077.691] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0077.691] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x6236fa1e, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0x6236fa1e, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.692] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0077.692] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0077.692] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a3ab44, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8a3ab44, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8a3ab44, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="addons.json", cAlternateFileName="ADDONS~1.JSO")) returned 1 [0077.692] lstrcmpiW (lpString1="addons.json", lpString2=".") returned 1 [0077.692] lstrcmpiW (lpString1="addons.json", lpString2="..") returned 1 [0077.692] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="addons.json" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json" [0077.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="addons.json", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0077.692] GetProcessHeap () returned 0x630000 [0077.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0077.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="addons.json", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="addons.json", lpUsedDefaultChar=0x0) returned 12 [0077.692] lstrlenA (lpString="addons.json") returned 11 [0077.692] lstrlenA (lpString=".happythreechoose") returned 17 [0077.692] lstrcmpiW (lpString1="addons.json", lpString2="Decryption INFO.html") returned -1 [0077.692] lstrcmpiW (lpString1="addons.json", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0077.692] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0077.692] lstrcmpiW (lpString1="addons.json", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0077.692] GetProcessHeap () returned 0x630000 [0077.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f10 [0077.692] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\addons.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0077.693] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=24) returned 1 [0077.693] GetProcessHeap () returned 0x630000 [0077.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655b20 [0077.693] GetProcessHeap () returned 0x630000 [0077.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6736d0 [0077.693] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json") returned 85 [0077.693] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0077.693] GetProcessHeap () returned 0x630000 [0077.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0077.693] GetProcessHeap () returned 0x630000 [0077.693] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x388) returned 0x6741d8 [0077.694] lstrlenA (lpString="rsa_encrypt") returned 11 [0077.694] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x673758) returned 1 [0077.694] CryptGenRandom (in: hProv=0x673758, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0077.694] CryptReleaseContext (hProv=0x673758, dwFlags=0x0) returned 1 [0077.694] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0077.694] GetProcessHeap () returned 0x630000 [0077.694] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6735c0 [0077.694] lstrlenA (lpString="010001") returned 6 [0077.694] GetProcessHeap () returned 0x630000 [0077.694] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3f8 [0077.694] GetProcessHeap () returned 0x630000 [0077.694] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673428 [0077.694] GetProcessHeap () returned 0x630000 [0077.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e3d0 [0077.695] GetProcessHeap () returned 0x630000 [0077.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673428 | out: hHeap=0x630000) returned 1 [0077.695] GetProcessHeap () returned 0x630000 [0077.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0077.695] GetProcessHeap () returned 0x630000 [0077.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656fe0 [0077.695] GetProcessHeap () returned 0x630000 [0077.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0077.695] GetProcessHeap () returned 0x630000 [0077.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0077.695] GetProcessHeap () returned 0x630000 [0077.695] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.695] GetProcessHeap () returned 0x630000 [0077.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0077.695] GetProcessHeap () returned 0x630000 [0077.695] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672d40 [0077.695] GetProcessHeap () returned 0x630000 [0077.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657440 [0077.696] GetProcessHeap () returned 0x630000 [0077.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.696] GetProcessHeap () returned 0x630000 [0077.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0077.696] GetProcessHeap () returned 0x630000 [0077.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65eb20 [0077.696] GetProcessHeap () returned 0x630000 [0077.696] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672d40 | out: hHeap=0x630000) returned 1 [0077.696] GetProcessHeap () returned 0x630000 [0077.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0077.696] GetProcessHeap () returned 0x630000 [0077.696] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0077.696] GetProcessHeap () returned 0x630000 [0077.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.696] GetProcessHeap () returned 0x630000 [0077.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cfb8 [0077.696] GetProcessHeap () returned 0x630000 [0077.696] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.696] GetProcessHeap () returned 0x630000 [0077.696] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.696] GetProcessHeap () returned 0x630000 [0077.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.696] GetProcessHeap () returned 0x630000 [0077.696] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.696] GetProcessHeap () returned 0x630000 [0077.696] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e8e0 [0077.696] GetProcessHeap () returned 0x630000 [0077.696] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cfb8 | out: hHeap=0x630000) returned 1 [0077.696] GetProcessHeap () returned 0x630000 [0077.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0077.697] GetProcessHeap () returned 0x630000 [0077.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0077.697] GetProcessHeap () returned 0x630000 [0077.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.697] GetProcessHeap () returned 0x630000 [0077.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.697] GetProcessHeap () returned 0x630000 [0077.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.697] GetProcessHeap () returned 0x630000 [0077.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.697] GetProcessHeap () returned 0x630000 [0077.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.697] GetProcessHeap () returned 0x630000 [0077.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.697] GetProcessHeap () returned 0x630000 [0077.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.697] GetProcessHeap () returned 0x630000 [0077.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.697] GetProcessHeap () returned 0x630000 [0077.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0077.697] GetProcessHeap () returned 0x630000 [0077.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0077.697] GetProcessHeap () returned 0x630000 [0077.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0077.697] GetProcessHeap () returned 0x630000 [0077.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0077.697] GetProcessHeap () returned 0x630000 [0077.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.697] GetProcessHeap () returned 0x630000 [0077.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.697] GetProcessHeap () returned 0x630000 [0077.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.697] GetProcessHeap () returned 0x630000 [0077.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.697] GetProcessHeap () returned 0x630000 [0077.697] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.697] GetProcessHeap () returned 0x630000 [0077.697] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.698] GetProcessHeap () returned 0x630000 [0077.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.698] GetProcessHeap () returned 0x630000 [0077.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.698] GetProcessHeap () returned 0x630000 [0077.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.698] GetProcessHeap () returned 0x630000 [0077.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.698] GetProcessHeap () returned 0x630000 [0077.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.698] GetProcessHeap () returned 0x630000 [0077.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.698] GetProcessHeap () returned 0x630000 [0077.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.698] GetProcessHeap () returned 0x630000 [0077.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.698] GetProcessHeap () returned 0x630000 [0077.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.698] GetProcessHeap () returned 0x630000 [0077.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.698] GetProcessHeap () returned 0x630000 [0077.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.698] GetProcessHeap () returned 0x630000 [0077.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.698] GetProcessHeap () returned 0x630000 [0077.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.698] GetProcessHeap () returned 0x630000 [0077.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.698] GetProcessHeap () returned 0x630000 [0077.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.698] GetProcessHeap () returned 0x630000 [0077.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.698] GetProcessHeap () returned 0x630000 [0077.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.698] GetProcessHeap () returned 0x630000 [0077.698] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.698] GetProcessHeap () returned 0x630000 [0077.698] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.699] GetProcessHeap () returned 0x630000 [0077.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.699] GetProcessHeap () returned 0x630000 [0077.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.699] GetProcessHeap () returned 0x630000 [0077.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.699] GetProcessHeap () returned 0x630000 [0077.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.699] GetProcessHeap () returned 0x630000 [0077.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.699] GetProcessHeap () returned 0x630000 [0077.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.699] GetProcessHeap () returned 0x630000 [0077.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.699] GetProcessHeap () returned 0x630000 [0077.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.699] GetProcessHeap () returned 0x630000 [0077.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.699] GetProcessHeap () returned 0x630000 [0077.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0077.699] GetProcessHeap () returned 0x630000 [0077.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0077.699] GetProcessHeap () returned 0x630000 [0077.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.699] GetProcessHeap () returned 0x630000 [0077.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.699] GetProcessHeap () returned 0x630000 [0077.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.699] GetProcessHeap () returned 0x630000 [0077.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.699] GetProcessHeap () returned 0x630000 [0077.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0077.699] GetProcessHeap () returned 0x630000 [0077.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0077.699] GetProcessHeap () returned 0x630000 [0077.699] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.699] GetProcessHeap () returned 0x630000 [0077.699] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.699] GetProcessHeap () returned 0x630000 [0077.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.700] GetProcessHeap () returned 0x630000 [0077.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.700] GetProcessHeap () returned 0x630000 [0077.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.700] GetProcessHeap () returned 0x630000 [0077.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.700] GetProcessHeap () returned 0x630000 [0077.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.700] GetProcessHeap () returned 0x630000 [0077.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.700] GetProcessHeap () returned 0x630000 [0077.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.700] GetProcessHeap () returned 0x630000 [0077.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.700] GetProcessHeap () returned 0x630000 [0077.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.700] GetProcessHeap () returned 0x630000 [0077.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.700] GetProcessHeap () returned 0x630000 [0077.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.700] GetProcessHeap () returned 0x630000 [0077.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.700] GetProcessHeap () returned 0x630000 [0077.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.700] GetProcessHeap () returned 0x630000 [0077.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.700] GetProcessHeap () returned 0x630000 [0077.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.700] GetProcessHeap () returned 0x630000 [0077.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.700] GetProcessHeap () returned 0x630000 [0077.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.700] GetProcessHeap () returned 0x630000 [0077.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.700] GetProcessHeap () returned 0x630000 [0077.700] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.700] GetProcessHeap () returned 0x630000 [0077.700] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.701] GetProcessHeap () returned 0x630000 [0077.701] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.701] GetProcessHeap () returned 0x630000 [0077.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.701] GetProcessHeap () returned 0x630000 [0077.701] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0077.701] GetProcessHeap () returned 0x630000 [0077.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0077.701] GetProcessHeap () returned 0x630000 [0077.701] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.701] GetProcessHeap () returned 0x630000 [0077.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.701] GetProcessHeap () returned 0x630000 [0077.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0077.701] GetProcessHeap () returned 0x630000 [0077.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0077.701] GetProcessHeap () returned 0x630000 [0077.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0077.701] GetProcessHeap () returned 0x630000 [0077.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0077.701] GetProcessHeap () returned 0x630000 [0077.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0077.701] GetProcessHeap () returned 0x630000 [0077.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0077.701] GetProcessHeap () returned 0x630000 [0077.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0077.701] GetProcessHeap () returned 0x630000 [0077.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0077.701] GetProcessHeap () returned 0x630000 [0077.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0077.701] GetProcessHeap () returned 0x630000 [0077.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.701] GetProcessHeap () returned 0x630000 [0077.701] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6735c0 | out: hHeap=0x630000) returned 1 [0077.701] WriteFile (in: hFile=0x230, lpBuffer=0x6741d8*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6741d8*, lpNumberOfBytesWritten=0x243d864*=0x388, lpOverlapped=0x0) returned 1 [0077.706] GetProcessHeap () returned 0x630000 [0077.706] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6741d8, Size=0x30) returned 0x6741d8 [0077.706] GetProcessHeap () returned 0x630000 [0077.706] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0077.706] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0077.706] GetProcessHeap () returned 0x630000 [0077.707] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x20) returned 0x651f88 [0077.707] ReadFile (in: hFile=0x230, lpBuffer=0x651f88, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x651f88*, lpNumberOfBytesRead=0x243d7e8*=0x20, lpOverlapped=0x0) returned 1 [0077.707] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0077.707] WriteFile (in: hFile=0x230, lpBuffer=0x651f88*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x651f88*, lpNumberOfBytesWritten=0x243d7e4*=0x20, lpOverlapped=0x0) returned 1 [0077.708] GetProcessHeap () returned 0x630000 [0077.708] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0077.708] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0077.708] WriteFile (in: hFile=0x230, lpBuffer=0x6741d8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6741d8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0077.709] CloseHandle (hObject=0x230) returned 1 [0077.709] GetProcessHeap () returned 0x630000 [0077.709] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f10 | out: hHeap=0x630000) returned 1 [0077.709] GetProcessHeap () returned 0x630000 [0077.709] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655b20 | out: hHeap=0x630000) returned 1 [0077.709] GetProcessHeap () returned 0x630000 [0077.709] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6736d0 | out: hHeap=0x630000) returned 1 [0077.709] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json" [0077.709] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json.happythreechoose") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json.happythreechoose" [0077.709] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\addons.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json.happythreechoose" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\addons.json.happythreechoose"), dwFlags=0x1) returned 1 [0077.710] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addons.json" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0077.710] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="" [0077.710] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html" [0077.710] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\decryption info.html")) returned 0xffffffff [0077.710] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\decryption info.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0077.711] GetProcessHeap () returned 0x630000 [0077.711] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6556e8 [0077.711] GetProcessHeap () returned 0x630000 [0077.711] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673208 [0077.718] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.719] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.719] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.719] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.719] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.720] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.720] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.720] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.720] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.720] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.720] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.720] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.720] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.720] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.720] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.720] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.720] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.721] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.721] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.721] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.721] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.721] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.721] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.721] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.721] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.721] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.721] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.721] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.721] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.722] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.722] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.722] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.722] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.722] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.722] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.722] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.722] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.723] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.723] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.723] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.723] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.723] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.723] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.723] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.723] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.723] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.724] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.724] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.724] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.724] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.724] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.724] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.724] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.724] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.724] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.724] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.725] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.725] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.725] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.725] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.725] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.725] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.725] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.725] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.725] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.725] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.726] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.726] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.726] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.726] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.726] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.726] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.726] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.726] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.726] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.726] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.727] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.727] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.727] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.727] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.727] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.727] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.727] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.727] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.727] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.727] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.727] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.728] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.728] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.728] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.728] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.728] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.728] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.728] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.728] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.728] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.728] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.728] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.728] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.728] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.729] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.729] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.729] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.729] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.729] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.729] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.729] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.729] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.729] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.729] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.729] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.729] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.730] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.730] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.730] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.730] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.730] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.730] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.730] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.730] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.730] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.730] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.730] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.730] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.731] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.731] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.731] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.731] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.731] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.731] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.731] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.731] GetProcessHeap () returned 0x630000 [0077.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6556e8 | out: hHeap=0x630000) returned 1 [0077.731] GetProcessHeap () returned 0x630000 [0077.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673208 | out: hHeap=0x630000) returned 1 [0077.731] WriteFile (in: hFile=0x230, lpBuffer=0x40c650*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x243d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c650*, lpNumberOfBytesWritten=0x243d9d0*=0x300, lpOverlapped=0x0) returned 1 [0077.731] GetProcessHeap () returned 0x630000 [0077.731] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655490 [0077.731] GetProcessHeap () returned 0x630000 [0077.731] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673538 [0077.738] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.738] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.738] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.738] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.739] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.739] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.739] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.739] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.739] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.739] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.739] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.739] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.739] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.739] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.739] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.739] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.740] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.740] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.740] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.740] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.740] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.740] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.740] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.740] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.740] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.740] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.740] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.740] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.740] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.741] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.741] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.741] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.741] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.741] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.741] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.741] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.741] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.741] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.741] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.741] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.741] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.742] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.742] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.742] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.742] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.742] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.742] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.742] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.742] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.742] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.742] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.742] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.742] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.781] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.781] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.782] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.783] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.783] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.783] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.783] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.783] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.783] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.783] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.783] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.783] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.783] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.783] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.784] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.784] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.784] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.784] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.784] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.784] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.784] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.784] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.784] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.784] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.784] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.784] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.785] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.785] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.785] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.785] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.785] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.785] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.785] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.785] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.785] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.785] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.785] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.785] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.786] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.786] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.786] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.786] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.786] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.786] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.786] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.786] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.786] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.786] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.786] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.786] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.787] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.787] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.787] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.787] WriteFile (in: hFile=0x230, lpBuffer=0x243d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x243d7ec*, lpNumberOfBytesWritten=0x243d7e8*=0x10, lpOverlapped=0x0) returned 1 [0077.788] GetProcessHeap () returned 0x630000 [0077.788] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655490 | out: hHeap=0x630000) returned 1 [0077.788] GetProcessHeap () returned 0x630000 [0077.788] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673538 | out: hHeap=0x630000) returned 1 [0077.788] CloseHandle (hObject=0x230) returned 1 [0077.788] GetProcessHeap () returned 0x630000 [0077.788] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0077.788] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfea98376, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfea98376, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfea98376, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x291, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="addonStartup.json.lz4", cAlternateFileName="ADDONS~1.LZ4")) returned 1 [0077.788] lstrcmpiW (lpString1="addonStartup.json.lz4", lpString2=".") returned 1 [0077.788] lstrcmpiW (lpString1="addonStartup.json.lz4", lpString2="..") returned 1 [0077.788] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="addonStartup.json.lz4" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4" [0077.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="addonStartup.json.lz4", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0077.788] GetProcessHeap () returned 0x630000 [0077.788] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x645c58 [0077.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="addonStartup.json.lz4", cchWideChar=-1, lpMultiByteStr=0x645c58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="addonStartup.json.lz4", lpUsedDefaultChar=0x0) returned 22 [0077.788] lstrlenA (lpString="addonStartup.json.lz4") returned 21 [0077.788] lstrlenA (lpString=".happythreechoose") returned 17 [0077.788] lstrlenA (lpString=".happythreechoose") returned 17 [0077.788] lstrlenA (lpString="addonStartup.json.lz4") returned 21 [0077.788] lstrcmpiA (lpString1="nStartup.json.lz4", lpString2=".happythreechoose") returned 1 [0077.788] lstrcmpiW (lpString1="addonStartup.json.lz4", lpString2="Decryption INFO.html") returned -1 [0077.788] lstrcmpiW (lpString1="addonStartup.json.lz4", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0077.788] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0077.788] lstrcmpiW (lpString1="addonStartup.json.lz4", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0077.788] GetProcessHeap () returned 0x630000 [0077.788] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0077.788] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\addonstartup.json.lz4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0077.789] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=657) returned 1 [0077.789] GetProcessHeap () returned 0x630000 [0077.789] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655580 [0077.789] GetProcessHeap () returned 0x630000 [0077.790] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672a10 [0077.790] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4") returned 95 [0077.790] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0077.790] GetProcessHeap () returned 0x630000 [0077.790] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0077.790] GetProcessHeap () returned 0x630000 [0077.790] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38f) returned 0x674210 [0077.790] lstrlenA (lpString="rsa_encrypt") returned 11 [0077.790] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x6737e0) returned 1 [0077.790] CryptGenRandom (in: hProv=0x6737e0, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0077.790] CryptReleaseContext (hProv=0x6737e0, dwFlags=0x0) returned 1 [0077.790] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0077.790] GetProcessHeap () returned 0x630000 [0077.790] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673208 [0077.790] lstrlenA (lpString="010001") returned 6 [0077.790] GetProcessHeap () returned 0x630000 [0077.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a348 [0077.791] GetProcessHeap () returned 0x630000 [0077.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672f60 [0077.791] GetProcessHeap () returned 0x630000 [0077.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0077.791] GetProcessHeap () returned 0x630000 [0077.791] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672f60 | out: hHeap=0x630000) returned 1 [0077.791] GetProcessHeap () returned 0x630000 [0077.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dfe0 [0077.791] GetProcessHeap () returned 0x630000 [0077.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657210 [0077.791] GetProcessHeap () returned 0x630000 [0077.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3a8 [0077.791] GetProcessHeap () returned 0x630000 [0077.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0077.791] GetProcessHeap () returned 0x630000 [0077.791] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.791] GetProcessHeap () returned 0x630000 [0077.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0077.791] GetProcessHeap () returned 0x630000 [0077.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673180 [0077.791] GetProcessHeap () returned 0x630000 [0077.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657558 [0077.791] GetProcessHeap () returned 0x630000 [0077.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.791] GetProcessHeap () returned 0x630000 [0077.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0077.791] GetProcessHeap () returned 0x630000 [0077.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0077.791] GetProcessHeap () returned 0x630000 [0077.791] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673180 | out: hHeap=0x630000) returned 1 [0077.791] GetProcessHeap () returned 0x630000 [0077.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0077.791] GetProcessHeap () returned 0x630000 [0077.791] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0077.791] GetProcessHeap () returned 0x630000 [0077.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.791] GetProcessHeap () returned 0x630000 [0077.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0077.791] GetProcessHeap () returned 0x630000 [0077.792] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.792] GetProcessHeap () returned 0x630000 [0077.792] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.792] GetProcessHeap () returned 0x630000 [0077.792] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.792] GetProcessHeap () returned 0x630000 [0077.792] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.792] GetProcessHeap () returned 0x630000 [0077.792] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e850 [0077.792] GetProcessHeap () returned 0x630000 [0077.792] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0077.792] GetProcessHeap () returned 0x630000 [0077.792] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0077.792] GetProcessHeap () returned 0x630000 [0077.792] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0077.792] GetProcessHeap () returned 0x630000 [0077.792] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.792] GetProcessHeap () returned 0x630000 [0077.792] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.792] GetProcessHeap () returned 0x630000 [0077.792] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.792] GetProcessHeap () returned 0x630000 [0077.792] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.792] GetProcessHeap () returned 0x630000 [0077.792] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.792] GetProcessHeap () returned 0x630000 [0077.792] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.792] GetProcessHeap () returned 0x630000 [0077.792] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.792] GetProcessHeap () returned 0x630000 [0077.792] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.792] GetProcessHeap () returned 0x630000 [0077.792] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.792] GetProcessHeap () returned 0x630000 [0077.792] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.792] GetProcessHeap () returned 0x630000 [0077.792] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.792] GetProcessHeap () returned 0x630000 [0077.792] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.792] GetProcessHeap () returned 0x630000 [0077.793] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.793] GetProcessHeap () returned 0x630000 [0077.793] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.793] GetProcessHeap () returned 0x630000 [0077.793] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.793] GetProcessHeap () returned 0x630000 [0077.793] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.793] GetProcessHeap () returned 0x630000 [0077.793] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.793] GetProcessHeap () returned 0x630000 [0077.793] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.793] GetProcessHeap () returned 0x630000 [0077.793] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.793] GetProcessHeap () returned 0x630000 [0077.793] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.793] GetProcessHeap () returned 0x630000 [0077.793] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.793] GetProcessHeap () returned 0x630000 [0077.793] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.793] GetProcessHeap () returned 0x630000 [0077.793] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.793] GetProcessHeap () returned 0x630000 [0077.793] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.793] GetProcessHeap () returned 0x630000 [0077.793] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.793] GetProcessHeap () returned 0x630000 [0077.793] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.793] GetProcessHeap () returned 0x630000 [0077.793] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.793] GetProcessHeap () returned 0x630000 [0077.793] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.793] GetProcessHeap () returned 0x630000 [0077.793] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.793] GetProcessHeap () returned 0x630000 [0077.793] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.793] GetProcessHeap () returned 0x630000 [0077.793] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0077.793] GetProcessHeap () returned 0x630000 [0077.794] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0077.794] GetProcessHeap () returned 0x630000 [0077.794] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.794] GetProcessHeap () returned 0x630000 [0077.794] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.794] GetProcessHeap () returned 0x630000 [0077.794] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.794] GetProcessHeap () returned 0x630000 [0077.794] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.794] GetProcessHeap () returned 0x630000 [0077.794] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.794] GetProcessHeap () returned 0x630000 [0077.794] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.794] GetProcessHeap () returned 0x630000 [0077.794] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.794] GetProcessHeap () returned 0x630000 [0077.794] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.794] GetProcessHeap () returned 0x630000 [0077.794] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.794] GetProcessHeap () returned 0x630000 [0077.794] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.794] GetProcessHeap () returned 0x630000 [0077.794] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.794] GetProcessHeap () returned 0x630000 [0077.794] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.794] GetProcessHeap () returned 0x630000 [0077.794] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.794] GetProcessHeap () returned 0x630000 [0077.794] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.794] GetProcessHeap () returned 0x630000 [0077.794] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.794] GetProcessHeap () returned 0x630000 [0077.794] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.794] GetProcessHeap () returned 0x630000 [0077.794] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.794] GetProcessHeap () returned 0x630000 [0077.794] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.794] GetProcessHeap () returned 0x630000 [0077.794] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0077.795] GetProcessHeap () returned 0x630000 [0077.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0077.795] GetProcessHeap () returned 0x630000 [0077.795] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.795] GetProcessHeap () returned 0x630000 [0077.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.795] GetProcessHeap () returned 0x630000 [0077.795] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.795] GetProcessHeap () returned 0x630000 [0077.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.795] GetProcessHeap () returned 0x630000 [0077.795] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.795] GetProcessHeap () returned 0x630000 [0077.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.795] GetProcessHeap () returned 0x630000 [0077.795] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.795] GetProcessHeap () returned 0x630000 [0077.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.795] GetProcessHeap () returned 0x630000 [0077.795] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.795] GetProcessHeap () returned 0x630000 [0077.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.795] GetProcessHeap () returned 0x630000 [0077.795] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0077.795] GetProcessHeap () returned 0x630000 [0077.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0077.795] GetProcessHeap () returned 0x630000 [0077.795] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.795] GetProcessHeap () returned 0x630000 [0077.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.795] GetProcessHeap () returned 0x630000 [0077.795] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.795] GetProcessHeap () returned 0x630000 [0077.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.795] GetProcessHeap () returned 0x630000 [0077.795] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.795] GetProcessHeap () returned 0x630000 [0077.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.795] GetProcessHeap () returned 0x630000 [0077.795] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.796] GetProcessHeap () returned 0x630000 [0077.796] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.796] GetProcessHeap () returned 0x630000 [0077.796] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.796] GetProcessHeap () returned 0x630000 [0077.796] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.796] GetProcessHeap () returned 0x630000 [0077.796] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.796] GetProcessHeap () returned 0x630000 [0077.796] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.796] GetProcessHeap () returned 0x630000 [0077.796] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.796] GetProcessHeap () returned 0x630000 [0077.796] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.796] GetProcessHeap () returned 0x630000 [0077.796] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.796] GetProcessHeap () returned 0x630000 [0077.796] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.796] GetProcessHeap () returned 0x630000 [0077.796] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.796] GetProcessHeap () returned 0x630000 [0077.796] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.796] GetProcessHeap () returned 0x630000 [0077.796] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0077.796] GetProcessHeap () returned 0x630000 [0077.796] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0077.796] GetProcessHeap () returned 0x630000 [0077.796] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0077.796] GetProcessHeap () returned 0x630000 [0077.796] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0077.796] GetProcessHeap () returned 0x630000 [0077.796] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0077.796] GetProcessHeap () returned 0x630000 [0077.796] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0077.796] GetProcessHeap () returned 0x630000 [0077.796] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0077.796] GetProcessHeap () returned 0x630000 [0077.796] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0077.797] GetProcessHeap () returned 0x630000 [0077.797] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0077.797] GetProcessHeap () returned 0x630000 [0077.797] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.797] GetProcessHeap () returned 0x630000 [0077.797] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673208 | out: hHeap=0x630000) returned 1 [0077.797] WriteFile (in: hFile=0x230, lpBuffer=0x674210*, nNumberOfBytesToWrite=0x38f, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x674210*, lpNumberOfBytesWritten=0x243d864*=0x38f, lpOverlapped=0x0) returned 1 [0077.800] GetProcessHeap () returned 0x630000 [0077.800] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x674210, Size=0x30) returned 0x674210 [0077.800] GetProcessHeap () returned 0x630000 [0077.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0077.800] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0077.800] GetProcessHeap () returned 0x630000 [0077.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2a0) returned 0x659cc0 [0077.800] ReadFile (in: hFile=0x230, lpBuffer=0x659cc0, nNumberOfBytesToRead=0x2a0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x659cc0*, lpNumberOfBytesRead=0x243d7e8*=0x2a0, lpOverlapped=0x0) returned 1 [0077.801] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0077.801] WriteFile (in: hFile=0x230, lpBuffer=0x659cc0*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x659cc0*, lpNumberOfBytesWritten=0x243d7e4*=0x2a0, lpOverlapped=0x0) returned 1 [0077.802] GetProcessHeap () returned 0x630000 [0077.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x659cc0 | out: hHeap=0x630000) returned 1 [0077.802] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0077.802] WriteFile (in: hFile=0x230, lpBuffer=0x674210*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x674210*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0077.803] CloseHandle (hObject=0x230) returned 1 [0077.803] GetProcessHeap () returned 0x630000 [0077.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0077.803] GetProcessHeap () returned 0x630000 [0077.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655580 | out: hHeap=0x630000) returned 1 [0077.803] GetProcessHeap () returned 0x630000 [0077.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672a10 | out: hHeap=0x630000) returned 1 [0077.803] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4" [0077.803] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4.happythreechoose") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4.happythreechoose" [0077.803] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\addonstartup.json.lz4"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4.happythreechoose" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\addonstartup.json.lz4.happythreechoose"), dwFlags=0x1) returned 1 [0077.804] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\addonStartup.json.lz4" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0077.804] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="" [0077.804] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html" [0077.804] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\decryption info.html")) returned 0x20 [0077.804] GetProcessHeap () returned 0x630000 [0077.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645c58 | out: hHeap=0x630000) returned 1 [0077.804] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x143f0f49, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x143f0f49, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x621cbf79, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AlternateServices.txt", cAlternateFileName="ALTERN~1.TXT")) returned 1 [0077.804] lstrcmpiW (lpString1="AlternateServices.txt", lpString2=".") returned 1 [0077.804] lstrcmpiW (lpString1="AlternateServices.txt", lpString2="..") returned 1 [0077.804] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="AlternateServices.txt" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\AlternateServices.txt") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\AlternateServices.txt" [0077.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AlternateServices.txt", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0077.804] GetProcessHeap () returned 0x630000 [0077.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x645f58 [0077.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AlternateServices.txt", cchWideChar=-1, lpMultiByteStr=0x645f58, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AlternateServices.txt", lpUsedDefaultChar=0x0) returned 22 [0077.804] lstrlenA (lpString="AlternateServices.txt") returned 21 [0077.804] lstrlenA (lpString=".happythreechoose") returned 17 [0077.805] lstrlenA (lpString=".happythreechoose") returned 17 [0077.805] lstrlenA (lpString="AlternateServices.txt") returned 21 [0077.805] lstrcmpiA (lpString1="rnateServices.txt", lpString2=".happythreechoose") returned 1 [0077.805] lstrcmpiW (lpString1="AlternateServices.txt", lpString2="Decryption INFO.html") returned -1 [0077.805] lstrcmpiW (lpString1="AlternateServices.txt", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0077.805] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0077.805] lstrcmpiW (lpString1="AlternateServices.txt", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0077.805] GetProcessHeap () returned 0x630000 [0077.805] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0077.805] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\AlternateServices.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\alternateservices.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0077.806] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=0) returned 1 [0077.806] CloseHandle (hObject=0x230) returned 1 [0077.806] GetProcessHeap () returned 0x630000 [0077.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0077.806] GetProcessHeap () returned 0x630000 [0077.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645f58 | out: hHeap=0x630000) returned 1 [0077.806] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc28c5b26, ftCreationTime.dwHighDateTime=0x1d5d80b, ftLastAccessTime.dwLowDateTime=0xc28c5b26, ftLastAccessTime.dwHighDateTime=0x1d5d80b, ftLastWriteTime.dwLowDateTime=0xc28c5b26, ftLastWriteTime.dwHighDateTime=0x1d5d80b, nFileSizeHigh=0x0, nFileSizeLow=0xd33d4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="blocklist.xml", cAlternateFileName="BLOCKL~1.XML")) returned 1 [0077.806] lstrcmpiW (lpString1="blocklist.xml", lpString2=".") returned 1 [0077.806] lstrcmpiW (lpString1="blocklist.xml", lpString2="..") returned 1 [0077.806] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="blocklist.xml" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml" [0077.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blocklist.xml", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0077.806] GetProcessHeap () returned 0x630000 [0077.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x64c9f0 [0077.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="blocklist.xml", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="blocklist.xml", lpUsedDefaultChar=0x0) returned 14 [0077.806] lstrlenA (lpString="blocklist.xml") returned 13 [0077.806] lstrlenA (lpString=".happythreechoose") returned 17 [0077.806] lstrcmpiW (lpString1="blocklist.xml", lpString2="Decryption INFO.html") returned -1 [0077.806] lstrcmpiW (lpString1="blocklist.xml", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0077.806] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0077.806] lstrcmpiW (lpString1="blocklist.xml", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0077.806] GetProcessHeap () returned 0x630000 [0077.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0077.807] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\blocklist.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0077.807] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=865236) returned 1 [0077.807] GetProcessHeap () returned 0x630000 [0077.807] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655760 [0077.807] GetProcessHeap () returned 0x630000 [0077.807] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673318 [0077.807] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml") returned 87 [0077.807] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0077.808] GetProcessHeap () returned 0x630000 [0077.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0077.808] GetProcessHeap () returned 0x630000 [0077.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x674248 [0077.808] lstrlenA (lpString="rsa_encrypt") returned 11 [0077.808] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x6733a0) returned 1 [0077.808] CryptGenRandom (in: hProv=0x6733a0, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0077.808] CryptReleaseContext (hProv=0x6733a0, dwFlags=0x0) returned 1 [0077.808] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0077.808] GetProcessHeap () returned 0x630000 [0077.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672a10 [0077.808] lstrlenA (lpString="010001") returned 6 [0077.808] GetProcessHeap () returned 0x630000 [0077.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a298 [0077.808] GetProcessHeap () returned 0x630000 [0077.808] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672ed8 [0077.808] GetProcessHeap () returned 0x630000 [0077.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dfe0 [0077.809] GetProcessHeap () returned 0x630000 [0077.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672ed8 | out: hHeap=0x630000) returned 1 [0077.809] GetProcessHeap () returned 0x630000 [0077.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ecd0 [0077.809] GetProcessHeap () returned 0x630000 [0077.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656950 [0077.809] GetProcessHeap () returned 0x630000 [0077.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3f8 [0077.809] GetProcessHeap () returned 0x630000 [0077.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0077.809] GetProcessHeap () returned 0x630000 [0077.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.809] GetProcessHeap () returned 0x630000 [0077.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0077.809] GetProcessHeap () returned 0x630000 [0077.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672d40 [0077.809] GetProcessHeap () returned 0x630000 [0077.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656db0 [0077.809] GetProcessHeap () returned 0x630000 [0077.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.809] GetProcessHeap () returned 0x630000 [0077.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0077.809] GetProcessHeap () returned 0x630000 [0077.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0077.809] GetProcessHeap () returned 0x630000 [0077.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672d40 | out: hHeap=0x630000) returned 1 [0077.809] GetProcessHeap () returned 0x630000 [0077.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0077.809] GetProcessHeap () returned 0x630000 [0077.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0077.809] GetProcessHeap () returned 0x630000 [0077.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.809] GetProcessHeap () returned 0x630000 [0077.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cd78 [0077.809] GetProcessHeap () returned 0x630000 [0077.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.809] GetProcessHeap () returned 0x630000 [0077.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.809] GetProcessHeap () returned 0x630000 [0077.809] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.809] GetProcessHeap () returned 0x630000 [0077.809] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.810] GetProcessHeap () returned 0x630000 [0077.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e730 [0077.810] GetProcessHeap () returned 0x630000 [0077.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cd78 | out: hHeap=0x630000) returned 1 [0077.810] GetProcessHeap () returned 0x630000 [0077.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0077.810] GetProcessHeap () returned 0x630000 [0077.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0077.810] GetProcessHeap () returned 0x630000 [0077.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.810] GetProcessHeap () returned 0x630000 [0077.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.810] GetProcessHeap () returned 0x630000 [0077.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.810] GetProcessHeap () returned 0x630000 [0077.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.810] GetProcessHeap () returned 0x630000 [0077.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0077.810] GetProcessHeap () returned 0x630000 [0077.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0077.810] GetProcessHeap () returned 0x630000 [0077.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.810] GetProcessHeap () returned 0x630000 [0077.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.810] GetProcessHeap () returned 0x630000 [0077.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.810] GetProcessHeap () returned 0x630000 [0077.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.810] GetProcessHeap () returned 0x630000 [0077.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.810] GetProcessHeap () returned 0x630000 [0077.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.810] GetProcessHeap () returned 0x630000 [0077.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.810] GetProcessHeap () returned 0x630000 [0077.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.810] GetProcessHeap () returned 0x630000 [0077.810] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.810] GetProcessHeap () returned 0x630000 [0077.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.811] GetProcessHeap () returned 0x630000 [0077.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.811] GetProcessHeap () returned 0x630000 [0077.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.811] GetProcessHeap () returned 0x630000 [0077.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.811] GetProcessHeap () returned 0x630000 [0077.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.811] GetProcessHeap () returned 0x630000 [0077.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.811] GetProcessHeap () returned 0x630000 [0077.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.811] GetProcessHeap () returned 0x630000 [0077.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.811] GetProcessHeap () returned 0x630000 [0077.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.811] GetProcessHeap () returned 0x630000 [0077.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.811] GetProcessHeap () returned 0x630000 [0077.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.811] GetProcessHeap () returned 0x630000 [0077.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.811] GetProcessHeap () returned 0x630000 [0077.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.811] GetProcessHeap () returned 0x630000 [0077.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.811] GetProcessHeap () returned 0x630000 [0077.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.811] GetProcessHeap () returned 0x630000 [0077.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.811] GetProcessHeap () returned 0x630000 [0077.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.811] GetProcessHeap () returned 0x630000 [0077.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0077.811] GetProcessHeap () returned 0x630000 [0077.811] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0077.811] GetProcessHeap () returned 0x630000 [0077.811] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.811] GetProcessHeap () returned 0x630000 [0077.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.812] GetProcessHeap () returned 0x630000 [0077.812] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.812] GetProcessHeap () returned 0x630000 [0077.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.812] GetProcessHeap () returned 0x630000 [0077.812] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.812] GetProcessHeap () returned 0x630000 [0077.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.812] GetProcessHeap () returned 0x630000 [0077.812] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.812] GetProcessHeap () returned 0x630000 [0077.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.812] GetProcessHeap () returned 0x630000 [0077.812] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.812] GetProcessHeap () returned 0x630000 [0077.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.812] GetProcessHeap () returned 0x630000 [0077.812] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.812] GetProcessHeap () returned 0x630000 [0077.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.812] GetProcessHeap () returned 0x630000 [0077.812] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.812] GetProcessHeap () returned 0x630000 [0077.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.812] GetProcessHeap () returned 0x630000 [0077.812] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.812] GetProcessHeap () returned 0x630000 [0077.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.812] GetProcessHeap () returned 0x630000 [0077.812] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.812] GetProcessHeap () returned 0x630000 [0077.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.812] GetProcessHeap () returned 0x630000 [0077.812] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.812] GetProcessHeap () returned 0x630000 [0077.812] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.812] GetProcessHeap () returned 0x630000 [0077.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.813] GetProcessHeap () returned 0x630000 [0077.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.813] GetProcessHeap () returned 0x630000 [0077.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.813] GetProcessHeap () returned 0x630000 [0077.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.813] GetProcessHeap () returned 0x630000 [0077.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.813] GetProcessHeap () returned 0x630000 [0077.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.813] GetProcessHeap () returned 0x630000 [0077.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.813] GetProcessHeap () returned 0x630000 [0077.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.813] GetProcessHeap () returned 0x630000 [0077.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0077.813] GetProcessHeap () returned 0x630000 [0077.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0077.813] GetProcessHeap () returned 0x630000 [0077.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.813] GetProcessHeap () returned 0x630000 [0077.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.813] GetProcessHeap () returned 0x630000 [0077.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.813] GetProcessHeap () returned 0x630000 [0077.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.813] GetProcessHeap () returned 0x630000 [0077.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.813] GetProcessHeap () returned 0x630000 [0077.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.813] GetProcessHeap () returned 0x630000 [0077.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.813] GetProcessHeap () returned 0x630000 [0077.813] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.813] GetProcessHeap () returned 0x630000 [0077.813] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a348 [0077.813] GetProcessHeap () returned 0x630000 [0077.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a348 | out: hHeap=0x630000) returned 1 [0077.814] GetProcessHeap () returned 0x630000 [0077.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.814] GetProcessHeap () returned 0x630000 [0077.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.814] GetProcessHeap () returned 0x630000 [0077.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.814] GetProcessHeap () returned 0x630000 [0077.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.814] GetProcessHeap () returned 0x630000 [0077.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.814] GetProcessHeap () returned 0x630000 [0077.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.814] GetProcessHeap () returned 0x630000 [0077.814] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.814] GetProcessHeap () returned 0x630000 [0077.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.814] GetProcessHeap () returned 0x630000 [0077.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0077.814] GetProcessHeap () returned 0x630000 [0077.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0077.814] GetProcessHeap () returned 0x630000 [0077.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0077.814] GetProcessHeap () returned 0x630000 [0077.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0077.814] GetProcessHeap () returned 0x630000 [0077.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0077.814] GetProcessHeap () returned 0x630000 [0077.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ecd0 | out: hHeap=0x630000) returned 1 [0077.814] GetProcessHeap () returned 0x630000 [0077.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0077.814] GetProcessHeap () returned 0x630000 [0077.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0077.814] GetProcessHeap () returned 0x630000 [0077.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0077.814] GetProcessHeap () returned 0x630000 [0077.814] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.814] GetProcessHeap () returned 0x630000 [0077.815] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672a10 | out: hHeap=0x630000) returned 1 [0077.815] WriteFile (in: hFile=0x230, lpBuffer=0x674248*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x674248*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0077.818] GetProcessHeap () returned 0x630000 [0077.818] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x674248, Size=0x30) returned 0x674248 [0077.818] GetProcessHeap () returned 0x630000 [0077.818] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0077.818] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0077.818] GetProcessHeap () returned 0x630000 [0077.818] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd33d4) returned 0x2443020 [0077.835] ReadFile (in: hFile=0x230, lpBuffer=0x2443020, nNumberOfBytesToRead=0xd33d4, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x2443020*, lpNumberOfBytesRead=0x243d7e8*=0xd33d4, lpOverlapped=0x0) returned 1 [0077.848] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0077.848] WriteFile (in: hFile=0x230, lpBuffer=0x2443020*, nNumberOfBytesToWrite=0xd33d4, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x2443020*, lpNumberOfBytesWritten=0x243d7e4*=0xd33d4, lpOverlapped=0x0) returned 1 [0077.854] GetProcessHeap () returned 0x630000 [0077.854] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x2443020 | out: hHeap=0x630000) returned 1 [0077.858] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0077.858] WriteFile (in: hFile=0x230, lpBuffer=0x674248*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x674248*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0077.859] CloseHandle (hObject=0x230) returned 1 [0077.863] GetProcessHeap () returned 0x630000 [0077.864] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0077.864] GetProcessHeap () returned 0x630000 [0077.864] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655760 | out: hHeap=0x630000) returned 1 [0077.864] GetProcessHeap () returned 0x630000 [0077.864] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673318 | out: hHeap=0x630000) returned 1 [0077.864] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml" [0077.864] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml.happythreechoose") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml.happythreechoose" [0077.864] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\blocklist.xml"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml.happythreechoose" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\blocklist.xml.happythreechoose"), dwFlags=0x1) returned 1 [0077.864] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\blocklist.xml" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0077.865] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="" [0077.865] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html" [0077.865] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\decryption info.html")) returned 0x20 [0077.865] GetProcessHeap () returned 0x630000 [0077.865] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0077.865] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe9b352a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe9b352a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfe9b352a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bookmarkbackups", cAlternateFileName="BOOKMA~1")) returned 1 [0077.865] lstrcmpiW (lpString1="bookmarkbackups", lpString2=".") returned 1 [0077.865] lstrcmpiW (lpString1="bookmarkbackups", lpString2="..") returned 1 [0077.865] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="bookmarkbackups" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\bookmarkbackups") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\bookmarkbackups" [0077.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bookmarkbackups", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0077.865] GetProcessHeap () returned 0x630000 [0077.865] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x64c9f0 [0077.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bookmarkbackups", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bookmarkbackups", lpUsedDefaultChar=0x0) returned 16 [0077.865] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="bookmarkbackups", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0077.865] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="bookmarkbackups", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0077.865] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="bookmarkbackups", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0077.865] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="bookmarkbackups", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0077.865] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="bookmarkbackups", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0077.865] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="bookmarkbackups", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0077.865] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="bookmarkbackups", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0077.865] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="bookmarkbackups", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0077.865] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="bookmarkbackups", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0077.865] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="bookmarkbackups", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0077.865] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="bookmarkbackups", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0077.865] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="bookmarkbackups", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0077.865] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="bookmarkbackups", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0077.865] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="bookmarkbackups", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0077.865] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="bookmarkbackups", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0077.865] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="bookmarkbackups", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0077.866] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="bookmarkbackups", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0077.866] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="bookmarkbackups", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0077.866] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="bookmarkbackups", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0077.866] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="bookmarkbackups", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0077.866] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="bookmarkbackups", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0077.866] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="bookmarkbackups", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0077.866] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="bookmarkbackups", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0077.866] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="bookmarkbackups", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0077.866] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="bookmarkbackups", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0077.866] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="bookmarkbackups", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0077.866] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="bookmarkbackups", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0077.866] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="bookmarkbackups", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0077.866] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="bookmarkbackups", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0077.866] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="bookmarkbackups", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0077.866] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="bookmarkbackups", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0077.866] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="bookmarkbackups", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0077.866] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="bookmarkbackups", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0077.866] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="bookmarkbackups", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0077.866] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="bookmarkbackups", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0077.866] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="bookmarkbackups", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0077.866] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="bookmarkbackups", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0077.866] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="bookmarkbackups", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0077.866] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="bookmarkbackups", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0077.866] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="bookmarkbackups", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0077.866] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="bookmarkbackups", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0077.866] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="bookmarkbackups", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0077.866] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="bookmarkbackups", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0077.866] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\bookmarkbackups", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\bookmarkbackups\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\bookmarkbackups\\" [0077.866] GetProcessHeap () returned 0x630000 [0077.866] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a348 [0077.866] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\bookmarkbackups\\") returned 90 [0077.866] GetProcessHeap () returned 0x630000 [0077.866] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb6) returned 0x641530 [0077.866] lstrcpyW (in: lpString1=0x641530, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\bookmarkbackups\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\bookmarkbackups\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\bookmarkbackups\\" [0077.867] GetProcessHeap () returned 0x630000 [0077.867] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0077.867] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe645e15, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe645e15, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x621f2203, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cert8.db", cAlternateFileName="")) returned 1 [0077.867] lstrcmpiW (lpString1="cert8.db", lpString2=".") returned 1 [0077.867] lstrcmpiW (lpString1="cert8.db", lpString2="..") returned 1 [0077.867] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="cert8.db" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db" [0077.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cert8.db", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0077.867] GetProcessHeap () returned 0x630000 [0077.867] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9) returned 0x64c9f0 [0077.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cert8.db", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cert8.db", lpUsedDefaultChar=0x0) returned 9 [0077.867] lstrlenA (lpString="cert8.db") returned 8 [0077.867] lstrlenA (lpString=".happythreechoose") returned 17 [0077.867] lstrcmpiW (lpString1="cert8.db", lpString2="Decryption INFO.html") returned -1 [0077.867] lstrcmpiW (lpString1="cert8.db", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0077.867] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0077.867] lstrcmpiW (lpString1="cert8.db", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0077.867] GetProcessHeap () returned 0x630000 [0077.867] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0077.867] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cert8.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0077.868] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=65536) returned 1 [0077.868] GetProcessHeap () returned 0x630000 [0077.868] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655a30 [0077.868] GetProcessHeap () returned 0x630000 [0077.868] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672d40 [0077.868] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db") returned 82 [0077.868] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0077.868] GetProcessHeap () returned 0x630000 [0077.868] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0077.868] GetProcessHeap () returned 0x630000 [0077.868] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x674280 [0077.868] lstrlenA (lpString="rsa_encrypt") returned 11 [0077.868] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x673180) returned 1 [0077.869] CryptGenRandom (in: hProv=0x673180, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0077.869] CryptReleaseContext (hProv=0x673180, dwFlags=0x0) returned 1 [0077.869] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0077.869] GetProcessHeap () returned 0x630000 [0077.869] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672dc8 [0077.869] lstrlenA (lpString="010001") returned 6 [0077.869] GetProcessHeap () returned 0x630000 [0077.869] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3a8 [0077.869] GetProcessHeap () returned 0x630000 [0077.869] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673428 [0077.869] GetProcessHeap () returned 0x630000 [0077.869] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ec40 [0077.869] GetProcessHeap () returned 0x630000 [0077.869] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673428 | out: hHeap=0x630000) returned 1 [0077.869] GetProcessHeap () returned 0x630000 [0077.869] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0077.869] GetProcessHeap () returned 0x630000 [0077.869] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657210 [0077.869] GetProcessHeap () returned 0x630000 [0077.869] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0077.869] GetProcessHeap () returned 0x630000 [0077.869] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0077.869] GetProcessHeap () returned 0x630000 [0077.869] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.870] GetProcessHeap () returned 0x630000 [0077.870] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0077.870] GetProcessHeap () returned 0x630000 [0077.870] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672c30 [0077.870] GetProcessHeap () returned 0x630000 [0077.870] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656db0 [0077.870] GetProcessHeap () returned 0x630000 [0077.870] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.870] GetProcessHeap () returned 0x630000 [0077.870] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0077.870] GetProcessHeap () returned 0x630000 [0077.870] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dfe0 [0077.870] GetProcessHeap () returned 0x630000 [0077.870] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672c30 | out: hHeap=0x630000) returned 1 [0077.870] GetProcessHeap () returned 0x630000 [0077.870] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0077.870] GetProcessHeap () returned 0x630000 [0077.870] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0077.870] GetProcessHeap () returned 0x630000 [0077.870] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.870] GetProcessHeap () returned 0x630000 [0077.870] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cf88 [0077.870] GetProcessHeap () returned 0x630000 [0077.870] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.870] GetProcessHeap () returned 0x630000 [0077.870] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.870] GetProcessHeap () returned 0x630000 [0077.870] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0077.870] GetProcessHeap () returned 0x630000 [0077.870] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0077.870] GetProcessHeap () returned 0x630000 [0077.870] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65de30 [0077.870] GetProcessHeap () returned 0x630000 [0077.870] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cf88 | out: hHeap=0x630000) returned 1 [0077.870] GetProcessHeap () returned 0x630000 [0077.870] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0077.870] GetProcessHeap () returned 0x630000 [0077.870] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0077.870] GetProcessHeap () returned 0x630000 [0077.870] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.871] GetProcessHeap () returned 0x630000 [0077.871] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.871] GetProcessHeap () returned 0x630000 [0077.871] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.871] GetProcessHeap () returned 0x630000 [0077.871] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.871] GetProcessHeap () returned 0x630000 [0077.871] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.871] GetProcessHeap () returned 0x630000 [0077.871] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.871] GetProcessHeap () returned 0x630000 [0077.871] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.871] GetProcessHeap () returned 0x630000 [0077.871] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.871] GetProcessHeap () returned 0x630000 [0077.871] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.871] GetProcessHeap () returned 0x630000 [0077.871] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.871] GetProcessHeap () returned 0x630000 [0077.871] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.871] GetProcessHeap () returned 0x630000 [0077.871] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.871] GetProcessHeap () returned 0x630000 [0077.871] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.871] GetProcessHeap () returned 0x630000 [0077.871] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.871] GetProcessHeap () returned 0x630000 [0077.871] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0077.871] GetProcessHeap () returned 0x630000 [0077.871] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0077.871] GetProcessHeap () returned 0x630000 [0077.871] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.871] GetProcessHeap () returned 0x630000 [0077.871] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.871] GetProcessHeap () returned 0x630000 [0077.871] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.871] GetProcessHeap () returned 0x630000 [0077.871] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.871] GetProcessHeap () returned 0x630000 [0077.871] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.871] GetProcessHeap () returned 0x630000 [0077.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.872] GetProcessHeap () returned 0x630000 [0077.872] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.872] GetProcessHeap () returned 0x630000 [0077.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.872] GetProcessHeap () returned 0x630000 [0077.872] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.872] GetProcessHeap () returned 0x630000 [0077.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.872] GetProcessHeap () returned 0x630000 [0077.872] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.872] GetProcessHeap () returned 0x630000 [0077.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.872] GetProcessHeap () returned 0x630000 [0077.872] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0077.872] GetProcessHeap () returned 0x630000 [0077.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0077.872] GetProcessHeap () returned 0x630000 [0077.872] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.872] GetProcessHeap () returned 0x630000 [0077.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.872] GetProcessHeap () returned 0x630000 [0077.872] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.872] GetProcessHeap () returned 0x630000 [0077.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.872] GetProcessHeap () returned 0x630000 [0077.872] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.872] GetProcessHeap () returned 0x630000 [0077.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.872] GetProcessHeap () returned 0x630000 [0077.872] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.872] GetProcessHeap () returned 0x630000 [0077.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.872] GetProcessHeap () returned 0x630000 [0077.872] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.872] GetProcessHeap () returned 0x630000 [0077.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.872] GetProcessHeap () returned 0x630000 [0077.873] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.873] GetProcessHeap () returned 0x630000 [0077.873] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.873] GetProcessHeap () returned 0x630000 [0077.873] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.873] GetProcessHeap () returned 0x630000 [0077.873] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.873] GetProcessHeap () returned 0x630000 [0077.873] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.873] GetProcessHeap () returned 0x630000 [0077.873] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.873] GetProcessHeap () returned 0x630000 [0077.873] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.873] GetProcessHeap () returned 0x630000 [0077.873] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.873] GetProcessHeap () returned 0x630000 [0077.873] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0077.873] GetProcessHeap () returned 0x630000 [0077.873] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0077.873] GetProcessHeap () returned 0x630000 [0077.873] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.873] GetProcessHeap () returned 0x630000 [0077.873] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.873] GetProcessHeap () returned 0x630000 [0077.873] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.873] GetProcessHeap () returned 0x630000 [0077.873] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.873] GetProcessHeap () returned 0x630000 [0077.873] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.873] GetProcessHeap () returned 0x630000 [0077.873] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.873] GetProcessHeap () returned 0x630000 [0077.873] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.873] GetProcessHeap () returned 0x630000 [0077.873] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.873] GetProcessHeap () returned 0x630000 [0077.873] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.873] GetProcessHeap () returned 0x630000 [0077.873] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.873] GetProcessHeap () returned 0x630000 [0077.873] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.874] GetProcessHeap () returned 0x630000 [0077.874] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.874] GetProcessHeap () returned 0x630000 [0077.874] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.874] GetProcessHeap () returned 0x630000 [0077.874] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.874] GetProcessHeap () returned 0x630000 [0077.874] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.874] GetProcessHeap () returned 0x630000 [0077.874] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.874] GetProcessHeap () returned 0x630000 [0077.874] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.874] GetProcessHeap () returned 0x630000 [0077.874] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.874] GetProcessHeap () returned 0x630000 [0077.874] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.874] GetProcessHeap () returned 0x630000 [0077.874] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.874] GetProcessHeap () returned 0x630000 [0077.874] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.874] GetProcessHeap () returned 0x630000 [0077.874] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.874] GetProcessHeap () returned 0x630000 [0077.874] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.874] GetProcessHeap () returned 0x630000 [0077.874] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.874] GetProcessHeap () returned 0x630000 [0077.874] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.874] GetProcessHeap () returned 0x630000 [0077.874] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.874] GetProcessHeap () returned 0x630000 [0077.874] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.874] GetProcessHeap () returned 0x630000 [0077.874] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.874] GetProcessHeap () returned 0x630000 [0077.874] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.874] GetProcessHeap () returned 0x630000 [0077.874] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.874] GetProcessHeap () returned 0x630000 [0077.875] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.875] GetProcessHeap () returned 0x630000 [0077.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.875] GetProcessHeap () returned 0x630000 [0077.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0077.875] GetProcessHeap () returned 0x630000 [0077.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0077.875] GetProcessHeap () returned 0x630000 [0077.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0077.875] GetProcessHeap () returned 0x630000 [0077.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0077.875] GetProcessHeap () returned 0x630000 [0077.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0077.875] GetProcessHeap () returned 0x630000 [0077.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0077.875] GetProcessHeap () returned 0x630000 [0077.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0077.875] GetProcessHeap () returned 0x630000 [0077.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ec40 | out: hHeap=0x630000) returned 1 [0077.875] GetProcessHeap () returned 0x630000 [0077.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0077.875] GetProcessHeap () returned 0x630000 [0077.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.875] GetProcessHeap () returned 0x630000 [0077.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672dc8 | out: hHeap=0x630000) returned 1 [0077.875] WriteFile (in: hFile=0x230, lpBuffer=0x674280*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x674280*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0077.879] GetProcessHeap () returned 0x630000 [0077.879] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x674280, Size=0x30) returned 0x674280 [0077.879] GetProcessHeap () returned 0x630000 [0077.879] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0077.879] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0077.879] GetProcessHeap () returned 0x630000 [0077.879] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10000) returned 0x6742b8 [0077.879] ReadFile (in: hFile=0x230, lpBuffer=0x6742b8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x6742b8*, lpNumberOfBytesRead=0x243d7e8*=0x10000, lpOverlapped=0x0) returned 1 [0077.880] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0077.880] WriteFile (in: hFile=0x230, lpBuffer=0x6742b8*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x6742b8*, lpNumberOfBytesWritten=0x243d7e4*=0x10000, lpOverlapped=0x0) returned 1 [0077.882] GetProcessHeap () returned 0x630000 [0077.883] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6742b8 | out: hHeap=0x630000) returned 1 [0077.884] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0077.884] WriteFile (in: hFile=0x230, lpBuffer=0x674280*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x674280*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0077.885] CloseHandle (hObject=0x230) returned 1 [0077.885] GetProcessHeap () returned 0x630000 [0077.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0077.885] GetProcessHeap () returned 0x630000 [0077.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655a30 | out: hHeap=0x630000) returned 1 [0077.885] GetProcessHeap () returned 0x630000 [0077.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672d40 | out: hHeap=0x630000) returned 1 [0077.885] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db" [0077.886] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db.happythreechoose") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db.happythreechoose" [0077.886] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cert8.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db.happythreechoose" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cert8.db.happythreechoose"), dwFlags=0x1) returned 1 [0077.886] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cert8.db" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0077.886] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="" [0077.886] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html" [0077.886] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\decryption info.html")) returned 0x20 [0077.886] GetProcessHeap () returned 0x630000 [0077.886] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0077.886] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x400ce751, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0xc7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="compatibility.ini", cAlternateFileName="COMPAT~1.INI")) returned 1 [0077.886] lstrcmpiW (lpString1="compatibility.ini", lpString2=".") returned 1 [0077.887] lstrcmpiW (lpString1="compatibility.ini", lpString2="..") returned 1 [0077.887] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="compatibility.ini" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini" [0077.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compatibility.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0077.887] GetProcessHeap () returned 0x630000 [0077.887] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x645cd8 [0077.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="compatibility.ini", cchWideChar=-1, lpMultiByteStr=0x645cd8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="compatibility.ini", lpUsedDefaultChar=0x0) returned 18 [0077.887] lstrlenA (lpString="compatibility.ini") returned 17 [0077.887] lstrlenA (lpString=".happythreechoose") returned 17 [0077.887] lstrlenA (lpString=".happythreechoose") returned 17 [0077.887] lstrlenA (lpString="compatibility.ini") returned 17 [0077.887] lstrcmpiA (lpString1="compatibility.ini", lpString2=".happythreechoose") returned 1 [0077.887] lstrcmpiW (lpString1="compatibility.ini", lpString2="Decryption INFO.html") returned -1 [0077.887] lstrcmpiW (lpString1="compatibility.ini", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0077.887] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0077.887] lstrcmpiW (lpString1="compatibility.ini", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0077.887] GetProcessHeap () returned 0x630000 [0077.887] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651ec0 [0077.887] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\compatibility.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0077.887] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=199) returned 1 [0077.887] GetProcessHeap () returned 0x630000 [0077.887] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655940 [0077.887] GetProcessHeap () returned 0x630000 [0077.887] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673428 [0077.887] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini") returned 91 [0077.887] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0077.888] GetProcessHeap () returned 0x630000 [0077.888] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0077.888] GetProcessHeap () returned 0x630000 [0077.888] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x389) returned 0x6742b8 [0077.889] lstrlenA (lpString="rsa_encrypt") returned 11 [0077.889] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x672fe8) returned 1 [0077.889] CryptGenRandom (in: hProv=0x672fe8, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0077.889] CryptReleaseContext (hProv=0x672fe8, dwFlags=0x0) returned 1 [0077.889] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0077.889] GetProcessHeap () returned 0x630000 [0077.889] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672ba8 [0077.889] lstrlenA (lpString="010001") returned 6 [0077.889] GetProcessHeap () returned 0x630000 [0077.889] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3a8 [0077.889] GetProcessHeap () returned 0x630000 [0077.889] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673318 [0077.889] GetProcessHeap () returned 0x630000 [0077.889] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e850 [0077.890] GetProcessHeap () returned 0x630000 [0077.890] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673318 | out: hHeap=0x630000) returned 1 [0077.890] GetProcessHeap () returned 0x630000 [0077.890] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0077.890] GetProcessHeap () returned 0x630000 [0077.890] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656a68 [0077.890] GetProcessHeap () returned 0x630000 [0077.890] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0077.890] GetProcessHeap () returned 0x630000 [0077.890] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0077.890] GetProcessHeap () returned 0x630000 [0077.890] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.890] GetProcessHeap () returned 0x630000 [0077.890] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0077.890] GetProcessHeap () returned 0x630000 [0077.890] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6734b0 [0077.890] GetProcessHeap () returned 0x630000 [0077.890] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657440 [0077.890] GetProcessHeap () returned 0x630000 [0077.890] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0077.890] GetProcessHeap () returned 0x630000 [0077.890] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0077.890] GetProcessHeap () returned 0x630000 [0077.890] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e460 [0077.890] GetProcessHeap () returned 0x630000 [0077.890] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6734b0 | out: hHeap=0x630000) returned 1 [0077.890] GetProcessHeap () returned 0x630000 [0077.890] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0077.890] GetProcessHeap () returned 0x630000 [0077.890] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e460 | out: hHeap=0x630000) returned 1 [0077.890] GetProcessHeap () returned 0x630000 [0077.890] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.890] GetProcessHeap () returned 0x630000 [0077.890] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0077.890] GetProcessHeap () returned 0x630000 [0077.890] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0077.890] GetProcessHeap () returned 0x630000 [0077.890] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.890] GetProcessHeap () returned 0x630000 [0077.890] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.891] GetProcessHeap () returned 0x630000 [0077.891] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.891] GetProcessHeap () returned 0x630000 [0077.891] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e4f0 [0077.891] GetProcessHeap () returned 0x630000 [0077.891] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0077.891] GetProcessHeap () returned 0x630000 [0077.891] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0077.891] GetProcessHeap () returned 0x630000 [0077.891] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0077.891] GetProcessHeap () returned 0x630000 [0077.891] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.891] GetProcessHeap () returned 0x630000 [0077.891] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.891] GetProcessHeap () returned 0x630000 [0077.891] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.891] GetProcessHeap () returned 0x630000 [0077.891] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.891] GetProcessHeap () returned 0x630000 [0077.891] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.891] GetProcessHeap () returned 0x630000 [0077.891] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.891] GetProcessHeap () returned 0x630000 [0077.891] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.891] GetProcessHeap () returned 0x630000 [0077.891] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.891] GetProcessHeap () returned 0x630000 [0077.891] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0077.891] GetProcessHeap () returned 0x630000 [0077.891] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0077.891] GetProcessHeap () returned 0x630000 [0077.891] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0077.891] GetProcessHeap () returned 0x630000 [0077.891] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0077.891] GetProcessHeap () returned 0x630000 [0077.891] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.891] GetProcessHeap () returned 0x630000 [0077.891] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.891] GetProcessHeap () returned 0x630000 [0077.891] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.892] GetProcessHeap () returned 0x630000 [0077.892] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.892] GetProcessHeap () returned 0x630000 [0077.892] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.892] GetProcessHeap () returned 0x630000 [0077.892] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.892] GetProcessHeap () returned 0x630000 [0077.892] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.892] GetProcessHeap () returned 0x630000 [0077.892] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.892] GetProcessHeap () returned 0x630000 [0077.892] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.892] GetProcessHeap () returned 0x630000 [0077.892] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.892] GetProcessHeap () returned 0x630000 [0077.892] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.892] GetProcessHeap () returned 0x630000 [0077.892] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.892] GetProcessHeap () returned 0x630000 [0077.892] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.892] GetProcessHeap () returned 0x630000 [0077.892] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.892] GetProcessHeap () returned 0x630000 [0077.892] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.892] GetProcessHeap () returned 0x630000 [0077.892] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.892] GetProcessHeap () returned 0x630000 [0077.892] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.892] GetProcessHeap () returned 0x630000 [0077.892] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.892] GetProcessHeap () returned 0x630000 [0077.892] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.892] GetProcessHeap () returned 0x630000 [0077.892] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.892] GetProcessHeap () returned 0x630000 [0077.892] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.892] GetProcessHeap () returned 0x630000 [0077.892] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.893] GetProcessHeap () returned 0x630000 [0077.893] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.893] GetProcessHeap () returned 0x630000 [0077.893] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.893] GetProcessHeap () returned 0x630000 [0077.893] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.893] GetProcessHeap () returned 0x630000 [0077.893] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.893] GetProcessHeap () returned 0x630000 [0077.893] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.893] GetProcessHeap () returned 0x630000 [0077.893] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.893] GetProcessHeap () returned 0x630000 [0077.893] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.893] GetProcessHeap () returned 0x630000 [0077.893] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.893] GetProcessHeap () returned 0x630000 [0077.893] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.893] GetProcessHeap () returned 0x630000 [0077.893] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.893] GetProcessHeap () returned 0x630000 [0077.893] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.893] GetProcessHeap () returned 0x630000 [0077.893] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.893] GetProcessHeap () returned 0x630000 [0077.893] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.893] GetProcessHeap () returned 0x630000 [0077.893] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.893] GetProcessHeap () returned 0x630000 [0077.893] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.893] GetProcessHeap () returned 0x630000 [0077.893] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.893] GetProcessHeap () returned 0x630000 [0077.893] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.893] GetProcessHeap () returned 0x630000 [0077.893] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.893] GetProcessHeap () returned 0x630000 [0077.893] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0077.893] GetProcessHeap () returned 0x630000 [0077.893] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0077.894] GetProcessHeap () returned 0x630000 [0077.894] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.894] GetProcessHeap () returned 0x630000 [0077.894] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.894] GetProcessHeap () returned 0x630000 [0077.894] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.894] GetProcessHeap () returned 0x630000 [0077.894] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.894] GetProcessHeap () returned 0x630000 [0077.894] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.894] GetProcessHeap () returned 0x630000 [0077.894] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.894] GetProcessHeap () returned 0x630000 [0077.894] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.894] GetProcessHeap () returned 0x630000 [0077.894] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.894] GetProcessHeap () returned 0x630000 [0077.894] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.894] GetProcessHeap () returned 0x630000 [0077.894] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.894] GetProcessHeap () returned 0x630000 [0077.894] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.894] GetProcessHeap () returned 0x630000 [0077.894] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.894] GetProcessHeap () returned 0x630000 [0077.894] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0077.894] GetProcessHeap () returned 0x630000 [0077.894] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0077.894] GetProcessHeap () returned 0x630000 [0077.894] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.894] GetProcessHeap () returned 0x630000 [0077.894] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.894] GetProcessHeap () returned 0x630000 [0077.895] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.895] GetProcessHeap () returned 0x630000 [0077.895] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.895] GetProcessHeap () returned 0x630000 [0077.895] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.895] GetProcessHeap () returned 0x630000 [0077.895] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.895] GetProcessHeap () returned 0x630000 [0077.895] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.895] GetProcessHeap () returned 0x630000 [0077.895] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.895] GetProcessHeap () returned 0x630000 [0077.895] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.895] GetProcessHeap () returned 0x630000 [0077.895] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.895] GetProcessHeap () returned 0x630000 [0077.895] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0077.895] GetProcessHeap () returned 0x630000 [0077.895] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0077.895] GetProcessHeap () returned 0x630000 [0077.895] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.895] GetProcessHeap () returned 0x630000 [0077.895] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.895] GetProcessHeap () returned 0x630000 [0077.895] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0077.895] GetProcessHeap () returned 0x630000 [0077.895] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0077.895] GetProcessHeap () returned 0x630000 [0077.895] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0077.896] GetProcessHeap () returned 0x630000 [0077.896] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0077.896] GetProcessHeap () returned 0x630000 [0077.896] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0077.896] GetProcessHeap () returned 0x630000 [0077.896] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0077.896] GetProcessHeap () returned 0x630000 [0077.896] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0077.896] GetProcessHeap () returned 0x630000 [0077.896] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0077.896] GetProcessHeap () returned 0x630000 [0077.896] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0077.896] GetProcessHeap () returned 0x630000 [0077.896] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.896] GetProcessHeap () returned 0x630000 [0077.896] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672ba8 | out: hHeap=0x630000) returned 1 [0077.896] WriteFile (in: hFile=0x230, lpBuffer=0x6742b8*, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6742b8*, lpNumberOfBytesWritten=0x243d864*=0x389, lpOverlapped=0x0) returned 1 [0077.900] GetProcessHeap () returned 0x630000 [0077.900] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6742b8, Size=0x30) returned 0x6742b8 [0077.900] GetProcessHeap () returned 0x630000 [0077.900] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0077.900] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0077.900] GetProcessHeap () returned 0x630000 [0077.900] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd0) returned 0x6491c0 [0077.900] ReadFile (in: hFile=0x230, lpBuffer=0x6491c0, nNumberOfBytesToRead=0xd0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x6491c0*, lpNumberOfBytesRead=0x243d7e8*=0xd0, lpOverlapped=0x0) returned 1 [0077.900] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0077.900] WriteFile (in: hFile=0x230, lpBuffer=0x6491c0*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x6491c0*, lpNumberOfBytesWritten=0x243d7e4*=0xd0, lpOverlapped=0x0) returned 1 [0077.901] GetProcessHeap () returned 0x630000 [0077.901] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6491c0 | out: hHeap=0x630000) returned 1 [0077.901] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0077.901] WriteFile (in: hFile=0x230, lpBuffer=0x6742b8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6742b8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0077.902] CloseHandle (hObject=0x230) returned 1 [0077.902] GetProcessHeap () returned 0x630000 [0077.903] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651ec0 | out: hHeap=0x630000) returned 1 [0077.903] GetProcessHeap () returned 0x630000 [0077.903] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655940 | out: hHeap=0x630000) returned 1 [0077.903] GetProcessHeap () returned 0x630000 [0077.903] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673428 | out: hHeap=0x630000) returned 1 [0077.903] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini" [0077.903] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini.happythreechoose") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini.happythreechoose" [0077.903] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\compatibility.ini"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini.happythreechoose" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\compatibility.ini.happythreechoose"), dwFlags=0x1) returned 1 [0077.903] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\compatibility.ini" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0077.903] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="" [0077.903] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html" [0077.903] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\decryption info.html")) returned 0x20 [0077.904] GetProcessHeap () returned 0x630000 [0077.904] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645cd8 | out: hHeap=0x630000) returned 1 [0077.904] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9a54e3, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xff9a54e3, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xff9a54e3, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x329, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="containers.json", cAlternateFileName="CONTAI~1.JSO")) returned 1 [0077.904] lstrcmpiW (lpString1="containers.json", lpString2=".") returned 1 [0077.904] lstrcmpiW (lpString1="containers.json", lpString2="..") returned 1 [0077.904] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="containers.json" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json" [0077.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="containers.json", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0077.904] GetProcessHeap () returned 0x630000 [0077.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x64c9f0 [0077.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="containers.json", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="containers.json", lpUsedDefaultChar=0x0) returned 16 [0077.904] lstrlenA (lpString="containers.json") returned 15 [0077.904] lstrlenA (lpString=".happythreechoose") returned 17 [0077.904] lstrcmpiW (lpString1="containers.json", lpString2="Decryption INFO.html") returned -1 [0077.904] lstrcmpiW (lpString1="containers.json", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0077.904] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0077.904] lstrcmpiW (lpString1="containers.json", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0077.904] GetProcessHeap () returned 0x630000 [0077.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f10 [0077.904] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\containers.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0077.904] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=809) returned 1 [0077.904] GetProcessHeap () returned 0x630000 [0077.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655760 [0077.904] GetProcessHeap () returned 0x630000 [0077.904] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6736d0 [0077.904] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json") returned 89 [0077.905] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0077.905] GetProcessHeap () returned 0x630000 [0077.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0077.905] GetProcessHeap () returned 0x630000 [0077.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x387) returned 0x6742f0 [0077.905] lstrlenA (lpString="rsa_encrypt") returned 11 [0077.905] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x673290) returned 1 [0077.905] CryptGenRandom (in: hProv=0x673290, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0077.905] CryptReleaseContext (hProv=0x673290, dwFlags=0x0) returned 1 [0077.905] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0077.905] GetProcessHeap () returned 0x630000 [0077.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673428 [0077.905] lstrlenA (lpString="010001") returned 6 [0077.905] GetProcessHeap () returned 0x630000 [0077.905] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3a8 [0077.906] GetProcessHeap () returned 0x630000 [0077.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672988 [0077.906] GetProcessHeap () returned 0x630000 [0077.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e4f0 [0077.906] GetProcessHeap () returned 0x630000 [0077.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672988 | out: hHeap=0x630000) returned 1 [0077.906] GetProcessHeap () returned 0x630000 [0077.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ec40 [0077.906] GetProcessHeap () returned 0x630000 [0077.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656c98 [0077.906] GetProcessHeap () returned 0x630000 [0077.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3b8 [0077.906] GetProcessHeap () returned 0x630000 [0077.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0077.906] GetProcessHeap () returned 0x630000 [0077.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.906] GetProcessHeap () returned 0x630000 [0077.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0077.906] GetProcessHeap () returned 0x630000 [0077.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673758 [0077.906] GetProcessHeap () returned 0x630000 [0077.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657670 [0077.906] GetProcessHeap () returned 0x630000 [0077.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.906] GetProcessHeap () returned 0x630000 [0077.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0077.906] GetProcessHeap () returned 0x630000 [0077.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e3d0 [0077.906] GetProcessHeap () returned 0x630000 [0077.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673758 | out: hHeap=0x630000) returned 1 [0077.906] GetProcessHeap () returned 0x630000 [0077.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0077.906] GetProcessHeap () returned 0x630000 [0077.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0077.906] GetProcessHeap () returned 0x630000 [0077.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0077.906] GetProcessHeap () returned 0x630000 [0077.906] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cd60 [0077.906] GetProcessHeap () returned 0x630000 [0077.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.906] GetProcessHeap () returned 0x630000 [0077.906] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0077.907] GetProcessHeap () returned 0x630000 [0077.907] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.907] GetProcessHeap () returned 0x630000 [0077.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.907] GetProcessHeap () returned 0x630000 [0077.907] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e070 [0077.907] GetProcessHeap () returned 0x630000 [0077.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cd60 | out: hHeap=0x630000) returned 1 [0077.907] GetProcessHeap () returned 0x630000 [0077.907] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0077.907] GetProcessHeap () returned 0x630000 [0077.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0077.907] GetProcessHeap () returned 0x630000 [0077.907] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.907] GetProcessHeap () returned 0x630000 [0077.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.907] GetProcessHeap () returned 0x630000 [0077.907] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.907] GetProcessHeap () returned 0x630000 [0077.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.907] GetProcessHeap () returned 0x630000 [0077.907] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.907] GetProcessHeap () returned 0x630000 [0077.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.907] GetProcessHeap () returned 0x630000 [0077.907] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0077.907] GetProcessHeap () returned 0x630000 [0077.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0077.907] GetProcessHeap () returned 0x630000 [0077.907] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.907] GetProcessHeap () returned 0x630000 [0077.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.907] GetProcessHeap () returned 0x630000 [0077.907] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.907] GetProcessHeap () returned 0x630000 [0077.907] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.907] GetProcessHeap () returned 0x630000 [0077.907] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.907] GetProcessHeap () returned 0x630000 [0077.908] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.908] GetProcessHeap () returned 0x630000 [0077.908] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.908] GetProcessHeap () returned 0x630000 [0077.908] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.908] GetProcessHeap () returned 0x630000 [0077.908] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.908] GetProcessHeap () returned 0x630000 [0077.908] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.908] GetProcessHeap () returned 0x630000 [0077.908] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.908] GetProcessHeap () returned 0x630000 [0077.908] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.908] GetProcessHeap () returned 0x630000 [0077.908] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.908] GetProcessHeap () returned 0x630000 [0077.908] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.908] GetProcessHeap () returned 0x630000 [0077.908] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.908] GetProcessHeap () returned 0x630000 [0077.908] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.908] GetProcessHeap () returned 0x630000 [0077.908] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.908] GetProcessHeap () returned 0x630000 [0077.908] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.908] GetProcessHeap () returned 0x630000 [0077.908] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.908] GetProcessHeap () returned 0x630000 [0077.908] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.908] GetProcessHeap () returned 0x630000 [0077.908] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.908] GetProcessHeap () returned 0x630000 [0077.908] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.908] GetProcessHeap () returned 0x630000 [0077.908] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.908] GetProcessHeap () returned 0x630000 [0077.908] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.908] GetProcessHeap () returned 0x630000 [0077.908] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.909] GetProcessHeap () returned 0x630000 [0077.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.909] GetProcessHeap () returned 0x630000 [0077.909] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.909] GetProcessHeap () returned 0x630000 [0077.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.909] GetProcessHeap () returned 0x630000 [0077.909] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.909] GetProcessHeap () returned 0x630000 [0077.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.909] GetProcessHeap () returned 0x630000 [0077.909] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.909] GetProcessHeap () returned 0x630000 [0077.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.909] GetProcessHeap () returned 0x630000 [0077.909] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.909] GetProcessHeap () returned 0x630000 [0077.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.909] GetProcessHeap () returned 0x630000 [0077.909] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0077.909] GetProcessHeap () returned 0x630000 [0077.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0077.909] GetProcessHeap () returned 0x630000 [0077.909] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.909] GetProcessHeap () returned 0x630000 [0077.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.909] GetProcessHeap () returned 0x630000 [0077.909] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.909] GetProcessHeap () returned 0x630000 [0077.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.909] GetProcessHeap () returned 0x630000 [0077.909] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0077.909] GetProcessHeap () returned 0x630000 [0077.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0077.909] GetProcessHeap () returned 0x630000 [0077.909] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.909] GetProcessHeap () returned 0x630000 [0077.909] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.909] GetProcessHeap () returned 0x630000 [0077.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.910] GetProcessHeap () returned 0x630000 [0077.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.910] GetProcessHeap () returned 0x630000 [0077.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.910] GetProcessHeap () returned 0x630000 [0077.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.910] GetProcessHeap () returned 0x630000 [0077.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.910] GetProcessHeap () returned 0x630000 [0077.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.910] GetProcessHeap () returned 0x630000 [0077.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.910] GetProcessHeap () returned 0x630000 [0077.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.910] GetProcessHeap () returned 0x630000 [0077.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.910] GetProcessHeap () returned 0x630000 [0077.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.910] GetProcessHeap () returned 0x630000 [0077.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.910] GetProcessHeap () returned 0x630000 [0077.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.910] GetProcessHeap () returned 0x630000 [0077.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.910] GetProcessHeap () returned 0x630000 [0077.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.910] GetProcessHeap () returned 0x630000 [0077.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.910] GetProcessHeap () returned 0x630000 [0077.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.910] GetProcessHeap () returned 0x630000 [0077.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.910] GetProcessHeap () returned 0x630000 [0077.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.910] GetProcessHeap () returned 0x630000 [0077.910] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.910] GetProcessHeap () returned 0x630000 [0077.910] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.911] GetProcessHeap () returned 0x630000 [0077.911] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.911] GetProcessHeap () returned 0x630000 [0077.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.911] GetProcessHeap () returned 0x630000 [0077.911] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.911] GetProcessHeap () returned 0x630000 [0077.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.911] GetProcessHeap () returned 0x630000 [0077.911] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.911] GetProcessHeap () returned 0x630000 [0077.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.911] GetProcessHeap () returned 0x630000 [0077.911] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0077.911] GetProcessHeap () returned 0x630000 [0077.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0077.911] GetProcessHeap () returned 0x630000 [0077.911] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.911] GetProcessHeap () returned 0x630000 [0077.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.911] GetProcessHeap () returned 0x630000 [0077.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0077.911] GetProcessHeap () returned 0x630000 [0077.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0077.911] GetProcessHeap () returned 0x630000 [0077.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0077.911] GetProcessHeap () returned 0x630000 [0077.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0077.911] GetProcessHeap () returned 0x630000 [0077.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0077.911] GetProcessHeap () returned 0x630000 [0077.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ec40 | out: hHeap=0x630000) returned 1 [0077.911] GetProcessHeap () returned 0x630000 [0077.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0077.911] GetProcessHeap () returned 0x630000 [0077.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e4f0 | out: hHeap=0x630000) returned 1 [0077.911] GetProcessHeap () returned 0x630000 [0077.911] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0077.911] GetProcessHeap () returned 0x630000 [0077.912] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.912] GetProcessHeap () returned 0x630000 [0077.912] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673428 | out: hHeap=0x630000) returned 1 [0077.912] WriteFile (in: hFile=0x230, lpBuffer=0x6742f0*, nNumberOfBytesToWrite=0x387, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6742f0*, lpNumberOfBytesWritten=0x243d864*=0x387, lpOverlapped=0x0) returned 1 [0077.915] GetProcessHeap () returned 0x630000 [0077.915] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6742f0, Size=0x30) returned 0x6742f0 [0077.915] GetProcessHeap () returned 0x630000 [0077.915] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0077.915] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0077.915] GetProcessHeap () returned 0x630000 [0077.915] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x330) returned 0x659cc0 [0077.915] ReadFile (in: hFile=0x230, lpBuffer=0x659cc0, nNumberOfBytesToRead=0x330, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x659cc0*, lpNumberOfBytesRead=0x243d7e8*=0x330, lpOverlapped=0x0) returned 1 [0077.915] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0077.915] WriteFile (in: hFile=0x230, lpBuffer=0x659cc0*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x659cc0*, lpNumberOfBytesWritten=0x243d7e4*=0x330, lpOverlapped=0x0) returned 1 [0077.916] GetProcessHeap () returned 0x630000 [0077.916] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x659cc0 | out: hHeap=0x630000) returned 1 [0077.916] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0077.916] WriteFile (in: hFile=0x230, lpBuffer=0x6742f0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6742f0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0077.917] CloseHandle (hObject=0x230) returned 1 [0077.918] GetProcessHeap () returned 0x630000 [0077.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f10 | out: hHeap=0x630000) returned 1 [0077.918] GetProcessHeap () returned 0x630000 [0077.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655760 | out: hHeap=0x630000) returned 1 [0077.918] GetProcessHeap () returned 0x630000 [0077.918] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6736d0 | out: hHeap=0x630000) returned 1 [0077.918] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json" [0077.918] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json.happythreechoose") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json.happythreechoose" [0077.918] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\containers.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json.happythreechoose" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\containers.json.happythreechoose"), dwFlags=0x1) returned 1 [0077.919] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\containers.json" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0077.919] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="" [0077.919] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html" [0077.919] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\decryption info.html")) returned 0x20 [0077.919] GetProcessHeap () returned 0x630000 [0077.919] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0077.919] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff97f27a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xff97f27a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x439749, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x38000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="content-prefs.sqlite", cAlternateFileName="CONTEN~1.SQL")) returned 1 [0077.919] lstrcmpiW (lpString1="content-prefs.sqlite", lpString2=".") returned 1 [0077.919] lstrcmpiW (lpString1="content-prefs.sqlite", lpString2="..") returned 1 [0077.919] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="content-prefs.sqlite" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite" [0077.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="content-prefs.sqlite", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0077.919] GetProcessHeap () returned 0x630000 [0077.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x15) returned 0x645d18 [0077.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="content-prefs.sqlite", cchWideChar=-1, lpMultiByteStr=0x645d18, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="content-prefs.sqlite", lpUsedDefaultChar=0x0) returned 21 [0077.919] lstrlenA (lpString="content-prefs.sqlite") returned 20 [0077.919] lstrlenA (lpString=".happythreechoose") returned 17 [0077.919] lstrlenA (lpString=".happythreechoose") returned 17 [0077.919] lstrlenA (lpString="content-prefs.sqlite") returned 20 [0077.919] lstrcmpiA (lpString1="tent-prefs.sqlite", lpString2=".happythreechoose") returned 1 [0077.919] lstrcmpiW (lpString1="content-prefs.sqlite", lpString2="Decryption INFO.html") returned -1 [0077.919] lstrcmpiW (lpString1="content-prefs.sqlite", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0077.919] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0077.919] lstrcmpiW (lpString1="content-prefs.sqlite", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0077.919] GetProcessHeap () returned 0x630000 [0077.919] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f10 [0077.919] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\content-prefs.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0077.920] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=229376) returned 1 [0077.920] GetProcessHeap () returned 0x630000 [0077.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655670 [0077.920] GetProcessHeap () returned 0x630000 [0077.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6730f8 [0077.920] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite") returned 94 [0077.920] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0077.920] GetProcessHeap () returned 0x630000 [0077.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0077.920] GetProcessHeap () returned 0x630000 [0077.920] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x674328 [0077.920] lstrlenA (lpString="rsa_encrypt") returned 11 [0077.920] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x673180) returned 1 [0077.921] CryptGenRandom (in: hProv=0x673180, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0077.921] CryptReleaseContext (hProv=0x673180, dwFlags=0x0) returned 1 [0077.921] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0077.921] GetProcessHeap () returned 0x630000 [0077.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672a10 [0077.921] lstrlenA (lpString="010001") returned 6 [0077.921] GetProcessHeap () returned 0x630000 [0077.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3f8 [0077.921] GetProcessHeap () returned 0x630000 [0077.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673290 [0077.921] GetProcessHeap () returned 0x630000 [0077.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e6a0 [0077.921] GetProcessHeap () returned 0x630000 [0077.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673290 | out: hHeap=0x630000) returned 1 [0077.921] GetProcessHeap () returned 0x630000 [0077.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e460 [0077.921] GetProcessHeap () returned 0x630000 [0077.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656ec8 [0077.921] GetProcessHeap () returned 0x630000 [0077.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3a8 [0077.922] GetProcessHeap () returned 0x630000 [0077.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0077.922] GetProcessHeap () returned 0x630000 [0077.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.922] GetProcessHeap () returned 0x630000 [0077.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0077.922] GetProcessHeap () returned 0x630000 [0077.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672ed8 [0077.922] GetProcessHeap () returned 0x630000 [0077.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656fe0 [0077.922] GetProcessHeap () returned 0x630000 [0077.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.922] GetProcessHeap () returned 0x630000 [0077.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0077.922] GetProcessHeap () returned 0x630000 [0077.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea00 [0077.922] GetProcessHeap () returned 0x630000 [0077.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672ed8 | out: hHeap=0x630000) returned 1 [0077.922] GetProcessHeap () returned 0x630000 [0077.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0077.922] GetProcessHeap () returned 0x630000 [0077.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0077.922] GetProcessHeap () returned 0x630000 [0077.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.922] GetProcessHeap () returned 0x630000 [0077.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0077.922] GetProcessHeap () returned 0x630000 [0077.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.922] GetProcessHeap () returned 0x630000 [0077.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.922] GetProcessHeap () returned 0x630000 [0077.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.922] GetProcessHeap () returned 0x630000 [0077.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.922] GetProcessHeap () returned 0x630000 [0077.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e070 [0077.922] GetProcessHeap () returned 0x630000 [0077.922] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0077.922] GetProcessHeap () returned 0x630000 [0077.922] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0077.923] GetProcessHeap () returned 0x630000 [0077.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0077.923] GetProcessHeap () returned 0x630000 [0077.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.923] GetProcessHeap () returned 0x630000 [0077.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.923] GetProcessHeap () returned 0x630000 [0077.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.923] GetProcessHeap () returned 0x630000 [0077.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.923] GetProcessHeap () returned 0x630000 [0077.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.923] GetProcessHeap () returned 0x630000 [0077.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.923] GetProcessHeap () returned 0x630000 [0077.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.923] GetProcessHeap () returned 0x630000 [0077.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.923] GetProcessHeap () returned 0x630000 [0077.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.923] GetProcessHeap () returned 0x630000 [0077.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.923] GetProcessHeap () returned 0x630000 [0077.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.923] GetProcessHeap () returned 0x630000 [0077.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.923] GetProcessHeap () returned 0x630000 [0077.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.923] GetProcessHeap () returned 0x630000 [0077.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.923] GetProcessHeap () returned 0x630000 [0077.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.923] GetProcessHeap () returned 0x630000 [0077.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.923] GetProcessHeap () returned 0x630000 [0077.923] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.923] GetProcessHeap () returned 0x630000 [0077.923] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.923] GetProcessHeap () returned 0x630000 [0077.924] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.924] GetProcessHeap () returned 0x630000 [0077.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.924] GetProcessHeap () returned 0x630000 [0077.924] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.924] GetProcessHeap () returned 0x630000 [0077.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.924] GetProcessHeap () returned 0x630000 [0077.924] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.924] GetProcessHeap () returned 0x630000 [0077.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.924] GetProcessHeap () returned 0x630000 [0077.924] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.924] GetProcessHeap () returned 0x630000 [0077.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.924] GetProcessHeap () returned 0x630000 [0077.924] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.924] GetProcessHeap () returned 0x630000 [0077.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.924] GetProcessHeap () returned 0x630000 [0077.924] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.924] GetProcessHeap () returned 0x630000 [0077.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.924] GetProcessHeap () returned 0x630000 [0077.924] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.924] GetProcessHeap () returned 0x630000 [0077.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.924] GetProcessHeap () returned 0x630000 [0077.924] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.924] GetProcessHeap () returned 0x630000 [0077.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.924] GetProcessHeap () returned 0x630000 [0077.924] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.924] GetProcessHeap () returned 0x630000 [0077.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.924] GetProcessHeap () returned 0x630000 [0077.924] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0077.924] GetProcessHeap () returned 0x630000 [0077.924] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0077.925] GetProcessHeap () returned 0x630000 [0077.925] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.925] GetProcessHeap () returned 0x630000 [0077.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.925] GetProcessHeap () returned 0x630000 [0077.925] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.925] GetProcessHeap () returned 0x630000 [0077.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.925] GetProcessHeap () returned 0x630000 [0077.925] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.925] GetProcessHeap () returned 0x630000 [0077.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.925] GetProcessHeap () returned 0x630000 [0077.925] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.925] GetProcessHeap () returned 0x630000 [0077.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.925] GetProcessHeap () returned 0x630000 [0077.925] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.925] GetProcessHeap () returned 0x630000 [0077.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.925] GetProcessHeap () returned 0x630000 [0077.925] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.925] GetProcessHeap () returned 0x630000 [0077.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.925] GetProcessHeap () returned 0x630000 [0077.925] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.925] GetProcessHeap () returned 0x630000 [0077.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.925] GetProcessHeap () returned 0x630000 [0077.925] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.925] GetProcessHeap () returned 0x630000 [0077.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.925] GetProcessHeap () returned 0x630000 [0077.925] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.925] GetProcessHeap () returned 0x630000 [0077.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.925] GetProcessHeap () returned 0x630000 [0077.925] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0077.925] GetProcessHeap () returned 0x630000 [0077.925] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0077.926] GetProcessHeap () returned 0x630000 [0077.926] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.926] GetProcessHeap () returned 0x630000 [0077.926] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.926] GetProcessHeap () returned 0x630000 [0077.926] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.926] GetProcessHeap () returned 0x630000 [0077.926] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.926] GetProcessHeap () returned 0x630000 [0077.926] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.926] GetProcessHeap () returned 0x630000 [0077.926] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.926] GetProcessHeap () returned 0x630000 [0077.926] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.926] GetProcessHeap () returned 0x630000 [0077.926] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.926] GetProcessHeap () returned 0x630000 [0077.926] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.926] GetProcessHeap () returned 0x630000 [0077.926] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.926] GetProcessHeap () returned 0x630000 [0077.926] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0077.926] GetProcessHeap () returned 0x630000 [0077.926] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0077.926] GetProcessHeap () returned 0x630000 [0077.926] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.926] GetProcessHeap () returned 0x630000 [0077.926] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.926] GetProcessHeap () returned 0x630000 [0077.926] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.926] GetProcessHeap () returned 0x630000 [0077.926] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.926] GetProcessHeap () returned 0x630000 [0077.926] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.926] GetProcessHeap () returned 0x630000 [0077.926] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.926] GetProcessHeap () returned 0x630000 [0077.926] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0077.927] GetProcessHeap () returned 0x630000 [0077.927] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.927] GetProcessHeap () returned 0x630000 [0077.927] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0077.927] GetProcessHeap () returned 0x630000 [0077.927] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0077.927] GetProcessHeap () returned 0x630000 [0077.927] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.927] GetProcessHeap () returned 0x630000 [0077.927] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.927] GetProcessHeap () returned 0x630000 [0077.927] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0077.927] GetProcessHeap () returned 0x630000 [0077.927] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0077.927] GetProcessHeap () returned 0x630000 [0077.927] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0077.927] GetProcessHeap () returned 0x630000 [0077.927] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0077.927] GetProcessHeap () returned 0x630000 [0077.927] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0077.927] GetProcessHeap () returned 0x630000 [0077.927] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e460 | out: hHeap=0x630000) returned 1 [0077.927] GetProcessHeap () returned 0x630000 [0077.927] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0077.927] GetProcessHeap () returned 0x630000 [0077.927] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e6a0 | out: hHeap=0x630000) returned 1 [0077.927] GetProcessHeap () returned 0x630000 [0077.927] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0077.927] GetProcessHeap () returned 0x630000 [0077.927] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.927] GetProcessHeap () returned 0x630000 [0077.927] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672a10 | out: hHeap=0x630000) returned 1 [0077.927] WriteFile (in: hFile=0x230, lpBuffer=0x674328*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x674328*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0077.931] GetProcessHeap () returned 0x630000 [0077.931] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x674328, Size=0x30) returned 0x674328 [0077.931] GetProcessHeap () returned 0x630000 [0077.931] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0077.931] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0077.931] GetProcessHeap () returned 0x630000 [0077.931] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x38000) returned 0x674360 [0077.934] ReadFile (in: hFile=0x230, lpBuffer=0x674360, nNumberOfBytesToRead=0x38000, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x674360*, lpNumberOfBytesRead=0x243d7e8*=0x38000, lpOverlapped=0x0) returned 1 [0077.938] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0077.938] WriteFile (in: hFile=0x230, lpBuffer=0x674360*, nNumberOfBytesToWrite=0x38000, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x674360*, lpNumberOfBytesWritten=0x243d7e4*=0x38000, lpOverlapped=0x0) returned 1 [0077.968] GetProcessHeap () returned 0x630000 [0077.968] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x674360 | out: hHeap=0x630000) returned 1 [0077.968] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0077.968] WriteFile (in: hFile=0x230, lpBuffer=0x674328*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x674328*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0077.969] CloseHandle (hObject=0x230) returned 1 [0077.979] GetProcessHeap () returned 0x630000 [0077.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f10 | out: hHeap=0x630000) returned 1 [0077.979] GetProcessHeap () returned 0x630000 [0077.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655670 | out: hHeap=0x630000) returned 1 [0077.979] GetProcessHeap () returned 0x630000 [0077.979] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6730f8 | out: hHeap=0x630000) returned 1 [0077.979] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite" [0077.979] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite.happythreechoose") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite.happythreechoose" [0077.979] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\content-prefs.sqlite"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite.happythreechoose" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\content-prefs.sqlite.happythreechoose"), dwFlags=0x1) returned 1 [0077.980] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\content-prefs.sqlite" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0077.980] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="" [0077.980] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html" [0077.980] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\decryption info.html")) returned 0x20 [0077.980] GetProcessHeap () returned 0x630000 [0077.980] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645d18 | out: hHeap=0x630000) returned 1 [0077.980] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ef1bce, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x1ef1bce, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x621f2203, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cookies.sqlite", cAlternateFileName="COOKIE~1.SQL")) returned 1 [0077.980] lstrcmpiW (lpString1="cookies.sqlite", lpString2=".") returned 1 [0077.980] lstrcmpiW (lpString1="cookies.sqlite", lpString2="..") returned 1 [0077.980] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="cookies.sqlite" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite" [0077.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cookies.sqlite", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0077.980] GetProcessHeap () returned 0x630000 [0077.980] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xf) returned 0x64c9f0 [0077.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cookies.sqlite", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cookies.sqlite", lpUsedDefaultChar=0x0) returned 15 [0077.980] lstrlenA (lpString="cookies.sqlite") returned 14 [0077.980] lstrlenA (lpString=".happythreechoose") returned 17 [0077.980] lstrcmpiW (lpString1="cookies.sqlite", lpString2="Decryption INFO.html") returned -1 [0077.980] lstrcmpiW (lpString1="cookies.sqlite", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0077.980] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0077.980] lstrcmpiW (lpString1="cookies.sqlite", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0077.980] GetProcessHeap () returned 0x630000 [0077.980] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0077.980] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cookies.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0077.981] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=524288) returned 1 [0077.981] GetProcessHeap () returned 0x630000 [0077.981] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655940 [0077.981] GetProcessHeap () returned 0x630000 [0077.981] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673428 [0077.981] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite") returned 88 [0077.981] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0077.981] GetProcessHeap () returned 0x630000 [0077.981] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0077.981] GetProcessHeap () returned 0x630000 [0077.981] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x674360 [0077.981] lstrlenA (lpString="rsa_encrypt") returned 11 [0077.982] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x672f60) returned 1 [0077.982] CryptGenRandom (in: hProv=0x672f60, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0077.982] CryptReleaseContext (hProv=0x672f60, dwFlags=0x0) returned 1 [0077.982] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0077.982] GetProcessHeap () returned 0x630000 [0077.982] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673538 [0077.982] lstrlenA (lpString="010001") returned 6 [0077.982] GetProcessHeap () returned 0x630000 [0077.982] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3a8 [0077.982] GetProcessHeap () returned 0x630000 [0077.982] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672c30 [0077.982] GetProcessHeap () returned 0x630000 [0077.982] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0077.982] GetProcessHeap () returned 0x630000 [0077.982] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672c30 | out: hHeap=0x630000) returned 1 [0077.983] GetProcessHeap () returned 0x630000 [0077.983] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e8e0 [0077.983] GetProcessHeap () returned 0x630000 [0077.983] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656a68 [0077.983] GetProcessHeap () returned 0x630000 [0077.983] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a298 [0077.983] GetProcessHeap () returned 0x630000 [0077.983] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0077.983] GetProcessHeap () returned 0x630000 [0077.983] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.983] GetProcessHeap () returned 0x630000 [0077.983] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0077.983] GetProcessHeap () returned 0x630000 [0077.983] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6737e0 [0077.983] GetProcessHeap () returned 0x630000 [0077.983] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656950 [0077.983] GetProcessHeap () returned 0x630000 [0077.983] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.983] GetProcessHeap () returned 0x630000 [0077.983] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0077.983] GetProcessHeap () returned 0x630000 [0077.983] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea00 [0077.983] GetProcessHeap () returned 0x630000 [0077.983] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6737e0 | out: hHeap=0x630000) returned 1 [0077.983] GetProcessHeap () returned 0x630000 [0077.983] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0077.983] GetProcessHeap () returned 0x630000 [0077.983] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0077.983] GetProcessHeap () returned 0x630000 [0077.983] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0077.983] GetProcessHeap () returned 0x630000 [0077.983] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65d048 [0077.983] GetProcessHeap () returned 0x630000 [0077.983] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.983] GetProcessHeap () returned 0x630000 [0077.983] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0077.983] GetProcessHeap () returned 0x630000 [0077.983] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.983] GetProcessHeap () returned 0x630000 [0077.983] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.984] GetProcessHeap () returned 0x630000 [0077.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e6a0 [0077.984] GetProcessHeap () returned 0x630000 [0077.984] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65d048 | out: hHeap=0x630000) returned 1 [0077.984] GetProcessHeap () returned 0x630000 [0077.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0077.984] GetProcessHeap () returned 0x630000 [0077.984] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e6a0 | out: hHeap=0x630000) returned 1 [0077.984] GetProcessHeap () returned 0x630000 [0077.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.984] GetProcessHeap () returned 0x630000 [0077.984] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.984] GetProcessHeap () returned 0x630000 [0077.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.984] GetProcessHeap () returned 0x630000 [0077.984] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.984] GetProcessHeap () returned 0x630000 [0077.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0077.984] GetProcessHeap () returned 0x630000 [0077.984] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0077.984] GetProcessHeap () returned 0x630000 [0077.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.984] GetProcessHeap () returned 0x630000 [0077.984] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.984] GetProcessHeap () returned 0x630000 [0077.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.984] GetProcessHeap () returned 0x630000 [0077.984] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.984] GetProcessHeap () returned 0x630000 [0077.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.984] GetProcessHeap () returned 0x630000 [0077.984] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.984] GetProcessHeap () returned 0x630000 [0077.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.984] GetProcessHeap () returned 0x630000 [0077.984] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.984] GetProcessHeap () returned 0x630000 [0077.984] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0077.984] GetProcessHeap () returned 0x630000 [0077.984] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0077.985] GetProcessHeap () returned 0x630000 [0077.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.985] GetProcessHeap () returned 0x630000 [0077.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.985] GetProcessHeap () returned 0x630000 [0077.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.985] GetProcessHeap () returned 0x630000 [0077.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.985] GetProcessHeap () returned 0x630000 [0077.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.985] GetProcessHeap () returned 0x630000 [0077.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.985] GetProcessHeap () returned 0x630000 [0077.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.985] GetProcessHeap () returned 0x630000 [0077.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.985] GetProcessHeap () returned 0x630000 [0077.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.985] GetProcessHeap () returned 0x630000 [0077.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.985] GetProcessHeap () returned 0x630000 [0077.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.985] GetProcessHeap () returned 0x630000 [0077.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.985] GetProcessHeap () returned 0x630000 [0077.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.985] GetProcessHeap () returned 0x630000 [0077.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.985] GetProcessHeap () returned 0x630000 [0077.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.985] GetProcessHeap () returned 0x630000 [0077.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.985] GetProcessHeap () returned 0x630000 [0077.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.985] GetProcessHeap () returned 0x630000 [0077.985] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.985] GetProcessHeap () returned 0x630000 [0077.985] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.986] GetProcessHeap () returned 0x630000 [0077.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.986] GetProcessHeap () returned 0x630000 [0077.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.986] GetProcessHeap () returned 0x630000 [0077.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.986] GetProcessHeap () returned 0x630000 [0077.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.986] GetProcessHeap () returned 0x630000 [0077.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.986] GetProcessHeap () returned 0x630000 [0077.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.986] GetProcessHeap () returned 0x630000 [0077.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.986] GetProcessHeap () returned 0x630000 [0077.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0077.986] GetProcessHeap () returned 0x630000 [0077.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0077.986] GetProcessHeap () returned 0x630000 [0077.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.986] GetProcessHeap () returned 0x630000 [0077.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.986] GetProcessHeap () returned 0x630000 [0077.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.986] GetProcessHeap () returned 0x630000 [0077.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.986] GetProcessHeap () returned 0x630000 [0077.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.986] GetProcessHeap () returned 0x630000 [0077.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.986] GetProcessHeap () returned 0x630000 [0077.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.986] GetProcessHeap () returned 0x630000 [0077.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.986] GetProcessHeap () returned 0x630000 [0077.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.986] GetProcessHeap () returned 0x630000 [0077.986] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.987] GetProcessHeap () returned 0x630000 [0077.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.987] GetProcessHeap () returned 0x630000 [0077.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.987] GetProcessHeap () returned 0x630000 [0077.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.987] GetProcessHeap () returned 0x630000 [0077.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.987] GetProcessHeap () returned 0x630000 [0077.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.987] GetProcessHeap () returned 0x630000 [0077.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.987] GetProcessHeap () returned 0x630000 [0077.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a298 [0077.987] GetProcessHeap () returned 0x630000 [0077.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a298 | out: hHeap=0x630000) returned 1 [0077.987] GetProcessHeap () returned 0x630000 [0077.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.987] GetProcessHeap () returned 0x630000 [0077.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.987] GetProcessHeap () returned 0x630000 [0077.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.987] GetProcessHeap () returned 0x630000 [0077.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.987] GetProcessHeap () returned 0x630000 [0077.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0077.987] GetProcessHeap () returned 0x630000 [0077.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0077.987] GetProcessHeap () returned 0x630000 [0077.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.987] GetProcessHeap () returned 0x630000 [0077.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.987] GetProcessHeap () returned 0x630000 [0077.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.987] GetProcessHeap () returned 0x630000 [0077.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.987] GetProcessHeap () returned 0x630000 [0077.987] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0077.987] GetProcessHeap () returned 0x630000 [0077.987] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0077.988] GetProcessHeap () returned 0x630000 [0077.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.988] GetProcessHeap () returned 0x630000 [0077.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.988] GetProcessHeap () returned 0x630000 [0077.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0077.988] GetProcessHeap () returned 0x630000 [0077.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0077.988] GetProcessHeap () returned 0x630000 [0077.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.988] GetProcessHeap () returned 0x630000 [0077.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.988] GetProcessHeap () returned 0x630000 [0077.988] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3b8 [0077.988] GetProcessHeap () returned 0x630000 [0077.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3b8 | out: hHeap=0x630000) returned 1 [0077.988] GetProcessHeap () returned 0x630000 [0077.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0077.988] GetProcessHeap () returned 0x630000 [0077.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0077.988] GetProcessHeap () returned 0x630000 [0077.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0077.988] GetProcessHeap () returned 0x630000 [0077.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0077.988] GetProcessHeap () returned 0x630000 [0077.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0077.988] GetProcessHeap () returned 0x630000 [0077.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0077.988] GetProcessHeap () returned 0x630000 [0077.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0077.988] GetProcessHeap () returned 0x630000 [0077.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0077.988] GetProcessHeap () returned 0x630000 [0077.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0077.988] GetProcessHeap () returned 0x630000 [0077.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0077.988] GetProcessHeap () returned 0x630000 [0077.988] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673538 | out: hHeap=0x630000) returned 1 [0077.989] WriteFile (in: hFile=0x230, lpBuffer=0x674360*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x674360*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0077.992] GetProcessHeap () returned 0x630000 [0077.992] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x674360, Size=0x30) returned 0x674360 [0077.992] GetProcessHeap () returned 0x630000 [0077.992] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0077.992] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0077.992] GetProcessHeap () returned 0x630000 [0077.992] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x80000) returned 0x1f33020 [0078.002] ReadFile (in: hFile=0x230, lpBuffer=0x1f33020, nNumberOfBytesToRead=0x80000, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x1f33020*, lpNumberOfBytesRead=0x243d7e8*=0x80000, lpOverlapped=0x0) returned 1 [0078.010] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0078.010] WriteFile (in: hFile=0x230, lpBuffer=0x1f33020*, nNumberOfBytesToWrite=0x80000, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x1f33020*, lpNumberOfBytesWritten=0x243d7e4*=0x80000, lpOverlapped=0x0) returned 1 [0078.185] GetProcessHeap () returned 0x630000 [0078.185] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x1f33020 | out: hHeap=0x630000) returned 1 [0078.188] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0078.188] WriteFile (in: hFile=0x230, lpBuffer=0x674360*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x674360*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0078.189] CloseHandle (hObject=0x230) returned 1 [0078.190] GetProcessHeap () returned 0x630000 [0078.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0078.190] GetProcessHeap () returned 0x630000 [0078.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655940 | out: hHeap=0x630000) returned 1 [0078.190] GetProcessHeap () returned 0x630000 [0078.190] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673428 | out: hHeap=0x630000) returned 1 [0078.190] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite" [0078.190] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite.happythreechoose") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite.happythreechoose" [0078.190] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cookies.sqlite"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite.happythreechoose" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\cookies.sqlite.happythreechoose"), dwFlags=0x1) returned 1 [0078.191] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\cookies.sqlite" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0078.191] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="" [0078.191] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html" [0078.191] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\decryption info.html")) returned 0x20 [0078.191] GetProcessHeap () returned 0x630000 [0078.191] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0078.191] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xd17edb60, ftLastAccessTime.dwHighDateTime=0x1d5d80b, ftLastWriteTime.dwLowDateTime=0xd17edb60, ftLastWriteTime.dwHighDateTime=0x1d5d80b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="crashes", cAlternateFileName="")) returned 1 [0078.191] lstrcmpiW (lpString1="crashes", lpString2=".") returned 1 [0078.191] lstrcmpiW (lpString1="crashes", lpString2="..") returned 1 [0078.191] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="crashes" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes" [0078.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crashes", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0078.192] GetProcessHeap () returned 0x630000 [0078.192] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a3a8 [0078.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="crashes", cchWideChar=-1, lpMultiByteStr=0x65a3a8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="crashes", lpUsedDefaultChar=0x0) returned 8 [0078.192] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="crashes", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0078.192] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="crashes", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0078.192] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="crashes", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0078.192] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="crashes", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0078.192] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="crashes", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0078.192] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="crashes", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0078.192] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="crashes", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0078.192] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="crashes", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0078.192] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="crashes", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0078.192] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="crashes", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0078.192] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="crashes", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0078.192] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="crashes", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0078.192] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="crashes", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0078.192] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="crashes", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0078.192] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="crashes", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0078.192] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="crashes", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0078.192] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="crashes", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0078.192] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="crashes", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0078.192] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="crashes", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0078.192] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="crashes", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0078.192] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="crashes", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0078.192] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="crashes", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0078.193] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="crashes", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0078.193] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="crashes", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0078.193] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="crashes", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0078.193] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="crashes", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0078.193] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="crashes", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0078.193] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="crashes", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0078.193] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="crashes", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0078.193] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="crashes", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0078.193] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="crashes", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0078.193] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="crashes", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0078.193] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="crashes", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0078.193] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="crashes", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0078.193] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="crashes", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0078.193] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="crashes", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0078.193] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="crashes", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0078.193] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="crashes", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0078.193] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="crashes", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0078.193] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="crashes", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0078.193] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="crashes", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0078.193] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="crashes", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0078.193] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="crashes", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0078.193] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\" [0078.193] GetProcessHeap () returned 0x630000 [0078.193] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a3b8 [0078.193] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\") returned 82 [0078.193] GetProcessHeap () returned 0x630000 [0078.193] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa6) returned 0x640088 [0078.193] lstrcpyW (in: lpString1=0x640088, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\crashes\\" [0078.194] GetProcessHeap () returned 0x630000 [0078.194] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0078.194] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x145d99f2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xd362d4ed, ftLastAccessTime.dwHighDateTime=0x1d5d80b, ftLastWriteTime.dwLowDateTime=0xd362d4ed, ftLastWriteTime.dwHighDateTime=0x1d5d80b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="datareporting", cAlternateFileName="DATARE~1")) returned 1 [0078.194] lstrcmpiW (lpString1="datareporting", lpString2=".") returned 1 [0078.194] lstrcmpiW (lpString1="datareporting", lpString2="..") returned 1 [0078.194] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="datareporting" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting" [0078.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datareporting", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0078.194] GetProcessHeap () returned 0x630000 [0078.194] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x64c9f0 [0078.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="datareporting", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="datareporting", lpUsedDefaultChar=0x0) returned 14 [0078.194] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="datareporting", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0078.194] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="datareporting", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0078.194] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="datareporting", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0078.194] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="datareporting", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0078.194] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="datareporting", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0078.194] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="datareporting", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0078.194] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="datareporting", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0078.194] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="datareporting", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0078.194] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="datareporting", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0078.194] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="datareporting", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0078.194] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="datareporting", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0078.194] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="datareporting", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0078.194] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="datareporting", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0078.194] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="datareporting", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0078.194] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="datareporting", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0078.194] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="datareporting", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0078.194] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="datareporting", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0078.194] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="datareporting", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0078.195] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="datareporting", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0078.195] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="datareporting", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0078.195] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="datareporting", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0078.195] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="datareporting", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0078.195] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="datareporting", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0078.195] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="datareporting", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0078.195] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="datareporting", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0078.195] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="datareporting", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0078.195] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="datareporting", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0078.195] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="datareporting", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0078.195] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="datareporting", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0078.195] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="datareporting", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0078.195] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="datareporting", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0078.195] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="datareporting", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0078.195] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="datareporting", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0078.195] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="datareporting", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0078.195] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="datareporting", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0078.195] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="datareporting", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0078.195] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="datareporting", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0078.195] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="datareporting", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0078.195] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="datareporting", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0078.195] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="datareporting", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0078.195] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="datareporting", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0078.195] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="datareporting", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0078.195] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="datareporting", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0078.195] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\" [0078.195] GetProcessHeap () returned 0x630000 [0078.196] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a298 [0078.196] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\") returned 88 [0078.196] GetProcessHeap () returned 0x630000 [0078.196] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb2) returned 0x64c178 [0078.196] lstrcpyW (in: lpString1=0x64c178, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\datareporting\\" [0078.196] GetProcessHeap () returned 0x630000 [0078.196] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0078.196] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909d293, ftCreationTime.dwHighDateTime=0x1d5d80c, ftLastAccessTime.dwLowDateTime=0x909d293, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0x909d293, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x292e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="extensions.json", cAlternateFileName="EXTENS~1.JSO")) returned 1 [0078.196] lstrcmpiW (lpString1="extensions.json", lpString2=".") returned 1 [0078.196] lstrcmpiW (lpString1="extensions.json", lpString2="..") returned 1 [0078.196] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="extensions.json" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\extensions.json") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\extensions.json" [0078.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="extensions.json", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0078.196] GetProcessHeap () returned 0x630000 [0078.196] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x64c9f0 [0078.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="extensions.json", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="extensions.json", lpUsedDefaultChar=0x0) returned 16 [0078.196] lstrlenA (lpString="extensions.json") returned 15 [0078.196] lstrlenA (lpString=".happythreechoose") returned 17 [0078.196] lstrcmpiW (lpString1="extensions.json", lpString2="Decryption INFO.html") returned 1 [0078.196] lstrcmpiW (lpString1="extensions.json", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0078.196] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0078.196] lstrcmpiW (lpString1="extensions.json", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0078.196] GetProcessHeap () returned 0x630000 [0078.196] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f88 [0078.196] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\extensions.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\extensions.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0078.197] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=10542) returned 1 [0078.197] GetProcessHeap () returned 0x630000 [0078.197] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6557d8 [0078.197] GetProcessHeap () returned 0x630000 [0078.197] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672988 [0078.198] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\extensions.json") returned 89 [0078.198] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0078.198] GetProcessHeap () returned 0x630000 [0078.198] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0078.198] GetProcessHeap () returned 0x630000 [0078.198] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x674398 [0078.198] lstrlenA (lpString="rsa_encrypt") returned 11 [0078.198] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x6734b0) returned 1 [0078.198] CryptGenRandom (in: hProv=0x6734b0, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0078.198] CryptReleaseContext (hProv=0x6734b0, dwFlags=0x0) returned 1 [0078.199] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0078.199] GetProcessHeap () returned 0x630000 [0078.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673180 [0078.199] lstrlenA (lpString="010001") returned 6 [0078.199] GetProcessHeap () returned 0x630000 [0078.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3a8 [0078.199] GetProcessHeap () returned 0x630000 [0078.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672d40 [0078.199] GetProcessHeap () returned 0x630000 [0078.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e190 [0078.199] GetProcessHeap () returned 0x630000 [0078.199] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672d40 | out: hHeap=0x630000) returned 1 [0078.199] GetProcessHeap () returned 0x630000 [0078.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e8e0 [0078.199] GetProcessHeap () returned 0x630000 [0078.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657788 [0078.199] GetProcessHeap () returned 0x630000 [0078.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3f8 [0078.199] GetProcessHeap () returned 0x630000 [0078.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0078.199] GetProcessHeap () returned 0x630000 [0078.199] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0078.199] GetProcessHeap () returned 0x630000 [0078.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0078.199] GetProcessHeap () returned 0x630000 [0078.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673208 [0078.199] GetProcessHeap () returned 0x630000 [0078.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656db0 [0078.199] GetProcessHeap () returned 0x630000 [0078.199] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0078.199] GetProcessHeap () returned 0x630000 [0078.200] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0078.200] GetProcessHeap () returned 0x630000 [0078.200] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0078.200] GetProcessHeap () returned 0x630000 [0078.200] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673208 | out: hHeap=0x630000) returned 1 [0078.200] GetProcessHeap () returned 0x630000 [0078.200] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0078.200] GetProcessHeap () returned 0x630000 [0078.200] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0078.200] GetProcessHeap () returned 0x630000 [0078.200] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0078.200] GetProcessHeap () returned 0x630000 [0078.200] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65d060 [0078.200] GetProcessHeap () returned 0x630000 [0078.200] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0078.200] GetProcessHeap () returned 0x630000 [0078.200] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0078.200] GetProcessHeap () returned 0x630000 [0078.200] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0078.200] GetProcessHeap () returned 0x630000 [0078.200] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0078.200] GetProcessHeap () returned 0x630000 [0078.200] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e850 [0078.200] GetProcessHeap () returned 0x630000 [0078.200] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65d060 | out: hHeap=0x630000) returned 1 [0078.200] GetProcessHeap () returned 0x630000 [0078.200] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0078.200] GetProcessHeap () returned 0x630000 [0078.200] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0078.200] GetProcessHeap () returned 0x630000 [0078.200] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0078.200] GetProcessHeap () returned 0x630000 [0078.200] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0078.201] GetProcessHeap () returned 0x630000 [0078.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0078.201] GetProcessHeap () returned 0x630000 [0078.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0078.201] GetProcessHeap () returned 0x630000 [0078.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0078.201] GetProcessHeap () returned 0x630000 [0078.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0078.201] GetProcessHeap () returned 0x630000 [0078.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0078.201] GetProcessHeap () returned 0x630000 [0078.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0078.201] GetProcessHeap () returned 0x630000 [0078.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0078.201] GetProcessHeap () returned 0x630000 [0078.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0078.201] GetProcessHeap () returned 0x630000 [0078.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0078.201] GetProcessHeap () returned 0x630000 [0078.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0078.201] GetProcessHeap () returned 0x630000 [0078.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0078.201] GetProcessHeap () returned 0x630000 [0078.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0078.201] GetProcessHeap () returned 0x630000 [0078.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0078.201] GetProcessHeap () returned 0x630000 [0078.201] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0078.201] GetProcessHeap () returned 0x630000 [0078.201] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0078.201] GetProcessHeap () returned 0x630000 [0078.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0078.202] GetProcessHeap () returned 0x630000 [0078.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0078.202] GetProcessHeap () returned 0x630000 [0078.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0078.202] GetProcessHeap () returned 0x630000 [0078.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0078.202] GetProcessHeap () returned 0x630000 [0078.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0078.202] GetProcessHeap () returned 0x630000 [0078.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0078.202] GetProcessHeap () returned 0x630000 [0078.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0078.202] GetProcessHeap () returned 0x630000 [0078.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0078.202] GetProcessHeap () returned 0x630000 [0078.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0078.202] GetProcessHeap () returned 0x630000 [0078.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0078.202] GetProcessHeap () returned 0x630000 [0078.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0078.202] GetProcessHeap () returned 0x630000 [0078.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0078.202] GetProcessHeap () returned 0x630000 [0078.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0078.202] GetProcessHeap () returned 0x630000 [0078.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0078.202] GetProcessHeap () returned 0x630000 [0078.202] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0078.202] GetProcessHeap () returned 0x630000 [0078.202] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0078.203] GetProcessHeap () returned 0x630000 [0078.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0078.203] GetProcessHeap () returned 0x630000 [0078.203] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0078.203] GetProcessHeap () returned 0x630000 [0078.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0078.203] GetProcessHeap () returned 0x630000 [0078.203] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0078.203] GetProcessHeap () returned 0x630000 [0078.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0078.203] GetProcessHeap () returned 0x630000 [0078.203] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0078.203] GetProcessHeap () returned 0x630000 [0078.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0078.203] GetProcessHeap () returned 0x630000 [0078.203] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0078.203] GetProcessHeap () returned 0x630000 [0078.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0078.203] GetProcessHeap () returned 0x630000 [0078.203] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0078.203] GetProcessHeap () returned 0x630000 [0078.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0078.203] GetProcessHeap () returned 0x630000 [0078.203] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0078.203] GetProcessHeap () returned 0x630000 [0078.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0078.203] GetProcessHeap () returned 0x630000 [0078.203] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0078.203] GetProcessHeap () returned 0x630000 [0078.203] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0078.203] GetProcessHeap () returned 0x630000 [0078.203] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0078.204] GetProcessHeap () returned 0x630000 [0078.204] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0078.204] GetProcessHeap () returned 0x630000 [0078.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0078.204] GetProcessHeap () returned 0x630000 [0078.204] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0078.204] GetProcessHeap () returned 0x630000 [0078.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0078.204] GetProcessHeap () returned 0x630000 [0078.204] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0078.204] GetProcessHeap () returned 0x630000 [0078.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0078.204] GetProcessHeap () returned 0x630000 [0078.204] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0078.204] GetProcessHeap () returned 0x630000 [0078.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0078.204] GetProcessHeap () returned 0x630000 [0078.204] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0078.204] GetProcessHeap () returned 0x630000 [0078.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0078.204] GetProcessHeap () returned 0x630000 [0078.204] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0078.204] GetProcessHeap () returned 0x630000 [0078.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0078.204] GetProcessHeap () returned 0x630000 [0078.204] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0078.204] GetProcessHeap () returned 0x630000 [0078.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0078.204] GetProcessHeap () returned 0x630000 [0078.204] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0078.204] GetProcessHeap () returned 0x630000 [0078.204] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0078.205] GetProcessHeap () returned 0x630000 [0078.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0078.205] GetProcessHeap () returned 0x630000 [0078.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0078.205] GetProcessHeap () returned 0x630000 [0078.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0078.205] GetProcessHeap () returned 0x630000 [0078.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0078.205] GetProcessHeap () returned 0x630000 [0078.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0078.205] GetProcessHeap () returned 0x630000 [0078.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0078.205] GetProcessHeap () returned 0x630000 [0078.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0078.205] GetProcessHeap () returned 0x630000 [0078.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0078.205] GetProcessHeap () returned 0x630000 [0078.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0078.205] GetProcessHeap () returned 0x630000 [0078.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0078.205] GetProcessHeap () returned 0x630000 [0078.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0078.205] GetProcessHeap () returned 0x630000 [0078.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0078.205] GetProcessHeap () returned 0x630000 [0078.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0078.205] GetProcessHeap () returned 0x630000 [0078.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0078.205] GetProcessHeap () returned 0x630000 [0078.205] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0078.205] GetProcessHeap () returned 0x630000 [0078.205] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0078.206] GetProcessHeap () returned 0x630000 [0078.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0078.206] GetProcessHeap () returned 0x630000 [0078.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0078.206] GetProcessHeap () returned 0x630000 [0078.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0078.206] GetProcessHeap () returned 0x630000 [0078.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0078.206] GetProcessHeap () returned 0x630000 [0078.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0078.206] GetProcessHeap () returned 0x630000 [0078.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0078.206] GetProcessHeap () returned 0x630000 [0078.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0078.206] GetProcessHeap () returned 0x630000 [0078.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0078.206] GetProcessHeap () returned 0x630000 [0078.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0078.206] GetProcessHeap () returned 0x630000 [0078.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0078.206] GetProcessHeap () returned 0x630000 [0078.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0078.206] GetProcessHeap () returned 0x630000 [0078.206] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673180 | out: hHeap=0x630000) returned 1 [0078.206] WriteFile (in: hFile=0x230, lpBuffer=0x674398*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x674398*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0078.209] GetProcessHeap () returned 0x630000 [0078.209] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x674398, Size=0x30) returned 0x674398 [0078.209] GetProcessHeap () returned 0x630000 [0078.209] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0078.210] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0078.210] GetProcessHeap () returned 0x630000 [0078.210] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x292e) returned 0x6743d0 [0078.210] ReadFile (in: hFile=0x230, lpBuffer=0x6743d0, nNumberOfBytesToRead=0x292e, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x6743d0*, lpNumberOfBytesRead=0x243d7e8*=0x292e, lpOverlapped=0x0) returned 1 [0078.210] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0078.211] WriteFile (in: hFile=0x230, lpBuffer=0x6743d0*, nNumberOfBytesToWrite=0x292e, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x6743d0*, lpNumberOfBytesWritten=0x243d7e4*=0x292e, lpOverlapped=0x0) returned 1 [0078.212] GetProcessHeap () returned 0x630000 [0078.212] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6743d0 | out: hHeap=0x630000) returned 1 [0078.212] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0078.212] WriteFile (in: hFile=0x230, lpBuffer=0x674398*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x674398*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0078.213] CloseHandle (hObject=0x230) returned 1 [0078.214] GetProcessHeap () returned 0x630000 [0078.214] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f88 | out: hHeap=0x630000) returned 1 [0078.214] GetProcessHeap () returned 0x630000 [0078.214] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6557d8 | out: hHeap=0x630000) returned 1 [0078.214] GetProcessHeap () returned 0x630000 [0078.214] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672988 | out: hHeap=0x630000) returned 1 [0078.214] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\extensions.json" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\extensions.json") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\extensions.json" [0078.214] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\extensions.json", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\extensions.json.happythreechoose") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\extensions.json.happythreechoose" [0078.214] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\extensions.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\extensions.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\extensions.json.happythreechoose" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\extensions.json.happythreechoose"), dwFlags=0x1) returned 1 [0078.215] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\extensions.json" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0078.215] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="" [0078.215] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html" [0078.215] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\decryption info.html")) returned 0x20 [0078.215] GetProcessHeap () returned 0x630000 [0078.215] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0078.215] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdd54ecc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfdd54ecc, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x145311ab, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x500000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="favicons.sqlite", cAlternateFileName="FAVICO~1.SQL")) returned 1 [0078.215] lstrcmpiW (lpString1="favicons.sqlite", lpString2=".") returned 1 [0078.215] lstrcmpiW (lpString1="favicons.sqlite", lpString2="..") returned 1 [0078.215] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="favicons.sqlite" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite" [0078.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="favicons.sqlite", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0078.215] GetProcessHeap () returned 0x630000 [0078.215] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x64c9f0 [0078.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="favicons.sqlite", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="favicons.sqlite", lpUsedDefaultChar=0x0) returned 16 [0078.215] lstrlenA (lpString="favicons.sqlite") returned 15 [0078.215] lstrlenA (lpString=".happythreechoose") returned 17 [0078.215] lstrcmpiW (lpString1="favicons.sqlite", lpString2="Decryption INFO.html") returned 1 [0078.215] lstrcmpiW (lpString1="favicons.sqlite", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0078.216] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0078.216] lstrcmpiW (lpString1="favicons.sqlite", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0078.216] GetProcessHeap () returned 0x630000 [0078.216] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0078.216] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\favicons.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0078.217] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=5242880) returned 1 [0078.217] GetProcessHeap () returned 0x630000 [0078.217] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655aa8 [0078.217] GetProcessHeap () returned 0x630000 [0078.217] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672a98 [0078.217] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite") returned 89 [0078.217] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0078.217] GetProcessHeap () returned 0x630000 [0078.217] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0078.217] GetProcessHeap () returned 0x630000 [0078.217] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x6743d0 [0078.217] lstrlenA (lpString="rsa_encrypt") returned 11 [0078.217] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x6736d0) returned 1 [0078.218] CryptGenRandom (in: hProv=0x6736d0, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0078.218] CryptReleaseContext (hProv=0x6736d0, dwFlags=0x0) returned 1 [0078.218] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0078.218] GetProcessHeap () returned 0x630000 [0078.218] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672f60 [0078.218] lstrlenA (lpString="010001") returned 6 [0078.218] GetProcessHeap () returned 0x630000 [0078.218] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2a8 [0078.218] GetProcessHeap () returned 0x630000 [0078.218] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672a10 [0078.218] GetProcessHeap () returned 0x630000 [0078.218] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dec0 [0078.218] GetProcessHeap () returned 0x630000 [0078.218] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672a10 | out: hHeap=0x630000) returned 1 [0078.218] GetProcessHeap () returned 0x630000 [0078.218] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65de30 [0078.218] GetProcessHeap () returned 0x630000 [0078.218] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656b80 [0078.218] GetProcessHeap () returned 0x630000 [0078.218] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3a8 [0078.218] GetProcessHeap () returned 0x630000 [0078.218] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0078.218] GetProcessHeap () returned 0x630000 [0078.219] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0078.219] GetProcessHeap () returned 0x630000 [0078.219] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657440 [0078.219] GetProcessHeap () returned 0x630000 [0078.219] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672ba8 [0078.219] GetProcessHeap () returned 0x630000 [0078.219] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656a68 [0078.219] GetProcessHeap () returned 0x630000 [0078.219] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0078.219] GetProcessHeap () returned 0x630000 [0078.219] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0078.219] GetProcessHeap () returned 0x630000 [0078.219] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e850 [0078.219] GetProcessHeap () returned 0x630000 [0078.219] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672ba8 | out: hHeap=0x630000) returned 1 [0078.219] GetProcessHeap () returned 0x630000 [0078.219] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0078.219] GetProcessHeap () returned 0x630000 [0078.219] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0078.219] GetProcessHeap () returned 0x630000 [0078.219] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0078.219] GetProcessHeap () returned 0x630000 [0078.219] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65ce08 [0078.219] GetProcessHeap () returned 0x630000 [0078.219] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0078.219] GetProcessHeap () returned 0x630000 [0078.219] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0078.219] GetProcessHeap () returned 0x630000 [0078.219] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0078.219] GetProcessHeap () returned 0x630000 [0078.219] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0078.219] GetProcessHeap () returned 0x630000 [0078.220] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e730 [0078.220] GetProcessHeap () returned 0x630000 [0078.220] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ce08 | out: hHeap=0x630000) returned 1 [0078.220] GetProcessHeap () returned 0x630000 [0078.220] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0078.220] GetProcessHeap () returned 0x630000 [0078.220] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e730 | out: hHeap=0x630000) returned 1 [0078.220] GetProcessHeap () returned 0x630000 [0078.220] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0078.220] GetProcessHeap () returned 0x630000 [0078.220] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0078.220] GetProcessHeap () returned 0x630000 [0078.220] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0078.220] GetProcessHeap () returned 0x630000 [0078.220] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0078.220] GetProcessHeap () returned 0x630000 [0078.220] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0078.220] GetProcessHeap () returned 0x630000 [0078.220] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0078.220] GetProcessHeap () returned 0x630000 [0078.220] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0078.220] GetProcessHeap () returned 0x630000 [0078.220] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0078.220] GetProcessHeap () returned 0x630000 [0078.220] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0078.220] GetProcessHeap () returned 0x630000 [0078.220] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0078.220] GetProcessHeap () returned 0x630000 [0078.220] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0078.220] GetProcessHeap () returned 0x630000 [0078.220] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0078.220] GetProcessHeap () returned 0x630000 [0078.220] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0078.221] GetProcessHeap () returned 0x630000 [0078.221] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0078.221] GetProcessHeap () returned 0x630000 [0078.221] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0078.221] GetProcessHeap () returned 0x630000 [0078.221] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0078.221] GetProcessHeap () returned 0x630000 [0078.221] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0078.221] GetProcessHeap () returned 0x630000 [0078.221] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0078.221] GetProcessHeap () returned 0x630000 [0078.221] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0078.221] GetProcessHeap () returned 0x630000 [0078.221] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0078.221] GetProcessHeap () returned 0x630000 [0078.221] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0078.221] GetProcessHeap () returned 0x630000 [0078.221] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0078.221] GetProcessHeap () returned 0x630000 [0078.221] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0078.221] GetProcessHeap () returned 0x630000 [0078.221] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0078.221] GetProcessHeap () returned 0x630000 [0078.221] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0078.221] GetProcessHeap () returned 0x630000 [0078.221] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0078.221] GetProcessHeap () returned 0x630000 [0078.221] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0078.221] GetProcessHeap () returned 0x630000 [0078.221] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0078.222] GetProcessHeap () returned 0x630000 [0078.222] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0078.222] GetProcessHeap () returned 0x630000 [0078.222] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0078.222] GetProcessHeap () returned 0x630000 [0078.222] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0078.222] GetProcessHeap () returned 0x630000 [0078.222] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0078.222] GetProcessHeap () returned 0x630000 [0078.222] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0078.222] GetProcessHeap () returned 0x630000 [0078.222] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0078.222] GetProcessHeap () returned 0x630000 [0078.222] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0078.222] GetProcessHeap () returned 0x630000 [0078.222] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0078.222] GetProcessHeap () returned 0x630000 [0078.222] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0078.222] GetProcessHeap () returned 0x630000 [0078.222] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0078.222] GetProcessHeap () returned 0x630000 [0078.222] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0078.222] GetProcessHeap () returned 0x630000 [0078.222] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0078.222] GetProcessHeap () returned 0x630000 [0078.222] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0078.222] GetProcessHeap () returned 0x630000 [0078.222] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0078.222] GetProcessHeap () returned 0x630000 [0078.223] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0078.223] GetProcessHeap () returned 0x630000 [0078.223] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0078.223] GetProcessHeap () returned 0x630000 [0078.223] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0078.223] GetProcessHeap () returned 0x630000 [0078.223] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0078.223] GetProcessHeap () returned 0x630000 [0078.223] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0078.223] GetProcessHeap () returned 0x630000 [0078.223] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0078.223] GetProcessHeap () returned 0x630000 [0078.223] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0078.223] GetProcessHeap () returned 0x630000 [0078.223] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0078.223] GetProcessHeap () returned 0x630000 [0078.223] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0078.223] GetProcessHeap () returned 0x630000 [0078.223] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0078.223] GetProcessHeap () returned 0x630000 [0078.223] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0078.223] GetProcessHeap () returned 0x630000 [0078.223] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0078.223] GetProcessHeap () returned 0x630000 [0078.223] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0078.223] GetProcessHeap () returned 0x630000 [0078.223] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0078.223] GetProcessHeap () returned 0x630000 [0078.223] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0078.223] GetProcessHeap () returned 0x630000 [0078.223] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0078.224] GetProcessHeap () returned 0x630000 [0078.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0078.224] GetProcessHeap () returned 0x630000 [0078.224] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0078.224] GetProcessHeap () returned 0x630000 [0078.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0078.224] GetProcessHeap () returned 0x630000 [0078.224] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0078.224] GetProcessHeap () returned 0x630000 [0078.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0078.224] GetProcessHeap () returned 0x630000 [0078.224] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0078.224] GetProcessHeap () returned 0x630000 [0078.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0078.224] GetProcessHeap () returned 0x630000 [0078.224] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0078.224] GetProcessHeap () returned 0x630000 [0078.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0078.224] GetProcessHeap () returned 0x630000 [0078.224] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0078.224] GetProcessHeap () returned 0x630000 [0078.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0078.224] GetProcessHeap () returned 0x630000 [0078.224] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0078.224] GetProcessHeap () returned 0x630000 [0078.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0078.224] GetProcessHeap () returned 0x630000 [0078.224] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0078.224] GetProcessHeap () returned 0x630000 [0078.224] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0078.224] GetProcessHeap () returned 0x630000 [0078.225] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0078.225] GetProcessHeap () returned 0x630000 [0078.225] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0078.225] GetProcessHeap () returned 0x630000 [0078.225] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0078.225] GetProcessHeap () returned 0x630000 [0078.225] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0078.225] GetProcessHeap () returned 0x630000 [0078.225] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0078.225] GetProcessHeap () returned 0x630000 [0078.225] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3a8 [0078.225] GetProcessHeap () returned 0x630000 [0078.225] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0078.225] GetProcessHeap () returned 0x630000 [0078.225] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0078.225] GetProcessHeap () returned 0x630000 [0078.225] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0078.225] GetProcessHeap () returned 0x630000 [0078.225] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657440 | out: hHeap=0x630000) returned 1 [0078.225] GetProcessHeap () returned 0x630000 [0078.225] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0078.225] GetProcessHeap () returned 0x630000 [0078.225] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0078.225] GetProcessHeap () returned 0x630000 [0078.225] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0078.225] GetProcessHeap () returned 0x630000 [0078.225] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0078.225] GetProcessHeap () returned 0x630000 [0078.225] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65de30 | out: hHeap=0x630000) returned 1 [0078.226] GetProcessHeap () returned 0x630000 [0078.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0078.226] GetProcessHeap () returned 0x630000 [0078.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0078.226] GetProcessHeap () returned 0x630000 [0078.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0078.226] GetProcessHeap () returned 0x630000 [0078.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0078.226] GetProcessHeap () returned 0x630000 [0078.226] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672f60 | out: hHeap=0x630000) returned 1 [0078.226] WriteFile (in: hFile=0x230, lpBuffer=0x6743d0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6743d0*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0078.390] GetProcessHeap () returned 0x630000 [0078.390] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6743d0, Size=0x30) returned 0x6743d0 [0078.390] GetProcessHeap () returned 0x630000 [0078.390] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0078.390] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0078.390] GetProcessHeap () returned 0x630000 [0078.390] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x500000) returned 0x2443020 [0078.657] ReadFile (in: hFile=0x230, lpBuffer=0x2443020, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x2443020*, lpNumberOfBytesRead=0x243d7e8*=0x500000, lpOverlapped=0x0) returned 1 [0079.003] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0079.003] WriteFile (in: hFile=0x230, lpBuffer=0x2443020*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x2443020*, lpNumberOfBytesWritten=0x243d7e4*=0x500000, lpOverlapped=0x0) returned 1 [0079.719] GetProcessHeap () returned 0x630000 [0079.719] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x2443020 | out: hHeap=0x630000) returned 1 [0079.839] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0079.839] WriteFile (in: hFile=0x230, lpBuffer=0x6743d0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6743d0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0079.849] CloseHandle (hObject=0x230) returned 1 [0079.850] GetProcessHeap () returned 0x630000 [0079.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0079.850] GetProcessHeap () returned 0x630000 [0079.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655aa8 | out: hHeap=0x630000) returned 1 [0079.850] GetProcessHeap () returned 0x630000 [0079.850] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672a98 | out: hHeap=0x630000) returned 1 [0079.850] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite" [0079.850] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite.happythreechoose") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite.happythreechoose" [0079.850] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\favicons.sqlite"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite.happythreechoose" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\favicons.sqlite.happythreechoose"), dwFlags=0x1) returned 1 [0079.852] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0079.852] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="" [0079.854] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html" [0079.854] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\decryption info.html")) returned 0x20 [0079.854] GetProcessHeap () returned 0x630000 [0079.854] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0079.854] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba329010, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xba329010, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xaf8d2087, ftLastWriteTime.dwHighDateTime=0x1d5d80b, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="favicons.sqlite-shm", cAlternateFileName="FAVICO~3.SQL")) returned 1 [0079.854] lstrcmpiW (lpString1="favicons.sqlite-shm", lpString2=".") returned 1 [0079.854] lstrcmpiW (lpString1="favicons.sqlite-shm", lpString2="..") returned 1 [0079.854] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="favicons.sqlite-shm" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-shm") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-shm" [0079.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="favicons.sqlite-shm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0079.854] GetProcessHeap () returned 0x630000 [0079.854] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x645d58 [0079.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="favicons.sqlite-shm", cchWideChar=-1, lpMultiByteStr=0x645d58, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="favicons.sqlite-shm", lpUsedDefaultChar=0x0) returned 20 [0079.855] lstrlenA (lpString="favicons.sqlite-shm") returned 19 [0079.855] lstrlenA (lpString=".happythreechoose") returned 17 [0079.855] lstrlenA (lpString=".happythreechoose") returned 17 [0079.855] lstrlenA (lpString="favicons.sqlite-shm") returned 19 [0079.855] lstrcmpiA (lpString1="vicons.sqlite-shm", lpString2=".happythreechoose") returned 1 [0079.855] lstrcmpiW (lpString1="favicons.sqlite-shm", lpString2="Decryption INFO.html") returned 1 [0079.855] lstrcmpiW (lpString1="favicons.sqlite-shm", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0079.855] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0079.855] lstrcmpiW (lpString1="favicons.sqlite-shm", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0079.855] GetProcessHeap () returned 0x630000 [0079.855] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f10 [0079.855] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-shm" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\favicons.sqlite-shm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0079.856] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=32768) returned 1 [0079.856] GetProcessHeap () returned 0x630000 [0079.856] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655490 [0079.856] GetProcessHeap () returned 0x630000 [0079.856] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672e50 [0079.856] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-shm") returned 93 [0079.856] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0079.856] GetProcessHeap () returned 0x630000 [0079.856] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0079.856] GetProcessHeap () returned 0x630000 [0079.856] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x674408 [0079.856] lstrlenA (lpString="rsa_encrypt") returned 11 [0079.856] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x673538) returned 1 [0079.857] CryptGenRandom (in: hProv=0x673538, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0079.857] CryptReleaseContext (hProv=0x673538, dwFlags=0x0) returned 1 [0079.857] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0079.857] GetProcessHeap () returned 0x630000 [0079.857] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672a10 [0079.857] lstrlenA (lpString="010001") returned 6 [0079.857] GetProcessHeap () returned 0x630000 [0079.857] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3a8 [0079.857] GetProcessHeap () returned 0x630000 [0079.857] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6735c0 [0079.857] GetProcessHeap () returned 0x630000 [0079.857] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ebb0 [0079.857] GetProcessHeap () returned 0x630000 [0079.857] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6735c0 | out: hHeap=0x630000) returned 1 [0079.857] GetProcessHeap () returned 0x630000 [0079.857] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e970 [0079.857] GetProcessHeap () returned 0x630000 [0079.857] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656ec8 [0079.857] GetProcessHeap () returned 0x630000 [0079.857] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0079.857] GetProcessHeap () returned 0x630000 [0079.857] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656fe0 [0079.857] GetProcessHeap () returned 0x630000 [0079.857] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0079.857] GetProcessHeap () returned 0x630000 [0079.857] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0079.857] GetProcessHeap () returned 0x630000 [0079.857] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672d40 [0079.857] GetProcessHeap () returned 0x630000 [0079.858] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656db0 [0079.858] GetProcessHeap () returned 0x630000 [0079.858] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.858] GetProcessHeap () returned 0x630000 [0079.858] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0079.858] GetProcessHeap () returned 0x630000 [0079.858] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65eb20 [0079.858] GetProcessHeap () returned 0x630000 [0079.858] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672d40 | out: hHeap=0x630000) returned 1 [0079.858] GetProcessHeap () returned 0x630000 [0079.858] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0079.858] GetProcessHeap () returned 0x630000 [0079.858] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0079.858] GetProcessHeap () returned 0x630000 [0079.858] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0079.858] GetProcessHeap () returned 0x630000 [0079.858] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0079.858] GetProcessHeap () returned 0x630000 [0079.858] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.858] GetProcessHeap () returned 0x630000 [0079.858] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0079.858] GetProcessHeap () returned 0x630000 [0079.858] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.858] GetProcessHeap () returned 0x630000 [0079.858] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.858] GetProcessHeap () returned 0x630000 [0079.858] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e610 [0079.858] GetProcessHeap () returned 0x630000 [0079.858] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0079.858] GetProcessHeap () returned 0x630000 [0079.858] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0079.858] GetProcessHeap () returned 0x630000 [0079.858] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e610 | out: hHeap=0x630000) returned 1 [0079.858] GetProcessHeap () returned 0x630000 [0079.858] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.858] GetProcessHeap () returned 0x630000 [0079.858] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.858] GetProcessHeap () returned 0x630000 [0079.858] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.858] GetProcessHeap () returned 0x630000 [0079.858] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.859] GetProcessHeap () returned 0x630000 [0079.859] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0079.859] GetProcessHeap () returned 0x630000 [0079.859] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0079.859] GetProcessHeap () returned 0x630000 [0079.859] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.859] GetProcessHeap () returned 0x630000 [0079.859] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.859] GetProcessHeap () returned 0x630000 [0079.859] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0079.859] GetProcessHeap () returned 0x630000 [0079.859] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0079.859] GetProcessHeap () returned 0x630000 [0079.859] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.859] GetProcessHeap () returned 0x630000 [0079.859] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.859] GetProcessHeap () returned 0x630000 [0079.859] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.859] GetProcessHeap () returned 0x630000 [0079.859] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.859] GetProcessHeap () returned 0x630000 [0079.859] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.859] GetProcessHeap () returned 0x630000 [0079.859] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.859] GetProcessHeap () returned 0x630000 [0079.859] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.859] GetProcessHeap () returned 0x630000 [0079.859] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.859] GetProcessHeap () returned 0x630000 [0079.859] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0079.859] GetProcessHeap () returned 0x630000 [0079.859] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0079.859] GetProcessHeap () returned 0x630000 [0079.859] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.859] GetProcessHeap () returned 0x630000 [0079.859] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.859] GetProcessHeap () returned 0x630000 [0079.859] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.860] GetProcessHeap () returned 0x630000 [0079.860] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.860] GetProcessHeap () returned 0x630000 [0079.860] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.860] GetProcessHeap () returned 0x630000 [0079.860] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.860] GetProcessHeap () returned 0x630000 [0079.860] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.860] GetProcessHeap () returned 0x630000 [0079.860] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.860] GetProcessHeap () returned 0x630000 [0079.860] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.860] GetProcessHeap () returned 0x630000 [0079.860] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.860] GetProcessHeap () returned 0x630000 [0079.860] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.860] GetProcessHeap () returned 0x630000 [0079.860] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.860] GetProcessHeap () returned 0x630000 [0079.860] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0079.860] GetProcessHeap () returned 0x630000 [0079.860] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0079.860] GetProcessHeap () returned 0x630000 [0079.860] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.860] GetProcessHeap () returned 0x630000 [0079.860] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.860] GetProcessHeap () returned 0x630000 [0079.860] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.860] GetProcessHeap () returned 0x630000 [0079.860] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.860] GetProcessHeap () returned 0x630000 [0079.860] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.860] GetProcessHeap () returned 0x630000 [0079.860] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.860] GetProcessHeap () returned 0x630000 [0079.860] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.860] GetProcessHeap () returned 0x630000 [0079.860] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.860] GetProcessHeap () returned 0x630000 [0079.861] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.861] GetProcessHeap () returned 0x630000 [0079.861] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.861] GetProcessHeap () returned 0x630000 [0079.861] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.861] GetProcessHeap () returned 0x630000 [0079.861] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.861] GetProcessHeap () returned 0x630000 [0079.861] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.861] GetProcessHeap () returned 0x630000 [0079.861] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.861] GetProcessHeap () returned 0x630000 [0079.861] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0079.861] GetProcessHeap () returned 0x630000 [0079.861] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0079.861] GetProcessHeap () returned 0x630000 [0079.861] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.861] GetProcessHeap () returned 0x630000 [0079.861] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.861] GetProcessHeap () returned 0x630000 [0079.861] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.861] GetProcessHeap () returned 0x630000 [0079.861] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.861] GetProcessHeap () returned 0x630000 [0079.861] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0079.861] GetProcessHeap () returned 0x630000 [0079.861] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0079.861] GetProcessHeap () returned 0x630000 [0079.861] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.861] GetProcessHeap () returned 0x630000 [0079.861] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.861] GetProcessHeap () returned 0x630000 [0079.861] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.861] GetProcessHeap () returned 0x630000 [0079.861] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.861] GetProcessHeap () returned 0x630000 [0079.861] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0079.861] GetProcessHeap () returned 0x630000 [0079.861] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0079.861] GetProcessHeap () returned 0x630000 [0079.861] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0079.862] GetProcessHeap () returned 0x630000 [0079.862] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0079.862] GetProcessHeap () returned 0x630000 [0079.862] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.862] GetProcessHeap () returned 0x630000 [0079.862] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.862] GetProcessHeap () returned 0x630000 [0079.862] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0079.862] GetProcessHeap () returned 0x630000 [0079.862] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0079.862] GetProcessHeap () returned 0x630000 [0079.862] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.862] GetProcessHeap () returned 0x630000 [0079.862] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.862] GetProcessHeap () returned 0x630000 [0079.862] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.862] GetProcessHeap () returned 0x630000 [0079.862] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.862] GetProcessHeap () returned 0x630000 [0079.862] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.862] GetProcessHeap () returned 0x630000 [0079.862] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.862] GetProcessHeap () returned 0x630000 [0079.862] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.862] GetProcessHeap () returned 0x630000 [0079.862] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.862] GetProcessHeap () returned 0x630000 [0079.862] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.862] GetProcessHeap () returned 0x630000 [0079.862] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.862] GetProcessHeap () returned 0x630000 [0079.862] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.862] GetProcessHeap () returned 0x630000 [0079.862] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.862] GetProcessHeap () returned 0x630000 [0079.862] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.862] GetProcessHeap () returned 0x630000 [0079.862] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.862] GetProcessHeap () returned 0x630000 [0079.863] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0079.863] GetProcessHeap () returned 0x630000 [0079.863] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0079.863] GetProcessHeap () returned 0x630000 [0079.863] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0079.863] GetProcessHeap () returned 0x630000 [0079.863] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0079.863] GetProcessHeap () returned 0x630000 [0079.863] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0079.863] GetProcessHeap () returned 0x630000 [0079.863] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e970 | out: hHeap=0x630000) returned 1 [0079.863] GetProcessHeap () returned 0x630000 [0079.863] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0079.863] GetProcessHeap () returned 0x630000 [0079.863] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0079.863] GetProcessHeap () returned 0x630000 [0079.863] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0079.863] GetProcessHeap () returned 0x630000 [0079.863] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0079.863] GetProcessHeap () returned 0x630000 [0079.863] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672a10 | out: hHeap=0x630000) returned 1 [0079.863] WriteFile (in: hFile=0x230, lpBuffer=0x674408*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x674408*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0079.868] GetProcessHeap () returned 0x630000 [0079.868] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x674408, Size=0x30) returned 0x674408 [0079.868] GetProcessHeap () returned 0x630000 [0079.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0079.868] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0079.869] GetProcessHeap () returned 0x630000 [0079.869] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8000) returned 0x674440 [0079.869] ReadFile (in: hFile=0x230, lpBuffer=0x674440, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x674440*, lpNumberOfBytesRead=0x243d7e8*=0x8000, lpOverlapped=0x0) returned 1 [0079.870] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0079.870] WriteFile (in: hFile=0x230, lpBuffer=0x674440*, nNumberOfBytesToWrite=0x8000, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x674440*, lpNumberOfBytesWritten=0x243d7e4*=0x8000, lpOverlapped=0x0) returned 1 [0079.875] GetProcessHeap () returned 0x630000 [0079.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x674440 | out: hHeap=0x630000) returned 1 [0079.876] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0079.876] WriteFile (in: hFile=0x230, lpBuffer=0x674408*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x674408*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0079.877] CloseHandle (hObject=0x230) returned 1 [0079.878] GetProcessHeap () returned 0x630000 [0079.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651f10 | out: hHeap=0x630000) returned 1 [0079.878] GetProcessHeap () returned 0x630000 [0079.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655490 | out: hHeap=0x630000) returned 1 [0079.878] GetProcessHeap () returned 0x630000 [0079.878] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672e50 | out: hHeap=0x630000) returned 1 [0079.878] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-shm" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-shm") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-shm" [0079.878] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-shm", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-shm.happythreechoose") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-shm.happythreechoose" [0079.878] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-shm" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\favicons.sqlite-shm"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-shm.happythreechoose" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\favicons.sqlite-shm.happythreechoose"), dwFlags=0x1) returned 1 [0079.879] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-shm" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0079.879] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="" [0079.879] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html" [0079.879] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\decryption info.html")) returned 0x20 [0079.879] GetProcessHeap () returned 0x630000 [0079.879] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645d58 | out: hHeap=0x630000) returned 1 [0079.879] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba329010, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xba329010, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x45aebce0, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x901d0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="favicons.sqlite-wal", cAlternateFileName="FAVICO~2.SQL")) returned 1 [0079.879] lstrcmpiW (lpString1="favicons.sqlite-wal", lpString2=".") returned 1 [0079.879] lstrcmpiW (lpString1="favicons.sqlite-wal", lpString2="..") returned 1 [0079.879] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="favicons.sqlite-wal" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-wal") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-wal" [0079.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="favicons.sqlite-wal", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0079.879] GetProcessHeap () returned 0x630000 [0079.879] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x645ed8 [0079.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="favicons.sqlite-wal", cchWideChar=-1, lpMultiByteStr=0x645ed8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="favicons.sqlite-wal", lpUsedDefaultChar=0x0) returned 20 [0079.879] lstrlenA (lpString="favicons.sqlite-wal") returned 19 [0079.879] lstrlenA (lpString=".happythreechoose") returned 17 [0079.879] lstrlenA (lpString=".happythreechoose") returned 17 [0079.879] lstrlenA (lpString="favicons.sqlite-wal") returned 19 [0079.879] lstrcmpiA (lpString1="vicons.sqlite-wal", lpString2=".happythreechoose") returned 1 [0079.879] lstrcmpiW (lpString1="favicons.sqlite-wal", lpString2="Decryption INFO.html") returned 1 [0079.880] lstrcmpiW (lpString1="favicons.sqlite-wal", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0079.880] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0079.880] lstrcmpiW (lpString1="favicons.sqlite-wal", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0079.880] GetProcessHeap () returned 0x630000 [0079.880] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0079.880] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-wal" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\favicons.sqlite-wal"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0079.880] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=590288) returned 1 [0079.880] GetProcessHeap () returned 0x630000 [0079.880] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655850 [0079.880] GetProcessHeap () returned 0x630000 [0079.880] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672d40 [0079.880] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-wal") returned 93 [0079.880] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0079.880] GetProcessHeap () returned 0x630000 [0079.880] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0079.880] GetProcessHeap () returned 0x630000 [0079.880] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x674440 [0079.881] lstrlenA (lpString="rsa_encrypt") returned 11 [0079.881] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x673070) returned 1 [0079.882] CryptGenRandom (in: hProv=0x673070, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0079.882] CryptReleaseContext (hProv=0x673070, dwFlags=0x0) returned 1 [0079.882] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0079.882] GetProcessHeap () returned 0x630000 [0079.882] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673290 [0079.882] lstrlenA (lpString="010001") returned 6 [0079.882] GetProcessHeap () returned 0x630000 [0079.882] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a3a8 [0079.882] GetProcessHeap () returned 0x630000 [0079.882] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6736d0 [0079.882] GetProcessHeap () returned 0x630000 [0079.882] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e190 [0079.882] GetProcessHeap () returned 0x630000 [0079.882] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6736d0 | out: hHeap=0x630000) returned 1 [0079.882] GetProcessHeap () returned 0x630000 [0079.882] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e580 [0079.882] GetProcessHeap () returned 0x630000 [0079.882] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656c98 [0079.882] GetProcessHeap () returned 0x630000 [0079.882] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2a8 [0079.882] GetProcessHeap () returned 0x630000 [0079.882] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0079.882] GetProcessHeap () returned 0x630000 [0079.882] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0079.882] GetProcessHeap () returned 0x630000 [0079.882] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657210 [0079.882] GetProcessHeap () returned 0x630000 [0079.882] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673208 [0079.882] GetProcessHeap () returned 0x630000 [0079.882] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656fe0 [0079.882] GetProcessHeap () returned 0x630000 [0079.883] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.883] GetProcessHeap () returned 0x630000 [0079.883] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0079.883] GetProcessHeap () returned 0x630000 [0079.883] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dfe0 [0079.883] GetProcessHeap () returned 0x630000 [0079.883] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673208 | out: hHeap=0x630000) returned 1 [0079.883] GetProcessHeap () returned 0x630000 [0079.883] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0079.883] GetProcessHeap () returned 0x630000 [0079.883] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dfe0 | out: hHeap=0x630000) returned 1 [0079.883] GetProcessHeap () returned 0x630000 [0079.883] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0079.883] GetProcessHeap () returned 0x630000 [0079.883] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0079.883] GetProcessHeap () returned 0x630000 [0079.883] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.883] GetProcessHeap () returned 0x630000 [0079.883] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0079.883] GetProcessHeap () returned 0x630000 [0079.883] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.883] GetProcessHeap () returned 0x630000 [0079.883] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.883] GetProcessHeap () returned 0x630000 [0079.883] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e6a0 [0079.883] GetProcessHeap () returned 0x630000 [0079.883] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0079.883] GetProcessHeap () returned 0x630000 [0079.883] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0079.883] GetProcessHeap () returned 0x630000 [0079.883] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e6a0 | out: hHeap=0x630000) returned 1 [0079.883] GetProcessHeap () returned 0x630000 [0079.883] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.883] GetProcessHeap () returned 0x630000 [0079.883] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.883] GetProcessHeap () returned 0x630000 [0079.883] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0079.883] GetProcessHeap () returned 0x630000 [0079.883] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0079.884] GetProcessHeap () returned 0x630000 [0079.884] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0079.884] GetProcessHeap () returned 0x630000 [0079.884] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0079.884] GetProcessHeap () returned 0x630000 [0079.884] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0079.884] GetProcessHeap () returned 0x630000 [0079.884] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0079.884] GetProcessHeap () returned 0x630000 [0079.884] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0079.884] GetProcessHeap () returned 0x630000 [0079.884] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0079.884] GetProcessHeap () returned 0x630000 [0079.884] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.884] GetProcessHeap () returned 0x630000 [0079.884] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.884] GetProcessHeap () returned 0x630000 [0079.884] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.884] GetProcessHeap () returned 0x630000 [0079.884] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.884] GetProcessHeap () returned 0x630000 [0079.884] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.884] GetProcessHeap () returned 0x630000 [0079.884] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.884] GetProcessHeap () returned 0x630000 [0079.884] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.884] GetProcessHeap () returned 0x630000 [0079.884] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.884] GetProcessHeap () returned 0x630000 [0079.884] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0079.884] GetProcessHeap () returned 0x630000 [0079.884] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0079.884] GetProcessHeap () returned 0x630000 [0079.884] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.884] GetProcessHeap () returned 0x630000 [0079.884] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.884] GetProcessHeap () returned 0x630000 [0079.884] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.884] GetProcessHeap () returned 0x630000 [0079.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.885] GetProcessHeap () returned 0x630000 [0079.885] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.885] GetProcessHeap () returned 0x630000 [0079.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.885] GetProcessHeap () returned 0x630000 [0079.885] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.885] GetProcessHeap () returned 0x630000 [0079.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.885] GetProcessHeap () returned 0x630000 [0079.885] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.885] GetProcessHeap () returned 0x630000 [0079.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.885] GetProcessHeap () returned 0x630000 [0079.885] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.885] GetProcessHeap () returned 0x630000 [0079.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.885] GetProcessHeap () returned 0x630000 [0079.885] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.885] GetProcessHeap () returned 0x630000 [0079.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.885] GetProcessHeap () returned 0x630000 [0079.885] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.885] GetProcessHeap () returned 0x630000 [0079.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.885] GetProcessHeap () returned 0x630000 [0079.885] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.885] GetProcessHeap () returned 0x630000 [0079.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.885] GetProcessHeap () returned 0x630000 [0079.885] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.885] GetProcessHeap () returned 0x630000 [0079.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.885] GetProcessHeap () returned 0x630000 [0079.885] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.885] GetProcessHeap () returned 0x630000 [0079.885] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.886] GetProcessHeap () returned 0x630000 [0079.886] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0079.886] GetProcessHeap () returned 0x630000 [0079.886] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0079.886] GetProcessHeap () returned 0x630000 [0079.886] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.886] GetProcessHeap () returned 0x630000 [0079.886] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.886] GetProcessHeap () returned 0x630000 [0079.886] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0079.886] GetProcessHeap () returned 0x630000 [0079.886] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0079.886] GetProcessHeap () returned 0x630000 [0079.886] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0079.886] GetProcessHeap () returned 0x630000 [0079.886] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0079.886] GetProcessHeap () returned 0x630000 [0079.886] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.886] GetProcessHeap () returned 0x630000 [0079.886] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.886] GetProcessHeap () returned 0x630000 [0079.886] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.886] GetProcessHeap () returned 0x630000 [0079.886] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.886] GetProcessHeap () returned 0x630000 [0079.886] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.886] GetProcessHeap () returned 0x630000 [0079.886] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.886] GetProcessHeap () returned 0x630000 [0079.886] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.886] GetProcessHeap () returned 0x630000 [0079.886] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.886] GetProcessHeap () returned 0x630000 [0079.886] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.886] GetProcessHeap () returned 0x630000 [0079.886] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.886] GetProcessHeap () returned 0x630000 [0079.886] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.886] GetProcessHeap () returned 0x630000 [0079.886] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.887] GetProcessHeap () returned 0x630000 [0079.887] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.887] GetProcessHeap () returned 0x630000 [0079.887] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.887] GetProcessHeap () returned 0x630000 [0079.887] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.887] GetProcessHeap () returned 0x630000 [0079.887] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.887] GetProcessHeap () returned 0x630000 [0079.887] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0079.887] GetProcessHeap () returned 0x630000 [0079.887] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0079.887] GetProcessHeap () returned 0x630000 [0079.887] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0079.887] GetProcessHeap () returned 0x630000 [0079.887] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0079.887] GetProcessHeap () returned 0x630000 [0079.887] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.887] GetProcessHeap () returned 0x630000 [0079.887] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.887] GetProcessHeap () returned 0x630000 [0079.887] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a3f8 [0079.887] GetProcessHeap () returned 0x630000 [0079.887] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3f8 | out: hHeap=0x630000) returned 1 [0079.887] GetProcessHeap () returned 0x630000 [0079.887] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0079.887] GetProcessHeap () returned 0x630000 [0079.887] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0079.887] GetProcessHeap () returned 0x630000 [0079.887] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0079.887] GetProcessHeap () returned 0x630000 [0079.887] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0079.887] GetProcessHeap () returned 0x630000 [0079.887] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2a8 [0079.887] GetProcessHeap () returned 0x630000 [0079.887] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0079.887] GetProcessHeap () returned 0x630000 [0079.887] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0079.887] GetProcessHeap () returned 0x630000 [0079.887] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0079.888] GetProcessHeap () returned 0x630000 [0079.888] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0079.888] GetProcessHeap () returned 0x630000 [0079.888] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0079.888] GetProcessHeap () returned 0x630000 [0079.888] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656fe0 | out: hHeap=0x630000) returned 1 [0079.888] GetProcessHeap () returned 0x630000 [0079.888] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0079.888] GetProcessHeap () returned 0x630000 [0079.888] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0079.888] GetProcessHeap () returned 0x630000 [0079.888] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e580 | out: hHeap=0x630000) returned 1 [0079.888] GetProcessHeap () returned 0x630000 [0079.888] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0079.888] GetProcessHeap () returned 0x630000 [0079.888] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0079.888] GetProcessHeap () returned 0x630000 [0079.888] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0079.888] GetProcessHeap () returned 0x630000 [0079.888] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a3a8 | out: hHeap=0x630000) returned 1 [0079.888] GetProcessHeap () returned 0x630000 [0079.888] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673290 | out: hHeap=0x630000) returned 1 [0079.888] WriteFile (in: hFile=0x230, lpBuffer=0x674440*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x674440*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0079.892] GetProcessHeap () returned 0x630000 [0079.892] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x674440, Size=0x30) returned 0x674440 [0079.892] GetProcessHeap () returned 0x630000 [0079.892] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0079.892] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0079.892] GetProcessHeap () returned 0x630000 [0079.892] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x901d0) returned 0x1f31020 [0079.903] ReadFile (in: hFile=0x230, lpBuffer=0x1f31020, nNumberOfBytesToRead=0x901d0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x1f31020*, lpNumberOfBytesRead=0x243d7e8*=0x901d0, lpOverlapped=0x0) returned 1 [0079.911] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0079.911] WriteFile (in: hFile=0x230, lpBuffer=0x1f31020*, nNumberOfBytesToWrite=0x901d0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x1f31020*, lpNumberOfBytesWritten=0x243d7e4*=0x901d0, lpOverlapped=0x0) returned 1 [0080.087] GetProcessHeap () returned 0x630000 [0080.087] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x1f31020 | out: hHeap=0x630000) returned 1 [0080.090] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0080.090] WriteFile (in: hFile=0x230, lpBuffer=0x674440*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x674440*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0080.091] CloseHandle (hObject=0x230) returned 1 [0080.091] GetProcessHeap () returned 0x630000 [0080.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0080.092] GetProcessHeap () returned 0x630000 [0080.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655850 | out: hHeap=0x630000) returned 1 [0080.092] GetProcessHeap () returned 0x630000 [0080.092] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672d40 | out: hHeap=0x630000) returned 1 [0080.092] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-wal" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-wal") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-wal" [0080.092] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-wal", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-wal.happythreechoose") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-wal.happythreechoose" [0080.092] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-wal" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\favicons.sqlite-wal"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-wal.happythreechoose" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\favicons.sqlite-wal.happythreechoose"), dwFlags=0x1) returned 1 [0080.092] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\favicons.sqlite-wal" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0080.092] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="" [0080.092] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html" [0080.092] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\decryption info.html")) returned 0x20 [0080.093] GetProcessHeap () returned 0x630000 [0080.093] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645ed8 | out: hHeap=0x630000) returned 1 [0080.093] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdbd76e4, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfdbd76e4, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x4079e226, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="gmp", cAlternateFileName="")) returned 1 [0080.093] lstrcmpiW (lpString1="gmp", lpString2=".") returned 1 [0080.093] lstrcmpiW (lpString1="gmp", lpString2="..") returned 1 [0080.093] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="gmp" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp" [0080.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gmp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0080.093] GetProcessHeap () returned 0x630000 [0080.093] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4) returned 0x65a2a8 [0080.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gmp", cchWideChar=-1, lpMultiByteStr=0x65a2a8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gmp", lpUsedDefaultChar=0x0) returned 4 [0080.093] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0080.093] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0080.093] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0080.093] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0080.093] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0080.093] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0080.093] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0080.093] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0080.093] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0080.093] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0080.093] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0080.093] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0080.093] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0080.093] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0080.093] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0080.093] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0080.093] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0080.093] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0080.093] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0080.093] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0080.093] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0080.094] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0080.094] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0080.094] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0080.094] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0080.094] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0080.094] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0080.094] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0080.094] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0080.094] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0080.094] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0080.094] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0080.094] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0080.094] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0080.094] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0080.094] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0080.094] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0080.094] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0080.094] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0080.094] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0080.094] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0080.094] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0080.094] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0080.094] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp\\" [0080.094] GetProcessHeap () returned 0x630000 [0080.094] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a3a8 [0080.094] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp\\") returned 78 [0080.094] GetProcessHeap () returned 0x630000 [0080.094] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x9e) returned 0x640fb0 [0080.094] lstrcpyW (in: lpString1=0x640fb0, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp\\" [0080.094] GetProcessHeap () returned 0x630000 [0080.094] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2a8 | out: hHeap=0x630000) returned 1 [0080.094] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40c4b15, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x40c4b15, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x40c5e7c, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="gmp-gmpopenh264", cAlternateFileName="GMP-GM~1")) returned 1 [0080.094] lstrcmpiW (lpString1="gmp-gmpopenh264", lpString2=".") returned 1 [0080.094] lstrcmpiW (lpString1="gmp-gmpopenh264", lpString2="..") returned 1 [0080.095] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="gmp-gmpopenh264" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264" [0080.095] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gmp-gmpopenh264", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0080.095] GetProcessHeap () returned 0x630000 [0080.095] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x64c9f0 [0080.095] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gmp-gmpopenh264", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gmp-gmpopenh264", lpUsedDefaultChar=0x0) returned 16 [0080.095] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-gmpopenh264", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0080.095] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-gmpopenh264", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0080.095] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-gmpopenh264", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0080.095] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-gmpopenh264", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0080.095] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-gmpopenh264", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0080.095] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-gmpopenh264", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0080.095] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-gmpopenh264", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0080.095] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-gmpopenh264", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0080.095] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-gmpopenh264", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0080.095] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-gmpopenh264", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0080.095] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-gmpopenh264", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0080.095] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-gmpopenh264", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0080.095] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-gmpopenh264", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0080.095] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-gmpopenh264", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0080.095] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-gmpopenh264", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0080.095] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-gmpopenh264", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0080.095] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-gmpopenh264", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0080.095] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-gmpopenh264", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0080.095] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-gmpopenh264", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0080.095] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-gmpopenh264", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0080.095] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-gmpopenh264", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0080.095] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-gmpopenh264", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0080.095] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-gmpopenh264", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0080.095] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-gmpopenh264", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0080.095] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-gmpopenh264", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0080.095] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-gmpopenh264", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0080.095] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-gmpopenh264", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0080.095] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-gmpopenh264", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0080.095] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-gmpopenh264", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0080.096] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-gmpopenh264", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0080.096] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-gmpopenh264", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0080.096] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-gmpopenh264", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0080.096] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-gmpopenh264", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0080.096] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-gmpopenh264", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0080.096] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-gmpopenh264", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0080.096] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-gmpopenh264", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0080.096] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-gmpopenh264", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0080.096] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-gmpopenh264", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0080.096] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-gmpopenh264", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0080.096] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-gmpopenh264", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0080.096] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-gmpopenh264", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0080.096] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-gmpopenh264", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0080.096] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-gmpopenh264", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0080.096] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\" [0080.096] GetProcessHeap () returned 0x630000 [0080.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a3f8 [0080.096] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\") returned 90 [0080.096] GetProcessHeap () returned 0x630000 [0080.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb6) returned 0x641ca8 [0080.096] lstrcpyW (in: lpString1=0x641ca8, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-gmpopenh264\\" [0080.096] GetProcessHeap () returned 0x630000 [0080.096] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0080.096] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5af7cc2, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x5af7cc2, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x5af7cc2, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="gmp-widevinecdm", cAlternateFileName="GMP-WI~1")) returned 1 [0080.096] lstrcmpiW (lpString1="gmp-widevinecdm", lpString2=".") returned 1 [0080.096] lstrcmpiW (lpString1="gmp-widevinecdm", lpString2="..") returned 1 [0080.096] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="gmp-widevinecdm" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm" [0080.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gmp-widevinecdm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0080.096] GetProcessHeap () returned 0x630000 [0080.096] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x64ca20 [0080.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gmp-widevinecdm", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gmp-widevinecdm", lpUsedDefaultChar=0x0) returned 16 [0080.096] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-widevinecdm", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0080.096] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-widevinecdm", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0080.096] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-widevinecdm", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0080.096] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-widevinecdm", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0080.096] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-widevinecdm", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0080.097] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-widevinecdm", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0080.097] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-widevinecdm", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0080.097] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-widevinecdm", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0080.097] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-widevinecdm", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0080.097] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-widevinecdm", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0080.097] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-widevinecdm", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0080.097] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-widevinecdm", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0080.097] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-widevinecdm", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0080.097] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-widevinecdm", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0080.097] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-widevinecdm", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0080.097] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-widevinecdm", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0080.097] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-widevinecdm", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0080.097] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-widevinecdm", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0080.097] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-widevinecdm", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0080.097] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-widevinecdm", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0080.097] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-widevinecdm", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0080.097] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-widevinecdm", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0080.097] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-widevinecdm", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0080.097] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-widevinecdm", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0080.097] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-widevinecdm", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0080.097] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-widevinecdm", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0080.097] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-widevinecdm", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0080.097] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-widevinecdm", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0080.097] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-widevinecdm", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0080.097] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-widevinecdm", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0080.097] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-widevinecdm", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0080.097] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-widevinecdm", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0080.097] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-widevinecdm", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0080.097] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-widevinecdm", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0080.097] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-widevinecdm", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0080.097] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-widevinecdm", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0080.097] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-widevinecdm", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0080.097] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-widevinecdm", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0080.098] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-widevinecdm", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0080.098] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-widevinecdm", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0080.098] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-widevinecdm", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0080.098] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-widevinecdm", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0080.098] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="gmp-widevinecdm", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0080.098] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\" [0080.098] GetProcessHeap () returned 0x630000 [0080.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a2a8 [0080.098] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\") returned 90 [0080.098] GetProcessHeap () returned 0x630000 [0080.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xb6) returned 0x6417c0 [0080.098] lstrcpyW (in: lpString1=0x6417c0, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\gmp-widevinecdm\\" [0080.098] GetProcessHeap () returned 0x630000 [0080.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0080.098] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2edfb3e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0x2edfb3e, ftLastAccessTime.dwHighDateTime=0x1d327ca, ftLastWriteTime.dwLowDateTime=0x2ee0ebb, ftLastWriteTime.dwHighDateTime=0x1d327ca, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="handlers.json", cAlternateFileName="HANDLE~1.JSO")) returned 1 [0080.098] lstrcmpiW (lpString1="handlers.json", lpString2=".") returned 1 [0080.098] lstrcmpiW (lpString1="handlers.json", lpString2="..") returned 1 [0080.098] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="handlers.json" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json" [0080.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="handlers.json", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0080.098] GetProcessHeap () returned 0x630000 [0080.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x64c9f0 [0080.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="handlers.json", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="handlers.json", lpUsedDefaultChar=0x0) returned 14 [0080.098] lstrlenA (lpString="handlers.json") returned 13 [0080.098] lstrlenA (lpString=".happythreechoose") returned 17 [0080.098] lstrcmpiW (lpString1="handlers.json", lpString2="Decryption INFO.html") returned 1 [0080.098] lstrcmpiW (lpString1="handlers.json", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0080.098] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0080.098] lstrcmpiW (lpString1="handlers.json", lpString2="HAPPYTHREE.EXE.exe") returned -1 [0080.098] GetProcessHeap () returned 0x630000 [0080.098] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e98 [0080.098] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\handlers.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0080.099] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=683) returned 1 [0080.099] GetProcessHeap () returned 0x630000 [0080.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655940 [0080.099] GetProcessHeap () returned 0x630000 [0080.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673428 [0080.099] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json") returned 87 [0080.099] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0080.099] GetProcessHeap () returned 0x630000 [0080.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0080.099] GetProcessHeap () returned 0x630000 [0080.099] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x385) returned 0x674478 [0080.099] lstrlenA (lpString="rsa_encrypt") returned 11 [0080.099] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x672f60) returned 1 [0080.100] CryptGenRandom (in: hProv=0x672f60, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0080.100] CryptReleaseContext (hProv=0x672f60, dwFlags=0x0) returned 1 [0080.100] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0080.100] GetProcessHeap () returned 0x630000 [0080.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673538 [0080.100] lstrlenA (lpString="010001") returned 6 [0080.100] GetProcessHeap () returned 0x630000 [0080.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0080.100] GetProcessHeap () returned 0x630000 [0080.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672c30 [0080.100] GetProcessHeap () returned 0x630000 [0080.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e070 [0080.100] GetProcessHeap () returned 0x630000 [0080.100] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672c30 | out: hHeap=0x630000) returned 1 [0080.100] GetProcessHeap () returned 0x630000 [0080.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e8e0 [0080.100] GetProcessHeap () returned 0x630000 [0080.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656a68 [0080.100] GetProcessHeap () returned 0x630000 [0080.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2b8 [0080.100] GetProcessHeap () returned 0x630000 [0080.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0080.100] GetProcessHeap () returned 0x630000 [0080.100] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0080.100] GetProcessHeap () returned 0x630000 [0080.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0080.100] GetProcessHeap () returned 0x630000 [0080.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6737e0 [0080.100] GetProcessHeap () returned 0x630000 [0080.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656950 [0080.100] GetProcessHeap () returned 0x630000 [0080.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.100] GetProcessHeap () returned 0x630000 [0080.100] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0080.101] GetProcessHeap () returned 0x630000 [0080.101] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea00 [0080.101] GetProcessHeap () returned 0x630000 [0080.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6737e0 | out: hHeap=0x630000) returned 1 [0080.101] GetProcessHeap () returned 0x630000 [0080.101] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0080.101] GetProcessHeap () returned 0x630000 [0080.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea00 | out: hHeap=0x630000) returned 1 [0080.101] GetProcessHeap () returned 0x630000 [0080.101] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0080.101] GetProcessHeap () returned 0x630000 [0080.101] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cf88 [0080.101] GetProcessHeap () returned 0x630000 [0080.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.101] GetProcessHeap () returned 0x630000 [0080.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0080.101] GetProcessHeap () returned 0x630000 [0080.101] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.101] GetProcessHeap () returned 0x630000 [0080.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.101] GetProcessHeap () returned 0x630000 [0080.101] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e340 [0080.101] GetProcessHeap () returned 0x630000 [0080.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cf88 | out: hHeap=0x630000) returned 1 [0080.101] GetProcessHeap () returned 0x630000 [0080.101] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0080.101] GetProcessHeap () returned 0x630000 [0080.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0080.101] GetProcessHeap () returned 0x630000 [0080.101] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.101] GetProcessHeap () returned 0x630000 [0080.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.101] GetProcessHeap () returned 0x630000 [0080.101] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.101] GetProcessHeap () returned 0x630000 [0080.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.101] GetProcessHeap () returned 0x630000 [0080.101] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.101] GetProcessHeap () returned 0x630000 [0080.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.101] GetProcessHeap () returned 0x630000 [0080.102] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.102] GetProcessHeap () returned 0x630000 [0080.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.102] GetProcessHeap () returned 0x630000 [0080.102] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.102] GetProcessHeap () returned 0x630000 [0080.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.102] GetProcessHeap () returned 0x630000 [0080.102] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.102] GetProcessHeap () returned 0x630000 [0080.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.102] GetProcessHeap () returned 0x630000 [0080.102] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.102] GetProcessHeap () returned 0x630000 [0080.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.102] GetProcessHeap () returned 0x630000 [0080.102] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0080.102] GetProcessHeap () returned 0x630000 [0080.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0080.102] GetProcessHeap () returned 0x630000 [0080.102] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0080.102] GetProcessHeap () returned 0x630000 [0080.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0080.102] GetProcessHeap () returned 0x630000 [0080.102] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.102] GetProcessHeap () returned 0x630000 [0080.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.102] GetProcessHeap () returned 0x630000 [0080.102] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0080.102] GetProcessHeap () returned 0x630000 [0080.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0080.102] GetProcessHeap () returned 0x630000 [0080.102] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.102] GetProcessHeap () returned 0x630000 [0080.102] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.102] GetProcessHeap () returned 0x630000 [0080.102] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.103] GetProcessHeap () returned 0x630000 [0080.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.103] GetProcessHeap () returned 0x630000 [0080.103] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.103] GetProcessHeap () returned 0x630000 [0080.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.103] GetProcessHeap () returned 0x630000 [0080.103] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.103] GetProcessHeap () returned 0x630000 [0080.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.103] GetProcessHeap () returned 0x630000 [0080.103] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.103] GetProcessHeap () returned 0x630000 [0080.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.103] GetProcessHeap () returned 0x630000 [0080.103] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.103] GetProcessHeap () returned 0x630000 [0080.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.103] GetProcessHeap () returned 0x630000 [0080.103] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.103] GetProcessHeap () returned 0x630000 [0080.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.103] GetProcessHeap () returned 0x630000 [0080.103] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.103] GetProcessHeap () returned 0x630000 [0080.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.103] GetProcessHeap () returned 0x630000 [0080.103] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.103] GetProcessHeap () returned 0x630000 [0080.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.103] GetProcessHeap () returned 0x630000 [0080.103] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.103] GetProcessHeap () returned 0x630000 [0080.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.103] GetProcessHeap () returned 0x630000 [0080.103] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0080.103] GetProcessHeap () returned 0x630000 [0080.103] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0080.104] GetProcessHeap () returned 0x630000 [0080.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0080.104] GetProcessHeap () returned 0x630000 [0080.104] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0080.104] GetProcessHeap () returned 0x630000 [0080.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.104] GetProcessHeap () returned 0x630000 [0080.104] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.104] GetProcessHeap () returned 0x630000 [0080.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0080.104] GetProcessHeap () returned 0x630000 [0080.104] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0080.104] GetProcessHeap () returned 0x630000 [0080.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.104] GetProcessHeap () returned 0x630000 [0080.104] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.104] GetProcessHeap () returned 0x630000 [0080.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.104] GetProcessHeap () returned 0x630000 [0080.104] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.104] GetProcessHeap () returned 0x630000 [0080.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.104] GetProcessHeap () returned 0x630000 [0080.104] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.104] GetProcessHeap () returned 0x630000 [0080.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.104] GetProcessHeap () returned 0x630000 [0080.104] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.104] GetProcessHeap () returned 0x630000 [0080.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.104] GetProcessHeap () returned 0x630000 [0080.104] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.104] GetProcessHeap () returned 0x630000 [0080.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0080.104] GetProcessHeap () returned 0x630000 [0080.104] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0080.104] GetProcessHeap () returned 0x630000 [0080.104] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.104] GetProcessHeap () returned 0x630000 [0080.104] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.104] GetProcessHeap () returned 0x630000 [0080.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.105] GetProcessHeap () returned 0x630000 [0080.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.105] GetProcessHeap () returned 0x630000 [0080.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.105] GetProcessHeap () returned 0x630000 [0080.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.105] GetProcessHeap () returned 0x630000 [0080.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.105] GetProcessHeap () returned 0x630000 [0080.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.105] GetProcessHeap () returned 0x630000 [0080.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.105] GetProcessHeap () returned 0x630000 [0080.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.105] GetProcessHeap () returned 0x630000 [0080.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0080.105] GetProcessHeap () returned 0x630000 [0080.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0080.105] GetProcessHeap () returned 0x630000 [0080.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.105] GetProcessHeap () returned 0x630000 [0080.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.105] GetProcessHeap () returned 0x630000 [0080.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.105] GetProcessHeap () returned 0x630000 [0080.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.105] GetProcessHeap () returned 0x630000 [0080.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.105] GetProcessHeap () returned 0x630000 [0080.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.105] GetProcessHeap () returned 0x630000 [0080.105] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.105] GetProcessHeap () returned 0x630000 [0080.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.105] GetProcessHeap () returned 0x630000 [0080.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0080.105] GetProcessHeap () returned 0x630000 [0080.105] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0080.105] GetProcessHeap () returned 0x630000 [0080.106] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0080.106] GetProcessHeap () returned 0x630000 [0080.106] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0080.106] GetProcessHeap () returned 0x630000 [0080.106] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0080.106] GetProcessHeap () returned 0x630000 [0080.106] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e8e0 | out: hHeap=0x630000) returned 1 [0080.106] GetProcessHeap () returned 0x630000 [0080.106] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0080.106] GetProcessHeap () returned 0x630000 [0080.106] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0080.106] GetProcessHeap () returned 0x630000 [0080.106] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0080.106] GetProcessHeap () returned 0x630000 [0080.106] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0080.106] GetProcessHeap () returned 0x630000 [0080.106] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673538 | out: hHeap=0x630000) returned 1 [0080.106] WriteFile (in: hFile=0x230, lpBuffer=0x674478*, nNumberOfBytesToWrite=0x385, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x674478*, lpNumberOfBytesWritten=0x243d864*=0x385, lpOverlapped=0x0) returned 1 [0080.109] GetProcessHeap () returned 0x630000 [0080.109] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x674478, Size=0x30) returned 0x674478 [0080.109] GetProcessHeap () returned 0x630000 [0080.109] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0080.109] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0080.109] GetProcessHeap () returned 0x630000 [0080.109] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2b0) returned 0x659cc0 [0080.109] ReadFile (in: hFile=0x230, lpBuffer=0x659cc0, nNumberOfBytesToRead=0x2b0, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x659cc0*, lpNumberOfBytesRead=0x243d7e8*=0x2b0, lpOverlapped=0x0) returned 1 [0080.109] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0080.110] WriteFile (in: hFile=0x230, lpBuffer=0x659cc0*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x659cc0*, lpNumberOfBytesWritten=0x243d7e4*=0x2b0, lpOverlapped=0x0) returned 1 [0080.110] GetProcessHeap () returned 0x630000 [0080.110] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x659cc0 | out: hHeap=0x630000) returned 1 [0080.110] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0080.111] WriteFile (in: hFile=0x230, lpBuffer=0x674478*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x674478*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0080.111] CloseHandle (hObject=0x230) returned 1 [0080.112] GetProcessHeap () returned 0x630000 [0080.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e98 | out: hHeap=0x630000) returned 1 [0080.112] GetProcessHeap () returned 0x630000 [0080.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655940 | out: hHeap=0x630000) returned 1 [0080.112] GetProcessHeap () returned 0x630000 [0080.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673428 | out: hHeap=0x630000) returned 1 [0080.112] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json" [0080.112] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json.happythreechoose") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json.happythreechoose" [0080.112] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\handlers.json"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json.happythreechoose" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\handlers.json.happythreechoose"), dwFlags=0x1) returned 1 [0080.113] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\handlers.json" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0080.113] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="" [0080.113] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html" [0080.113] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\decryption info.html")) returned 0x20 [0080.113] GetProcessHeap () returned 0x630000 [0080.113] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0080.113] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe6922fa, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfe6922fa, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x621f2203, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="key3.db", cAlternateFileName="")) returned 1 [0080.113] lstrcmpiW (lpString1="key3.db", lpString2=".") returned 1 [0080.113] lstrcmpiW (lpString1="key3.db", lpString2="..") returned 1 [0080.113] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="key3.db" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db" [0080.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="key3.db", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0080.113] GetProcessHeap () returned 0x630000 [0080.113] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a408 [0080.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="key3.db", cchWideChar=-1, lpMultiByteStr=0x65a408, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="key3.db", lpUsedDefaultChar=0x0) returned 8 [0080.113] lstrlenA (lpString="key3.db") returned 7 [0080.113] lstrlenA (lpString=".happythreechoose") returned 17 [0080.113] lstrcmpiW (lpString1="key3.db", lpString2="Decryption INFO.html") returned 1 [0080.113] lstrcmpiW (lpString1="key3.db", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0080.113] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0080.113] lstrcmpiW (lpString1="key3.db", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0080.113] GetProcessHeap () returned 0x630000 [0080.113] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0080.113] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\key3.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0080.113] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=16384) returned 1 [0080.114] GetProcessHeap () returned 0x630000 [0080.114] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655a30 [0080.114] GetProcessHeap () returned 0x630000 [0080.114] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6736d0 [0080.114] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db") returned 81 [0080.114] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0080.114] GetProcessHeap () returned 0x630000 [0080.114] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0080.114] GetProcessHeap () returned 0x630000 [0080.114] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x6744b0 [0080.114] lstrlenA (lpString="rsa_encrypt") returned 11 [0080.114] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x672e50) returned 1 [0080.114] CryptGenRandom (in: hProv=0x672e50, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0080.114] CryptReleaseContext (hProv=0x672e50, dwFlags=0x0) returned 1 [0080.114] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0080.114] GetProcessHeap () returned 0x630000 [0080.114] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673318 [0080.114] lstrlenA (lpString="010001") returned 6 [0080.115] GetProcessHeap () returned 0x630000 [0080.115] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a2b8 [0080.115] GetProcessHeap () returned 0x630000 [0080.115] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672a10 [0080.115] GetProcessHeap () returned 0x630000 [0080.115] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ebb0 [0080.115] GetProcessHeap () returned 0x630000 [0080.115] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672a10 | out: hHeap=0x630000) returned 1 [0080.115] GetProcessHeap () returned 0x630000 [0080.115] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65df50 [0080.115] GetProcessHeap () returned 0x630000 [0080.115] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657210 [0080.115] GetProcessHeap () returned 0x630000 [0080.115] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0080.115] GetProcessHeap () returned 0x630000 [0080.115] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656c98 [0080.115] GetProcessHeap () returned 0x630000 [0080.115] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.115] GetProcessHeap () returned 0x630000 [0080.115] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0080.115] GetProcessHeap () returned 0x630000 [0080.115] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673428 [0080.115] GetProcessHeap () returned 0x630000 [0080.115] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657788 [0080.115] GetProcessHeap () returned 0x630000 [0080.115] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.115] GetProcessHeap () returned 0x630000 [0080.115] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0080.115] GetProcessHeap () returned 0x630000 [0080.115] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dec0 [0080.115] GetProcessHeap () returned 0x630000 [0080.115] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673428 | out: hHeap=0x630000) returned 1 [0080.115] GetProcessHeap () returned 0x630000 [0080.115] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657328 [0080.115] GetProcessHeap () returned 0x630000 [0080.115] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dec0 | out: hHeap=0x630000) returned 1 [0080.115] GetProcessHeap () returned 0x630000 [0080.115] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0080.115] GetProcessHeap () returned 0x630000 [0080.115] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0080.116] GetProcessHeap () returned 0x630000 [0080.116] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.116] GetProcessHeap () returned 0x630000 [0080.116] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0080.116] GetProcessHeap () returned 0x630000 [0080.116] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.116] GetProcessHeap () returned 0x630000 [0080.116] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.116] GetProcessHeap () returned 0x630000 [0080.116] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e070 [0080.116] GetProcessHeap () returned 0x630000 [0080.116] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0080.116] GetProcessHeap () returned 0x630000 [0080.116] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0080.116] GetProcessHeap () returned 0x630000 [0080.116] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0080.116] GetProcessHeap () returned 0x630000 [0080.116] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.116] GetProcessHeap () returned 0x630000 [0080.116] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.116] GetProcessHeap () returned 0x630000 [0080.116] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.116] GetProcessHeap () returned 0x630000 [0080.116] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.116] GetProcessHeap () returned 0x630000 [0080.116] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.116] GetProcessHeap () returned 0x630000 [0080.116] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.116] GetProcessHeap () returned 0x630000 [0080.116] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.116] GetProcessHeap () returned 0x630000 [0080.116] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.116] GetProcessHeap () returned 0x630000 [0080.116] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.116] GetProcessHeap () returned 0x630000 [0080.116] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.116] GetProcessHeap () returned 0x630000 [0080.116] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.116] GetProcessHeap () returned 0x630000 [0080.116] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.117] GetProcessHeap () returned 0x630000 [0080.117] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.117] GetProcessHeap () returned 0x630000 [0080.117] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.117] GetProcessHeap () returned 0x630000 [0080.117] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.117] GetProcessHeap () returned 0x630000 [0080.117] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.117] GetProcessHeap () returned 0x630000 [0080.117] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.117] GetProcessHeap () returned 0x630000 [0080.117] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.117] GetProcessHeap () returned 0x630000 [0080.117] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0080.117] GetProcessHeap () returned 0x630000 [0080.117] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0080.117] GetProcessHeap () returned 0x630000 [0080.117] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.117] GetProcessHeap () returned 0x630000 [0080.117] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.117] GetProcessHeap () returned 0x630000 [0080.117] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.117] GetProcessHeap () returned 0x630000 [0080.117] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.117] GetProcessHeap () returned 0x630000 [0080.117] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.117] GetProcessHeap () returned 0x630000 [0080.117] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.117] GetProcessHeap () returned 0x630000 [0080.117] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.117] GetProcessHeap () returned 0x630000 [0080.117] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.117] GetProcessHeap () returned 0x630000 [0080.117] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.117] GetProcessHeap () returned 0x630000 [0080.117] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.118] GetProcessHeap () returned 0x630000 [0080.118] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.118] GetProcessHeap () returned 0x630000 [0080.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.118] GetProcessHeap () returned 0x630000 [0080.118] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.118] GetProcessHeap () returned 0x630000 [0080.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.118] GetProcessHeap () returned 0x630000 [0080.118] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.118] GetProcessHeap () returned 0x630000 [0080.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.118] GetProcessHeap () returned 0x630000 [0080.118] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.118] GetProcessHeap () returned 0x630000 [0080.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.118] GetProcessHeap () returned 0x630000 [0080.118] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.118] GetProcessHeap () returned 0x630000 [0080.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.118] GetProcessHeap () returned 0x630000 [0080.118] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.118] GetProcessHeap () returned 0x630000 [0080.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.118] GetProcessHeap () returned 0x630000 [0080.118] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.118] GetProcessHeap () returned 0x630000 [0080.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.118] GetProcessHeap () returned 0x630000 [0080.118] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.118] GetProcessHeap () returned 0x630000 [0080.118] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.119] GetProcessHeap () returned 0x630000 [0080.119] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.119] GetProcessHeap () returned 0x630000 [0080.119] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.119] GetProcessHeap () returned 0x630000 [0080.119] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.119] GetProcessHeap () returned 0x630000 [0080.119] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.119] GetProcessHeap () returned 0x630000 [0080.119] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.119] GetProcessHeap () returned 0x630000 [0080.119] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.119] GetProcessHeap () returned 0x630000 [0080.119] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.119] GetProcessHeap () returned 0x630000 [0080.119] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.119] GetProcessHeap () returned 0x630000 [0080.119] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.119] GetProcessHeap () returned 0x630000 [0080.119] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.119] GetProcessHeap () returned 0x630000 [0080.119] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.119] GetProcessHeap () returned 0x630000 [0080.119] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.119] GetProcessHeap () returned 0x630000 [0080.119] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.119] GetProcessHeap () returned 0x630000 [0080.119] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.119] GetProcessHeap () returned 0x630000 [0080.119] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.119] GetProcessHeap () returned 0x630000 [0080.119] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.119] GetProcessHeap () returned 0x630000 [0080.119] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.119] GetProcessHeap () returned 0x630000 [0080.119] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.119] GetProcessHeap () returned 0x630000 [0080.119] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.119] GetProcessHeap () returned 0x630000 [0080.119] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.119] GetProcessHeap () returned 0x630000 [0080.119] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.120] GetProcessHeap () returned 0x630000 [0080.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.120] GetProcessHeap () returned 0x630000 [0080.120] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.120] GetProcessHeap () returned 0x630000 [0080.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.120] GetProcessHeap () returned 0x630000 [0080.120] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.120] GetProcessHeap () returned 0x630000 [0080.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.120] GetProcessHeap () returned 0x630000 [0080.120] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.120] GetProcessHeap () returned 0x630000 [0080.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.120] GetProcessHeap () returned 0x630000 [0080.120] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.120] GetProcessHeap () returned 0x630000 [0080.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.120] GetProcessHeap () returned 0x630000 [0080.120] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.120] GetProcessHeap () returned 0x630000 [0080.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.120] GetProcessHeap () returned 0x630000 [0080.120] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.120] GetProcessHeap () returned 0x630000 [0080.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.120] GetProcessHeap () returned 0x630000 [0080.120] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.120] GetProcessHeap () returned 0x630000 [0080.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.120] GetProcessHeap () returned 0x630000 [0080.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0080.120] GetProcessHeap () returned 0x630000 [0080.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657328 | out: hHeap=0x630000) returned 1 [0080.120] GetProcessHeap () returned 0x630000 [0080.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0080.120] GetProcessHeap () returned 0x630000 [0080.120] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0080.120] GetProcessHeap () returned 0x630000 [0080.121] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0080.121] GetProcessHeap () returned 0x630000 [0080.121] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0080.121] GetProcessHeap () returned 0x630000 [0080.121] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0080.121] GetProcessHeap () returned 0x630000 [0080.121] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ebb0 | out: hHeap=0x630000) returned 1 [0080.121] GetProcessHeap () returned 0x630000 [0080.121] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0080.121] GetProcessHeap () returned 0x630000 [0080.121] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0080.121] GetProcessHeap () returned 0x630000 [0080.121] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673318 | out: hHeap=0x630000) returned 1 [0080.121] WriteFile (in: hFile=0x230, lpBuffer=0x6744b0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6744b0*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0080.124] GetProcessHeap () returned 0x630000 [0080.124] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6744b0, Size=0x30) returned 0x6744b0 [0080.124] GetProcessHeap () returned 0x630000 [0080.124] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0080.124] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0080.124] GetProcessHeap () returned 0x630000 [0080.124] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4000) returned 0x6744e8 [0080.125] ReadFile (in: hFile=0x230, lpBuffer=0x6744e8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x6744e8*, lpNumberOfBytesRead=0x243d7e8*=0x4000, lpOverlapped=0x0) returned 1 [0080.125] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0080.126] WriteFile (in: hFile=0x230, lpBuffer=0x6744e8*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x6744e8*, lpNumberOfBytesWritten=0x243d7e4*=0x4000, lpOverlapped=0x0) returned 1 [0080.127] GetProcessHeap () returned 0x630000 [0080.127] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6744e8 | out: hHeap=0x630000) returned 1 [0080.127] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0080.127] WriteFile (in: hFile=0x230, lpBuffer=0x6744b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6744b0*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0080.128] CloseHandle (hObject=0x230) returned 1 [0080.128] GetProcessHeap () returned 0x630000 [0080.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0080.129] GetProcessHeap () returned 0x630000 [0080.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655a30 | out: hHeap=0x630000) returned 1 [0080.129] GetProcessHeap () returned 0x630000 [0080.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6736d0 | out: hHeap=0x630000) returned 1 [0080.129] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db" [0080.129] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db.happythreechoose") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db.happythreechoose" [0080.129] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\key3.db"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db.happythreechoose" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\key3.db.happythreechoose"), dwFlags=0x1) returned 1 [0080.129] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\key3.db" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0080.129] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="" [0080.129] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html" [0080.129] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\decryption info.html")) returned 0x20 [0080.129] GetProcessHeap () returned 0x630000 [0080.129] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0080.130] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1815111, ftCreationTime.dwHighDateTime=0x1d5d80b, ftLastAccessTime.dwLowDateTime=0xc1815111, ftLastAccessTime.dwHighDateTime=0x1d5d80b, ftLastWriteTime.dwLowDateTime=0xcc632bbd, ftLastWriteTime.dwHighDateTime=0x1d5d80b, nFileSizeHigh=0x0, nFileSizeLow=0x208000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="kinto.sqlite", cAlternateFileName="KINTO~1.SQL")) returned 1 [0080.130] lstrcmpiW (lpString1="kinto.sqlite", lpString2=".") returned 1 [0080.130] lstrcmpiW (lpString1="kinto.sqlite", lpString2="..") returned 1 [0080.130] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="kinto.sqlite" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\kinto.sqlite") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\kinto.sqlite" [0080.130] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kinto.sqlite", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0080.130] GetProcessHeap () returned 0x630000 [0080.130] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd) returned 0x64ca20 [0080.130] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kinto.sqlite", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kinto.sqlite", lpUsedDefaultChar=0x0) returned 13 [0080.130] lstrlenA (lpString="kinto.sqlite") returned 12 [0080.130] lstrlenA (lpString=".happythreechoose") returned 17 [0080.130] lstrcmpiW (lpString1="kinto.sqlite", lpString2="Decryption INFO.html") returned 1 [0080.130] lstrcmpiW (lpString1="kinto.sqlite", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0080.130] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0080.130] lstrcmpiW (lpString1="kinto.sqlite", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0080.130] GetProcessHeap () returned 0x630000 [0080.130] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651ec0 [0080.130] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\kinto.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\kinto.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0080.130] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=2129920) returned 1 [0080.130] GetProcessHeap () returned 0x630000 [0080.130] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x655850 [0080.130] GetProcessHeap () returned 0x630000 [0080.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672ed8 [0080.131] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\kinto.sqlite") returned 86 [0080.131] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0080.131] GetProcessHeap () returned 0x630000 [0080.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0080.131] GetProcessHeap () returned 0x630000 [0080.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x6744e8 [0080.131] lstrlenA (lpString="rsa_encrypt") returned 11 [0080.131] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x6730f8) returned 1 [0080.131] CryptGenRandom (in: hProv=0x6730f8, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0080.131] CryptReleaseContext (hProv=0x6730f8, dwFlags=0x0) returned 1 [0080.131] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0080.131] GetProcessHeap () returned 0x630000 [0080.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673070 [0080.131] lstrlenA (lpString="010001") returned 6 [0080.131] GetProcessHeap () returned 0x630000 [0080.131] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0080.132] GetProcessHeap () returned 0x630000 [0080.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6736d0 [0080.132] GetProcessHeap () returned 0x630000 [0080.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65df50 [0080.132] GetProcessHeap () returned 0x630000 [0080.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6736d0 | out: hHeap=0x630000) returned 1 [0080.132] GetProcessHeap () returned 0x630000 [0080.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65dda0 [0080.132] GetProcessHeap () returned 0x630000 [0080.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x6570f8 [0080.132] GetProcessHeap () returned 0x630000 [0080.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a258 [0080.132] GetProcessHeap () returned 0x630000 [0080.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0080.132] GetProcessHeap () returned 0x630000 [0080.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.132] GetProcessHeap () returned 0x630000 [0080.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656b80 [0080.132] GetProcessHeap () returned 0x630000 [0080.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672a10 [0080.132] GetProcessHeap () returned 0x630000 [0080.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656950 [0080.132] GetProcessHeap () returned 0x630000 [0080.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0080.132] GetProcessHeap () returned 0x630000 [0080.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0080.132] GetProcessHeap () returned 0x630000 [0080.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e850 [0080.132] GetProcessHeap () returned 0x630000 [0080.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672a10 | out: hHeap=0x630000) returned 1 [0080.132] GetProcessHeap () returned 0x630000 [0080.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657670 [0080.132] GetProcessHeap () returned 0x630000 [0080.132] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e850 | out: hHeap=0x630000) returned 1 [0080.132] GetProcessHeap () returned 0x630000 [0080.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.132] GetProcessHeap () returned 0x630000 [0080.132] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65cd30 [0080.132] GetProcessHeap () returned 0x630000 [0080.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0080.133] GetProcessHeap () returned 0x630000 [0080.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.133] GetProcessHeap () returned 0x630000 [0080.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.133] GetProcessHeap () returned 0x630000 [0080.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.133] GetProcessHeap () returned 0x630000 [0080.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e070 [0080.133] GetProcessHeap () returned 0x630000 [0080.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65cd30 | out: hHeap=0x630000) returned 1 [0080.133] GetProcessHeap () returned 0x630000 [0080.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0080.133] GetProcessHeap () returned 0x630000 [0080.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e070 | out: hHeap=0x630000) returned 1 [0080.133] GetProcessHeap () returned 0x630000 [0080.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.133] GetProcessHeap () returned 0x630000 [0080.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.133] GetProcessHeap () returned 0x630000 [0080.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0080.133] GetProcessHeap () returned 0x630000 [0080.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0080.133] GetProcessHeap () returned 0x630000 [0080.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.133] GetProcessHeap () returned 0x630000 [0080.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.133] GetProcessHeap () returned 0x630000 [0080.133] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.133] GetProcessHeap () returned 0x630000 [0080.133] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.134] GetProcessHeap () returned 0x630000 [0080.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.134] GetProcessHeap () returned 0x630000 [0080.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.134] GetProcessHeap () returned 0x630000 [0080.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0080.134] GetProcessHeap () returned 0x630000 [0080.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0080.134] GetProcessHeap () returned 0x630000 [0080.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.134] GetProcessHeap () returned 0x630000 [0080.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.134] GetProcessHeap () returned 0x630000 [0080.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.134] GetProcessHeap () returned 0x630000 [0080.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.134] GetProcessHeap () returned 0x630000 [0080.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.134] GetProcessHeap () returned 0x630000 [0080.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.134] GetProcessHeap () returned 0x630000 [0080.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.134] GetProcessHeap () returned 0x630000 [0080.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.134] GetProcessHeap () returned 0x630000 [0080.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.134] GetProcessHeap () returned 0x630000 [0080.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.134] GetProcessHeap () returned 0x630000 [0080.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.134] GetProcessHeap () returned 0x630000 [0080.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.134] GetProcessHeap () returned 0x630000 [0080.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.134] GetProcessHeap () returned 0x630000 [0080.134] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.134] GetProcessHeap () returned 0x630000 [0080.134] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.134] GetProcessHeap () returned 0x630000 [0080.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.135] GetProcessHeap () returned 0x630000 [0080.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.135] GetProcessHeap () returned 0x630000 [0080.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.135] GetProcessHeap () returned 0x630000 [0080.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.135] GetProcessHeap () returned 0x630000 [0080.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.135] GetProcessHeap () returned 0x630000 [0080.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.135] GetProcessHeap () returned 0x630000 [0080.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.135] GetProcessHeap () returned 0x630000 [0080.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.135] GetProcessHeap () returned 0x630000 [0080.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.135] GetProcessHeap () returned 0x630000 [0080.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.135] GetProcessHeap () returned 0x630000 [0080.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.135] GetProcessHeap () returned 0x630000 [0080.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.135] GetProcessHeap () returned 0x630000 [0080.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.135] GetProcessHeap () returned 0x630000 [0080.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0080.135] GetProcessHeap () returned 0x630000 [0080.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0080.135] GetProcessHeap () returned 0x630000 [0080.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0080.135] GetProcessHeap () returned 0x630000 [0080.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0080.135] GetProcessHeap () returned 0x630000 [0080.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.135] GetProcessHeap () returned 0x630000 [0080.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.135] GetProcessHeap () returned 0x630000 [0080.135] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.136] GetProcessHeap () returned 0x630000 [0080.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.136] GetProcessHeap () returned 0x630000 [0080.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.136] GetProcessHeap () returned 0x630000 [0080.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.136] GetProcessHeap () returned 0x630000 [0080.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.136] GetProcessHeap () returned 0x630000 [0080.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.136] GetProcessHeap () returned 0x630000 [0080.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.136] GetProcessHeap () returned 0x630000 [0080.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.136] GetProcessHeap () returned 0x630000 [0080.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.136] GetProcessHeap () returned 0x630000 [0080.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.136] GetProcessHeap () returned 0x630000 [0080.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0080.136] GetProcessHeap () returned 0x630000 [0080.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0080.136] GetProcessHeap () returned 0x630000 [0080.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.136] GetProcessHeap () returned 0x630000 [0080.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.136] GetProcessHeap () returned 0x630000 [0080.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.136] GetProcessHeap () returned 0x630000 [0080.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.136] GetProcessHeap () returned 0x630000 [0080.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0080.136] GetProcessHeap () returned 0x630000 [0080.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0080.136] GetProcessHeap () returned 0x630000 [0080.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.136] GetProcessHeap () returned 0x630000 [0080.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.136] GetProcessHeap () returned 0x630000 [0080.136] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.137] GetProcessHeap () returned 0x630000 [0080.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.137] GetProcessHeap () returned 0x630000 [0080.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.137] GetProcessHeap () returned 0x630000 [0080.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.137] GetProcessHeap () returned 0x630000 [0080.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0080.137] GetProcessHeap () returned 0x630000 [0080.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0080.137] GetProcessHeap () returned 0x630000 [0080.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0080.137] GetProcessHeap () returned 0x630000 [0080.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0080.137] GetProcessHeap () returned 0x630000 [0080.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.137] GetProcessHeap () returned 0x630000 [0080.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.137] GetProcessHeap () returned 0x630000 [0080.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0080.137] GetProcessHeap () returned 0x630000 [0080.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0080.137] GetProcessHeap () returned 0x630000 [0080.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0080.137] GetProcessHeap () returned 0x630000 [0080.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0080.137] GetProcessHeap () returned 0x630000 [0080.137] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a258 [0080.137] GetProcessHeap () returned 0x630000 [0080.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a258 | out: hHeap=0x630000) returned 1 [0080.137] GetProcessHeap () returned 0x630000 [0080.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656b80 | out: hHeap=0x630000) returned 1 [0080.137] GetProcessHeap () returned 0x630000 [0080.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0080.137] GetProcessHeap () returned 0x630000 [0080.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0080.137] GetProcessHeap () returned 0x630000 [0080.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0080.137] GetProcessHeap () returned 0x630000 [0080.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0080.138] GetProcessHeap () returned 0x630000 [0080.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65dda0 | out: hHeap=0x630000) returned 1 [0080.138] GetProcessHeap () returned 0x630000 [0080.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0080.138] GetProcessHeap () returned 0x630000 [0080.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65df50 | out: hHeap=0x630000) returned 1 [0080.138] GetProcessHeap () returned 0x630000 [0080.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0080.138] GetProcessHeap () returned 0x630000 [0080.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0080.138] GetProcessHeap () returned 0x630000 [0080.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673070 | out: hHeap=0x630000) returned 1 [0080.138] WriteFile (in: hFile=0x230, lpBuffer=0x6744e8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6744e8*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0080.261] GetProcessHeap () returned 0x630000 [0080.261] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6744e8, Size=0x30) returned 0x6744e8 [0080.261] GetProcessHeap () returned 0x630000 [0080.261] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0080.261] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0080.261] GetProcessHeap () returned 0x630000 [0080.261] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x208000) returned 0x2444020 [0080.308] ReadFile (in: hFile=0x230, lpBuffer=0x2444020, nNumberOfBytesToRead=0x208000, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x2444020*, lpNumberOfBytesRead=0x243d7e8*=0x208000, lpOverlapped=0x0) returned 1 [0080.451] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0080.451] WriteFile (in: hFile=0x230, lpBuffer=0x2444020*, nNumberOfBytesToWrite=0x208000, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x2444020*, lpNumberOfBytesWritten=0x243d7e4*=0x208000, lpOverlapped=0x0) returned 1 [0080.483] GetProcessHeap () returned 0x630000 [0080.483] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x2444020 | out: hHeap=0x630000) returned 1 [0080.544] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0080.544] WriteFile (in: hFile=0x230, lpBuffer=0x6744e8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x6744e8*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0080.545] CloseHandle (hObject=0x230) returned 1 [0080.546] GetProcessHeap () returned 0x630000 [0080.546] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651ec0 | out: hHeap=0x630000) returned 1 [0080.546] GetProcessHeap () returned 0x630000 [0080.546] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x655850 | out: hHeap=0x630000) returned 1 [0080.546] GetProcessHeap () returned 0x630000 [0080.546] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672ed8 | out: hHeap=0x630000) returned 1 [0080.546] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\kinto.sqlite" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\kinto.sqlite") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\kinto.sqlite" [0080.546] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\kinto.sqlite", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\kinto.sqlite.happythreechoose") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\kinto.sqlite.happythreechoose" [0080.546] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\kinto.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\kinto.sqlite"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\kinto.sqlite.happythreechoose" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\kinto.sqlite.happythreechoose"), dwFlags=0x1) returned 1 [0080.547] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\kinto.sqlite" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0080.547] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="" [0080.547] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html" [0080.547] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\decryption info.html")) returned 0x20 [0080.547] GetProcessHeap () returned 0x630000 [0080.547] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0080.547] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfb00785a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="minidumps", cAlternateFileName="MINIDU~1")) returned 1 [0080.547] lstrcmpiW (lpString1="minidumps", lpString2=".") returned 1 [0080.547] lstrcmpiW (lpString1="minidumps", lpString2="..") returned 1 [0080.547] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="minidumps" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\minidumps") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\minidumps" [0080.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="minidumps", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0080.547] GetProcessHeap () returned 0x630000 [0080.547] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x64ca20 [0080.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="minidumps", cchWideChar=-1, lpMultiByteStr=0x64ca20, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="minidumps", lpUsedDefaultChar=0x0) returned 10 [0080.547] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="minidumps", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0080.547] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="minidumps", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0080.547] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="minidumps", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0080.547] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="minidumps", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0080.547] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="minidumps", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0080.547] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="minidumps", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0080.547] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="minidumps", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0080.547] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="minidumps", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0080.547] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="minidumps", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0080.547] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="minidumps", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0080.547] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="minidumps", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0080.547] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="minidumps", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0080.547] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="minidumps", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0080.547] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="minidumps", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0080.547] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="minidumps", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0080.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="minidumps", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0080.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="minidumps", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0080.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="minidumps", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0080.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="minidumps", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0080.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="minidumps", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0080.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="minidumps", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0080.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="minidumps", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0080.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="minidumps", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0080.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="minidumps", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0080.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="minidumps", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0080.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="minidumps", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0080.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="minidumps", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0080.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="minidumps", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0080.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="minidumps", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0080.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="minidumps", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0080.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="minidumps", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0080.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="minidumps", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0080.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="minidumps", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0080.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="minidumps", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0080.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="minidumps", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0080.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="minidumps", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0080.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="minidumps", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0080.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="minidumps", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0080.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="minidumps", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0080.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="minidumps", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0080.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="minidumps", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0080.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="minidumps", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0080.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="minidumps", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0080.548] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\minidumps", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\minidumps\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\minidumps\\" [0080.548] GetProcessHeap () returned 0x630000 [0080.549] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x65a258 [0080.549] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\minidumps\\") returned 84 [0080.549] GetProcessHeap () returned 0x630000 [0080.549] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xaa) returned 0x640c90 [0080.549] lstrcpyW (in: lpString1=0x640c90, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\minidumps\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\minidumps\\") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\minidumps\\" [0080.549] GetProcessHeap () returned 0x630000 [0080.549] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0080.549] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb00785a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfb00785a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xaf2b6063, ftLastWriteTime.dwHighDateTime=0x1d5d80b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="parent.lock", cAlternateFileName="PARENT~1.LOC")) returned 1 [0080.549] lstrcmpiW (lpString1="parent.lock", lpString2=".") returned 1 [0080.549] lstrcmpiW (lpString1="parent.lock", lpString2="..") returned 1 [0080.549] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="parent.lock" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock" [0080.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="parent.lock", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0080.549] GetProcessHeap () returned 0x630000 [0080.549] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x64c9f0 [0080.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="parent.lock", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="parent.lock", lpUsedDefaultChar=0x0) returned 12 [0080.549] lstrlenA (lpString="parent.lock") returned 11 [0080.549] lstrlenA (lpString=".happythreechoose") returned 17 [0080.549] lstrcmpiW (lpString1="parent.lock", lpString2="Decryption INFO.html") returned 1 [0080.549] lstrcmpiW (lpString1="parent.lock", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0080.549] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0080.549] lstrcmpiW (lpString1="parent.lock", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0080.549] GetProcessHeap () returned 0x630000 [0080.549] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0080.549] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\parent.lock" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\parent.lock"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0080.550] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=0) returned 1 [0080.551] CloseHandle (hObject=0x230) returned 1 [0080.551] GetProcessHeap () returned 0x630000 [0080.551] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0080.551] GetProcessHeap () returned 0x630000 [0080.551] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0080.551] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd67a0d8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfd67a0d8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xfd7d1832, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="permissions.sqlite", cAlternateFileName="PERMIS~1.SQL")) returned 1 [0080.551] lstrcmpiW (lpString1="permissions.sqlite", lpString2=".") returned 1 [0080.551] lstrcmpiW (lpString1="permissions.sqlite", lpString2="..") returned 1 [0080.551] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="permissions.sqlite" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite" [0080.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="permissions.sqlite", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0080.551] GetProcessHeap () returned 0x630000 [0080.551] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x13) returned 0x645e58 [0080.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="permissions.sqlite", cchWideChar=-1, lpMultiByteStr=0x645e58, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="permissions.sqlite", lpUsedDefaultChar=0x0) returned 19 [0080.551] lstrlenA (lpString="permissions.sqlite") returned 18 [0080.551] lstrlenA (lpString=".happythreechoose") returned 17 [0080.551] lstrlenA (lpString=".happythreechoose") returned 17 [0080.551] lstrlenA (lpString="permissions.sqlite") returned 18 [0080.551] lstrcmpiA (lpString1="ermissions.sqlite", lpString2=".happythreechoose") returned 1 [0080.551] lstrcmpiW (lpString1="permissions.sqlite", lpString2="Decryption INFO.html") returned 1 [0080.551] lstrcmpiW (lpString1="permissions.sqlite", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0080.551] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0080.551] lstrcmpiW (lpString1="permissions.sqlite", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0080.551] GetProcessHeap () returned 0x630000 [0080.551] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651e48 [0080.551] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\permissions.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0080.552] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=98304) returned 1 [0080.552] GetProcessHeap () returned 0x630000 [0080.552] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6555f8 [0080.552] GetProcessHeap () returned 0x630000 [0080.552] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672c30 [0080.552] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite") returned 92 [0080.552] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0080.552] GetProcessHeap () returned 0x630000 [0080.552] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0080.552] GetProcessHeap () returned 0x630000 [0080.552] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x674520 [0080.552] lstrlenA (lpString="rsa_encrypt") returned 11 [0080.552] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x6733a0) returned 1 [0080.553] CryptGenRandom (in: hProv=0x6733a0, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0080.553] CryptReleaseContext (hProv=0x6733a0, dwFlags=0x0) returned 1 [0080.553] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0080.553] GetProcessHeap () returned 0x630000 [0080.553] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673180 [0080.553] lstrlenA (lpString="010001") returned 6 [0080.553] GetProcessHeap () returned 0x630000 [0080.553] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0080.553] GetProcessHeap () returned 0x630000 [0080.553] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672a10 [0080.553] GetProcessHeap () returned 0x630000 [0080.553] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e3d0 [0080.553] GetProcessHeap () returned 0x630000 [0080.553] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672a10 | out: hHeap=0x630000) returned 1 [0080.553] GetProcessHeap () returned 0x630000 [0080.553] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65ea90 [0080.553] GetProcessHeap () returned 0x630000 [0080.553] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x657670 [0080.553] GetProcessHeap () returned 0x630000 [0080.553] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0080.553] GetProcessHeap () returned 0x630000 [0080.553] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0080.553] GetProcessHeap () returned 0x630000 [0080.553] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0080.553] GetProcessHeap () returned 0x630000 [0080.553] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656950 [0080.554] GetProcessHeap () returned 0x630000 [0080.554] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673070 [0080.554] GetProcessHeap () returned 0x630000 [0080.554] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x656a68 [0080.554] GetProcessHeap () returned 0x630000 [0080.554] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0080.554] GetProcessHeap () returned 0x630000 [0080.554] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64c9f0 [0080.554] GetProcessHeap () returned 0x630000 [0080.554] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e190 [0080.554] GetProcessHeap () returned 0x630000 [0080.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673070 | out: hHeap=0x630000) returned 1 [0080.554] GetProcessHeap () returned 0x630000 [0080.554] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657788 [0080.554] GetProcessHeap () returned 0x630000 [0080.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e190 | out: hHeap=0x630000) returned 1 [0080.554] GetProcessHeap () returned 0x630000 [0080.554] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0080.554] GetProcessHeap () returned 0x630000 [0080.554] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0080.554] GetProcessHeap () returned 0x630000 [0080.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0080.554] GetProcessHeap () returned 0x630000 [0080.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0080.554] GetProcessHeap () returned 0x630000 [0080.554] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0080.554] GetProcessHeap () returned 0x630000 [0080.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0080.554] GetProcessHeap () returned 0x630000 [0080.554] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e340 [0080.554] GetProcessHeap () returned 0x630000 [0080.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0080.554] GetProcessHeap () returned 0x630000 [0080.554] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x6570f8 [0080.554] GetProcessHeap () returned 0x630000 [0080.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e340 | out: hHeap=0x630000) returned 1 [0080.554] GetProcessHeap () returned 0x630000 [0080.554] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0080.554] GetProcessHeap () returned 0x630000 [0080.554] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0080.555] GetProcessHeap () returned 0x630000 [0080.555] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0080.555] GetProcessHeap () returned 0x630000 [0080.555] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0080.555] GetProcessHeap () returned 0x630000 [0080.555] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0080.555] GetProcessHeap () returned 0x630000 [0080.555] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0080.555] GetProcessHeap () returned 0x630000 [0080.555] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0080.555] GetProcessHeap () returned 0x630000 [0080.555] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0080.555] GetProcessHeap () returned 0x630000 [0080.555] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0080.555] GetProcessHeap () returned 0x630000 [0080.555] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0080.555] GetProcessHeap () returned 0x630000 [0080.555] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0080.555] GetProcessHeap () returned 0x630000 [0080.555] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0080.555] GetProcessHeap () returned 0x630000 [0080.555] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0080.555] GetProcessHeap () returned 0x630000 [0080.555] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0080.555] GetProcessHeap () returned 0x630000 [0080.555] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0080.555] GetProcessHeap () returned 0x630000 [0080.555] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0080.555] GetProcessHeap () returned 0x630000 [0080.555] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0080.556] GetProcessHeap () returned 0x630000 [0080.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0080.556] GetProcessHeap () returned 0x630000 [0080.556] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0080.556] GetProcessHeap () returned 0x630000 [0080.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0080.556] GetProcessHeap () returned 0x630000 [0080.556] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0080.556] GetProcessHeap () returned 0x630000 [0080.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0080.556] GetProcessHeap () returned 0x630000 [0080.556] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0080.556] GetProcessHeap () returned 0x630000 [0080.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0080.556] GetProcessHeap () returned 0x630000 [0080.556] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0080.556] GetProcessHeap () returned 0x630000 [0080.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0080.556] GetProcessHeap () returned 0x630000 [0080.556] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0080.556] GetProcessHeap () returned 0x630000 [0080.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0080.556] GetProcessHeap () returned 0x630000 [0080.556] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0080.556] GetProcessHeap () returned 0x630000 [0080.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0080.556] GetProcessHeap () returned 0x630000 [0080.556] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0080.556] GetProcessHeap () returned 0x630000 [0080.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0080.556] GetProcessHeap () returned 0x630000 [0080.556] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0080.556] GetProcessHeap () returned 0x630000 [0080.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0080.556] GetProcessHeap () returned 0x630000 [0080.556] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0080.556] GetProcessHeap () returned 0x630000 [0080.556] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0080.556] GetProcessHeap () returned 0x630000 [0080.556] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0080.557] GetProcessHeap () returned 0x630000 [0080.557] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0080.557] GetProcessHeap () returned 0x630000 [0080.557] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0080.557] GetProcessHeap () returned 0x630000 [0080.557] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0080.557] GetProcessHeap () returned 0x630000 [0080.557] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0080.557] GetProcessHeap () returned 0x630000 [0080.557] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0080.557] GetProcessHeap () returned 0x630000 [0080.557] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0080.557] GetProcessHeap () returned 0x630000 [0080.557] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0080.557] GetProcessHeap () returned 0x630000 [0080.557] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0080.557] GetProcessHeap () returned 0x630000 [0080.557] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0080.557] GetProcessHeap () returned 0x630000 [0080.557] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0080.557] GetProcessHeap () returned 0x630000 [0080.557] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0080.557] GetProcessHeap () returned 0x630000 [0080.557] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0080.557] GetProcessHeap () returned 0x630000 [0080.557] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0080.557] GetProcessHeap () returned 0x630000 [0080.557] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0080.557] GetProcessHeap () returned 0x630000 [0080.557] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0080.557] GetProcessHeap () returned 0x630000 [0080.557] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0080.557] GetProcessHeap () returned 0x630000 [0080.557] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0080.557] GetProcessHeap () returned 0x630000 [0080.557] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0080.557] GetProcessHeap () returned 0x630000 [0080.557] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0080.557] GetProcessHeap () returned 0x630000 [0080.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0080.558] GetProcessHeap () returned 0x630000 [0080.558] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0080.558] GetProcessHeap () returned 0x630000 [0080.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0080.558] GetProcessHeap () returned 0x630000 [0080.558] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0080.558] GetProcessHeap () returned 0x630000 [0080.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0080.558] GetProcessHeap () returned 0x630000 [0080.558] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0080.558] GetProcessHeap () returned 0x630000 [0080.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0080.558] GetProcessHeap () returned 0x630000 [0080.558] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0080.558] GetProcessHeap () returned 0x630000 [0080.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0080.558] GetProcessHeap () returned 0x630000 [0080.558] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0080.558] GetProcessHeap () returned 0x630000 [0080.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0080.558] GetProcessHeap () returned 0x630000 [0080.558] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0080.558] GetProcessHeap () returned 0x630000 [0080.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0080.558] GetProcessHeap () returned 0x630000 [0080.558] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0080.558] GetProcessHeap () returned 0x630000 [0080.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0080.558] GetProcessHeap () returned 0x630000 [0080.558] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0080.558] GetProcessHeap () returned 0x630000 [0080.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0080.558] GetProcessHeap () returned 0x630000 [0080.558] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0080.558] GetProcessHeap () returned 0x630000 [0080.558] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0080.558] GetProcessHeap () returned 0x630000 [0080.558] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0080.559] GetProcessHeap () returned 0x630000 [0080.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0080.559] GetProcessHeap () returned 0x630000 [0080.559] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0080.559] GetProcessHeap () returned 0x630000 [0080.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0080.559] GetProcessHeap () returned 0x630000 [0080.559] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0080.559] GetProcessHeap () returned 0x630000 [0080.559] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a408 [0080.559] GetProcessHeap () returned 0x630000 [0080.559] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0080.559] GetProcessHeap () returned 0x630000 [0080.559] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656950 | out: hHeap=0x630000) returned 1 [0080.559] GetProcessHeap () returned 0x630000 [0080.559] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657788 | out: hHeap=0x630000) returned 1 [0080.559] GetProcessHeap () returned 0x630000 [0080.559] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0080.559] GetProcessHeap () returned 0x630000 [0080.559] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6570f8 | out: hHeap=0x630000) returned 1 [0080.559] GetProcessHeap () returned 0x630000 [0080.559] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64c9f0 | out: hHeap=0x630000) returned 1 [0080.559] GetProcessHeap () returned 0x630000 [0080.559] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65ea90 | out: hHeap=0x630000) returned 1 [0080.559] GetProcessHeap () returned 0x630000 [0080.559] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657670 | out: hHeap=0x630000) returned 1 [0080.559] GetProcessHeap () returned 0x630000 [0080.559] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0080.559] GetProcessHeap () returned 0x630000 [0080.559] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0080.559] GetProcessHeap () returned 0x630000 [0080.559] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0080.559] GetProcessHeap () returned 0x630000 [0080.560] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673180 | out: hHeap=0x630000) returned 1 [0080.560] WriteFile (in: hFile=0x230, lpBuffer=0x674520*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x674520*, lpNumberOfBytesWritten=0x243d864*=0x380, lpOverlapped=0x0) returned 1 [0080.562] GetProcessHeap () returned 0x630000 [0080.562] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x674520, Size=0x30) returned 0x674520 [0080.562] GetProcessHeap () returned 0x630000 [0080.563] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64cc78 | out: hHeap=0x630000) returned 1 [0080.563] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0080.563] GetProcessHeap () returned 0x630000 [0080.563] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18000) returned 0x674558 [0080.564] ReadFile (in: hFile=0x230, lpBuffer=0x674558, nNumberOfBytesToRead=0x18000, lpNumberOfBytesRead=0x243d7e8, lpOverlapped=0x0 | out: lpBuffer=0x674558*, lpNumberOfBytesRead=0x243d7e8*=0x18000, lpOverlapped=0x0) returned 1 [0080.566] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d7b8 | out: lpNewFilePointer=0x0) returned 1 [0080.566] WriteFile (in: hFile=0x230, lpBuffer=0x674558*, nNumberOfBytesToWrite=0x18000, lpNumberOfBytesWritten=0x243d7e4, lpOverlapped=0x0 | out: lpBuffer=0x674558*, lpNumberOfBytesWritten=0x243d7e4*=0x18000, lpOverlapped=0x0) returned 1 [0080.731] GetProcessHeap () returned 0x630000 [0080.731] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x674558 | out: hHeap=0x630000) returned 1 [0080.731] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0080.731] WriteFile (in: hFile=0x230, lpBuffer=0x674520*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0 | out: lpBuffer=0x674520*, lpNumberOfBytesWritten=0x243d864*=0x30, lpOverlapped=0x0) returned 1 [0080.732] CloseHandle (hObject=0x230) returned 1 [0080.733] GetProcessHeap () returned 0x630000 [0080.733] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x651e48 | out: hHeap=0x630000) returned 1 [0080.733] GetProcessHeap () returned 0x630000 [0080.733] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6555f8 | out: hHeap=0x630000) returned 1 [0080.733] GetProcessHeap () returned 0x630000 [0080.733] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x672c30 | out: hHeap=0x630000) returned 1 [0080.733] lstrcpyW (in: lpString1=0x243ef84, lpString2="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite" [0080.733] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite", lpString2=".happythreechoose" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite.happythreechoose") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite.happythreechoose" [0080.733] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\permissions.sqlite"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite.happythreechoose" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\permissions.sqlite.happythreechoose"), dwFlags=0x1) returned 1 [0080.733] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\permissions.sqlite" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default") returned 1 [0080.734] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\") returned="" [0080.734] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="Decryption INFO.html" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html" [0080.734] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\Decryption INFO.html" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\decryption info.html")) returned 0x20 [0080.734] GetProcessHeap () returned 0x630000 [0080.734] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x645e58 | out: hHeap=0x630000) returned 1 [0080.734] FindNextFileW (in: hFindFile=0x648a10, lpFindFileData=0x243d9f4 | out: lpFindFileData=0x243d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdd54ecc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfdd54ecc, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x42fefdeb, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x500000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="places.sqlite", cAlternateFileName="PLACES~1.SQL")) returned 1 [0080.734] lstrcmpiW (lpString1="places.sqlite", lpString2=".") returned 1 [0080.734] lstrcmpiW (lpString1="places.sqlite", lpString2="..") returned 1 [0080.734] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\", lpString2="places.sqlite" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite") returned="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite" [0080.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="places.sqlite", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0080.734] GetProcessHeap () returned 0x630000 [0080.734] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x64c9f0 [0080.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="places.sqlite", cchWideChar=-1, lpMultiByteStr=0x64c9f0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="places.sqlite", lpUsedDefaultChar=0x0) returned 14 [0080.734] lstrlenA (lpString="places.sqlite") returned 13 [0080.734] lstrlenA (lpString=".happythreechoose") returned 17 [0080.734] lstrcmpiW (lpString1="places.sqlite", lpString2="Decryption INFO.html") returned 1 [0080.734] lstrcmpiW (lpString1="places.sqlite", lpString2="5D64CC94FBAA1E0F7D767179EACF76DE6051563629F05D7C3B1FABE9EF4413FF") returned 1 [0080.734] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\HAPPYTHREE.EXE.exe") returned="HAPPYTHREE.EXE.exe" [0080.734] lstrcmpiW (lpString1="places.sqlite", lpString2="HAPPYTHREE.EXE.exe") returned 1 [0080.734] GetProcessHeap () returned 0x630000 [0080.734] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x20) returned 0x651f10 [0080.734] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\mozilla\\firefox\\profiles\\w7cr0hor.default\\places.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0080.734] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x243d83c | out: lpFileSize=0x243d83c*=5242880) returned 1 [0080.735] GetProcessHeap () returned 0x630000 [0080.735] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6c) returned 0x6558c8 [0080.735] GetProcessHeap () returned 0x630000 [0080.735] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x672a10 [0080.735] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\w7cr0hor.default\\places.sqlite") returned 87 [0080.735] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x243d800 | out: lpNewFilePointer=0x0) returned 1 [0080.735] GetProcessHeap () returned 0x630000 [0080.735] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x200) returned 0x64cc78 [0080.735] GetProcessHeap () returned 0x630000 [0080.735] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x380) returned 0x674558 [0080.735] lstrlenA (lpString="rsa_encrypt") returned 11 [0080.735] CryptAcquireContextW (in: phProv=0x243cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x243cd30*=0x672b20) returned 1 [0080.735] CryptGenRandom (in: hProv=0x672b20, dwLen=0x80, pbBuffer=0x243cd48 | out: pbBuffer=0x243cd48) returned 1 [0080.735] CryptReleaseContext (hProv=0x672b20, dwFlags=0x0) returned 1 [0080.735] lstrlenA (lpString="9F7FD0D67053C68733EEB1D1215E5EC1155710B19FAEB8DD66524D4A8004BD31B1419B079305F8E57CDD6D5FA870AA90F19EE069AA31B8C47B1713413A37CF742E96DDE8CC3D088487D34E6FA461EFDD2C8538A5DD3BF618C9E73BAA6F87E22E4F1378A89BAB26C51CA16F04C4E936BD1CB052E4CCAE5A1A936D67951D62D9FB") returned 256 [0080.735] GetProcessHeap () returned 0x630000 [0080.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673180 [0080.736] lstrlenA (lpString="010001") returned 6 [0080.736] GetProcessHeap () returned 0x630000 [0080.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a408 [0080.736] GetProcessHeap () returned 0x630000 [0080.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x673290 [0080.736] GetProcessHeap () returned 0x630000 [0080.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e220 [0080.736] GetProcessHeap () returned 0x630000 [0080.736] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673290 | out: hHeap=0x630000) returned 1 [0080.736] GetProcessHeap () returned 0x630000 [0080.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65eb20 [0080.736] GetProcessHeap () returned 0x630000 [0080.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x108) returned 0x656c98 [0080.736] GetProcessHeap () returned 0x630000 [0080.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x4) returned 0x65a268 [0080.736] GetProcessHeap () returned 0x630000 [0080.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656db0 [0080.736] GetProcessHeap () returned 0x630000 [0080.736] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0080.736] GetProcessHeap () returned 0x630000 [0080.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656a68 [0080.736] GetProcessHeap () returned 0x630000 [0080.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x80) returned 0x6736d0 [0080.736] GetProcessHeap () returned 0x630000 [0080.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x10c) returned 0x657210 [0080.736] GetProcessHeap () returned 0x630000 [0080.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0080.736] GetProcessHeap () returned 0x630000 [0080.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x64ca20 [0080.736] GetProcessHeap () returned 0x630000 [0080.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x84) returned 0x65e3d0 [0080.736] GetProcessHeap () returned 0x630000 [0080.736] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6736d0 | out: hHeap=0x630000) returned 1 [0080.736] GetProcessHeap () returned 0x630000 [0080.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x656ec8 [0080.736] GetProcessHeap () returned 0x630000 [0080.736] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e3d0 | out: hHeap=0x630000) returned 1 [0080.736] GetProcessHeap () returned 0x630000 [0080.736] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0080.737] GetProcessHeap () returned 0x630000 [0080.737] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xc) returned 0x65d048 [0080.737] GetProcessHeap () returned 0x630000 [0080.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0080.737] GetProcessHeap () returned 0x630000 [0080.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0080.737] GetProcessHeap () returned 0x630000 [0080.737] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0080.737] GetProcessHeap () returned 0x630000 [0080.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0080.737] GetProcessHeap () returned 0x630000 [0080.737] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x88) returned 0x65e6a0 [0080.737] GetProcessHeap () returned 0x630000 [0080.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65d048 | out: hHeap=0x630000) returned 1 [0080.737] GetProcessHeap () returned 0x630000 [0080.737] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x104) returned 0x657558 [0080.737] GetProcessHeap () returned 0x630000 [0080.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e6a0 | out: hHeap=0x630000) returned 1 [0080.737] GetProcessHeap () returned 0x630000 [0080.737] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0080.737] GetProcessHeap () returned 0x630000 [0080.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0080.737] GetProcessHeap () returned 0x630000 [0080.737] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0080.737] GetProcessHeap () returned 0x630000 [0080.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0080.737] GetProcessHeap () returned 0x630000 [0080.737] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0080.737] GetProcessHeap () returned 0x630000 [0080.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0080.737] GetProcessHeap () returned 0x630000 [0080.737] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0080.737] GetProcessHeap () returned 0x630000 [0080.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0080.737] GetProcessHeap () returned 0x630000 [0080.737] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0080.737] GetProcessHeap () returned 0x630000 [0080.737] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0080.737] GetProcessHeap () returned 0x630000 [0080.737] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0080.737] GetProcessHeap () returned 0x630000 [0080.738] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0080.738] GetProcessHeap () returned 0x630000 [0080.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0080.738] GetProcessHeap () returned 0x630000 [0080.738] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0080.738] GetProcessHeap () returned 0x630000 [0080.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0080.738] GetProcessHeap () returned 0x630000 [0080.738] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0080.738] GetProcessHeap () returned 0x630000 [0080.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0080.738] GetProcessHeap () returned 0x630000 [0080.738] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0080.738] GetProcessHeap () returned 0x630000 [0080.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0080.738] GetProcessHeap () returned 0x630000 [0080.738] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0080.738] GetProcessHeap () returned 0x630000 [0080.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0080.738] GetProcessHeap () returned 0x630000 [0080.738] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0080.738] GetProcessHeap () returned 0x630000 [0080.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0080.738] GetProcessHeap () returned 0x630000 [0080.738] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0080.738] GetProcessHeap () returned 0x630000 [0080.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0080.738] GetProcessHeap () returned 0x630000 [0080.738] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0080.738] GetProcessHeap () returned 0x630000 [0080.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0080.738] GetProcessHeap () returned 0x630000 [0080.738] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0080.738] GetProcessHeap () returned 0x630000 [0080.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0080.738] GetProcessHeap () returned 0x630000 [0080.738] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0080.738] GetProcessHeap () returned 0x630000 [0080.738] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0080.739] GetProcessHeap () returned 0x630000 [0080.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0080.739] GetProcessHeap () returned 0x630000 [0080.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0080.739] GetProcessHeap () returned 0x630000 [0080.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0080.739] GetProcessHeap () returned 0x630000 [0080.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0080.739] GetProcessHeap () returned 0x630000 [0080.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0080.739] GetProcessHeap () returned 0x630000 [0080.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0080.739] GetProcessHeap () returned 0x630000 [0080.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0080.739] GetProcessHeap () returned 0x630000 [0080.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0080.739] GetProcessHeap () returned 0x630000 [0080.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0080.739] GetProcessHeap () returned 0x630000 [0080.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0080.739] GetProcessHeap () returned 0x630000 [0080.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0080.739] GetProcessHeap () returned 0x630000 [0080.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0080.739] GetProcessHeap () returned 0x630000 [0080.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0080.739] GetProcessHeap () returned 0x630000 [0080.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0080.739] GetProcessHeap () returned 0x630000 [0080.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0080.739] GetProcessHeap () returned 0x630000 [0080.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0080.739] GetProcessHeap () returned 0x630000 [0080.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0080.739] GetProcessHeap () returned 0x630000 [0080.739] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0080.739] GetProcessHeap () returned 0x630000 [0080.739] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0080.740] GetProcessHeap () returned 0x630000 [0080.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0080.740] GetProcessHeap () returned 0x630000 [0080.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0080.740] GetProcessHeap () returned 0x630000 [0080.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0080.740] GetProcessHeap () returned 0x630000 [0080.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0080.740] GetProcessHeap () returned 0x630000 [0080.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0080.740] GetProcessHeap () returned 0x630000 [0080.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0080.740] GetProcessHeap () returned 0x630000 [0080.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0080.740] GetProcessHeap () returned 0x630000 [0080.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0080.740] GetProcessHeap () returned 0x630000 [0080.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0080.740] GetProcessHeap () returned 0x630000 [0080.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0080.740] GetProcessHeap () returned 0x630000 [0080.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0080.740] GetProcessHeap () returned 0x630000 [0080.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0080.740] GetProcessHeap () returned 0x630000 [0080.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0080.740] GetProcessHeap () returned 0x630000 [0080.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0080.740] GetProcessHeap () returned 0x630000 [0080.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0080.740] GetProcessHeap () returned 0x630000 [0080.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0080.740] GetProcessHeap () returned 0x630000 [0080.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0080.740] GetProcessHeap () returned 0x630000 [0080.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0080.740] GetProcessHeap () returned 0x630000 [0080.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0080.740] GetProcessHeap () returned 0x630000 [0080.740] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0080.740] GetProcessHeap () returned 0x630000 [0080.740] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0080.741] GetProcessHeap () returned 0x630000 [0080.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0080.741] GetProcessHeap () returned 0x630000 [0080.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a268 [0080.741] GetProcessHeap () returned 0x630000 [0080.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a268 | out: hHeap=0x630000) returned 1 [0080.741] GetProcessHeap () returned 0x630000 [0080.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0080.741] GetProcessHeap () returned 0x630000 [0080.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0080.741] GetProcessHeap () returned 0x630000 [0080.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0080.741] GetProcessHeap () returned 0x630000 [0080.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0080.741] GetProcessHeap () returned 0x630000 [0080.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0080.741] GetProcessHeap () returned 0x630000 [0080.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0080.741] GetProcessHeap () returned 0x630000 [0080.741] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x8) returned 0x65a2b8 [0080.741] GetProcessHeap () returned 0x630000 [0080.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a2b8 | out: hHeap=0x630000) returned 1 [0080.741] GetProcessHeap () returned 0x630000 [0080.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656a68 | out: hHeap=0x630000) returned 1 [0080.741] GetProcessHeap () returned 0x630000 [0080.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656ec8 | out: hHeap=0x630000) returned 1 [0080.741] GetProcessHeap () returned 0x630000 [0080.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657210 | out: hHeap=0x630000) returned 1 [0080.741] GetProcessHeap () returned 0x630000 [0080.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x657558 | out: hHeap=0x630000) returned 1 [0080.741] GetProcessHeap () returned 0x630000 [0080.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x64ca20 | out: hHeap=0x630000) returned 1 [0080.741] GetProcessHeap () returned 0x630000 [0080.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65eb20 | out: hHeap=0x630000) returned 1 [0080.741] GetProcessHeap () returned 0x630000 [0080.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656c98 | out: hHeap=0x630000) returned 1 [0080.741] GetProcessHeap () returned 0x630000 [0080.741] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65e220 | out: hHeap=0x630000) returned 1 [0080.741] GetProcessHeap () returned 0x630000 [0080.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x656db0 | out: hHeap=0x630000) returned 1 [0080.742] GetProcessHeap () returned 0x630000 [0080.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x65a408 | out: hHeap=0x630000) returned 1 [0080.742] GetProcessHeap () returned 0x630000 [0080.742] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x673180 | out: hHeap=0x630000) returned 1 [0080.742] WriteFile (hFile=0x230, lpBuffer=0x674558, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x243d864, lpOverlapped=0x0)